From 2aa7a27352434d43c5b9eae3c319717a4748b02d Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 2 Apr 2022 08:59:29 -0400
Subject: [PATCH] Fixes for 5.16

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...fix-return-value-of-__setup-handlers.patch |  86 ++
 ...it-printable-size-of-bert-table-data.patch |  72 ++
 ...king-the-acpi-namespace-if-it-is-not.patch |  44 +
 .../adjust-cifssb-maximum-read-size.patch     |  71 ++
 ...hift-out-of-bounds-in-group-mask-cal.patch |  62 ++
 ...-data-races-around-unix_sk-sk-oob_sk.patch | 109 ++
 ...b-fix-uninitialized-flag-for-av-c-de.patch |  84 ++
 ...-driver-index-handling-at-re-binding.patch |  85 ++
 ...k-add-alc256-samsung-headphone-fixup.patch |  85 ++
 .../alsa-spi-add-check-for-clk_enable.patch   |  92 ++
 ...i_v5_defconfig-re-enable-config_v4l_.patch |  44 +
 ...i_v5_defconfig-re-enable-drm_panel-a.patch |  48 +
 ...add-the-missing-l1-l2-cache-informat.patch | 113 +++
 ...add-the-missing-l1-l2-cache-informat.patch | 112 +++
 ...openbmc-flash-layout-label-addresses.patch |  54 +
 ...add-missing-lvds-decoder-on-m53menlo.patch |  81 ++
 ...-audio_mclk_post_div-instead-audio_m.patch | 166 +++
 ...-gic_irq_domain_translate-warnings-f.patch |  60 ++
 ...arm-dts-qcom-ipq4019-fix-sleep-clock.patch |  42 +
 ...x-av96-board-sai2-pin-muxing-on-stm3.patch |  37 +
 ...s-move-the-csi1-block-to-follow-addr.patch |  64 ++
 ...oid-redundant-loads-or-clobbering-ip.patch | 135 +++
 ...e-that-adr-takes-the-thumb-bit-into-.patch |  40 +
 ...mp-fix-failure-to-remove-sram-device.patch |  79 ++
 ...-tegra-tamonten-fix-i2c3-pad-setting.patch |  46 +
 ...defconfig-build-imx-sdma-as-a-module.patch |  39 +
 ...adcom-bcm4908-use-proper-twd-binding.patch |  57 ++
 ...arm64-dts-broadcom-fix-sata-nodename.patch |  41 +
 ...2-fix-spi-cpol-and-spi-cpha-property.patch |  52 +
 ...com-ipq6018-fix-usb-reference-period.patch |  39 +
 ...sm8994-provide-missing-xo_board-and-.patch |  46 +
 ...dts-qcom-sc7280-fix-gmu-unit-address.patch |  43 +
 ...dm845-fix-microphone-bias-properties.patch |  58 ++
 ...m8150-correct-tcs-configuration-for-.patch |  41 +
 ...m8250-fix-pcie-bindings-to-follow-sc.patch |  65 ++
 ...m8350-correct-tcs-configuration-for-.patch |  37 +
 ...ip-fix-sdio-regulator-supply-propert.patch |  40 +
 ...ixmap-race-condition-when-create-pud.patch |  75 ++
 ...ule-remove-noload-from-linker-script.patch |  54 +
 ...strumentation-of-bp-hardening-callba.patch | 153 +++
 ...he-return-value-of-devm_kzalloc-in-a.patch |  39 +
 ...-fix-reference-to-pcm-buffer-address.patch |  40 +
 ...-fix-uninitialized-symbol-warning-in.patch |  38 +
 ...-fix-for-pm-resume-callback-sequence.patch | 119 +++
 ...issing-of_node_put-in-at91sam9g20ek_.patch |  38 +
 ...rror-handling-in-sam9x5_wm8731_drive.patch |  71 ++
 ...ix-error-handling-in-snd_proto_probe.patch |  80 ++
 ...ssc_dai-handle-errors-for-clk_enable.patch |  40 +
 ...k-for-error-pointer-after-calling-de.patch |  71 ++
 ...acro-fix-accessing-array-out-of-boun.patch |  66 ++
 ...acro-fix-accessing-compander-for-aux.patch |  42 +
 ...acro-fix-accessing-array-out-of-boun.patch |  48 +
 ...8x-fix-accessing-array-out-of-bounds.patch |  49 +
 ...34x-add-missing-of_node_put-in-wcd93.patch |  39 +
 ...decs-wcd934x-fix-kcontrol-max-values.patch |  49 +
 ...34x-fix-return-value-of-wcd934x_rx_h.patch |  46 +
 ...decs-wcd938x-fix-kcontrol-max-values.patch |  49 +
 ...asoc-cs35l41-fix-gpio2-configuration.patch |  39 +
 ...s35l41-fix-max-number-of-tx-channels.patch |  37 +
 ...ort-full-jack-status-when-plug-is-de.patch |  67 ++
 ...o-not-use-a-null-prepare_slave_confi.patch |  42 +
 ...dwc-i2s-handle-errors-for-clk_enable.patch |  61 ++
 .../asoc-fsi-add-check-for-clk_enable.patch   |  60 ++
 ...fsl_spdif-disable-tx-clock-when-stop.patch |  41 +
 ...fix-error-return-code-in-imx_es8328_.patch |  36 +
 ...t-asoc-intel-sof_es8336-add-quirk-fo.patch |  51 +
 ...cpi-add-more-acpi-hids-for-es83x6-de.patch | 162 +++
 ...es8336-add-quirk-for-huawei-d15-2021.patch |  42 +
 ...asoc-intel-sof_es8336-log-all-quirks.patch |  46 +
 ...s8336-use-nhlt-information-to-set-dm.patch | 129 +++
 ...dw-fix-quirks-for-2022-hp-spectre-x3.patch |  54 +
 .../asoc-madera-add-dependencies-on-mfd.patch |  60 ++
 ...soc-max98927-add-missing-header-file.patch |  53 +
 ...8192-mt6359-fix-error-handling-in-mt.patch |  76 ++
 ...ediatek-use-of_device_get_match_data.patch | 102 ++
 ...-analog-fix-error-handling-in-pm8916.patch |  80 ++
 ...-digital-fix-missing-clk_disable_unp.patch |  48 +
 ...error-handling-in-mxs_sgtl5000_probe.patch |  43 +
 ...xs-saif-handle-errors-for-clk_enable.patch |  40 +
 ...issing-clk_disable_unprepare-in-rk81.patch |  47 +
 ...x-pm-usage-reference-of-rockchip_i2s.patch |  41 +
 ...s-fix-missing-clk_disable_unprepare-.patch |  67 ++
 ...k-the-return-value-of-devm_kzalloc-i.patch |  39 +
 ...82s-fix-the-wrong-jack-type-detected.patch | 140 +++
 ...rop-calling-rz_ssi_pio_recv-recursiv.patch | 123 +++
 ...ake-the-data-structures-available-be.patch |  49 +
 ...d-utils-set-sysclk-on-all-components.patch |  78 ++
 ...s-prevent-the-potentially-use-of-nul.patch |  65 ++
 ...ip-zero-num_dai-component-in-searchi.patch |  47 +
 ...d-missing-of_node_put-in-imx8m_probe.patch |  37 +
 ...l-enable-dmi-l1-for-playback-streams.patch |  41 +
 ...da-remove-link-assignment-limitation.patch |  65 ++
 ...atch-sdw-version-on-link_slaves_foun.patch |  85 ++
 ...davinci-i2s-add-check-for-clk_enable.patch |  49 +
 ...handle-error-for-wm8350_register_irq.patch |  73 ++
 ..._formatter_pcm-handle-sysclk-setting.patch |  92 ++
 ...-handling-in-ath10k_setup_msa_resour.patch |  45 +
 ...y-overwrite-of-the-wowlan-wakeup-pac.patch |  56 ++
 ...void-active-pdev-check-for-each-msdu.patch | 184 ++++
 ...e-cached-reo-ring-entry-before-acces.patch |  54 +
 ...eer_40mhz-while-peer-assoc-for-6-ghz.patch |  41 +
 .../ath9k_htc-fix-uninit-value-bugs.patch     | 100 ++
 ...ic64_-read_acquire-set_release-fallb.patch | 221 ++++
 ...-audit_time_-records-only-from-rules.patch | 167 +++
 ..._mod_enabled-to-check-if-ipv6-enable.patch |  92 ++
 ...e-after-free-in-bfq_dispatch_request.patch | 183 ++++
 ...lkg-iostat-after-percpu-stat-aggrega.patch |  58 ++
 .../block-bfq-don-t-move-oom_bfqq.patch       | 142 +++
 ...ck-bfq_wf2q-correct-weight-to-ioprio.patch |  38 +
 ...te-queue-kobject-before-its-children.patch |  72 ++
 ...ttle-split-bio-in-case-of-iops-limit.patch | 106 ++
 ...l-fix-wbs-setting-for-intel-legacy-r.patch |  94 ++
 ...dio-fix-kernel-oops-in-btmtksdio_int.patch |  72 ++
 ...ci_le_conn_failed-with-hdev-lock-in-.patch |  41 +
 ...serdev-call-init_rwsem-before-p-open.patch |  71 ++
 ...rt-add-missing-null-check-in-h5_enqu.patch |  46 +
 ...uild_prologue-first-in-first-jit-pas.patch |  53 +
 ...-feed-byte-offset-into-bpf-line-info.patch |  46 +
 ...decl_tag-bug-when-tagging-a-function.patch | 141 +++
 ...to-race-between-btf_try_get_module-a.patch | 165 +++
 ...ix-double-uncharge-the-mem-of-sk_msg.patch |  72 ++
 ...ap-fix-memleak-in-sk_psock_queue_msg.patch | 117 +++
 ...memleak-in-tcp_bpf_sendmsg-while-sk-.patch | 109 ++
 ...more-uncharged-while-msg-has-more_da.patch | 100 ++
 ...rror-check-when-calling-hashmap__new.patch | 121 +++
 ...ol-fix-print-error-when-show-bpf-map.patch |  60 ++
 ...the-error-when-lookup-in-no-btf-maps.patch |  56 ++
 ...set-obj-skeleton-on-complete-success.patch |  51 +
 ...-clean-up-repair-bio-if-submit-fails.patch |  61 ++
 ...ble-complete-bio-on-errors-during-co.patch | 130 +++
 ...cted-error-path-when-reflinking-an-i.patch |  50 +
 ...csum-lookup-errors-properly-on-reads.patch | 114 +++
 ...den-identification-of-a-stale-device.patch | 101 ++
 ...h_csum_tree-return-0-if-we-get-efbig.patch |  51 +
 ...-eaddrnotavail-when-reading-from-unb.patch |  49 +
 ...t-msg_trunc-flag-when-reading-from-s.patch |  86 ++
 ...inate-clk_div_table-with-sentinel-el.patch |  58 ++
 ...91-sama7g5-fix-parents-of-pdmcs-gclk.patch |  49 +
 ...minate-clk_div_table-with-sentinel-e.patch |  45 +
 ...-fix-clk_hw_get_clk-when-dev-is-null.patch |  49 +
 ...rminate-clk_div_table-with-sentinel-.patch |  42 +
 ...y-one-in-imx_lpcg_parse_clks_from_dt.patch |  38 +
 ...clk-imx7d-remove-audio_mclk_root_clk.patch |  38 +
 .../clk-initialize-orphan-req_rate.patch      |  68 ++
 ...rminate-clk_div_table-with-sentinel-.patch |  40 +
 ...2-update-logic-to-calculate-d-value-.patch |  60 ++
 ...2-update-the-frac-table-for-pixel-cl.patch |  37 +
 ...clk-qcom-gcc-msm8994-fix-gpll4-width.patch |  43 +
 ...lk-qcom-ipq8074-fix-pci-e-clock-oops.patch | 163 +++
 ...pq8074-use-floor-ops-for-sdcc1-clock.patch |  49 +
 ...7g044-update-multiplier-and-divider-.patch |  45 +
 ...24-emc-fix-missing-put_device-call-i.patch |  39 +
 ..._pm-fix-return-value-of-__setup-hand.patch |  50 +
 ...ers-exynos_mct-handle-dts-with-highe.patch |  65 ++
 ...ers-exynos_mct-refactor-resources-al.patch | 111 ++
 ...ers-timer-microchip-pit64b-use-notra.patch |  38 +
 ...ers-timer-of-check-return-value-of-o.patch |  45 +
 ...ers-timer-ti-dm-fix-regression-from-.patch | 133 +++
 ...freq-nvmem-fix-reading-of-pvs-valid-.patch |  38 +
 ...m-check-if-any-cpu-is-managed-by-spm.patch |  78 ++
 ...logic-call-finalize-with-bh-disabled.patch |  37 +
 ...ix-sleep-in-atomic-context-in-decryp.patch |  42 +
 ...maengine_unregister-release-dma-chan.patch |  69 ++
 ...e-psp_ret-is-always-init-d-in-__sev_.patch |  48 +
 ...ree-don-t-attempt-0-len-dma-mappings.patch |  45 +
 ...fix-use-after-free-in-cc_cipher_exit.patch |  40 +
 ...emini-call-finalize-with-bh-disabled.patch |  37 +
 ...-qm-cleanup-warning-in-qm_vf_read_qo.patch |  36 +
 ...-sec-fix-the-aead-software-fallback-.patch |  67 ++
 ...-sec-not-need-to-enable-sm4-extra-mo.patch |  40 +
 ...o-mxs-dcp-fix-scatterlist-processing.patch |  35 +
 ...teontx2-remove-config_dm_crypt-check.patch |  67 ++
 ...crypto-rockchip-ecb-does-not-need-iv.patch |  36 +
 ...8i-ce-call-finalize-with-bh-disabled.patch |  67 ++
 ...8i-ss-call-finalize-with-bh-disabled.patch |  67 ++
 ...-sun8i-ss-really-disable-hash-on-a80.patch |  40 +
 .../crypto-vmx-add-missing-dependencies.patch |  62 ++
 .../crypto-xts-add-softdep-on-ecb.patch       |  32 +
 ...l_probe_component_regs-error-message.patch |  37 +
 ...port-reference-until-decoder-release.patch |  73 ++
 ...ze-of-cxl-capability-header-register.patch |  74 ++
 ...odes-are-flushed-before-destroy-cach.patch |  51 +
 ..._key_size-compiler-warning-if-config.patch |  40 +
 ...fix-return-value-of-__setup-handlers.patch |  72 ++
 ...ma-fix-msi-allocate-fail-when-reload.patch |  53 +
 ...hange-bandwidth-token-to-read-buffer.patch | 311 ++++++
 ...estore-traffic-class-defaults-after-.patch |  46 +
 ...-fix-return-value-of-__setup-handler.patch |  59 ++
 ...ory-add-memory-block-to-memory-group.patch |  58 ++
 ...-cpsw-fix-panic-when-interrupt-coale.patch |  58 ++
 ...add-affected-crtcs-to-atomic-state-f.patch |  58 ++
 ...fix-a-null-pointer-dereference-in-am.patch |  49 +
 ...-remove-vupdate_int_entry-definition.patch | 162 +++
 ...nable-pm-sysfs-write-for-one-vf-mode.patch |  42 +
 ...n-enotsupp-if-there-is-no-get_dpm_ul.patch |  43 +
 ...issing-pm_runtime_disable-in-__dw_mi.patch |  38 +
 ...e-adv7511-fix-adv7535-hpd-enablement.patch | 100 ++
 ...25-fix-overflow-issue-on-reading-edi.patch |  39 +
 ...dsi-make-sure-to-to-create-proper-al.patch |  38 +
 ...mi-use-safe-format-when-first-in-bri.patch |  58 ++
 ...ree-wrong-object-in-sii8620_init_rcp.patch |  39 +
 ...si-fix-pm-disable-depth-imbalance-in.patch |  38 +
 ...-t-clear-formats-if-using-deep-color.patch |  76 ++
 ...eep-color-modes-between-rgb-and-yuv4.patch | 153 +++
 ...-do-not-re-enable-psr-after-it-was-m.patch |  63 ++
 ...-fix-hpd-short-pulse-handling-for-ed.patch |  97 ++
 ...x-drm_modeset_acquire_ctx-kernel-doc.patch |  41 +
 ...ror-handling-when-afbcd.ops-init-fai.patch |  91 ++
 ...bcd-add-an-exit-callback-to-struct-m.patch | 144 +++
 ...split-out-encoder-from-meson_dw_hdmi.patch | 948 ++++++++++++++++++
 ...sm-a6xx-fix-missing-array_size-check.patch |  53 +
 ...s-add-fail-safe-mode-into-connector-.patch |  47 +
 ...opulate-connector-of-struct-dp_panel.patch |  82 ++
 ...link-training-after-link-training-2-.patch |  49 +
 ...drm-msm-dpu-add-dspp-blocks-teardown.patch |  45 +
 .../drm-msm-dpu-fix-dp-audio-condition.patch  |  41 +
 ...fix-7nm-v4.0-settings-for-c-phy-mode.patch |  67 ++
 ...ref-fw-clock-instead-of-global-name-.patch | 135 +++
 ...fix-undefined-behavior-in-nvkm_acr_h.patch |  54 +
 ...eck-for-error-num-after-setting-mask.patch |  45 +
 ...st-drm_dp_mst_helper-fix-memory-leak.patch |  45 +
 ...ference-leak-in-tegra_dsi_ganged_pro.patch |  39 +
 ...check-for-error-num-after-setting-ma.patch |  55 +
 ...the-evm-__setup-handler-return-value.patch |  58 ++
 ...ext2-correct-max-file-size-computing.patch |  58 ++
 ...ster-len-and-clusters-changed-accoun.patch |  82 ++
 ...f-someone-dirty-pages-without-asking.patch |  84 ++
 ..._mark_bb-with-flex_bg-with-fast_comm.patch | 224 +++++
 ...x-to-print-raw-data-size-in-error-pa.patch |  41 +
 ...reeze-lock-in-f2fs_evict_inode-in-fr.patch | 118 +++
 ...sed-file-start-atomic-write-may-caus.patch |  79 ++
 ...-free-nid-in-f2fs_handle_failed_inod.patch | 109 ++
 ...f2fs-fix-to-avoid-potential-deadlock.patch |  88 ++
 ...do-sanity-check-on-curseg-alloc_type.patch |  86 ++
 ...le-atgc-correctly-via-gc_idle-sysfs-.patch |  38 +
 .../f2fs-use-spin_lock-to-avoid-hang.patch    | 141 +++
 ...ogle-properly-state-iomem-dependency.patch |  58 ++
 ...m-remove-reassignment-to-desc-follow.patch |  47 +
 ...fix-compilation-failure-when-config_.patch |  37 +
 ...pe-in-assignment-of-ipv6-port-for-au.patch |  35 +
 ...lf-fix-at_phdr-for-unusual-elf-files.patch | 119 +++
 ...ave-to-be-multiples-of-bits_per_long.patch | 128 +++
 ...fix-fd-table-size-alignment-properly.patch |  55 +
 ...i-aspeed-fix-a-potential-double-free.patch |  95 ++
 queue-5.16/fsi-scom-fix-error-handling.patch  |  70 ++
 ...com-remove-retries-in-indirect-scoms.patch | 114 +++
 ...kleak-exactly-match-strings-instead-.patch |  70 ++
 ...x-fix-a-memory-leak-in-host1x_remove.patch |  35 +
 ...labs-add-check-for-pci_enable_device.patch |  38 +
 ...get-set_report-for-unnumbered-report.patch |  91 ++
 ...rate-limit-unhandled-message-warning.patch |  51 +
 ...mon-pmbus-add-mutex-to-regulator-ops.patch |  71 ++
 ...wmon-pmbus-add-vin-unit-off-handling.patch |  61 ++
 ...mmon-replace-wdog_active-with-wdog_h.patch |  45 +
 ...g-atmel-disable-trng-on-failure-path.patch |  34 +
 ...ck-health-status-while-reading-rando.patch | 339 +++++++
 ...random_cavium-should-depend-on-arch_.patch |  38 +
 ...ange-clk_disable-to-clk_disable_unpr.patch |  47 +
 ...the-error-handling-in-bcm2835_i2c_pr.patch |  77 ++
 ...platform_get_irq-to-get-the-interrup.patch |  58 ++
 ...meson-fix-wrong-speed-use-from-probe.patch |  59 ++
 ...nctrl-do-not-deactivate-a-master-tha.patch |  53 +
 ...i2c-classes-from-platform-driver-var.patch |  55 +
 .../i2c-xiic-make-bus-names-unique.patch      |  49 +
 ...ve-excessive-xdp_packet_headroom-on-.patch |  53 +
 ...0e-remove-dead-stores-on-xsk-hotpath.patch |  59 ++
 ...0e-respect-metadata-on-xsk-rx-to-skb.patch |  68 ++
 ...-ini-qps-to-set-their-local-ack-time.patch |  41 +
 ...ib-hfi1-allow-larger-mtu-without-aip.patch |  46 +
 ...vnic-fix-race-between-xmit-and-reset.patch | 275 +++++
 ...to-run-ice_send_event_to_aux-in-atom.patch |  47 +
 ...e-excessive-xdp_packet_headroom-on-x.patch |  56 ++
 ...ng-while-atomic-on-aux-critical-err-.patch | 132 +++
 ...ce-respect-metadata-on-xsk-rx-to-skb.patch |  67 ++
 .../igb-refactor-xdp-registration.patch       |  85 ++
 ...-warning-when-changing-rx-ring-param.patch |  77 ++
 ...e-excessive-xdp_packet_headroom-on-x.patch |  66 ++
 ...-check-for-devm_request_threaded_irq.patch |  38 +
 ...probe-failing-when-an-i2c_device_id-.patch | 143 +++
 ...heck-unrelated-req-open.how-in-accep.patch |  42 +
 ...te-manual-loop-iterator-loop-correct.patch |  48 +
 ...-check-for-error-num-after-setting-m.patch |  42 +
 ...print-aq-errors-if-completions-aren-.patch |  57 ++
 ...d-reset-commands-if-fw-isn-t-running.patch | 131 +++
 ...ype-complaint-in-ionic_dev_cmd_clean.patch |  51 +
 ...nic-fix-up-printing-of-timeout-error.patch |  43 +
 ...ic-start-watchdog-after-all-is-setup.patch |  62 ++
 ...ookups-when-handling-icmp-redirects-.patch | 115 +++
 ...-nvic-release-nvic_base-upon-failure.patch |  50 +
 .../irqchip-qcom-pdc-fix-broken-locking.patch |  56 ++
 ...fix-incorrect-device_caps-for-ivtvfb.patch | 123 +++
 ...io-error-code-that-is-never-returned.patch |  39 +
 ...mvm-align-locking-in-d3-test-debugfs.patch |  53 +
 ...t-call-iwl_mvm_sta_from_mac80211-wit.patch |  52 +
 ...t-iterate-unadded-vifs-when-handling.patch |  42 +
 ...-mvm-fix-an-error-code-in-iwl_mvm_up.patch |  39 +
 ...wifi-pcie-fix-sw-error-msi-x-mapping.patch |  38 +
 ...id-using-dram-data-if-allocation-fai.patch |  53 +
 ...move-dbgi_sram-address-reset-writing.patch |  55 +
 ...rve-excessive-xdp_packet_headroom-on.patch |  52 +
 ...p-to-ixgbe_construct_skb_zc-directly.patch |  80 ++
 ...be-respect-metadata-on-xsk-rx-to-skb.patch |  68 ++
 .../jfs-fix-divide-error-in-dbnextag.patch    |  56 ++
 .../kdb-fix-the-putarea-helper-function.patch |  47 +
 ...ce-fix-kfree-of-bootmem-memory-again.patch |  96 ++
 ...id-calling-null-function-trusted_key.patch |  47 +
 ...-trusted-key-backends-when-building-.patch |  54 +
 ...-fix-return-value-of-__setup-handler.patch |  76 ++
 ...-fix-return-value-of-__setup-handler.patch |  65 ++
 ..._test_timeout-compatible-with-commen.patch |  48 +
 ...-cortex-a510-erratum-2077057-by-defa.patch |  39 +
 ...v-check-return-value-of-kvmppc_radix.patch |  42 +
 ...-fix-vmx-vsx-mixup-in-mmio-emulation.patch |  48 +
 ...userspace-on-enomem-efault-ghcb-erro.patch | 191 ++++
 ...-defer-not-present-segment-check-in-.patch |  69 ++
 ...kvm-x86-fix-emulation-in-writing-cr8.patch |  65 ++
 ...akefile-use-pound-instead-of-for-mak.patch |  85 ++
 ...after-free-in-register_test_dev_kmod.patch |  34 +
 ...fix-kernel-pointer-check-for-separat.patch |  48 +
 ...lation-warning-due-to-mismatched-pri.patch |  38 +
 ...f-fix-memleak-in-libbpf_netlink_recv.patch |  55 +
 ...ble-null-pointer-dereference-when-de.patch |  59 ++
 ...ignedness-bug-in-btf_dump_array_data.patch |  47 +
 ...ard-declaration-when-counting-duplic.patch |  54 +
 ...libbpf-unmap-rings-when-umem-deleted.patch |  60 ++
 ...ically-allocated-buffer-when-receivi.patch | 135 +++
 ...-build-failure-on-32-bits-processors.patch |  67 ++
 ...iterate-lock_classes-directly-when-r.patch | 255 +++++
 ...use-sysfs_emit-in-the-sysfs-xxx-show.patch |  73 ++
 ...otection-fault-in-legacy_parse_param.patch |  79 ++
 ...vice.c-only-build-for-mcf_edma-when-.patch |  84 ++
 ...1-limit-bandwidth-in-he-capabilities.patch | 155 +++
 ...211-remove-a-couple-of-obsolete-todo.patch |  67 ++
 ...-imx-fix-crash-in-resume-on-i.mx8ulp.patch |  38 +
 ...eed-correct-value-for-h-total-pixels.patch |  74 ++
 ...l-isc-base-report-frame-sizes-as-ful.patch |  74 ++
 ...atmel-sama7g5-isc-fix-ispck-leftover.patch |  56 ++
 ...ix-bad-usage-at-error-handling-logic.patch |  95 ++
 ...x-dummy_ptr-check-to-avoid-duplicate.patch | 116 +++
 ...in_platform-add-dmi-quirk-to-not-tur.patch |  68 ++
 ...arning-regression-on-tunerless-devic.patch |  50 +
 ...ss-csid-170-don-t-enable-unused-irqs.patch |  47 +
 ...camss-csid-170-fix-non-10bit-formats.patch |  52 +
 ...-170-set-the-right-halt_cmd-when-dis.patch |  55 +
 ...s-vfe-170-fix-vfe-halt-timeout-error.patch |  52 +
 ...-h264-fix-neighbour-info-buffer-size.patch |  44 +
 ...-h265-fix-neighbour-info-buffer-size.patch |  44 +
 ...issing-put_device-call-in-coda_get_v.patch |  37 +
 ...clear-interrupt-status-register-befo.patch |  47 +
 ...-initialize-refcount-before-kref_get.patch |  66 ++
 ...-overfill-bottom-register-field-name.patch |  64 ++
 ...ialize-dev-worker-at-hdpvr_register_.patch |  61 ++
 .../media-i2c-ov5648-fix-lockdep-error.patch  |  53 +
 ...-mipi-csi2-remove-wrong-irq-config-w.patch |  41 +
 ...x-imx8mq-mipi_csi2-fix-system-resume.patch | 173 ++++
 ...ix-a-bug-of-accessing-array-out-of-b.patch |  41 +
 ...revent-decoding-nv12m-jpegs-into-sin.patch |  43 +
 ...atek-add-device_link-between-the-con.patch | 185 ++++
 ...atek-return-enodev-if-the-device-is-.patch |  58 ++
 ...atek-v1-free-the-existed-fwspec-if-t.patch |  77 ++
 ...dia-ir_toy-free-before-error-exiting.patch |  35 +
 ...-potential-dereference-of-null-point.patch |  96 ++
 ...-ge2d-fixup-frames-size-in-registers.patch |  79 ++
 ...-potential-dereference-of-null-point.patch |  38 +
 ...-set-format-v4l2_mbus_pixelcode-not-.patch |  80 ++
 ...ia-ov5648-don-t-pack-controls-struct.patch |  38 +
 ...0-fix-set-format-try-processing-path.patch | 234 +++++
 ...ia-em28xx-add-missing-em28xx_close_e.patch |  50 +
 ...x-incorrect-use-to-determine-if-list.patch |  49 +
 ...dia-imx-imx7-mipi-csis-make-subdev-n.patch |  60 ++
 ...dia-zoran-calculate-the-right-buffer.patch |  51 +
 ...dia-zoran-fix-usage-of-vb2_dma_conti.patch |  45 +
 ...dia-zoran-fix-various-v4l2-complianc.patch | 102 ++
 ...ging-media-zoran-move-videodev-alloc.patch | 185 ++++
 ...-start-stream-fails-return-buffers-w.patch | 143 +++
 ...-fix-a-null-pointer-dereference-in-c.patch |  48 +
 ...go7007-s2250-board-fix-leak-in-probe.patch |  57 ++
 ...unaligned-access-warnings-when-print.patch |  74 ++
 ...-core-initialize-h264-scaling-matrix.patch |  64 ++
 ...em-apply-dst_queue_off_base-on-mmap-.patch | 136 +++
 ...-handle-short-reads-of-hdmi-info-fra.patch |  66 ++
 ...dtv-check-for-null-return-of-vzalloc.patch |  70 ++
 ...-emif-add-check-for-setup_interrupts.patch |  49 +
 ...k-the-pointer-temp-in-get_device_det.patch |  37 +
 ...gra20-emc-correct-memory-device-mask.patch |  38 +
 ...lock-fix-handling-of-read-only-devic.patch |  53 +
 ...ssing-iounmap-on-error-asic3_mfd_pro.patch |  59 ++
 ...xx-add-check-for-mc13xxx_irq_request.patch |  41 +
 ...refcount-leak-in-mips_cdmm_phys_base.patch |  37 +
 ...s-dec-honor-config_mips_fp_support-n.patch |  80 ++
 ...c-fix-memory-leak-caused-by-pgd_free.patch |  57 ++
 ...-fix-return-value-of-__setup-handler.patch |  57 ++
 ...vium-switch-cases-in-tlb-handler-syn.patch |  73 ++
 ...alcor_pci-fix-an-error-handling-path.patch |  72 ++
 ...inci_mmc-handle-error-for-clk_enable.patch |  43 +
 ...an-error-when-enable_sdio_irq-ops-is.patch |  60 ++
 ...m654-fix-the-driver-data-of-am64-soc.patch |  70 ++
 ...due-to-tcp_tsorted_anchor-was-initia.patch |  68 ++
 ...mt76-connac-fix-sta_rec_wtbl-tag-len.patch |  36 +
 ...k-sta_rates-pointer-in-mt7603_sta_ra.patch |  37 +
 ...k-sta_rates-pointer-in-mt7615_sta_ra.patch |  37 +
 ...15-fix-a-leftover-race-in-runtime-pm.patch |  43 +
 ...-fix-mcu_ce_cmd_set_roc-definition-e.patch |  36 +
 ...fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch |  35 +
 ...mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch |  95 ++
 ...possible-memory-leak-in-mt7915_mcu_a.patch |  50 +
 .../mt76-mt7915-fix-the-muru-tlv-issue.patch  |  68 ++
 ...7915-fix-the-nss-setting-in-bitrates.patch |  43 +
 ...proper-aid-value-in-mt7915_mcu_sta_b.patch |  51 +
 ...proper-aid-value-in-mt7915_mcu_wtbl_.patch |  42 +
 ...-do-not-always-disable-fw-runtime-pm.patch |  46 +
 ...21-fix-a-leftover-race-in-runtime-pm.patch |  43 +
 ...fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch |  35 +
 ...fix-mt7921_queues_acq-implementation.patch |  80 ++
 ...edca-parameters-with-the-mcu-ce-comm.patch | 136 +++
 ...-possible-probe-failure-after-reboot.patch | 384 +++++++
 ...-missing-fc-type-sub-type-for-802.11.patch |  64 ++
 ...921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch | 121 +++
 .../mtd-mchp23k256-add-spi-id-table.patch     |  60 ++
 .../mtd-mchp48l640-add-spi-id-table.patch     |  56 ++
 .../mtd-onenand-check-for-error-irq.patch     |  47 +
 ...l-fix-refcount-issue-in-atmel_nand_c.patch |  75 ++
 ...-gpmi-fix-controller-timings-setting.patch |  59 ++
 ...3-set-the-nand-chip-node-as-the-flas.patch |  38 +
 ...t_buf-leak-in-activate-when-lsr-0xff.patch |  76 ++
 ...per-error-handling-of-usb-read-error.patch | 146 +++
 ...rx-ring-refill-allocation-failure-ha.patch | 141 +++
 ...-stronger-register-read-writes-to-as.patch | 115 +++
 ...cfp-fix-an-incorrect-null-check-on-l.patch |  55 +
 ...c-on-shutdown-if-multi-chip-tree-fai.patch |  64 ++
 ...x-enable-port-policy-support-on-6097.patch |  35 +
 ...et-dsa-realtek-smi-fix-kdoc-warnings.patch |  58 ++
 ...dsa-realtek-smi-move-to-subdirectory.patch | 155 +++
 ...te-cbd-ring-data-memory-using-dma-co.patch | 283 ++++++
 ...-software-timestamping-via-so_timest.patch |  41 +
 ...-vlan-list-lock-to-protect-vlan-list.patch | 182 ++++
 ...esidual-vf-config-after-disable-srio.patch | 153 +++
 ...-when-pf-set-the-duplicate-mac-addre.patch |  51 +
 ...t-base-vlan-add-fail-when-concurrent.patch | 169 ++++
 ...format-the-output-of-the-mac-address.patch | 346 +++++++
 ...fine-the-process-when-pf-set-vf-vlan.patch |  92 ++
 ...ove-page-selection-fix-to-config_ini.patch |  91 ++
 ...hy-broadcom-fix-brcm_fet_config_init.patch |  79 ++
 ...icrel-fix-concurrent-register-access.patch |  76 ++
 ...f_ct_put-instead-of-nf_conntrack_put.patch | 126 +++
 ...ct-fix-ref-leak-when-switching-zones.patch |  65 ++
 ...5-depends-on-ptp_1588_clock_optional.patch |  56 ++
 ...hdev-fix-possible-null-pointer-deref.patch |  38 +
 ...l-ptr-deref-caused-by-x25_disconnect.patch |  65 ++
 ...ack-add-and-use-nf_ct_set_auto_assig.patch |  67 ++
 ...-egress-report-interface-as-outgoing.patch |  36 +
 ...ble-fix-qinq-and-pppoe-support-for-i.patch | 129 +++
 ...ntrack_tcp-preserve-liberal-flag-in-.patch |  71 ++
 ..._h323-eliminate-anonymous-module_ini.patch |  74 ++
 ...-t-loop-forever-in-nfs_do_recoalesce.patch |  40 +
 ...ded-check-in-decode_devicenotify_arg.patch |  39 +
 ...lid-errors-from-nfs2-3_decode_dirent.patch | 106 ++
 ...ng_set_error-results-in-spurious-err.patch |  41 +
 ...fsd_breaker_owns_lease-return-values.patch |  57 ++
 ...-allocation-failure-handling-in-nfsd.patch |  63 ++
 ...nother-issue-with-a-list-iterator-po.patch | 120 +++
 ...try-bind_conn_to_session-on-session-.patch |  35 +
 ...-add-sanity-check-on-allocation-size.patch |  43 +
 ...x-default-alignment-for-small-region.patch |  41 +
 .../nvme-cleanup-__nvme_check_ids.patch       |  56 ++
 ...eck-for-duplicate-unique-identifiers.patch |  69 ++
 ...p-lockdep-annotate-in-kernel-sockets.patch | 127 +++
 ...eontx2-af-initialize-action-variable.patch | 109 ++
 ...tch-always-update-flow-key-after-nat.patch | 200 ++++
 ...handling-off-probe-non-access-faults.patch | 168 ++++
 ...n-access-data-tlb-cache-flush-faults.patch |  92 ++
 ...ark-fix-reading-msi-interrupt-number.patch |  65 ++
 ...-reading-pci_exp_rtsta_pme-bit-on-em.patch |  55 +
 ...void-broken-msi-on-sb600-usb-devices.patch |  61 ++
 ...warnings-on-possible-rw1c-corruption.patch |  71 ++
 ...dress-filter-parser-for-multiple-fil.patch |  40 +
 ...rked-applications-enablement-of-coun.patch |  99 ++
 ...t-fix-address-filter-config-for-32-b.patch |  37 +
 ...-lpx-parameter-and-its-derivatives-t.patch |  70 ++
 ...y-phy-brcm-usb-fixup-bcm4908-support.patch | 161 +++
 ...-fix-missing-of_node_put-in-mtk_pctr.patch |  45 +
 ...-paris-fix-argument-argument-type-fo.patch |  45 +
 ...-paris-fix-pin_config_bias_-readback.patch |  60 ++
 ...-paris-fix-pingroup-pin-config-state.patch |  61 ++
 ...-paris-skip-custom-extra-pin-config-.patch |  43 +
 ...ctrl-microchip-sgpio-lock-rmw-access.patch | 110 ++
 ...add-missing-of_node_put-in-nmk_pinct.patch |  41 +
 ...-broken-references-to-chip-parent_de.patch | 125 +++
 ...checker-fix-miscalculation-of-number.patch |  51 +
 ...r8a77470-reduce-size-for-narrow-vin1.patch |  50 +
 ...-add-missing-of_node_put-in-rockchip.patch |  45 +
 ...remove-eint-handler-for-exynos850-al.patch |  53 +
 ...wei-wmi-check-the-return-value-of-de.patch |  52 +
 ...q-flags-in-device_pm_check_callbacks.patch | 107 ++
 ...e-fix-__setup-handler-error-handling.patch |  40 +
 ...-fix-return-value-of-__setup-handler.patch |  73 ++
 ...-ab8500_chargalg-use-clock_monotonic.patch |  58 ++
 ...ni-poweroff-fix-irq-check-in-gemini_.patch |  45 +
 ...500-fix-memory-leak-in-ab8500_fg_sys.patch |  47 +
 ...4190_charger-fix-bq24190_vbus_is_ena.patch |  58 ++
 ...-charger-don-t-cancel-work-that-is-n.patch |  82 ++
 ...350-power-add-missing-free-in-free_c.patch |  36 +
 ...350-power-handle-error-for-wm8350_re.patch | 156 +++
 ...u-reset-per_cpu-variable-in-the-rele.patch |  48 +
 ...c-64s-don-t-use-dsisr-for-slb-faults.patch | 103 ++
 ...a-return-value-error-in-mpc8xx_pic_i.patch |  38 +
 ...0rdb-fix-ports-names-for-seville-eth.patch | 111 ++
 ...-don-t-pass-mcpu-powerpc64-when-buil.patch |  57 ++
 ...skip-numa_no_node-onlining-in-parse_.patch |  53 +
 ...-t-use-perf_hw_context-for-trace-imc.patch |  52 +
 ...fix-use-after-free-in-remove_phb_dyn.patch |  95 ++
 ...ix-incorrect-use-to-determine-if-lis.patch |  50 +
 ...-propagate-return-value-from-pps_gpi.patch |  43 +
 ...n-value-of-printk.devkmsg-__setup-ha.patch |  70 ++
 ...irtual-clocks-when-unregistering-phy.patch |  68 ++
 ...initialize-driver-data-and-hardware-.patch |  83 ++
 ...-dcb-default-to-returning-eopnotsupp.patch |  81 ++
 .../ray_cs-check-ioremap-return-value.patch   |  57 ++
 ..._seq-and-use-only-rcu_state.ofl_lock.patch | 221 ++++
 ...to-the-rcu_segcblist-structure-s-fla.patch |  47 +
 ...x-ib_qp_usecnt_dec-called-when-error.patch |  74 ++
 ...a-core-set-mr-type-in-ib_reg_user_mr.patch |  36 +
 ...-fix-netdev-notifications-for-vlan-s.patch | 140 +++
 ...dma-irdma-fix-passthrough-mode-in-vm.patch |  81 ++
 ...rdma-prevent-some-integer-underflows.patch |  76 ++
 ...irdma-remove-incorrect-masking-of-pd.patch |  48 +
 ...mory-leak-in-error-flow-for-subscrib.patch |  40 +
 ...e-flow-of-a-miss-in-the-allocation-o.patch |  39 +
 ...nt-underflow-in-nldev_stat_set_count.patch |  42 +
 ...variable-and-function-argument-to-pr.patch |  73 ++
 ...heck-the-last-packet-by-rxe_end_mask.patch |  54 +
 .../rdma-rxe-fix-ref-error-in-rxe_av.c.patch  | 302 ++++++
 ...md-fix-for_each_child.cocci-warnings.patch |  48 +
 ...nel-handle-i2c-errors-timing-to-the-.patch | 143 +++
 ...fix-missing-of_node_put-in-adsp_allo.patch |  36 +
 ...q6v5_mss-fix-some-leaks-in-q6v5_allo.patch |  74 ++
 ...wcnss-add-missing-of_node_put-in-wcn.patch |  37 +
 ...-fix-ib_qp_usecnt_dec-called-when-er.patch | 103 ++
 ...ock-bfq-honor-already-setup-queue-me.patch |  78 ++
 ...en-uapi-field-layout-on-32-bit-littl.patch |  95 ++
 ...ock-fix-race-when-running-for-fix-du.patch |  72 ++
 .../sched-core-export-pelt_thermal_tp.patch   |  36 +
 ...d-cpuacct-fix-charge-percpu-cpuusage.patch |  49 +
 ...ve-mpol_get-put-and-task_lock-unlock.patch |  60 ++
 ...ve-consistency-of-allowed-numa-balan.patch |  81 ++
 ...t_mutex_setprio-vs-push_rt_task-race.patch | 150 +++
 ...n-t-re-read-p-state-when-emitting-sc.patch | 247 +++++
 ...port-task_rtlock_wait-tasks-as-task_.patch |  58 ++
 ...-iowait-boost-escaping-uclamp-restri.patch |  43 +
 ...-dtc-call-pkg-config-posixly-correct.patch |  38 +
 .../scsi-fnic-fix-a-tracing-statement.patch   |  40 +
 ...ange-permission-of-parameter-prot_ma.patch |  42 +
 ...sas-fix-incorrect-4gb-boundary-check.patch | 112 +++
 ...01-fix-abort-all-task-initialization.patch |  97 ++
 ...command-initialization-in-pm8001_chi.patch |  43 +
 ...command-initialization-in-pm80xx_sen.patch |  59 ++
 ...le32-values-handling-in-pm80xx_chip_.patch | 143 +++
 ...values-handling-in-pm80xx_chip_.patch-2702 | 190 ++++
 ...le32-values-handling-in-pm80xx_set_s.patch | 112 +++
 ...ncq-non-data-command-completion-hand.patch |  61 ++
 ...ncq-non-data-command-task-initializa.patch | 101 ++
 ...payload-initialization-in-pm80xx_enc.patch |  51 +
 ...payload-initialization-in-pm80xx_set.patch |  51 +
 ...rity-add-sctp_assoc_established-hook.patch | 207 ++++
 ...nt-sctp_assoc_established-hook-in-se.patch | 217 ++++
 ...elftests-bpf-extract-syscall-wrapper.patch |  77 ++
 .../selftests-bpf-fix-bind-on-used-port.patch |  73 ++
 ...x-error-reporting-from-sock_fields-p.patch |  46 +
 ...ke-test_lwt_ip_encap-more-stable-and.patch |  75 ++
 ...st_lirc_mode2.sh-exit-with-proper-co.patch |  55 +
 ...st_xdp_redirect_multi-use-temp-netns.patch | 159 +++
 ...e-__se_-prefix-on-architectures-with.patch |  41 +
 .../selftests-lkdtm-add-ubsan-config.patch    |  48 +
 ...add-csum-mib-check-for-mptcp_connect.patch |  72 ++
 ...-net-timestamping-fix-bind_phc-check.patch |  49 +
 ...lftests-sgx-treat-cc-as-one-argument.patch |  39 +
 ...vxlan_under_vrf-fix-broken-test-case.patch |  69 ++
 ...s-skip-cmsg_to_pipe-tests-with-tls-n.patch |  50 +
 ...d-validity-check-and-allow-field-spl.patch |  40 +
 ...fix-how-check_cc.sh-is-being-invoked.patch |  73 ++
 ...selftests-xsk-fix-rx_full-stats-test.patch |  42 +
 ...uperblock_security_struct-in-lsm-blo.patch |  48 +
 ...oclex-and-fionclex-with-policy-capab.patch |  92 ++
 ...k-return-value-of-sel_make_avc_files.patch |  49 +
 ...linux-fix-selinux_sb_mnt_opts_compat.patch | 226 +++++
 ...-use-correct-type-for-context-length.patch |  47 +
 ...race-condition-in-rts-after-send-han.patch |  63 ++
 ...ix-xoff-xon-sending-when-dma-is-used.patch | 125 +++
 ...ed_vuart-add-port_aspeed_vuart-port-.patch |  90 ++
 ...-balance-reference-count-for-pci-dma.patch | 113 +++
 ...balance-reference-count-for-pci-dma-.patch |  93 ++
 queue-5.16/series                             | 661 ++++++++++++
 ...domains-add-wakeup-capacity-support-.patch |  41 +
 ...x-missing-put_device-call-in-qmp_get.patch |  43 +
 ...s-remove-spurious-irqf_oneshot-flags.patch |  50 +
 ...ix-missing-put_device-call-in-of_get.patch |  37 +
 ...heck-for-null-return-of-devm_kcalloc.patch |  43 +
 ...pc-fix-irq-check-in-wkup_m3_ipc_prob.patch |  47 +
 ...fix-wrong-register-name-in-intel_shi.patch |  41 +
 ...plement-a-timeout-for-polling-status.patch |  75 ++
 ...alance-reference-count-for-pci-dma-d.patch |  77 ++
 ...-gqspi-handle-error-for-dma_set_mask.patch |  41 +
 ...-missing-irq-check-in-tegra_spi_prob.patch |  41 +
 ...tegra20-use-of_device_get_match_data.patch |  43 +
 ...d-fix-missin-irq-check-in-tegra_qspi.patch |  39 +
 ...and-fix-stack-offset-randomization-w.patch | 106 ++
 ...ad7280a-fix-handing-of-device-addres.patch |  44 +
 .../staging-mt7621-dts-fix-formatting.patch   | 114 +++
 ...ing-mt7621-dts-fix-gb-pc2-devicetree.patch | 172 ++++
 ...ts-fix-leds-and-pinctrl-on-gb-pc1-de.patch | 139 +++
 ...ts-fix-pinctrl-properties-for-ethern.patch |  96 ++
 ...-add-unregister_netdev-in-qlge_probe.patch |  57 ++
 ...convert-dbg_88e_level-call-in-hal-rt.patch |  38 +
 ...8188eu-fix-endless-loop-in-recv_func.patch |  40 +
 ...release_firmware-is-not-called-if-al.patch |  44 +
 ...c-async-tasks-mustn-t-block-waiting-.patch |  65 ++
 ...l-connect-more-than-once-on-a-tcp-so.patch |  85 ++
 ...send-a-task-on-an-offlined-transport.patch |  39 +
 ...wap-handling-scheduling-and-pf_memal.patch | 238 +++++
 ...updates-are-processed-during-fastope.patch |  68 ++
 ...check-for-null-after-calling-kmemdup.patch |  45 +
 ...e-timer-expires-after-interval-100ms.patch |  45 +
 ...o-fix-__setup-handlers-return-values.patch |  72 ++
 ...l-fix-root-port-to-host-bridge-assig.patch |  35 +
 ...ce_define_enum-affect-trace-event-ty.patch |  83 ++
 ...-fix-return-value-of-__setup-handler.patch |  50 +
 ...-fix-nios2-and-microblaze-get_user_8.patch | 144 +++
 ...ype-mismatch-warnings-from-access_ok.patch | 232 +++++
 .../udmabuf-validate-ubuf-pagecount.patch     |  47 +
 ...nate-anonymous-module_init-module_ex.patch | 150 +++
 ...realtek-fix-error-code-in-rts51x_rea.patch |  39 +
 ...ate-anonymous-module_init-module_exi.patch |  81 ++
 ...ory-leak-during-d3hot-to-d0-transiti.patch |  66 ++
 ...ke-up-devices-around-reset-functions.patch | 150 +++
 ...l_lcdfb-fix-an-error-code-in-atmel_l.patch |  50 +
 ...usfb-check-pixclock-to-avoid-divide-.patch |  83 ++
 ...dev-controlfb-fix-compile_test-build.patch |  46 +
 ...t.c-fix-printing-in-fb_cvt_print_nam.patch | 111 ++
 ...oxfb-set-maxvram-of-vbg200ew-to-the-.patch |  39 +
 ...iafb-use-strscpy-to-prevent-buffer-o.patch |  51 +
 ...fb-acx565akm-replace-snprintf-with-s.patch |  39 +
 ...fb-add-missing-of_node_put-in-dvic_p.patch |  35 +
 ...fb-panel-dsi-cm-use-sysfs_emit-inste.patch |  63 ++
 ...fb-panel-tpo-td043mtea1-use-sysfs_em.patch |  45 +
 ...ev-sm712fb-fix-crash-in-smtcfb_write.patch |  75 ++
 ...ufx-fix-null-ptr-deref-in-ufx_usb_pr.patch |  62 ++
 ...b-replace-snprintf-in-show-functions.patch |  63 ++
 ...ideo-fbdev-w100fb-reset-global-state.patch |  68 ++
 ...-fix-a-memory-leak-in-acrn_dev_ioctl.patch |  76 ++
 ...-obtain-pa-from-vma-with-pfnmap-flag.patch |  68 ++
 ...nate-anonymous-module_init-module_ex.patch |  82 ++
 ...ock-virtio-enable-vqs-early-on-probe.patch |  43 +
 ...nitialize-vdev-priv-before-using-vqs.patch |  48 +
 ...d-the-negotiated-features-before-usi.patch |  50 +
 ...vsprintf-fix-pk-with-kptr_restrict-0.patch | 135 +++
 ...rintf-fix-potential-unaligned-access.patch |  75 ++
 ...nable-local-echo-for-sent-can-frames.patch |  46 +
 .../watch_queue-actually-free-the-watch.patch |  54 +
 ...ix-null-dereference-in-error-cleanup.patch |  68 ++
 queue-5.16/xen-fix-is_xen_pmu.patch           | 127 +++
 .../xsk-fix-race-at-socket-teardown.patch     | 246 +++++
 ...dd-missing-xchal_have_windowed-check.patch |  39 +
 662 files changed, 50374 insertions(+)
 create mode 100644 queue-5.16/acpi-apei-fix-return-value-of-__setup-handlers.patch
 create mode 100644 queue-5.16/acpi-apei-limit-printable-size-of-bert-table-data.patch
 create mode 100644 queue-5.16/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
 create mode 100644 queue-5.16/adjust-cifssb-maximum-read-size.patch
 create mode 100644 queue-5.16/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
 create mode 100644 queue-5.16/af_unix-fix-some-data-races-around-unix_sk-sk-oob_sk.patch
 create mode 100644 queue-5.16/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
 create mode 100644 queue-5.16/alsa-hda-fix-driver-index-handling-at-re-binding.patch
 create mode 100644 queue-5.16/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
 create mode 100644 queue-5.16/alsa-spi-add-check-for-clk_enable.patch
 create mode 100644 queue-5.16/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch
 create mode 100644 queue-5.16/arm-configs-multi_v5_defconfig-re-enable-drm_panel-a.patch
 create mode 100644 queue-5.16/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch
 create mode 100644 queue-5.16/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
 create mode 100644 queue-5.16/arm-dts-fix-openbmc-flash-layout-label-addresses.patch
 create mode 100644 queue-5.16/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
 create mode 100644 queue-5.16/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch
 create mode 100644 queue-5.16/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
 create mode 100644 queue-5.16/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
 create mode 100644 queue-5.16/arm-dts-stm32-fix-av96-board-sai2-pin-muxing-on-stm3.patch
 create mode 100644 queue-5.16/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch
 create mode 100644 queue-5.16/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
 create mode 100644 queue-5.16/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
 create mode 100644 queue-5.16/arm-mmp-fix-failure-to-remove-sram-device.patch
 create mode 100644 queue-5.16/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
 create mode 100644 queue-5.16/arm64-defconfig-build-imx-sdma-as-a-module.patch
 create mode 100644 queue-5.16/arm64-dts-broadcom-bcm4908-use-proper-twd-binding.patch
 create mode 100644 queue-5.16/arm64-dts-broadcom-fix-sata-nodename.patch
 create mode 100644 queue-5.16/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-ipq6018-fix-usb-reference-period.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-msm8994-provide-missing-xo_board-and-.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-sc7280-fix-gmu-unit-address.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-sm8250-fix-pcie-bindings-to-follow-sc.patch
 create mode 100644 queue-5.16/arm64-dts-qcom-sm8350-correct-tcs-configuration-for-.patch
 create mode 100644 queue-5.16/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
 create mode 100644 queue-5.16/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch
 create mode 100644 queue-5.16/arm64-module-remove-noload-from-linker-script.patch
 create mode 100644 queue-5.16/arm64-prevent-instrumentation-of-bp-hardening-callba.patch
 create mode 100644 queue-5.16/asoc-acp-check-the-return-value-of-devm_kzalloc-in-a.patch
 create mode 100644 queue-5.16/asoc-amd-fix-reference-to-pcm-buffer-address.patch
 create mode 100644 queue-5.16/asoc-amd-vangogh-fix-uninitialized-symbol-warning-in.patch
 create mode 100644 queue-5.16/asoc-amd-vg-fix-for-pm-resume-callback-sequence.patch
 create mode 100644 queue-5.16/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
 create mode 100644 queue-5.16/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch
 create mode 100644 queue-5.16/asoc-atmel-fix-error-handling-in-snd_proto_probe.patch
 create mode 100644 queue-5.16/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
 create mode 100644 queue-5.16/asoc-codecs-check-for-error-pointer-after-calling-de.patch
 create mode 100644 queue-5.16/asoc-codecs-rx-macro-fix-accessing-array-out-of-boun.patch
 create mode 100644 queue-5.16/asoc-codecs-rx-macro-fix-accessing-compander-for-aux.patch
 create mode 100644 queue-5.16/asoc-codecs-va-macro-fix-accessing-array-out-of-boun.patch
 create mode 100644 queue-5.16/asoc-codecs-wc938x-fix-accessing-array-out-of-bounds.patch
 create mode 100644 queue-5.16/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch
 create mode 100644 queue-5.16/asoc-codecs-wcd934x-fix-kcontrol-max-values.patch
 create mode 100644 queue-5.16/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch
 create mode 100644 queue-5.16/asoc-codecs-wcd938x-fix-kcontrol-max-values.patch
 create mode 100644 queue-5.16/asoc-cs35l41-fix-gpio2-configuration.patch
 create mode 100644 queue-5.16/asoc-cs35l41-fix-max-number-of-tx-channels.patch
 create mode 100644 queue-5.16/asoc-cs42l42-report-full-jack-status-when-plug-is-de.patch
 create mode 100644 queue-5.16/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
 create mode 100644 queue-5.16/asoc-dwc-i2s-handle-errors-for-clk_enable.patch
 create mode 100644 queue-5.16/asoc-fsi-add-check-for-clk_enable.patch
 create mode 100644 queue-5.16/asoc-fsl_spdif-disable-tx-clock-when-stop.patch
 create mode 100644 queue-5.16/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
 create mode 100644 queue-5.16/asoc-intel-revert-asoc-intel-sof_es8336-add-quirk-fo.patch
 create mode 100644 queue-5.16/asoc-intel-soc-acpi-add-more-acpi-hids-for-es83x6-de.patch
 create mode 100644 queue-5.16/asoc-intel-sof_es8336-add-quirk-for-huawei-d15-2021.patch
 create mode 100644 queue-5.16/asoc-intel-sof_es8336-log-all-quirks.patch
 create mode 100644 queue-5.16/asoc-intel-sof_es8336-use-nhlt-information-to-set-dm.patch
 create mode 100644 queue-5.16/asoc-intel-sof_sdw-fix-quirks-for-2022-hp-spectre-x3.patch
 create mode 100644 queue-5.16/asoc-madera-add-dependencies-on-mfd.patch
 create mode 100644 queue-5.16/asoc-max98927-add-missing-header-file.patch
 create mode 100644 queue-5.16/asoc-mediatek-mt8192-mt6359-fix-error-handling-in-mt.patch
 create mode 100644 queue-5.16/asoc-mediatek-use-of_device_get_match_data.patch
 create mode 100644 queue-5.16/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
 create mode 100644 queue-5.16/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
 create mode 100644 queue-5.16/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
 create mode 100644 queue-5.16/asoc-mxs-saif-handle-errors-for-clk_enable.patch
 create mode 100644 queue-5.16/asoc-rk817-fix-missing-clk_disable_unprepare-in-rk81.patch
 create mode 100644 queue-5.16/asoc-rockchip-fix-pm-usage-reference-of-rockchip_i2s.patch
 create mode 100644 queue-5.16/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch
 create mode 100644 queue-5.16/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
 create mode 100644 queue-5.16/asoc-rt5682s-fix-the-wrong-jack-type-detected.patch
 create mode 100644 queue-5.16/asoc-sh-rz-ssi-drop-calling-rz_ssi_pio_recv-recursiv.patch
 create mode 100644 queue-5.16/asoc-sh-rz-ssi-make-the-data-structures-available-be.patch
 create mode 100644 queue-5.16/asoc-simple-card-utils-set-sysclk-on-all-components.patch
 create mode 100644 queue-5.16/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
 create mode 100644 queue-5.16/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
 create mode 100644 queue-5.16/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch
 create mode 100644 queue-5.16/asoc-sof-intel-enable-dmi-l1-for-playback-streams.patch
 create mode 100644 queue-5.16/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
 create mode 100644 queue-5.16/asoc-sof-intel-match-sdw-version-on-link_slaves_foun.patch
 create mode 100644 queue-5.16/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
 create mode 100644 queue-5.16/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
 create mode 100644 queue-5.16/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch
 create mode 100644 queue-5.16/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch
 create mode 100644 queue-5.16/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
 create mode 100644 queue-5.16/ath11k-avoid-active-pdev-check-for-each-msdu.patch
 create mode 100644 queue-5.16/ath11k-invalidate-cached-reo-ring-entry-before-acces.patch
 create mode 100644 queue-5.16/ath11k-set-wmi_peer_40mhz-while-peer-assoc-for-6-ghz.patch
 create mode 100644 queue-5.16/ath9k_htc-fix-uninit-value-bugs.patch
 create mode 100644 queue-5.16/atomics-fix-atomic64_-read_acquire-set_release-fallb.patch
 create mode 100644 queue-5.16/audit-log-audit_time_-records-only-from-rules.patch
 create mode 100644 queue-5.16/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch
 create mode 100644 queue-5.16/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
 create mode 100644 queue-5.16/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
 create mode 100644 queue-5.16/block-bfq-don-t-move-oom_bfqq.patch
 create mode 100644 queue-5.16/block-bfq_wf2q-correct-weight-to-ioprio.patch
 create mode 100644 queue-5.16/block-don-t-delete-queue-kobject-before-its-children.patch
 create mode 100644 queue-5.16/block-throttle-split-bio-in-case-of-iops-limit.patch
 create mode 100644 queue-5.16/bluetooth-btintel-fix-wbs-setting-for-intel-legacy-r.patch
 create mode 100644 queue-5.16/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
 create mode 100644 queue-5.16/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch
 create mode 100644 queue-5.16/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
 create mode 100644 queue-5.16/bluetooth-hci_uart-add-missing-null-check-in-h5_enqu.patch
 create mode 100644 queue-5.16/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
 create mode 100644 queue-5.16/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
 create mode 100644 queue-5.16/bpf-fix-a-btf-decl_tag-bug-when-tagging-a-function.patch
 create mode 100644 queue-5.16/bpf-fix-uaf-due-to-race-between-btf_try_get_module-a.patch
 create mode 100644 queue-5.16/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
 create mode 100644 queue-5.16/bpf-sockmap-fix-memleak-in-sk_psock_queue_msg.patch
 create mode 100644 queue-5.16/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
 create mode 100644 queue-5.16/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
 create mode 100644 queue-5.16/bpftool-fix-error-check-when-calling-hashmap__new.patch
 create mode 100644 queue-5.16/bpftool-fix-print-error-when-show-bpf-map.patch
 create mode 100644 queue-5.16/bpftool-fix-the-error-when-lookup-in-no-btf-maps.patch
 create mode 100644 queue-5.16/bpftool-only-set-obj-skeleton-on-complete-success.patch
 create mode 100644 queue-5.16/btrfs-do-not-clean-up-repair-bio-if-submit-fails.patch
 create mode 100644 queue-5.16/btrfs-do-not-double-complete-bio-on-errors-during-co.patch
 create mode 100644 queue-5.16/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch
 create mode 100644 queue-5.16/btrfs-handle-csum-lookup-errors-properly-on-reads.patch
 create mode 100644 queue-5.16/btrfs-harden-identification-of-a-stale-device.patch
 create mode 100644 queue-5.16/btrfs-make-search_csum_tree-return-0-if-we-get-efbig.patch
 create mode 100644 queue-5.16/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch
 create mode 100644 queue-5.16/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch
 create mode 100644 queue-5.16/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
 create mode 100644 queue-5.16/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch
 create mode 100644 queue-5.16/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
 create mode 100644 queue-5.16/clk-fix-clk_hw_get_clk-when-dev-is-null.patch
 create mode 100644 queue-5.16/clk-hisilicon-terminate-clk_div_table-with-sentinel-.patch
 create mode 100644 queue-5.16/clk-imx-off-by-one-in-imx_lpcg_parse_clks_from_dt.patch
 create mode 100644 queue-5.16/clk-imx7d-remove-audio_mclk_root_clk.patch
 create mode 100644 queue-5.16/clk-initialize-orphan-req_rate.patch
 create mode 100644 queue-5.16/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
 create mode 100644 queue-5.16/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
 create mode 100644 queue-5.16/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
 create mode 100644 queue-5.16/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
 create mode 100644 queue-5.16/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch
 create mode 100644 queue-5.16/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
 create mode 100644 queue-5.16/clk-renesas-r9a07g044-update-multiplier-and-divider-.patch
 create mode 100644 queue-5.16/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
 create mode 100644 queue-5.16/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
 create mode 100644 queue-5.16/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch
 create mode 100644 queue-5.16/clocksource-drivers-exynos_mct-refactor-resources-al.patch
 create mode 100644 queue-5.16/clocksource-drivers-timer-microchip-pit64b-use-notra.patch
 create mode 100644 queue-5.16/clocksource-drivers-timer-of-check-return-value-of-o.patch
 create mode 100644 queue-5.16/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch
 create mode 100644 queue-5.16/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch
 create mode 100644 queue-5.16/cpuidle-qcom-spm-check-if-any-cpu-is-managed-by-spm.patch
 create mode 100644 queue-5.16/crypto-amlogic-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-5.16/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
 create mode 100644 queue-5.16/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
 create mode 100644 queue-5.16/crypto-ccp-ensure-psp_ret-is-always-init-d-in-__sev_.patch
 create mode 100644 queue-5.16/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
 create mode 100644 queue-5.16/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch
 create mode 100644 queue-5.16/crypto-gemini-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-5.16/crypto-hisilicon-qm-cleanup-warning-in-qm_vf_read_qo.patch
 create mode 100644 queue-5.16/crypto-hisilicon-sec-fix-the-aead-software-fallback-.patch
 create mode 100644 queue-5.16/crypto-hisilicon-sec-not-need-to-enable-sm4-extra-mo.patch
 create mode 100644 queue-5.16/crypto-mxs-dcp-fix-scatterlist-processing.patch
 create mode 100644 queue-5.16/crypto-octeontx2-remove-config_dm_crypt-check.patch
 create mode 100644 queue-5.16/crypto-rockchip-ecb-does-not-need-iv.patch
 create mode 100644 queue-5.16/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-5.16/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-5.16/crypto-sun8i-ss-really-disable-hash-on-a80.patch
 create mode 100644 queue-5.16/crypto-vmx-add-missing-dependencies.patch
 create mode 100644 queue-5.16/crypto-xts-add-softdep-on-ecb.patch
 create mode 100644 queue-5.16/cxl-core-fix-cxl_probe_component_regs-error-message.patch
 create mode 100644 queue-5.16/cxl-port-hold-port-reference-until-decoder-release.patch
 create mode 100644 queue-5.16/cxl-regs-fix-size-of-cxl-capability-header-register.patch
 create mode 100644 queue-5.16/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
 create mode 100644 queue-5.16/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
 create mode 100644 queue-5.16/dma-debug-fix-return-value-of-__setup-handlers.patch
 create mode 100644 queue-5.16/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch
 create mode 100644 queue-5.16/dmaengine-idxd-change-bandwidth-token-to-read-buffer.patch
 create mode 100644 queue-5.16/dmaengine-idxd-restore-traffic-class-defaults-after-.patch
 create mode 100644 queue-5.16/driver-core-dd-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/drivers-base-memory-add-memory-block-to-memory-group.patch
 create mode 100644 queue-5.16/drivers-ethernet-cpsw-fix-panic-when-interrupt-coale.patch
 create mode 100644 queue-5.16/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
 create mode 100644 queue-5.16/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
 create mode 100644 queue-5.16/drm-amd-display-remove-vupdate_int_entry-definition.patch
 create mode 100644 queue-5.16/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch
 create mode 100644 queue-5.16/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch
 create mode 100644 queue-5.16/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
 create mode 100644 queue-5.16/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch
 create mode 100644 queue-5.16/drm-bridge-anx7625-fix-overflow-issue-on-reading-edi.patch
 create mode 100644 queue-5.16/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
 create mode 100644 queue-5.16/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch
 create mode 100644 queue-5.16/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
 create mode 100644 queue-5.16/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch
 create mode 100644 queue-5.16/drm-edid-don-t-clear-formats-if-using-deep-color.patch
 create mode 100644 queue-5.16/drm-edid-split-deep-color-modes-between-rgb-and-yuv4.patch
 create mode 100644 queue-5.16/drm-i915-display-do-not-re-enable-psr-after-it-was-m.patch
 create mode 100644 queue-5.16/drm-i915-display-fix-hpd-short-pulse-handling-for-ed.patch
 create mode 100644 queue-5.16/drm-locking-fix-drm_modeset_acquire_ctx-kernel-doc.patch
 create mode 100644 queue-5.16/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch
 create mode 100644 queue-5.16/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch
 create mode 100644 queue-5.16/drm-meson-split-out-encoder-from-meson_dw_hdmi.patch
 create mode 100644 queue-5.16/drm-msm-a6xx-fix-missing-array_size-check.patch
 create mode 100644 queue-5.16/drm-msm-dp-always-add-fail-safe-mode-into-connector-.patch
 create mode 100644 queue-5.16/drm-msm-dp-populate-connector-of-struct-dp_panel.patch
 create mode 100644 queue-5.16/drm-msm-dp-stop-link-training-after-link-training-2-.patch
 create mode 100644 queue-5.16/drm-msm-dpu-add-dspp-blocks-teardown.patch
 create mode 100644 queue-5.16/drm-msm-dpu-fix-dp-audio-condition.patch
 create mode 100644 queue-5.16/drm-msm-dsi-phy-fix-7nm-v4.0-settings-for-c-phy-mode.patch
 create mode 100644 queue-5.16/drm-msm-dsi-use-ref-fw-clock-instead-of-global-name-.patch
 create mode 100644 queue-5.16/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch
 create mode 100644 queue-5.16/drm-panfrost-check-for-error-num-after-setting-mask.patch
 create mode 100644 queue-5.16/drm-selftests-test-drm_dp_mst_helper-fix-memory-leak.patch
 create mode 100644 queue-5.16/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
 create mode 100644 queue-5.16/drm-v3d-v3d_drv-check-for-error-num-after-setting-ma.patch
 create mode 100644 queue-5.16/evm-fix-the-evm-__setup-handler-return-value.patch
 create mode 100644 queue-5.16/ext2-correct-max-file-size-computing.patch
 create mode 100644 queue-5.16/ext4-correct-cluster-len-and-clusters-changed-accoun.patch
 create mode 100644 queue-5.16/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
 create mode 100644 queue-5.16/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch
 create mode 100644 queue-5.16/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch
 create mode 100644 queue-5.16/f2fs-don-t-get-freeze-lock-in-f2fs_evict_inode-in-fr.patch
 create mode 100644 queue-5.16/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch
 create mode 100644 queue-5.16/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
 create mode 100644 queue-5.16/f2fs-fix-to-avoid-potential-deadlock.patch
 create mode 100644 queue-5.16/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch
 create mode 100644 queue-5.16/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch
 create mode 100644 queue-5.16/f2fs-use-spin_lock-to-avoid-hang.patch
 create mode 100644 queue-5.16/firmware-google-properly-state-iomem-dependency.patch
 create mode 100644 queue-5.16/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch
 create mode 100644 queue-5.16/firmware-ti_sci-fix-compilation-failure-when-config_.patch
 create mode 100644 queue-5.16/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
 create mode 100644 queue-5.16/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch
 create mode 100644 queue-5.16/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch
 create mode 100644 queue-5.16/fs-fix-fd-table-size-alignment-properly.patch
 create mode 100644 queue-5.16/fsi-aspeed-fix-a-potential-double-free.patch
 create mode 100644 queue-5.16/fsi-scom-fix-error-handling.patch
 create mode 100644 queue-5.16/fsi-scom-remove-retries-in-indirect-scoms.patch
 create mode 100644 queue-5.16/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
 create mode 100644 queue-5.16/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch
 create mode 100644 queue-5.16/habanalabs-add-check-for-pci_enable_device.patch
 create mode 100644 queue-5.16/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
 create mode 100644 queue-5.16/hv_balloon-rate-limit-unhandled-message-warning.patch
 create mode 100644 queue-5.16/hwmon-pmbus-add-mutex-to-regulator-ops.patch
 create mode 100644 queue-5.16/hwmon-pmbus-add-vin-unit-off-handling.patch
 create mode 100644 queue-5.16/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
 create mode 100644 queue-5.16/hwrng-atmel-disable-trng-on-failure-path.patch
 create mode 100644 queue-5.16/hwrng-cavium-check-health-status-while-reading-rando.patch
 create mode 100644 queue-5.16/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch
 create mode 100644 queue-5.16/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch
 create mode 100644 queue-5.16/i2c-bcm2835-fix-the-error-handling-in-bcm2835_i2c_pr.patch
 create mode 100644 queue-5.16/i2c-bcm2835-use-platform_get_irq-to-get-the-interrup.patch
 create mode 100644 queue-5.16/i2c-meson-fix-wrong-speed-use-from-probe.patch
 create mode 100644 queue-5.16/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
 create mode 100644 queue-5.16/i2c-pasemi-drop-i2c-classes-from-platform-driver-var.patch
 create mode 100644 queue-5.16/i2c-xiic-make-bus-names-unique.patch
 create mode 100644 queue-5.16/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
 create mode 100644 queue-5.16/i40e-remove-dead-stores-on-xsk-hotpath.patch
 create mode 100644 queue-5.16/i40e-respect-metadata-on-xsk-rx-to-skb.patch
 create mode 100644 queue-5.16/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
 create mode 100644 queue-5.16/ib-hfi1-allow-larger-mtu-without-aip.patch
 create mode 100644 queue-5.16/ibmvnic-fix-race-between-xmit-and-reset.patch
 create mode 100644 queue-5.16/ice-don-t-allow-to-run-ice_send_event_to_aux-in-atom.patch
 create mode 100644 queue-5.16/ice-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
 create mode 100644 queue-5.16/ice-fix-scheduling-while-atomic-on-aux-critical-err-.patch
 create mode 100644 queue-5.16/ice-respect-metadata-on-xsk-rx-to-skb.patch
 create mode 100644 queue-5.16/igb-refactor-xdp-registration.patch
 create mode 100644 queue-5.16/igc-avoid-kernel-warning-when-changing-rx-ring-param.patch
 create mode 100644 queue-5.16/igc-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
 create mode 100644 queue-5.16/iio-adc-add-check-for-devm_request_threaded_irq.patch
 create mode 100644 queue-5.16/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch
 create mode 100644 queue-5.16/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
 create mode 100644 queue-5.16/io_uring-terminate-manual-loop-iterator-loop-correct.patch
 create mode 100644 queue-5.16/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
 create mode 100644 queue-5.16/ionic-correctly-print-aq-errors-if-completions-aren-.patch
 create mode 100644 queue-5.16/ionic-don-t-send-reset-commands-if-fw-isn-t-running.patch
 create mode 100644 queue-5.16/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch
 create mode 100644 queue-5.16/ionic-fix-up-printing-of-timeout-error.patch
 create mode 100644 queue-5.16/ionic-start-watchdog-after-all-is-setup.patch
 create mode 100644 queue-5.16/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch
 create mode 100644 queue-5.16/irqchip-nvic-release-nvic_base-upon-failure.patch
 create mode 100644 queue-5.16/irqchip-qcom-pdc-fix-broken-locking.patch
 create mode 100644 queue-5.16/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
 create mode 100644 queue-5.16/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
 create mode 100644 queue-5.16/iwlwifi-mvm-align-locking-in-d3-test-debugfs.patch
 create mode 100644 queue-5.16/iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch
 create mode 100644 queue-5.16/iwlwifi-mvm-don-t-iterate-unadded-vifs-when-handling.patch
 create mode 100644 queue-5.16/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
 create mode 100644 queue-5.16/iwlwifi-pcie-fix-sw-error-msi-x-mapping.patch
 create mode 100644 queue-5.16/iwlwifi-yoyo-avoid-using-dram-data-if-allocation-fai.patch
 create mode 100644 queue-5.16/iwlwifi-yoyo-remove-dbgi_sram-address-reset-writing.patch
 create mode 100644 queue-5.16/ixgbe-don-t-reserve-excessive-xdp_packet_headroom-on.patch
 create mode 100644 queue-5.16/ixgbe-pass-bi-xdp-to-ixgbe_construct_skb_zc-directly.patch
 create mode 100644 queue-5.16/ixgbe-respect-metadata-on-xsk-rx-to-skb.patch
 create mode 100644 queue-5.16/jfs-fix-divide-error-in-dbnextag.patch
 create mode 100644 queue-5.16/kdb-fix-the-putarea-helper-function.patch
 create mode 100644 queue-5.16/kernel-resource-fix-kfree-of-bootmem-memory-again.patch
 create mode 100644 queue-5.16/keys-trusted-avoid-calling-null-function-trusted_key.patch
 create mode 100644 queue-5.16/keys-trusted-fix-trusted-key-backends-when-building-.patch
 create mode 100644 queue-5.16/kgdboc-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/kgdbts-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/kunit-make-kunit_test_timeout-compatible-with-commen.patch
 create mode 100644 queue-5.16/kvm-arm64-enable-cortex-a510-erratum-2077057-by-defa.patch
 create mode 100644 queue-5.16/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch
 create mode 100644 queue-5.16/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
 create mode 100644 queue-5.16/kvm-svm-exit-to-userspace-on-enomem-efault-ghcb-erro.patch
 create mode 100644 queue-5.16/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
 create mode 100644 queue-5.16/kvm-x86-fix-emulation-in-writing-cr8.patch
 create mode 100644 queue-5.16/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
 create mode 100644 queue-5.16/lib-test-use-after-free-in-register_test_dev_kmod.patch
 create mode 100644 queue-5.16/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch
 create mode 100644 queue-5.16/libbpf-fix-compilation-warning-due-to-mismatched-pri.patch
 create mode 100644 queue-5.16/libbpf-fix-memleak-in-libbpf_netlink_recv.patch
 create mode 100644 queue-5.16/libbpf-fix-possible-null-pointer-dereference-when-de.patch
 create mode 100644 queue-5.16/libbpf-fix-signedness-bug-in-btf_dump_array_data.patch
 create mode 100644 queue-5.16/libbpf-skip-forward-declaration-when-counting-duplic.patch
 create mode 100644 queue-5.16/libbpf-unmap-rings-when-umem-deleted.patch
 create mode 100644 queue-5.16/libbpf-use-dynamically-allocated-buffer-when-receivi.patch
 create mode 100644 queue-5.16/livepatch-fix-build-failure-on-32-bits-processors.patch
 create mode 100644 queue-5.16/locking-lockdep-iterate-lock_classes-directly-when-r.patch
 create mode 100644 queue-5.16/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
 create mode 100644 queue-5.16/lsm-general-protection-fault-in-legacy_parse_param.patch
 create mode 100644 queue-5.16/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch
 create mode 100644 queue-5.16/mac80211-limit-bandwidth-in-he-capabilities.patch
 create mode 100644 queue-5.16/mac80211-remove-a-couple-of-obsolete-todo.patch
 create mode 100644 queue-5.16/mailbox-imx-fix-crash-in-resume-on-i.mx8ulp.patch
 create mode 100644 queue-5.16/media-aspeed-correct-value-for-h-total-pixels.patch
 create mode 100644 queue-5.16/media-atmel-atmel-isc-base-report-frame-sizes-as-ful.patch
 create mode 100644 queue-5.16/media-atmel-atmel-sama7g5-isc-fix-ispck-leftover.patch
 create mode 100644 queue-5.16/media-atomisp-fix-bad-usage-at-error-handling-logic.patch
 create mode 100644 queue-5.16/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch
 create mode 100644 queue-5.16/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch
 create mode 100644 queue-5.16/media-bttv-fix-warning-regression-on-tunerless-devic.patch
 create mode 100644 queue-5.16/media-camss-csid-170-don-t-enable-unused-irqs.patch
 create mode 100644 queue-5.16/media-camss-csid-170-fix-non-10bit-formats.patch
 create mode 100644 queue-5.16/media-camss-csid-170-set-the-right-halt_cmd-when-dis.patch
 create mode 100644 queue-5.16/media-camss-vfe-170-fix-vfe-halt-timeout-error.patch
 create mode 100644 queue-5.16/media-cedrus-h264-fix-neighbour-info-buffer-size.patch
 create mode 100644 queue-5.16/media-cedrus-h265-fix-neighbour-info-buffer-size.patch
 create mode 100644 queue-5.16/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
 create mode 100644 queue-5.16/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
 create mode 100644 queue-5.16/media-em28xx-initialize-refcount-before-kref_get.patch
 create mode 100644 queue-5.16/media-hantro-fix-overfill-bottom-register-field-name.patch
 create mode 100644 queue-5.16/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
 create mode 100644 queue-5.16/media-i2c-ov5648-fix-lockdep-error.patch
 create mode 100644 queue-5.16/media-imx-imx8mq-mipi-csi2-remove-wrong-irq-config-w.patch
 create mode 100644 queue-5.16/media-imx-imx8mq-mipi_csi2-fix-system-resume.patch
 create mode 100644 queue-5.16/media-imx-jpeg-fix-a-bug-of-accessing-array-out-of-b.patch
 create mode 100644 queue-5.16/media-imx-jpeg-prevent-decoding-nv12m-jpegs-into-sin.patch
 create mode 100644 queue-5.16/media-iommu-mediatek-add-device_link-between-the-con.patch
 create mode 100644 queue-5.16/media-iommu-mediatek-return-enodev-if-the-device-is-.patch
 create mode 100644 queue-5.16/media-iommu-mediatek-v1-free-the-existed-fwspec-if-t.patch
 create mode 100644 queue-5.16/media-ir_toy-free-before-error-exiting.patch
 create mode 100644 queue-5.16/media-meson-vdec-potential-dereference-of-null-point.patch
 create mode 100644 queue-5.16/media-mexon-ge2d-fixup-frames-size-in-registers.patch
 create mode 100644 queue-5.16/media-mtk-vcodec-potential-dereference-of-null-point.patch
 create mode 100644 queue-5.16/media-ov5640-fix-set-format-v4l2_mbus_pixelcode-not-.patch
 create mode 100644 queue-5.16/media-ov5648-don-t-pack-controls-struct.patch
 create mode 100644 queue-5.16/media-ov6650-fix-set-format-try-processing-path.patch
 create mode 100644 queue-5.16/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
 create mode 100644 queue-5.16/media-saa7134-fix-incorrect-use-to-determine-if-list.patch
 create mode 100644 queue-5.16/media-staging-media-imx-imx7-mipi-csis-make-subdev-n.patch
 create mode 100644 queue-5.16/media-staging-media-zoran-calculate-the-right-buffer.patch
 create mode 100644 queue-5.16/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch
 create mode 100644 queue-5.16/media-staging-media-zoran-fix-various-v4l2-complianc.patch
 create mode 100644 queue-5.16/media-staging-media-zoran-move-videodev-alloc.patch
 create mode 100644 queue-5.16/media-stk1160-if-start-stream-fails-return-buffers-w.patch
 create mode 100644 queue-5.16/media-ti-vpe-cal-fix-a-null-pointer-dereference-in-c.patch
 create mode 100644 queue-5.16/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
 create mode 100644 queue-5.16/media-v4l-avoid-unaligned-access-warnings-when-print.patch
 create mode 100644 queue-5.16/media-v4l2-core-initialize-h264-scaling-matrix.patch
 create mode 100644 queue-5.16/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch
 create mode 100644 queue-5.16/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
 create mode 100644 queue-5.16/media-vidtv-check-for-null-return-of-vzalloc.patch
 create mode 100644 queue-5.16/memory-emif-add-check-for-setup_interrupts.patch
 create mode 100644 queue-5.16/memory-emif-check-the-pointer-temp-in-get_device_det.patch
 create mode 100644 queue-5.16/memory-tegra20-emc-correct-memory-device-mask.patch
 create mode 100644 queue-5.16/memstick-mspro_block-fix-handling-of-read-only-devic.patch
 create mode 100644 queue-5.16/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
 create mode 100644 queue-5.16/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
 create mode 100644 queue-5.16/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch
 create mode 100644 queue-5.16/mips-dec-honor-config_mips_fp_support-n.patch
 create mode 100644 queue-5.16/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch
 create mode 100644 queue-5.16/mips-rb532-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/mips-sanitise-cavium-switch-cases-in-tlb-handler-syn.patch
 create mode 100644 queue-5.16/misc-alcor_pci-fix-an-error-handling-path.patch
 create mode 100644 queue-5.16/mmc-davinci_mmc-handle-error-for-clk_enable.patch
 create mode 100644 queue-5.16/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
 create mode 100644 queue-5.16/mmc-sdhci_am654-fix-the-driver-data-of-am64-soc.patch
 create mode 100644 queue-5.16/mptcp-fix-crash-due-to-tcp_tsorted_anchor-was-initia.patch
 create mode 100644 queue-5.16/mt76-connac-fix-sta_rec_wtbl-tag-len.patch
 create mode 100644 queue-5.16/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
 create mode 100644 queue-5.16/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
 create mode 100644 queue-5.16/mt76-mt7615-fix-a-leftover-race-in-runtime-pm.patch
 create mode 100644 queue-5.16/mt76-mt76_connac-fix-mcu_ce_cmd_set_roc-definition-e.patch
 create mode 100644 queue-5.16/mt76-mt7915-fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch
 create mode 100644 queue-5.16/mt76-mt7915-fix-mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch
 create mode 100644 queue-5.16/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch
 create mode 100644 queue-5.16/mt76-mt7915-fix-the-muru-tlv-issue.patch
 create mode 100644 queue-5.16/mt76-mt7915-fix-the-nss-setting-in-bitrates.patch
 create mode 100644 queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch
 create mode 100644 queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch
 create mode 100644 queue-5.16/mt76-mt7921-do-not-always-disable-fw-runtime-pm.patch
 create mode 100644 queue-5.16/mt76-mt7921-fix-a-leftover-race-in-runtime-pm.patch
 create mode 100644 queue-5.16/mt76-mt7921-fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch
 create mode 100644 queue-5.16/mt76-mt7921-fix-mt7921_queues_acq-implementation.patch
 create mode 100644 queue-5.16/mt76-mt7921-set-edca-parameters-with-the-mcu-ce-comm.patch
 create mode 100644 queue-5.16/mt76-mt7921e-fix-possible-probe-failure-after-reboot.patch
 create mode 100644 queue-5.16/mt76-mt7921s-fix-missing-fc-type-sub-type-for-802.11.patch
 create mode 100644 queue-5.16/mt76-mt7921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch
 create mode 100644 queue-5.16/mtd-mchp23k256-add-spi-id-table.patch
 create mode 100644 queue-5.16/mtd-mchp48l640-add-spi-id-table.patch
 create mode 100644 queue-5.16/mtd-onenand-check-for-error-irq.patch
 create mode 100644 queue-5.16/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
 create mode 100644 queue-5.16/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
 create mode 100644 queue-5.16/mtd-rawnand-pl353-set-the-nand-chip-node-as-the-flas.patch
 create mode 100644 queue-5.16/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
 create mode 100644 queue-5.16/net-asix-add-proper-error-handling-of-usb-read-error.patch
 create mode 100644 queue-5.16/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch
 create mode 100644 queue-5.16/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
 create mode 100644 queue-5.16/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
 create mode 100644 queue-5.16/net-dsa-fix-panic-on-shutdown-if-multi-chip-tree-fai.patch
 create mode 100644 queue-5.16/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
 create mode 100644 queue-5.16/net-dsa-realtek-smi-fix-kdoc-warnings.patch
 create mode 100644 queue-5.16/net-dsa-realtek-smi-move-to-subdirectory.patch
 create mode 100644 queue-5.16/net-enetc-allocate-cbd-ring-data-memory-using-dma-co.patch
 create mode 100644 queue-5.16/net-enetc-report-software-timestamping-via-so_timest.patch
 create mode 100644 queue-5.16/net-hns3-add-vlan-list-lock-to-protect-vlan-list.patch
 create mode 100644 queue-5.16/net-hns3-clean-residual-vf-config-after-disable-srio.patch
 create mode 100644 queue-5.16/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch
 create mode 100644 queue-5.16/net-hns3-fix-port-base-vlan-add-fail-when-concurrent.patch
 create mode 100644 queue-5.16/net-hns3-format-the-output-of-the-mac-address.patch
 create mode 100644 queue-5.16/net-hns3-refine-the-process-when-pf-set-vf-vlan.patch
 create mode 100644 queue-5.16/net-phy-at803x-move-page-selection-fix-to-config_ini.patch
 create mode 100644 queue-5.16/net-phy-broadcom-fix-brcm_fet_config_init.patch
 create mode 100644 queue-5.16/net-phy-micrel-fix-concurrent-register-access.patch
 create mode 100644 queue-5.16/net-prefer-nf_ct_put-instead-of-nf_conntrack_put.patch
 create mode 100644 queue-5.16/net-sched-act_ct-fix-ref-leak-when-switching-zones.patch
 create mode 100644 queue-5.16/net-sparx5-depends-on-ptp_1588_clock_optional.patch
 create mode 100644 queue-5.16/net-sparx5-switchdev-fix-possible-null-pointer-deref.patch
 create mode 100644 queue-5.16/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
 create mode 100644 queue-5.16/netfilter-conntrack-add-and-use-nf_ct_set_auto_assig.patch
 create mode 100644 queue-5.16/netfilter-egress-report-interface-as-outgoing.patch
 create mode 100644 queue-5.16/netfilter-flowtable-fix-qinq-and-pppoe-support-for-i.patch
 create mode 100644 queue-5.16/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
 create mode 100644 queue-5.16/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
 create mode 100644 queue-5.16/nfs-don-t-loop-forever-in-nfs_do_recoalesce.patch
 create mode 100644 queue-5.16/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
 create mode 100644 queue-5.16/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
 create mode 100644 queue-5.16/nfs-use-of-mapping_set_error-results-in-spurious-err.patch
 create mode 100644 queue-5.16/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch
 create mode 100644 queue-5.16/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch
 create mode 100644 queue-5.16/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
 create mode 100644 queue-5.16/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
 create mode 100644 queue-5.16/ntfs-add-sanity-check-on-allocation-size.patch
 create mode 100644 queue-5.16/nvdimm-region-fix-default-alignment-for-small-region.patch
 create mode 100644 queue-5.16/nvme-cleanup-__nvme_check_ids.patch
 create mode 100644 queue-5.16/nvme-fix-the-check-for-duplicate-unique-identifiers.patch
 create mode 100644 queue-5.16/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch
 create mode 100644 queue-5.16/octeontx2-af-initialize-action-variable.patch
 create mode 100644 queue-5.16/openvswitch-always-update-flow-key-after-nat.patch
 create mode 100644 queue-5.16/parisc-fix-handling-off-probe-non-access-faults.patch
 create mode 100644 queue-5.16/parisc-fix-non-access-data-tlb-cache-flush-faults.patch
 create mode 100644 queue-5.16/pci-aardvark-fix-reading-msi-interrupt-number.patch
 create mode 100644 queue-5.16/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
 create mode 100644 queue-5.16/pci-avoid-broken-msi-on-sb600-usb-devices.patch
 create mode 100644 queue-5.16/pci-reduce-warnings-on-possible-rw1c-corruption.patch
 create mode 100644 queue-5.16/perf-core-fix-address-filter-parser-for-multiple-fil.patch
 create mode 100644 queue-5.16/perf-stat-fix-forked-applications-enablement-of-coun.patch
 create mode 100644 queue-5.16/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
 create mode 100644 queue-5.16/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
 create mode 100644 queue-5.16/phy-phy-brcm-usb-fixup-bcm4908-support.patch
 create mode 100644 queue-5.16/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
 create mode 100644 queue-5.16/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
 create mode 100644 queue-5.16/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch
 create mode 100644 queue-5.16/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
 create mode 100644 queue-5.16/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch
 create mode 100644 queue-5.16/pinctrl-microchip-sgpio-lock-rmw-access.patch
 create mode 100644 queue-5.16/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
 create mode 100644 queue-5.16/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
 create mode 100644 queue-5.16/pinctrl-renesas-checker-fix-miscalculation-of-number.patch
 create mode 100644 queue-5.16/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
 create mode 100644 queue-5.16/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
 create mode 100644 queue-5.16/pinctrl-samsung-remove-eint-handler-for-exynos850-al.patch
 create mode 100644 queue-5.16/platform-x86-huawei-wmi-check-the-return-value-of-de.patch
 create mode 100644 queue-5.16/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
 create mode 100644 queue-5.16/pm-hibernate-fix-__setup-handler-error-handling.patch
 create mode 100644 queue-5.16/pm-suspend-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/power-ab8500_chargalg-use-clock_monotonic.patch
 create mode 100644 queue-5.16/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
 create mode 100644 queue-5.16/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
 create mode 100644 queue-5.16/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
 create mode 100644 queue-5.16/power-supply-sbs-charger-don-t-cancel-work-that-is-n.patch
 create mode 100644 queue-5.16/power-supply-wm8350-power-add-missing-free-in-free_c.patch
 create mode 100644 queue-5.16/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
 create mode 100644 queue-5.16/powercap-dtpm_cpu-reset-per_cpu-variable-in-the-rele.patch
 create mode 100644 queue-5.16/powerpc-64s-don-t-use-dsisr-for-slb-faults.patch
 create mode 100644 queue-5.16/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
 create mode 100644 queue-5.16/powerpc-dts-t1040rdb-fix-ports-names-for-seville-eth.patch
 create mode 100644 queue-5.16/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
 create mode 100644 queue-5.16/powerpc-mm-numa-skip-numa_no_node-onlining-in-parse_.patch
 create mode 100644 queue-5.16/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
 create mode 100644 queue-5.16/powerpc-pseries-fix-use-after-free-in-remove_phb_dyn.patch
 create mode 100644 queue-5.16/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
 create mode 100644 queue-5.16/pps-clients-gpio-propagate-return-value-from-pps_gpi.patch
 create mode 100644 queue-5.16/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
 create mode 100644 queue-5.16/ptp-unregister-virtual-clocks-when-unregistering-phy.patch
 create mode 100644 queue-5.16/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
 create mode 100644 queue-5.16/qlcnic-dcb-default-to-returning-eopnotsupp.patch
 create mode 100644 queue-5.16/ray_cs-check-ioremap-return-value.patch
 create mode 100644 queue-5.16/rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch
 create mode 100644 queue-5.16/rcu-mark-writes-to-the-rcu_segcblist-structure-s-fla.patch
 create mode 100644 queue-5.16/rdma-core-fix-ib_qp_usecnt_dec-called-when-error.patch
 create mode 100644 queue-5.16/rdma-core-set-mr-type-in-ib_reg_user_mr.patch
 create mode 100644 queue-5.16/rdma-irdma-fix-netdev-notifications-for-vlan-s.patch
 create mode 100644 queue-5.16/rdma-irdma-fix-passthrough-mode-in-vm.patch
 create mode 100644 queue-5.16/rdma-irdma-prevent-some-integer-underflows.patch
 create mode 100644 queue-5.16/rdma-irdma-remove-incorrect-masking-of-pd.patch
 create mode 100644 queue-5.16/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
 create mode 100644 queue-5.16/rdma-mlx5-fix-the-flow-of-a-miss-in-the-allocation-o.patch
 create mode 100644 queue-5.16/rdma-nldev-prevent-underflow-in-nldev_stat_set_count.patch
 create mode 100644 queue-5.16/rdma-rxe-change-variable-and-function-argument-to-pr.patch
 create mode 100644 queue-5.16/rdma-rxe-check-the-last-packet-by-rxe_end_mask.patch
 create mode 100644 queue-5.16/rdma-rxe-fix-ref-error-in-rxe_av.c.patch
 create mode 100644 queue-5.16/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
 create mode 100644 queue-5.16/regulator-rpi-panel-handle-i2c-errors-timing-to-the-.patch
 create mode 100644 queue-5.16/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
 create mode 100644 queue-5.16/remoteproc-qcom_q6v5_mss-fix-some-leaks-in-q6v5_allo.patch
 create mode 100644 queue-5.16/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
 create mode 100644 queue-5.16/revert-rdma-core-fix-ib_qp_usecnt_dec-called-when-er.patch
 create mode 100644 queue-5.16/revert-revert-block-bfq-honor-already-setup-queue-me.patch
 create mode 100644 queue-5.16/rseq-remove-broken-uapi-field-layout-on-32-bit-littl.patch
 create mode 100644 queue-5.16/samples-bpf-xdpsock-fix-race-when-running-for-fix-du.patch
 create mode 100644 queue-5.16/sched-core-export-pelt_thermal_tp.patch
 create mode 100644 queue-5.16/sched-cpuacct-fix-charge-percpu-cpuusage.patch
 create mode 100644 queue-5.16/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
 create mode 100644 queue-5.16/sched-fair-improve-consistency-of-allowed-numa-balan.patch
 create mode 100644 queue-5.16/sched-rt-plug-rt_mutex_setprio-vs-push_rt_task-race.patch
 create mode 100644 queue-5.16/sched-tracing-don-t-re-read-p-state-when-emitting-sc.patch
 create mode 100644 queue-5.16/sched-tracing-report-task_rtlock_wait-tasks-as-task_.patch
 create mode 100644 queue-5.16/sched-uclamp-fix-iowait-boost-escaping-uclamp-restri.patch
 create mode 100644 queue-5.16/scripts-dtc-call-pkg-config-posixly-correct.patch
 create mode 100644 queue-5.16/scsi-fnic-fix-a-tracing-statement.patch
 create mode 100644 queue-5.16/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
 create mode 100644 queue-5.16/scsi-mpt3sas-fix-incorrect-4gb-boundary-check.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-abort-all-task-initialization.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch-2702
 create mode 100644 queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_set_s.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-ncq-non-data-command-completion-hand.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-ncq-non-data-command-task-initializa.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_enc.patch
 create mode 100644 queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
 create mode 100644 queue-5.16/security-add-sctp_assoc_established-hook.patch
 create mode 100644 queue-5.16/security-implement-sctp_assoc_established-hook-in-se.patch
 create mode 100644 queue-5.16/selftests-bpf-extract-syscall-wrapper.patch
 create mode 100644 queue-5.16/selftests-bpf-fix-bind-on-used-port.patch
 create mode 100644 queue-5.16/selftests-bpf-fix-error-reporting-from-sock_fields-p.patch
 create mode 100644 queue-5.16/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
 create mode 100644 queue-5.16/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
 create mode 100644 queue-5.16/selftests-bpf-test_xdp_redirect_multi-use-temp-netns.patch
 create mode 100644 queue-5.16/selftests-bpf-use-__se_-prefix-on-architectures-with.patch
 create mode 100644 queue-5.16/selftests-lkdtm-add-ubsan-config.patch
 create mode 100644 queue-5.16/selftests-mptcp-add-csum-mib-check-for-mptcp_connect.patch
 create mode 100644 queue-5.16/selftests-net-timestamping-fix-bind_phc-check.patch
 create mode 100644 queue-5.16/selftests-sgx-treat-cc-as-one-argument.patch
 create mode 100644 queue-5.16/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
 create mode 100644 queue-5.16/selftests-tls-skip-cmsg_to_pipe-tests-with-tls-n.patch
 create mode 100644 queue-5.16/selftests-x86-add-validity-check-and-allow-field-spl.patch
 create mode 100644 queue-5.16/selftests-x86-fix-how-check_cc.sh-is-being-invoked.patch
 create mode 100644 queue-5.16/selftests-xsk-fix-rx_full-stats-test.patch
 create mode 100644 queue-5.16/selinux-access-superblock_security_struct-in-lsm-blo.patch
 create mode 100644 queue-5.16/selinux-allow-fioclex-and-fionclex-with-policy-capab.patch
 create mode 100644 queue-5.16/selinux-check-return-value-of-sel_make_avc_files.patch
 create mode 100644 queue-5.16/selinux-fix-selinux_sb_mnt_opts_compat.patch
 create mode 100644 queue-5.16/selinux-use-correct-type-for-context-length.patch
 create mode 100644 queue-5.16/serial-8250-fix-race-condition-in-rts-after-send-han.patch
 create mode 100644 queue-5.16/serial-8250-fix-xoff-xon-sending-when-dma-is-used.patch
 create mode 100644 queue-5.16/serial-8250_aspeed_vuart-add-port_aspeed_vuart-port-.patch
 create mode 100644 queue-5.16/serial-8250_lpss-balance-reference-count-for-pci-dma.patch
 create mode 100644 queue-5.16/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
 create mode 100644 queue-5.16/soc-mediatek-pm-domains-add-wakeup-capacity-support-.patch
 create mode 100644 queue-5.16/soc-qcom-aoss-fix-missing-put_device-call-in-qmp_get.patch
 create mode 100644 queue-5.16/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
 create mode 100644 queue-5.16/soc-qcom-ocmem-fix-missing-put_device-call-in-of_get.patch
 create mode 100644 queue-5.16/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
 create mode 100644 queue-5.16/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
 create mode 100644 queue-5.16/soundwire-intel-fix-wrong-register-name-in-intel_shi.patch
 create mode 100644 queue-5.16/spi-fsi-implement-a-timeout-for-polling-status.patch
 create mode 100644 queue-5.16/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
 create mode 100644 queue-5.16/spi-spi-zynqmp-gqspi-handle-error-for-dma_set_mask.patch
 create mode 100644 queue-5.16/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
 create mode 100644 queue-5.16/spi-tegra20-use-of_device_get_match_data.patch
 create mode 100644 queue-5.16/spi-tegra210-quad-fix-missin-irq-check-in-tegra_qspi.patch
 create mode 100644 queue-5.16/stack-constrain-and-fix-stack-offset-randomization-w.patch
 create mode 100644 queue-5.16/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
 create mode 100644 queue-5.16/staging-mt7621-dts-fix-formatting.patch
 create mode 100644 queue-5.16/staging-mt7621-dts-fix-gb-pc2-devicetree.patch
 create mode 100644 queue-5.16/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
 create mode 100644 queue-5.16/staging-mt7621-dts-fix-pinctrl-properties-for-ethern.patch
 create mode 100644 queue-5.16/staging-qlge-add-unregister_netdev-in-qlge_probe.patch
 create mode 100644 queue-5.16/staging-r8188eu-convert-dbg_88e_level-call-in-hal-rt.patch
 create mode 100644 queue-5.16/staging-r8188eu-fix-endless-loop-in-recv_func.patch
 create mode 100644 queue-5.16/staging-r8188eu-release_firmware-is-not-called-if-al.patch
 create mode 100644 queue-5.16/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch
 create mode 100644 queue-5.16/sunrpc-don-t-call-connect-more-than-once-on-a-tcp-so.patch
 create mode 100644 queue-5.16/sunrpc-don-t-resend-a-task-on-an-offlined-transport.patch
 create mode 100644 queue-5.16/sunrpc-improve-swap-handling-scheduling-and-pf_memal.patch
 create mode 100644 queue-5.16/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
 create mode 100644 queue-5.16/thermal-int340x-check-for-null-after-calling-kmemdup.patch
 create mode 100644 queue-5.16/tipc-fix-the-timer-expires-after-interval-100ms.patch
 create mode 100644 queue-5.16/tomoyo-fix-__setup-handlers-return-values.patch
 create mode 100644 queue-5.16/tools-testing-cxl-fix-root-port-to-host-bridge-assig.patch
 create mode 100644 queue-5.16/tracing-have-trace_define_enum-affect-trace-event-ty.patch
 create mode 100644 queue-5.16/tty-hvc-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.16/uaccess-fix-nios2-and-microblaze-get_user_8.patch
 create mode 100644 queue-5.16/uaccess-fix-type-mismatch-warnings-from-access_ok.patch
 create mode 100644 queue-5.16/udmabuf-validate-ubuf-pagecount.patch
 create mode 100644 queue-5.16/usb-gadget-eliminate-anonymous-module_init-module_ex.patch
 create mode 100644 queue-5.16/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
 create mode 100644 queue-5.16/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
 create mode 100644 queue-5.16/vfio-pci-fix-memory-leak-during-d3hot-to-d0-transiti.patch
 create mode 100644 queue-5.16/vfio-pci-wake-up-devices-around-reset-functions.patch
 create mode 100644 queue-5.16/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
 create mode 100644 queue-5.16/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
 create mode 100644 queue-5.16/video-fbdev-controlfb-fix-compile_test-build.patch
 create mode 100644 queue-5.16/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
 create mode 100644 queue-5.16/video-fbdev-matroxfb-set-maxvram-of-vbg200ew-to-the-.patch
 create mode 100644 queue-5.16/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
 create mode 100644 queue-5.16/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
 create mode 100644 queue-5.16/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
 create mode 100644 queue-5.16/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
 create mode 100644 queue-5.16/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
 create mode 100644 queue-5.16/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
 create mode 100644 queue-5.16/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
 create mode 100644 queue-5.16/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
 create mode 100644 queue-5.16/video-fbdev-w100fb-reset-global-state.patch
 create mode 100644 queue-5.16/virt-acrn-fix-a-memory-leak-in-acrn_dev_ioctl.patch
 create mode 100644 queue-5.16/virt-acrn-obtain-pa-from-vma-with-pfnmap-flag.patch
 create mode 100644 queue-5.16/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
 create mode 100644 queue-5.16/vsock-virtio-enable-vqs-early-on-probe.patch
 create mode 100644 queue-5.16/vsock-virtio-initialize-vdev-priv-before-using-vqs.patch
 create mode 100644 queue-5.16/vsock-virtio-read-the-negotiated-features-before-usi.patch
 create mode 100644 queue-5.16/vsprintf-fix-pk-with-kptr_restrict-0.patch
 create mode 100644 queue-5.16/vsprintf-fix-potential-unaligned-access.patch
 create mode 100644 queue-5.16/vxcan-enable-local-echo-for-sent-can-frames.patch
 create mode 100644 queue-5.16/watch_queue-actually-free-the-watch.patch
 create mode 100644 queue-5.16/watch_queue-fix-null-dereference-in-error-cleanup.patch
 create mode 100644 queue-5.16/xen-fix-is_xen_pmu.patch
 create mode 100644 queue-5.16/xsk-fix-race-at-socket-teardown.patch
 create mode 100644 queue-5.16/xtensa-add-missing-xchal_have_windowed-check.patch

diff --git a/queue-5.16/acpi-apei-fix-return-value-of-__setup-handlers.patch b/queue-5.16/acpi-apei-fix-return-value-of-__setup-handlers.patch
new file mode 100644
index 00000000000..a8e01d4f6fb
--- /dev/null
+++ b/queue-5.16/acpi-apei-fix-return-value-of-__setup-handlers.patch
@@ -0,0 +1,86 @@
+From 0ce08ce12e303f0f8dab39c7232f5a48b5965a4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 18:46:20 -0800
+Subject: ACPI: APEI: fix return value of __setup handlers
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f3303ff649dbf7dcdc6a6e1a922235b12b3028f4 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled. Returning 0 causes a boot option to be listed in
+the Unknown kernel command line parameters and also added to init's
+arg list (if no '=' sign) or environment list (if of the form 'a=b').
+
+Unknown kernel command line parameters "erst_disable
+  bert_disable hest_disable BOOT_IMAGE=/boot/bzImage-517rc6", will be
+  passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+     erst_disable
+     bert_disable
+     hest_disable
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc6
+
+Fixes: a3e2acc5e37b ("ACPI / APEI: Add Boot Error Record Table (BERT) support")
+Fixes: a08f82d08053 ("ACPI, APEI, Error Record Serialization Table (ERST) support")
+Fixes: 9dc966641677 ("ACPI, APEI, HEST table parsing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Reviewed-by: "Huang, Ying" <ying.huang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/bert.c | 2 +-
+ drivers/acpi/apei/erst.c | 2 +-
+ drivers/acpi/apei/hest.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c
+index 19e50fcbf4d6..86211422f4ee 100644
+--- a/drivers/acpi/apei/bert.c
++++ b/drivers/acpi/apei/bert.c
+@@ -77,7 +77,7 @@ static int __init setup_bert_disable(char *str)
+ {
+ 	bert_disable = 1;
+ 
+-	return 0;
++	return 1;
+ }
+ __setup("bert_disable", setup_bert_disable);
+ 
+diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
+index 242f3c2d5533..698d67cee052 100644
+--- a/drivers/acpi/apei/erst.c
++++ b/drivers/acpi/apei/erst.c
+@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear);
+ static int __init setup_erst_disable(char *str)
+ {
+ 	erst_disable = 1;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("erst_disable", setup_erst_disable);
+diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
+index 0edc1ed47673..6aef1ee5e1bd 100644
+--- a/drivers/acpi/apei/hest.c
++++ b/drivers/acpi/apei/hest.c
+@@ -224,7 +224,7 @@ static int __init hest_ghes_dev_register(unsigned int ghes_count)
+ static int __init setup_hest_disable(char *str)
+ {
+ 	hest_disable = HEST_DISABLED;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("hest_disable", setup_hest_disable);
+-- 
+2.34.1
+
diff --git a/queue-5.16/acpi-apei-limit-printable-size-of-bert-table-data.patch b/queue-5.16/acpi-apei-limit-printable-size-of-bert-table-data.patch
new file mode 100644
index 00000000000..d41d4760cad
--- /dev/null
+++ b/queue-5.16/acpi-apei-limit-printable-size-of-bert-table-data.patch
@@ -0,0 +1,72 @@
+From 2bef094d7b6e0361f5a30f09e620bd7687374629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 10:50:48 -0800
+Subject: ACPI/APEI: Limit printable size of BERT table data
+
+From: Darren Hart <darren@os.amperecomputing.com>
+
+[ Upstream commit 3f8dec116210ca649163574ed5f8df1e3b837d07 ]
+
+Platforms with large BERT table data can trigger soft lockup errors
+while attempting to print the entire BERT table data to the console at
+boot:
+
+  watchdog: BUG: soft lockup - CPU#160 stuck for 23s! [swapper/0:1]
+
+Observed on Ampere Altra systems with a single BERT record of ~250KB.
+
+The original bert driver appears to have assumed relatively small table
+data. Since it is impractical to reassemble large table data from
+interwoven console messages, and the table data is available in
+
+  /sys/firmware/acpi/tables/data/BERT
+
+limit the size for tables printed to the console to 1024 (for no reason
+other than it seemed like a good place to kick off the discussion, would
+appreciate feedback from existing users in terms of what size would
+maintain their current usage model).
+
+Alternatively, we could make printing a CONFIG option, use the
+bert_disable boot arg (or something similar), or use a debug log level.
+However, all those solutions require extra steps or change the existing
+behavior for small table data. Limiting the size preserves existing
+behavior on existing platforms with small table data, and eliminates the
+soft lockups for platforms with large table data, while still making it
+available.
+
+Signed-off-by: Darren Hart <darren@os.amperecomputing.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/bert.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c
+index 86211422f4ee..598fd19b65fa 100644
+--- a/drivers/acpi/apei/bert.c
++++ b/drivers/acpi/apei/bert.c
+@@ -29,6 +29,7 @@
+ 
+ #undef pr_fmt
+ #define pr_fmt(fmt) "BERT: " fmt
++#define ACPI_BERT_PRINT_MAX_LEN 1024
+ 
+ static int bert_disable;
+ 
+@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region,
+ 		}
+ 
+ 		pr_info_once("Error records from previous boot:\n");
+-
+-		cper_estatus_print(KERN_INFO HW_ERR, estatus);
++		if (region_len < ACPI_BERT_PRINT_MAX_LEN)
++			cper_estatus_print(KERN_INFO HW_ERR, estatus);
++		else
++			pr_info_once("Max print length exceeded, table data is available at:\n"
++				     "/sys/firmware/acpi/tables/data/BERT");
+ 
+ 		/*
+ 		 * Because the boot error source is "one-time polled" type,
+-- 
+2.34.1
+
diff --git a/queue-5.16/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch b/queue-5.16/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
new file mode 100644
index 00000000000..e477aa5d243
--- /dev/null
+++ b/queue-5.16/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
@@ -0,0 +1,44 @@
+From 15c13e46a3d5b0b0a968371e52c1e3d2ea2d72db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 20:28:26 +0100
+Subject: ACPICA: Avoid walking the ACPI Namespace if it is not there
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 0c9992315e738e7d6e927ef36839a466b080dba6 ]
+
+ACPICA commit b1c3656ef4950098e530be68d4b589584f06cddc
+
+Prevent acpi_ns_walk_namespace() from crashing when called with
+start_node equal to ACPI_ROOT_OBJECT if the Namespace has not been
+instantiated yet and acpi_gbl_root_node is NULL.
+
+For instance, this can happen if the kernel is run with "acpi=off"
+in the command line.
+
+Link: https://github.com/acpica/acpica/commit/b1c3656ef4950098e530be68d4b589584f06cddc
+Link: https://lore.kernel.org/linux-acpi/CAJZ5v0hJWW_vZ3wwajE7xT38aWjY7cZyvqMJpXHzUL98-SiCVQ@mail.gmail.com/
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/nswalk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
+index 915c2433463d..e7c30ce06e18 100644
+--- a/drivers/acpi/acpica/nswalk.c
++++ b/drivers/acpi/acpica/nswalk.c
+@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type,
+ 
+ 	if (start_node == ACPI_ROOT_OBJECT) {
+ 		start_node = acpi_gbl_root_node;
++		if (!start_node) {
++			return_ACPI_STATUS(AE_NO_NAMESPACE);
++		}
+ 	}
+ 
+ 	/* Null child means "get first node" */
+-- 
+2.34.1
+
diff --git a/queue-5.16/adjust-cifssb-maximum-read-size.patch b/queue-5.16/adjust-cifssb-maximum-read-size.patch
new file mode 100644
index 00000000000..51bf12ba13f
--- /dev/null
+++ b/queue-5.16/adjust-cifssb-maximum-read-size.patch
@@ -0,0 +1,71 @@
+From d6af33640540efc16398141cf89cf7ab142b22c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 18:37:22 +0000
+Subject: Adjust cifssb maximum read size
+
+From: Rohith Surabattula <rohiths@microsoft.com>
+
+[ Upstream commit 06a466565d54a1a42168f9033a062a3f5c40e73b ]
+
+When session gets reconnected during mount then read size in super block fs context
+gets set to zero and after negotiate, rsize is not modified which results in
+incorrect read with requested bytes as zero. Fixes intermittent failure
+of xfstest generic/240
+
+Note that stable requires a different version of this patch which will be
+sent to the stable mailing list.
+
+Signed-off-by: Rohith Surabattula <rohiths@microsoft.com>
+Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsfs.c |  3 +++
+ fs/cifs/file.c   | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 9dd5f89557b7..02b762b7e3fd 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -209,6 +209,9 @@ cifs_read_super(struct super_block *sb)
+ 	if (rc)
+ 		goto out_no_root;
+ 	/* tune readahead according to rsize if readahead size not set on mount */
++	if (cifs_sb->ctx->rsize == 0)
++		cifs_sb->ctx->rsize =
++			tcon->ses->server->ops->negotiate_rsize(tcon, cifs_sb->ctx);
+ 	if (cifs_sb->ctx->rasize)
+ 		sb->s_bdi->ra_pages = cifs_sb->ctx->rasize / PAGE_SIZE;
+ 	else
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 9fee3af83a73..abadc2f86dea 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3734,6 +3734,11 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
+ 				break;
+ 		}
+ 
++		if (cifs_sb->ctx->rsize == 0)
++			cifs_sb->ctx->rsize =
++				server->ops->negotiate_rsize(tlink_tcon(open_file->tlink),
++							     cifs_sb->ctx);
++
+ 		rc = server->ops->wait_mtu_credits(server, cifs_sb->ctx->rsize,
+ 						   &rsize, credits);
+ 		if (rc)
+@@ -4512,6 +4517,11 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ 				break;
+ 		}
+ 
++		if (cifs_sb->ctx->rsize == 0)
++			cifs_sb->ctx->rsize =
++				server->ops->negotiate_rsize(tlink_tcon(open_file->tlink),
++							     cifs_sb->ctx);
++
+ 		rc = server->ops->wait_mtu_credits(server, cifs_sb->ctx->rsize,
+ 						   &rsize, credits);
+ 		if (rc)
+-- 
+2.34.1
+
diff --git a/queue-5.16/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch b/queue-5.16/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
new file mode 100644
index 00000000000..402bfe1bedc
--- /dev/null
+++ b/queue-5.16/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
@@ -0,0 +1,62 @@
+From 6e4ed52c219c18d47e8717345f6f6d6345b8f269 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 15:53:06 +0100
+Subject: af_netlink: Fix shift out of bounds in group mask calculation
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 0caf6d9922192dd1afa8dc2131abfb4df1443b9f ]
+
+When a netlink message is received, netlink_recvmsg() fills in the address
+of the sender. One of the fields is the 32-bit bitfield nl_groups, which
+carries the multicast group on which the message was received. The least
+significant bit corresponds to group 1, and therefore the highest group
+that the field can represent is 32. Above that, the UB sanitizer flags the
+out-of-bounds shift attempts.
+
+Which bits end up being set in such case is implementation defined, but
+it's either going to be a wrong non-zero value, or zero, which is at least
+not misleading. Make the latter choice deterministic by always setting to 0
+for higher-numbered multicast groups.
+
+To get information about membership in groups >= 32, userspace is expected
+to use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO
+socket option.
+[0] https://lwn.net/Articles/147608/
+
+The way to trigger this issue is e.g. through monitoring the BRVLAN group:
+
+	# bridge monitor vlan &
+	# ip link add name br type bridge
+
+Which produces the following citation:
+
+	UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19
+	shift exponent 32 is too large for 32-bit type 'int'
+
+Fixes: f7fa9b10edbb ("[NETLINK]: Support dynamic number of multicast groups per netlink family")
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/2bef6aabf201d1fc16cca139a744700cff9dcb04.1647527635.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 9eba2e648385..6fbc3ea735e5 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -157,6 +157,8 @@ EXPORT_SYMBOL(do_trace_netlink_extack);
+ 
+ static inline u32 netlink_group_mask(u32 group)
+ {
++	if (group > 32)
++		return 0;
+ 	return group ? 1 << (group - 1) : 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/af_unix-fix-some-data-races-around-unix_sk-sk-oob_sk.patch b/queue-5.16/af_unix-fix-some-data-races-around-unix_sk-sk-oob_sk.patch
new file mode 100644
index 00000000000..ff98691a5da
--- /dev/null
+++ b/queue-5.16/af_unix-fix-some-data-races-around-unix_sk-sk-oob_sk.patch
@@ -0,0 +1,109 @@
+From cd532be24c38a8e681567efc8493f863e9e9dcf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 12:08:08 +0900
+Subject: af_unix: Fix some data-races around unix_sk(sk)->oob_skb.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
+
+[ Upstream commit e82025c623e2bf04d162bafceb66a59115814479 ]
+
+Out-of-band data automatically places a "mark" showing wherein the
+sequence the out-of-band data would have been.  If the out-of-band data
+implies cancelling everything sent so far, the "mark" is helpful to flush
+them.  When the socket's read pointer reaches the "mark", the ioctl() below
+sets a non zero value to the arg `atmark`:
+
+The out-of-band data is queued in sk->sk_receive_queue as well as ordinary
+data and also saved in unix_sk(sk)->oob_skb.  It can be used to test if the
+head of the receive queue is the out-of-band data meaning the socket is at
+the "mark".
+
+While testing that, unix_ioctl() reads unix_sk(sk)->oob_skb locklessly.
+Thus, all accesses to oob_skb need some basic protection to avoid
+load/store tearing which KCSAN detects when these are called concurrently:
+
+  - ioctl(fd_a, SIOCATMARK, &atmark, sizeof(atmark))
+  - send(fd_b_connected_to_a, buf, sizeof(buf), MSG_OOB)
+
+BUG: KCSAN: data-race in unix_ioctl / unix_stream_sendmsg
+
+write to 0xffff888003d9cff0 of 8 bytes by task 175 on cpu 1:
+ unix_stream_sendmsg (net/unix/af_unix.c:2087 net/unix/af_unix.c:2191)
+ sock_sendmsg (net/socket.c:705 net/socket.c:725)
+ __sys_sendto (net/socket.c:2040)
+ __x64_sys_sendto (net/socket.c:2048)
+ do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
+ entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:113)
+
+read to 0xffff888003d9cff0 of 8 bytes by task 176 on cpu 0:
+ unix_ioctl (net/unix/af_unix.c:3101 (discriminator 1))
+ sock_do_ioctl (net/socket.c:1128)
+ sock_ioctl (net/socket.c:1242)
+ __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:874 fs/ioctl.c:860 fs/ioctl.c:860)
+ do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
+ entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:113)
+
+value changed: 0xffff888003da0c00 -> 0xffff888003da0d00
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 176 Comm: unix_race_oob_i Not tainted 5.17.0-rc5-59529-g83dc4c2af682 #12
+Hardware name: Red Hat KVM, BIOS 1.11.0-2.amzn2 04/01/2014
+
+Fixes: 314001f0bf92 ("af_unix: Add OOB support")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/af_unix.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index b0bfc78e421c..826ac391a7a4 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1996,7 +1996,7 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other
+ 	if (ousk->oob_skb)
+ 		consume_skb(ousk->oob_skb);
+ 
+-	ousk->oob_skb = skb;
++	WRITE_ONCE(ousk->oob_skb, skb);
+ 
+ 	scm_stat_add(other, skb);
+ 	skb_queue_tail(&other->sk_receive_queue, skb);
+@@ -2514,9 +2514,8 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)
+ 
+ 	oob_skb = u->oob_skb;
+ 
+-	if (!(state->flags & MSG_PEEK)) {
+-		u->oob_skb = NULL;
+-	}
++	if (!(state->flags & MSG_PEEK))
++		WRITE_ONCE(u->oob_skb, NULL);
+ 
+ 	unix_state_unlock(sk);
+ 
+@@ -2551,7 +2550,7 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
+ 				skb = NULL;
+ 			} else if (sock_flag(sk, SOCK_URGINLINE)) {
+ 				if (!(flags & MSG_PEEK)) {
+-					u->oob_skb = NULL;
++					WRITE_ONCE(u->oob_skb, NULL);
+ 					consume_skb(skb);
+ 				}
+ 			} else if (!(flags & MSG_PEEK)) {
+@@ -3006,11 +3005,10 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ 	case SIOCATMARK:
+ 		{
+ 			struct sk_buff *skb;
+-			struct unix_sock *u = unix_sk(sk);
+ 			int answ = 0;
+ 
+ 			skb = skb_peek(&sk->sk_receive_queue);
+-			if (skb && skb == u->oob_skb)
++			if (skb && skb == READ_ONCE(unix_sk(sk)->oob_skb))
+ 				answ = 1;
+ 			err = put_user(answ, (int __user *)arg);
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch b/queue-5.16/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
new file mode 100644
index 00000000000..ae68196765a
--- /dev/null
+++ b/queue-5.16/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
@@ -0,0 +1,84 @@
+From 7f363cc556517f5774ec0ef29c2655cb0c602e1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 21:56:47 +0900
+Subject: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred
+ transaction
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ]
+
+AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA:
+firewire-lib: Add support for deferred transaction") while 'deferrable'
+flag can be uninitialized for non-control/notify AV/C transactions.
+UBSAN reports it:
+
+kernel: ================================================================================
+kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9
+kernel: load of value 158 is not a valid value for type '_Bool'
+kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P           OE     5.15.0-18-generic #18-Ubuntu
+kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019
+kernel: Call Trace:
+kernel:  <IRQ>
+kernel:  show_stack+0x52/0x58
+kernel:  dump_stack_lvl+0x4a/0x5f
+kernel:  dump_stack+0x10/0x12
+kernel:  ubsan_epilogue+0x9/0x45
+kernel:  __ubsan_handle_load_invalid_value.cold+0x44/0x49
+kernel:  fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib]
+kernel:  fcp_response+0x28/0x30 [snd_firewire_lib]
+kernel:  fw_core_handle_request+0x230/0x3d0 [firewire_core]
+kernel:  handle_ar_packet+0x1d9/0x200 [firewire_ohci]
+kernel:  ? handle_ar_packet+0x1d9/0x200 [firewire_ohci]
+kernel:  ? transmit_complete_callback+0x9f/0x120 [firewire_core]
+kernel:  ar_context_tasklet+0xa8/0x2e0 [firewire_ohci]
+kernel:  tasklet_action_common.constprop.0+0xea/0xf0
+kernel:  tasklet_action+0x22/0x30
+kernel:  __do_softirq+0xd9/0x2e3
+kernel:  ? irq_finalize_oneshot.part.0+0xf0/0xf0
+kernel:  do_softirq+0x75/0xa0
+kernel:  </IRQ>
+kernel:  <TASK>
+kernel:  __local_bh_enable_ip+0x50/0x60
+kernel:  irq_forced_thread_fn+0x7e/0x90
+kernel:  irq_thread+0xba/0x190
+kernel:  ? irq_thread_fn+0x60/0x60
+kernel:  kthread+0x11e/0x140
+kernel:  ? irq_thread_check_affinity+0xf0/0xf0
+kernel:  ? set_kthread_struct+0x50/0x50
+kernel:  ret_from_fork+0x22/0x30
+kernel:  </TASK>
+kernel: ================================================================================
+
+This commit fixes the bug. The bug has no disadvantage for the non-
+control/notify AV/C transactions since the flag has an effect for AV/C
+response with INTERIM (0x0f) status which is not used for the transactions
+in AV/C general specification.
+
+Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/fcp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c
+index bbfbebf4affb..df44dd5dc4b2 100644
+--- a/sound/firewire/fcp.c
++++ b/sound/firewire/fcp.c
+@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit,
+ 	t.response_match_bytes = response_match_bytes;
+ 	t.state = STATE_PENDING;
+ 	init_waitqueue_head(&t.wait);
+-
+-	if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03)
+-		t.deferrable = true;
++	t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03);
+ 
+ 	spin_lock_irq(&transactions_lock);
+ 	list_add_tail(&t.list, &transactions);
+-- 
+2.34.1
+
diff --git a/queue-5.16/alsa-hda-fix-driver-index-handling-at-re-binding.patch b/queue-5.16/alsa-hda-fix-driver-index-handling-at-re-binding.patch
new file mode 100644
index 00000000000..cd060c6fd2b
--- /dev/null
+++ b/queue-5.16/alsa-hda-fix-driver-index-handling-at-re-binding.patch
@@ -0,0 +1,85 @@
+From cd7cdae1612e6308d76f566c75b6c9f60bc0f117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 09:19:12 +0100
+Subject: ALSA: hda: Fix driver index handling at re-binding
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 69458e2c27800da7697c87ed908b65323ef3f3bd ]
+
+HD-audio driver handles the multiple instances and keeps the static
+index that is incremented at each probe.  This becomes a problem when
+user tries to re-bind the device via sysfs multiple times; as the
+device index isn't cleared unlike rmmod case, it points to the next
+element at re-binding, and eventually later you can't probe any more
+when it reaches to SNDRV_CARDS_MAX (usually 32).
+
+This patch is an attempt to improve the handling at rebinding.
+Instead of a static device index, now we keep a bitmap and assigns to
+the first zero bit position.  At the driver remove, in return, the
+bitmap slot is cleared again, so that it'll be available for the next
+probe.
+
+Reported-by: Alexander Sergeyev <sergeev917@gmail.com>
+Link: https://lore.kernel.org/r/20220209081912.20687-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 3b6f2aacda45..1ffd96fbf230 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2061,14 +2061,16 @@ static const struct hda_controller_ops pci_hda_ops = {
+ 	.position_check = azx_position_check,
+ };
+ 
++static DECLARE_BITMAP(probed_devs, SNDRV_CARDS);
++
+ static int azx_probe(struct pci_dev *pci,
+ 		     const struct pci_device_id *pci_id)
+ {
+-	static int dev;
+ 	struct snd_card *card;
+ 	struct hda_intel *hda;
+ 	struct azx *chip;
+ 	bool schedule_probe;
++	int dev;
+ 	int err;
+ 
+ 	if (pci_match_id(driver_denylist, pci)) {
+@@ -2076,10 +2078,11 @@ static int azx_probe(struct pci_dev *pci,
+ 		return -ENODEV;
+ 	}
+ 
++	dev = find_first_zero_bit(probed_devs, SNDRV_CARDS);
+ 	if (dev >= SNDRV_CARDS)
+ 		return -ENODEV;
+ 	if (!enable[dev]) {
+-		dev++;
++		set_bit(dev, probed_devs);
+ 		return -ENOENT;
+ 	}
+ 
+@@ -2146,7 +2149,7 @@ static int azx_probe(struct pci_dev *pci,
+ 	if (schedule_probe)
+ 		schedule_delayed_work(&hda->probe_work, 0);
+ 
+-	dev++;
++	set_bit(dev, probed_devs);
+ 	if (chip->disabled)
+ 		complete_all(&hda->probe_wait);
+ 	return 0;
+@@ -2369,6 +2372,7 @@ static void azx_remove(struct pci_dev *pci)
+ 		cancel_delayed_work_sync(&hda->probe_work);
+ 		device_lock(&pci->dev);
+ 
++		clear_bit(chip->dev_index, probed_devs);
+ 		pci_set_drvdata(pci, NULL);
+ 		snd_card_free(card);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch b/queue-5.16/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
new file mode 100644
index 00000000000..10f0b9ba81c
--- /dev/null
+++ b/queue-5.16/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
@@ -0,0 +1,85 @@
+From 7d95e9ae8766dd81b22244f048b9c8834a3e7413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 13:48:17 -0700
+Subject: ALSA: hda/realtek: Add alc256-samsung-headphone fixup
+
+From: Matt Kramer <mccleetus@gmail.com>
+
+[ Upstream commit ef248d9bd616b04df8be25539a4dc5db4b6c56f4 ]
+
+This fixes the near-silence of the headphone jack on the ALC256-based
+Samsung Galaxy Book Flex Alpha (NP730QCJ). The magic verbs were found
+through trial and error, using known ALC298 hacks as inspiration. The
+fixup is auto-enabled only when the NP730QCJ is detected. It can be
+manually enabled using model=alc256-samsung-headphone.
+
+Signed-off-by: Matt Kramer <mccleetus@gmail.com>
+Link: https://lore.kernel.org/r/3168355.aeNJFYEL58@linus
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sound/hd-audio/models.rst |  4 ++++
+ sound/pci/hda/patch_realtek.c           | 11 +++++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index d25335993e55..9b52f50a6854 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -261,6 +261,10 @@ alc-sense-combo
+ huawei-mbx-stereo
+     Enable initialization verbs for Huawei MBX stereo speakers;
+     might be risky, try this at your own risk
++alc298-samsung-headphone
++    Samsung laptops with ALC298
++alc256-samsung-headphone
++    Samsung laptops with ALC256
+ 
+ ALC66x/67x/892
+ ==============
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 888d049d5304..f6e5ed34dd09 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6816,6 +6816,7 @@ enum {
+ 	ALC236_FIXUP_HP_MUTE_LED,
+ 	ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
+ 	ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
++	ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ 	ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+ 	ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
+ 	ALC269VC_FIXUP_ACER_HEADSET_MIC,
+@@ -8138,6 +8139,14 @@ static const struct hda_fixup alc269_fixups[] = {
+ 			{ }
+ 		},
+ 	},
++	[ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
++		.type = HDA_FIXUP_VERBS,
++		.v.verbs = (const struct hda_verb[]) {
++			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x08},
++			{ 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf},
++			{ }
++		},
++	},
+ 	[ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -8900,6 +8909,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ 	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++	SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+@@ -9242,6 +9252,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ 	{.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
+ 	{.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
++	{.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"},
+ 	{.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+ 	{.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"},
+ 	{.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"},
+-- 
+2.34.1
+
diff --git a/queue-5.16/alsa-spi-add-check-for-clk_enable.patch b/queue-5.16/alsa-spi-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..97dd4656ba7
--- /dev/null
+++ b/queue-5.16/alsa-spi-add-check-for-clk_enable.patch
@@ -0,0 +1,92 @@
+From e79e42c212259aaeaff9f7f866213e01ea60423a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 10:28:39 +0800
+Subject: ALSA: spi: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ca1697eb09208f0168d94b88b72f57505339cbe5 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: 3568459a5113 ("ALSA: at73c213: manage SSC clock")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220228022839.3547266-1-jiasheng@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/spi/at73c213.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
+index 76c0e37a838c..8a2da6b1012e 100644
+--- a/sound/spi/at73c213.c
++++ b/sound/spi/at73c213.c
+@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream)
+ 	runtime->hw = snd_at73c213_playback_hw;
+ 	chip->substream = substream;
+ 
+-	clk_enable(chip->ssc->clk);
++	err = clk_enable(chip->ssc->clk);
++	if (err)
++		return err;
+ 
+ 	return 0;
+ }
+@@ -776,7 +778,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip)
+ 		goto out;
+ 
+ 	/* Enable DAC master clock. */
+-	clk_enable(chip->board->dac_clk);
++	retval = clk_enable(chip->board->dac_clk);
++	if (retval)
++		goto out;
+ 
+ 	/* Initialize at73c213 on SPI bus. */
+ 	retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04);
+@@ -889,7 +893,9 @@ static int snd_at73c213_dev_init(struct snd_card *card,
+ 	chip->card = card;
+ 	chip->irq = -1;
+ 
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->ssc->clk);
++	if (retval)
++		return retval;
+ 
+ 	retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip);
+ 	if (retval) {
+@@ -1008,7 +1014,9 @@ static int snd_at73c213_remove(struct spi_device *spi)
+ 	int retval;
+ 
+ 	/* Stop playback. */
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->ssc->clk);
++	if (retval)
++		goto out;
+ 	ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS));
+ 	clk_disable(chip->ssc->clk);
+ 
+@@ -1088,9 +1096,16 @@ static int snd_at73c213_resume(struct device *dev)
+ {
+ 	struct snd_card *card = dev_get_drvdata(dev);
+ 	struct snd_at73c213 *chip = card->private_data;
++	int retval;
+ 
+-	clk_enable(chip->board->dac_clk);
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->board->dac_clk);
++	if (retval)
++		return retval;
++	retval = clk_enable(chip->ssc->clk);
++	if (retval) {
++		clk_disable(chip->board->dac_clk);
++		return retval;
++	}
+ 	ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN));
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch b/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch
new file mode 100644
index 00000000000..1318f5ce976
--- /dev/null
+++ b/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch
@@ -0,0 +1,44 @@
+From 04fd021d5e791feec32aad583a65c8dd3a6fb68c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 18:30:40 +0000
+Subject: ARM: configs: multi_v5_defconfig: re-enable
+ CONFIG_V4L_PLATFORM_DRIVERS
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit f5eb04d7a0e419d61f784de3ced708259ddb71d7 ]
+
+Commit 06b93644f4d1 ("media: Kconfig: add an option to filter in/out
+platform drivers") introduced CONFIG_MEDIA_PLATFORM_SUPPORT, to allow
+more fine grained control over the inclusion of certain Kconfig files.
+multi_v5_defconfig was selecting some drivers described in
+drivers/media/platform/Kconfig, which now wasn't included anymore.
+
+Explicitly set the new symbol in multi_v5_defconfig to bring those
+drivers back.
+This enables some new V4L2 and VIDEOBUF2 features, but as modules only.
+
+Fixes: 06b93644f4d1 ("media: Kconfig: add an option to filter in/out platform drivers")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Link: https://lore.kernel.org/r/20220317183043.948432-3-andre.przywara@arm.com'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/multi_v5_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/multi_v5_defconfig b/arch/arm/configs/multi_v5_defconfig
+index fe8d760256a4..dac1db2e181f 100644
+--- a/arch/arm/configs/multi_v5_defconfig
++++ b/arch/arm/configs/multi_v5_defconfig
+@@ -188,6 +188,7 @@ CONFIG_REGULATOR=y
+ CONFIG_REGULATOR_FIXED_VOLTAGE=y
+ CONFIG_MEDIA_SUPPORT=y
+ CONFIG_MEDIA_CAMERA_SUPPORT=y
++CONFIG_MEDIA_PLATFORM_SUPPORT=y
+ CONFIG_V4L_PLATFORM_DRIVERS=y
+ CONFIG_VIDEO_ASPEED=m
+ CONFIG_VIDEO_ATMEL_ISI=m
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-drm_panel-a.patch b/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-drm_panel-a.patch
new file mode 100644
index 00000000000..7db8a751f6d
--- /dev/null
+++ b/queue-5.16/arm-configs-multi_v5_defconfig-re-enable-drm_panel-a.patch
@@ -0,0 +1,48 @@
+From 28481296e752f83c8f9f57a7813cca29d282458f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 18:30:41 +0000
+Subject: ARM: configs: multi_v5_defconfig: re-enable DRM_PANEL and FB_xxx
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 9c44d0805f949c56121b4ae6949fb064537bf198 ]
+
+Commit 91185d55b32e ("drm: Remove DRM_KMS_FB_HELPER Kconfig option")
+led to de-selection of CONFIG_FB, which was a prerequisite for
+BACKLIGHT_CLASS_DEVICE, which CONFIG_DRM_PANEL_SIMPLE depended on.
+Explicitly set CONFIG_FB, to bring DRM_PANEL_SIMPLE, DRM_PANEL_EDP,
+FB_IMX and FB_ATMEL back into the generated .config.
+This also adds some new FB related features like fonts and the
+framebuffer console.
+
+See also commit 8c1768967e27 ("ARM: config: mutli v7: Reenable FB
+dependency"), which solved the same problem for multi_v7_defconfig.
+
+This relies on [1], to fix a broken Kconfig dependency.
+
+[1] https://lore.kernel.org/dri-devel/20220315084559.23510-1-tzimmermann@suse.de/raw
+
+Fixes: 91185d55b32e ("drm: Remove DRM_KMS_FB_HELPER Kconfig option")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Link: https://lore.kernel.org/r/20220317183043.948432-4-andre.przywara@arm.com'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/multi_v5_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/multi_v5_defconfig b/arch/arm/configs/multi_v5_defconfig
+index dac1db2e181f..3e3beb0cc33d 100644
+--- a/arch/arm/configs/multi_v5_defconfig
++++ b/arch/arm/configs/multi_v5_defconfig
+@@ -197,6 +197,7 @@ CONFIG_DRM_ATMEL_HLCDC=m
+ CONFIG_DRM_PANEL_SIMPLE=y
+ CONFIG_DRM_PANEL_EDP=y
+ CONFIG_DRM_ASPEED_GFX=m
++CONFIG_FB=y
+ CONFIG_FB_IMX=y
+ CONFIG_FB_ATMEL=y
+ CONFIG_BACKLIGHT_ATMEL_LCDC=y
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch b/queue-5.16/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch
new file mode 100644
index 00000000000..2607f1ae7ea
--- /dev/null
+++ b/queue-5.16/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch
@@ -0,0 +1,113 @@
+From 6e0917022d3bd2edd9c09734834ed42b24e20a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Dec 2021 23:48:30 +0100
+Subject: ARM: dts: bcm2711: Add the missing L1/L2 cache information
+
+From: Richard Schleich <rs@noreya.tech>
+
+[ Upstream commit 618682b350990f8f1bee718949c4b3858711eb58 ]
+
+This patch fixes the kernel warning
+"cacheinfo: Unable to detect cache hierarchy for CPU 0"
+for the bcm2711 on newer kernel versions.
+
+Signed-off-by: Richard Schleich <rs@noreya.tech>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+[florian: Align and remove comments matching property values]
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2711.dtsi | 50 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
+index 21294f775a20..89af57482bc8 100644
+--- a/arch/arm/boot/dts/bcm2711.dtsi
++++ b/arch/arm/boot/dts/bcm2711.dtsi
+@@ -459,12 +459,26 @@
+ 		#size-cells = <0>;
+ 		enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit
+ 
++		/* Source for d/i-cache-line-size and d/i-cache-sets
++		 * https://developer.arm.com/documentation/100095/0003
++		 * /Level-1-Memory-System/About-the-L1-memory-system?lang=en
++		 * Source for d/i-cache-size
++		 * https://www.raspberrypi.com/documentation/computers
++		 * /processors.html#bcm2711
++		 */
+ 		cpu0: cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a72";
+ 			reg = <0>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000d8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			i-cache-size = <0xc000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -473,6 +487,13 @@
+ 			reg = <1>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			i-cache-size = <0xc000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu2: cpu@2 {
+@@ -481,6 +502,13 @@
+ 			reg = <2>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			i-cache-size = <0xc000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu3: cpu@3 {
+@@ -489,6 +517,28 @@
+ 			reg = <3>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000f0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			i-cache-size = <0xc000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set
++			next-level-cache = <&l2>;
++		};
++
++		/* Source for d/i-cache-line-size and d/i-cache-sets
++		 *  https://developer.arm.com/documentation/100095/0003
++		 *  /Level-2-Memory-System/About-the-L2-memory-system?lang=en
++		 *  Source for d/i-cache-size
++		 *  https://www.raspberrypi.com/documentation/computers
++		 *  /processors.html#bcm2711
++		 */
++		l2: l2-cache0 {
++			compatible = "cache";
++			cache-size = <0x100000>;
++			cache-line-size = <64>;
++			cache-sets = <1024>; // 1MiB(size)/64(line-size)=16384ways/16-way set
++			cache-level = <2>;
+ 		};
+ 	};
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch b/queue-5.16/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
new file mode 100644
index 00000000000..ce89ea24d74
--- /dev/null
+++ b/queue-5.16/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
@@ -0,0 +1,112 @@
+From 572fbe92f1523e2df580d5de8590d847db2e4ec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Dec 2021 21:00:09 +0100
+Subject: ARM: dts: bcm2837: Add the missing L1/L2 cache information
+
+From: Richard Schleich <rs@noreya.tech>
+
+[ Upstream commit bdf8762da268d2a34abf517c36528413906e9cd5 ]
+
+This patch fixes the kernel warning
+"cacheinfo: Unable to detect cache hierarchy for CPU 0"
+for the bcm2837 on newer kernel versions.
+
+Signed-off-by: Richard Schleich <rs@noreya.tech>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+[florian: Align and remove comments matching property values]
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi
+index 0199ec98cd61..5dbdebc46259 100644
+--- a/arch/arm/boot/dts/bcm2837.dtsi
++++ b/arch/arm/boot/dts/bcm2837.dtsi
+@@ -40,12 +40,26 @@
+ 		#size-cells = <0>;
+ 		enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit
+ 
++		/* Source for d/i-cache-line-size and d/i-cache-sets
++		 * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system
++		 * /about-the-l1-memory-system?lang=en
++		 *
++		 * Source for d/i-cache-size
++		 * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks
++		 */
+ 		cpu0: cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a53";
+ 			reg = <0>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000d8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -54,6 +68,13 @@
+ 			reg = <1>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu2: cpu@2 {
+@@ -62,6 +83,13 @@
+ 			reg = <2>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu3: cpu@3 {
+@@ -70,6 +98,27 @@
+ 			reg = <3>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000f0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
++		};
++
++		/* Source for cache-line-size + cache-sets
++		 * https://developer.arm.com/documentation/ddi0500
++		 * /e/level-2-memory-system/about-the-l2-memory-system?lang=en
++		 * Source for cache-size
++		 * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf
++		 */
++		l2: l2-cache0 {
++			compatible = "cache";
++			cache-size = <0x80000>;
++			cache-line-size = <64>;
++			cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set
++			cache-level = <2>;
+ 		};
+ 	};
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-fix-openbmc-flash-layout-label-addresses.patch b/queue-5.16/arm-dts-fix-openbmc-flash-layout-label-addresses.patch
new file mode 100644
index 00000000000..03bfff6055e
--- /dev/null
+++ b/queue-5.16/arm-dts-fix-openbmc-flash-layout-label-addresses.patch
@@ -0,0 +1,54 @@
+From 9d426717eb1cc1d8b3545d33ef6bbb62d439aed9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jan 2022 16:37:18 -0800
+Subject: ARM: dts: Fix OpenBMC flash layout label addresses
+
+From: Zev Weiss <zev@bewilderbeest.net>
+
+[ Upstream commit e011df3579ac980d840db8e8c3b9431f88ebddab ]
+
+We've ended up with some inconsistencies between the addresses in the
+DT node labels and the actual offsets of the partitions; this brings
+them back in sync.
+
+Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
+Fixes: 529022738c8e ("ARM: dts: Add OpenBMC flash layout")
+Fixes: 8dec60e7b8d0 ("ARM: dts: aspeed: Grow u-boot partition 64MiB OpenBMC flash layout")
+Reviewed-by: Lei YU <yulei.sh@bytedance.com>
+Link: https://lore.kernel.org/r/20220105003718.19888-1-zev@bewilderbeest.net
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/openbmc-flash-layout-64.dtsi | 2 +-
+ arch/arm/boot/dts/openbmc-flash-layout.dtsi    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/openbmc-flash-layout-64.dtsi b/arch/arm/boot/dts/openbmc-flash-layout-64.dtsi
+index 31f59de5190b..7af41361c480 100644
+--- a/arch/arm/boot/dts/openbmc-flash-layout-64.dtsi
++++ b/arch/arm/boot/dts/openbmc-flash-layout-64.dtsi
+@@ -28,7 +28,7 @@ partitions {
+ 		label = "rofs";
+ 	};
+ 
+-	rwfs@6000000 {
++	rwfs@2a00000 {
+ 		reg = <0x2a00000 0x1600000>; // 22MB
+ 		label = "rwfs";
+ 	};
+diff --git a/arch/arm/boot/dts/openbmc-flash-layout.dtsi b/arch/arm/boot/dts/openbmc-flash-layout.dtsi
+index 6c26524e93e1..b47e14063c38 100644
+--- a/arch/arm/boot/dts/openbmc-flash-layout.dtsi
++++ b/arch/arm/boot/dts/openbmc-flash-layout.dtsi
+@@ -20,7 +20,7 @@ partitions {
+ 		label = "kernel";
+ 	};
+ 
+-	rofs@c0000 {
++	rofs@4c0000 {
+ 		reg = <0x4c0000 0x1740000>;
+ 		label = "rofs";
+ 	};
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch b/queue-5.16/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
new file mode 100644
index 00000000000..da680114192
--- /dev/null
+++ b/queue-5.16/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
@@ -0,0 +1,81 @@
+From 05e4c4fe120b1111617ff2203c88ea64324f3d8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 23:11:23 +0100
+Subject: ARM: dts: imx: Add missing LVDS decoder on M53Menlo
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 0c6f71176ea43d6f4003a4d57f7bb518c5ad6145 ]
+
+The M53Menlo display unit uses an LVDS-to-DPI bridge, TI DS90CF364A.
+Describe this bridge in DT, otherwise the DT incorrectly describes
+DPI panel attached directly to LVDS source.
+
+Fixes: 716be61d1869 ("ARM: dts: imx53: Add Menlosystems M53 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index 4f88e96d81dd..d5c68d1ea707 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -53,6 +53,31 @@
+ 		};
+ 	};
+ 
++	lvds-decoder {
++		compatible = "ti,ds90cf364a", "lvds-decoder";
++
++		ports {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			port@0 {
++				reg = <0>;
++
++				lvds_decoder_in: endpoint {
++					remote-endpoint = <&lvds0_out>;
++				};
++			};
++
++			port@1 {
++				reg = <1>;
++
++				lvds_decoder_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
+ 	panel {
+ 		compatible = "edt,etm0700g0dh6";
+ 		pinctrl-0 = <&pinctrl_display_gpio>;
+@@ -61,7 +86,7 @@
+ 
+ 		port {
+ 			panel_in: endpoint {
+-				remote-endpoint = <&lvds0_out>;
++				remote-endpoint = <&lvds_decoder_out>;
+ 			};
+ 		};
+ 	};
+@@ -450,7 +475,7 @@
+ 			reg = <2>;
+ 
+ 			lvds0_out: endpoint {
+-				remote-endpoint = <&panel_in>;
++				remote-endpoint = <&lvds_decoder_in>;
+ 			};
+ 		};
+ 	};
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch b/queue-5.16/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch
new file mode 100644
index 00000000000..267bdf8694c
--- /dev/null
+++ b/queue-5.16/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch
@@ -0,0 +1,166 @@
+From d0d854af976dccde45ebceb81c4fd06056c2c688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 16:10:51 +0200
+Subject: ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit 4cb7df64c732b2b9918424095c11660c2a8c4a33 ]
+
+The audio_mclk_root_clk was added as a gate with the CCGR121 (0x4790),
+but according to the reference manual, there is no such gate. Moreover,
+the consumer driver of the mentioned clock might gate it and leave
+the ECSPI2 (the true owner of that gate) hanging. So lets use the
+audio_mclk_post_div, which is the parent.
+
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7-colibri.dtsi     | 4 ++--
+ arch/arm/boot/dts/imx7-mba7.dtsi        | 2 +-
+ arch/arm/boot/dts/imx7d-nitrogen7.dts   | 2 +-
+ arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 ++--
+ arch/arm/boot/dts/imx7d-pico-pi.dts     | 4 ++--
+ arch/arm/boot/dts/imx7d-sdb.dts         | 4 ++--
+ arch/arm/boot/dts/imx7s-warp.dts        | 4 ++--
+ 7 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi
+index 62b771c1d5a9..f1c60b0cb143 100644
+--- a/arch/arm/boot/dts/imx7-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7-colibri.dtsi
+@@ -40,7 +40,7 @@
+ 
+ 		dailink_master: simple-audio-card,codec {
+ 			sound-dai = <&codec>;
+-			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		};
+ 	};
+ };
+@@ -293,7 +293,7 @@
+ 		compatible = "fsl,sgtl5000";
+ 		#sound-dai-cells = <0>;
+ 		reg = <0x0a>;
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_sai1_mclk>;
+ 		VDDA-supply = <&reg_module_3v3_avdd>;
+diff --git a/arch/arm/boot/dts/imx7-mba7.dtsi b/arch/arm/boot/dts/imx7-mba7.dtsi
+index 49086c6b6a0a..3df6dff7734a 100644
+--- a/arch/arm/boot/dts/imx7-mba7.dtsi
++++ b/arch/arm/boot/dts/imx7-mba7.dtsi
+@@ -302,7 +302,7 @@
+ 	tlv320aic32x4: audio-codec@18 {
+ 		compatible = "ti,tlv320aic32x4";
+ 		reg = <0x18>;
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		clock-names = "mclk";
+ 		ldoin-supply = <&reg_audio_3v3>;
+ 		iov-supply = <&reg_audio_3v3>;
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index e0751e6ba3c0..a31de900139d 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -288,7 +288,7 @@
+ 	codec: wm8960@1a {
+ 		compatible = "wlf,wm8960";
+ 		reg = <0x1a>;
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		clock-names = "mclk";
+ 		wlf,shared-lrclk;
+ 	};
+diff --git a/arch/arm/boot/dts/imx7d-pico-hobbit.dts b/arch/arm/boot/dts/imx7d-pico-hobbit.dts
+index 7b2198a9372c..d917dc4f2f22 100644
+--- a/arch/arm/boot/dts/imx7d-pico-hobbit.dts
++++ b/arch/arm/boot/dts/imx7d-pico-hobbit.dts
+@@ -31,7 +31,7 @@
+ 
+ 		dailink_master: simple-audio-card,codec {
+ 			sound-dai = <&sgtl5000>;
+-			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		};
+ 	};
+ };
+@@ -41,7 +41,7 @@
+ 		#sound-dai-cells = <0>;
+ 		reg = <0x0a>;
+ 		compatible = "fsl,sgtl5000";
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		VDDA-supply = <&reg_2p5v>;
+ 		VDDIO-supply = <&reg_vref_1v8>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx7d-pico-pi.dts b/arch/arm/boot/dts/imx7d-pico-pi.dts
+index 70bea95c06d8..f263e391e24c 100644
+--- a/arch/arm/boot/dts/imx7d-pico-pi.dts
++++ b/arch/arm/boot/dts/imx7d-pico-pi.dts
+@@ -31,7 +31,7 @@
+ 
+ 		dailink_master: simple-audio-card,codec {
+ 			sound-dai = <&sgtl5000>;
+-			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		};
+ 	};
+ };
+@@ -41,7 +41,7 @@
+ 		#sound-dai-cells = <0>;
+ 		reg = <0x0a>;
+ 		compatible = "fsl,sgtl5000";
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		VDDA-supply = <&reg_2p5v>;
+ 		VDDIO-supply = <&reg_vref_1v8>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
+index 7813ef960f6e..f053f5122741 100644
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -385,14 +385,14 @@
+ 	codec: wm8960@1a {
+ 		compatible = "wlf,wm8960";
+ 		reg = <0x1a>;
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		clock-names = "mclk";
+ 		wlf,shared-lrclk;
+ 		wlf,hp-cfg = <2 2 3>;
+ 		wlf,gpio-cfg = <1 3>;
+ 		assigned-clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_SRC>,
+ 				  <&clks IMX7D_PLL_AUDIO_POST_DIV>,
+-				  <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++				  <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		assigned-clock-parents = <&clks IMX7D_PLL_AUDIO_POST_DIV>;
+ 		assigned-clock-rates = <0>, <884736000>, <12288000>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts
+index 569bbd84e371..558b064da743 100644
+--- a/arch/arm/boot/dts/imx7s-warp.dts
++++ b/arch/arm/boot/dts/imx7s-warp.dts
+@@ -75,7 +75,7 @@
+ 
+ 		dailink_master: simple-audio-card,codec {
+ 			sound-dai = <&codec>;
+-			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++			clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		};
+ 	};
+ };
+@@ -232,7 +232,7 @@
+ 		#sound-dai-cells = <0>;
+ 		reg = <0x0a>;
+ 		compatible = "fsl,sgtl5000";
+-		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>;
++		clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_sai1_mclk>;
+ 		VDDA-supply = <&vgen4_reg>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch b/queue-5.16/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
new file mode 100644
index 00000000000..5bb96d591e8
--- /dev/null
+++ b/queue-5.16/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
@@ -0,0 +1,60 @@
+From d4a8ce1aec6b9acb63747c5970949aaef68787b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 18:42:28 +0100
+Subject: ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 6f7e221e7a5cfc3299616543fce42b36e631497b ]
+
+IRQ types blindly copied from very similar APQ8064.
+
+Fixes warnings as:
+WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1080 gic_irq_domain_translate+0x118/0x120
+...
+
+Tested-by: LogicalErzor <logicalerzor@gmail.com> # boot-tested on Samsung S3
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220108174229.60384-1-david@ixit.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi
+index 2a0ec97a264f..a0f9ab7f08f3 100644
+--- a/arch/arm/boot/dts/qcom-msm8960.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi
+@@ -146,7 +146,9 @@
+ 			reg		= <0x108000 0x1000>;
+ 			qcom,ipc	= <&l2cc 0x8 2>;
+ 
+-			interrupts	= <0 19 0>, <0 21 0>, <0 22 0>;
++			interrupts	= <GIC_SPI 19 IRQ_TYPE_EDGE_RISING>,
++					  <GIC_SPI 21 IRQ_TYPE_EDGE_RISING>,
++					  <GIC_SPI 22 IRQ_TYPE_EDGE_RISING>;
+ 			interrupt-names	= "ack", "err", "wakeup";
+ 
+ 			regulators {
+@@ -192,7 +194,7 @@
+ 				compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
+ 				reg = <0x16440000 0x1000>,
+ 				      <0x16400000 0x1000>;
+-				interrupts = <0 154 0x0>;
++				interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>;
+ 				clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>;
+ 				clock-names = "core", "iface";
+ 				status = "disabled";
+@@ -318,7 +320,7 @@
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
+ 				reg = <0x16080000 0x1000>;
+-				interrupts = <0 147 0>;
++				interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
+ 				spi-max-frequency = <24000000>;
+ 				cs-gpios = <&msmgpio 8 0>;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-qcom-ipq4019-fix-sleep-clock.patch b/queue-5.16/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
new file mode 100644
index 00000000000..918ce55bf5d
--- /dev/null
+++ b/queue-5.16/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
@@ -0,0 +1,42 @@
+From ba516a3a66ed0688f2157569b1323f24dd8b7da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Dec 2021 18:03:52 +0100
+Subject: ARM: dts: qcom: ipq4019: fix sleep clock
+
+From: Pavel Kubelun <be.dissent@gmail.com>
+
+[ Upstream commit 3d7e7980993d2c1ae42d3d314040fc2de6a9c45f ]
+
+It seems like sleep_clk was copied from ipq806x.
+Fix ipq40xx sleep_clk to the value QSDK defines.
+
+Link: https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=d92ec59973484acc86dd24b67f10f8911b4b4b7d
+Link: https://patchwork.kernel.org/comment/22721613/
+Fixes: bec6ba4cdf2a ("qcom: ipq4019: Add basic board/dts support for IPQ4019 SoC")
+Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org> (clock-output-names)
+Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (removed clock rename)
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211220170352.34591-1-chunkeey@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index ff1bdb10ad19..08bc5f46649d 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -142,7 +142,8 @@
+ 	clocks {
+ 		sleep_clk: sleep_clk {
+ 			compatible = "fixed-clock";
+-			clock-frequency = <32768>;
++			clock-frequency = <32000>;
++			clock-output-names = "gcc_sleep_clk_src";
+ 			#clock-cells = <0>;
+ 		};
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-stm32-fix-av96-board-sai2-pin-muxing-on-stm3.patch b/queue-5.16/arm-dts-stm32-fix-av96-board-sai2-pin-muxing-on-stm3.patch
new file mode 100644
index 00000000000..a10cc11f099
--- /dev/null
+++ b/queue-5.16/arm-dts-stm32-fix-av96-board-sai2-pin-muxing-on-stm3.patch
@@ -0,0 +1,37 @@
+From be783a73342b377444bc05711adfbb525970dd2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 16:35:25 +0100
+Subject: ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit ee2aacb6f3a901a95b1dd68964b69c92cdbbf213 ]
+
+Replace sai2a-2 node name by sai2a-sleep-2, to avoid name
+duplication.
+
+Fixes: 1a9a9d226f0f ("ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+index 2ebafe27a865..d3553e0f0187 100644
+--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+@@ -1190,7 +1190,7 @@
+ 		};
+ 	};
+ 
+-	sai2a_sleep_pins_c: sai2a-2 {
++	sai2a_sleep_pins_c: sai2a-sleep-2 {
+ 		pins {
+ 			pinmux = <STM32_PINMUX('D', 13, ANALOG)>, /* SAI2_SCK_A */
+ 				 <STM32_PINMUX('D', 11, ANALOG)>, /* SAI2_SD_A */
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch b/queue-5.16/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch
new file mode 100644
index 00000000000..acee2c661f9
--- /dev/null
+++ b/queue-5.16/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch
@@ -0,0 +1,64 @@
+From 86b3245b3c98395e51da8e5fb59ad6a75c08bddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Feb 2022 19:53:24 +0100
+Subject: ARM: dts: sun8i: v3s: Move the csi1 block to follow address order
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit c4af51698c4fb4fc683f2ac67f482cdf9ba2cd13 ]
+
+The csi1 block node was mistakenly added before the gic node, although
+its address comes after the gic's. Move the node to its correct
+position.
+
+Fixes: 90e048101fa1 ("ARM: dts: sun8i: V3/V3s/S3/S3L: add CSI1 device node")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220205185429.2278860-2-paul.kocialkowski@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index b30bc1a25ebb..084323d5c61c 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -593,6 +593,17 @@
+ 			#size-cells = <0>;
+ 		};
+ 
++		gic: interrupt-controller@1c81000 {
++			compatible = "arm,gic-400";
++			reg = <0x01c81000 0x1000>,
++			      <0x01c82000 0x2000>,
++			      <0x01c84000 0x2000>,
++			      <0x01c86000 0x2000>;
++			interrupt-controller;
++			#interrupt-cells = <3>;
++			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++		};
++
+ 		csi1: camera@1cb4000 {
+ 			compatible = "allwinner,sun8i-v3s-csi";
+ 			reg = <0x01cb4000 0x3000>;
+@@ -604,16 +615,5 @@
+ 			resets = <&ccu RST_BUS_CSI>;
+ 			status = "disabled";
+ 		};
+-
+-		gic: interrupt-controller@1c81000 {
+-			compatible = "arm,gic-400";
+-			reg = <0x01c81000 0x1000>,
+-			      <0x01c82000 0x2000>,
+-			      <0x01c84000 0x2000>,
+-			      <0x01c86000 0x2000>;
+-			interrupt-controller;
+-			#interrupt-cells = <3>;
+-			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+-		};
+ 	};
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch b/queue-5.16/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
new file mode 100644
index 00000000000..c3bb81a4a3d
--- /dev/null
+++ b/queue-5.16/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
@@ -0,0 +1,135 @@
+From 7a9078649870fd5cf093f538390714fd8fd18c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jan 2022 20:18:33 +0100
+Subject: ARM: ftrace: avoid redundant loads or clobbering IP
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit d11967870815b5ab89843980e35aab616c97c463 ]
+
+Tweak the ftrace return paths to avoid redundant loads of SP, as well as
+unnecessary clobbering of IP.
+
+This also fixes the inconsistency of using MOV to perform a function
+return, which is sub-optimal on recent micro-architectures but more
+importantly, does not perform an interworking return, unlike compiler
+generated function returns in Thumb2 builds.
+
+Let's fix this by popping PC from the stack like most ordinary code
+does.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-ftrace.S | 51 +++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 29 deletions(-)
+
+diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
+index f4886fb6e9ba..f33c171e3090 100644
+--- a/arch/arm/kernel/entry-ftrace.S
++++ b/arch/arm/kernel/entry-ftrace.S
+@@ -22,10 +22,7 @@
+  * mcount can be thought of as a function called in the middle of a subroutine
+  * call.  As such, it needs to be transparent for both the caller and the
+  * callee: the original lr needs to be restored when leaving mcount, and no
+- * registers should be clobbered.  (In the __gnu_mcount_nc implementation, we
+- * clobber the ip register.  This is OK because the ARM calling convention
+- * allows it to be clobbered in subroutines and doesn't use it to hold
+- * parameters.)
++ * registers should be clobbered.
+  *
+  * When using dynamic ftrace, we patch out the mcount call by a "pop {lr}"
+  * instead of the __gnu_mcount_nc call (see arch/arm/kernel/ftrace.c).
+@@ -70,26 +67,25 @@
+ 
+ .macro __ftrace_regs_caller
+ 
+-	sub	sp, sp, #8	@ space for PC and CPSR OLD_R0,
++	str	lr, [sp, #-8]!	@ store LR as PC and make space for CPSR/OLD_R0,
+ 				@ OLD_R0 will overwrite previous LR
+ 
+-	add 	ip, sp, #12	@ move in IP the value of SP as it was
+-				@ before the push {lr} of the mcount mechanism
++	ldr	lr, [sp, #8]    @ get previous LR
+ 
+-	str     lr, [sp, #0]    @ store LR instead of PC
++	str	r0, [sp, #8]	@ write r0 as OLD_R0 over previous LR
+ 
+-	ldr     lr, [sp, #8]    @ get previous LR
++	str	lr, [sp, #-4]!	@ store previous LR as LR
+ 
+-	str	r0, [sp, #8]	@ write r0 as OLD_R0 over previous LR
++	add 	lr, sp, #16	@ move in LR the value of SP as it was
++				@ before the push {lr} of the mcount mechanism
+ 
+-	stmdb   sp!, {ip, lr}
+-	stmdb   sp!, {r0-r11, lr}
++	push	{r0-r11, ip, lr}
+ 
+ 	@ stack content at this point:
+ 	@ 0  4          48   52       56            60   64    68       72
+-	@ R0 | R1 | ... | LR | SP + 4 | previous LR | LR | PSR | OLD_R0 |
++	@ R0 | R1 | ... | IP | SP + 4 | previous LR | LR | PSR | OLD_R0 |
+ 
+-	mov r3, sp				@ struct pt_regs*
++	mov	r3, sp				@ struct pt_regs*
+ 
+ 	ldr r2, =function_trace_op
+ 	ldr r2, [r2]				@ pointer to the current
+@@ -112,11 +108,9 @@ ftrace_graph_regs_call:
+ #endif
+ 
+ 	@ pop saved regs
+-	ldmia   sp!, {r0-r12}			@ restore r0 through r12
+-	ldr	ip, [sp, #8]			@ restore PC
+-	ldr	lr, [sp, #4]			@ restore LR
+-	ldr	sp, [sp, #0]			@ restore SP
+-	mov	pc, ip				@ return
++	pop	{r0-r11, ip, lr}		@ restore r0 through r12
++	ldr	lr, [sp], #4			@ restore LR
++	ldr	pc, [sp], #12
+ .endm
+ 
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+@@ -132,11 +126,9 @@ ftrace_graph_regs_call:
+ 	bl	prepare_ftrace_return
+ 
+ 	@ pop registers saved in ftrace_regs_caller
+-	ldmia   sp!, {r0-r12}			@ restore r0 through r12
+-	ldr	ip, [sp, #8]			@ restore PC
+-	ldr	lr, [sp, #4]			@ restore LR
+-	ldr	sp, [sp, #0]			@ restore SP
+-	mov	pc, ip				@ return
++	pop	{r0-r11, ip, lr}		@ restore r0 through r12
++	ldr	lr, [sp], #4			@ restore LR
++	ldr	pc, [sp], #12
+ 
+ .endm
+ #endif
+@@ -202,16 +194,17 @@ ftrace_graph_call\suffix:
+ .endm
+ 
+ .macro mcount_exit
+-	ldmia	sp!, {r0-r3, ip, lr}
+-	ret	ip
++	ldmia	sp!, {r0-r3}
++	ldr	lr, [sp, #4]
++	ldr	pc, [sp], #8
+ .endm
+ 
+ ENTRY(__gnu_mcount_nc)
+ UNWIND(.fnstart)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+-	mov	ip, lr
+-	ldmia	sp!, {lr}
+-	ret	ip
++	push	{lr}
++	ldr	lr, [sp, #4]
++	ldr	pc, [sp], #8
+ #else
+ 	__mcount
+ #endif
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch b/queue-5.16/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
new file mode 100644
index 00000000000..6618f964748
--- /dev/null
+++ b/queue-5.16/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
@@ -0,0 +1,40 @@
+From 85860b7fbac53ba043e57dfcab41d86c4f219ad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:38:15 +0100
+Subject: ARM: ftrace: ensure that ADR takes the Thumb bit into account
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit dd88b03ff0c84f4bcbe1419b93a4bed429fed3be ]
+
+Using ADR to take the address of 'ftrace_stub' via a local label
+produces an address that has the Thumb bit cleared, which means the
+subsequent comparison is guaranteed to fail. Instead, use the badr
+macro, which forces the Thumb bit to be set.
+
+Fixes: a3ba87a61499 ("ARM: 6316/1: ftrace: add Thumb-2 support")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-ftrace.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
+index a74289ebc803..f4886fb6e9ba 100644
+--- a/arch/arm/kernel/entry-ftrace.S
++++ b/arch/arm/kernel/entry-ftrace.S
+@@ -40,7 +40,7 @@
+ 	mcount_enter
+ 	ldr	r0, =ftrace_trace_function
+ 	ldr	r2, [r0]
+-	adr	r0, .Lftrace_stub
++	badr	r0, .Lftrace_stub
+ 	cmp	r0, r2
+ 	bne	1f
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-mmp-fix-failure-to-remove-sram-device.patch b/queue-5.16/arm-mmp-fix-failure-to-remove-sram-device.patch
new file mode 100644
index 00000000000..e1d6c91bda7
--- /dev/null
+++ b/queue-5.16/arm-mmp-fix-failure-to-remove-sram-device.patch
@@ -0,0 +1,79 @@
+From c5d44f98ed5896393d9ba28039d8afcba0c4e85f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 22:01:58 +0200
+Subject: ARM: mmp: Fix failure to remove sram device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 4036b29a146b2749af3bb213b003eb69f3e5ecc4 ]
+
+Make sure in .probe() to set driver data before the function is left to
+make it possible in .remove() to undo the actions done.
+
+This fixes a potential memory leak and stops returning an error code in
+.remove() that is ignored by the driver core anyhow.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-mmp/sram.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c
+index 6794e2db1ad5..ecc46c31004f 100644
+--- a/arch/arm/mach-mmp/sram.c
++++ b/arch/arm/mach-mmp/sram.c
+@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev)
+ 	if (!info)
+ 		return -ENOMEM;
+ 
++	platform_set_drvdata(pdev, info);
++
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (res == NULL) {
+ 		dev_err(&pdev->dev, "no memory resource defined\n");
+@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev)
+ 	list_add(&info->node, &sram_bank_list);
+ 	mutex_unlock(&sram_lock);
+ 
+-	platform_set_drvdata(pdev, info);
+-
+ 	dev_info(&pdev->dev, "initialized\n");
+ 	return 0;
+ 
+@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev)
+ 	struct sram_bank_info *info;
+ 
+ 	info = platform_get_drvdata(pdev);
+-	if (info == NULL)
+-		return -ENODEV;
+ 
+-	mutex_lock(&sram_lock);
+-	list_del(&info->node);
+-	mutex_unlock(&sram_lock);
++	if (info->sram_size) {
++		mutex_lock(&sram_lock);
++		list_del(&info->node);
++		mutex_unlock(&sram_lock);
++
++		gen_pool_destroy(info->gpool);
++		iounmap(info->sram_virt);
++		kfree(info->pool_name);
++	}
+ 
+-	gen_pool_destroy(info->gpool);
+-	iounmap(info->sram_virt);
+-	kfree(info->pool_name);
+ 	kfree(info);
++
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm-tegra-tamonten-fix-i2c3-pad-setting.patch b/queue-5.16/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
new file mode 100644
index 00000000000..8a5c7aea259
--- /dev/null
+++ b/queue-5.16/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
@@ -0,0 +1,46 @@
+From 9c0a72d59422f108ef788dd7cb4b6b49c000a7fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Dec 2021 17:11:48 +0100
+Subject: ARM: tegra: tamonten: Fix I2C3 pad setting
+
+From: Richard Leitner <richard.leitner@skidata.com>
+
+[ Upstream commit 0092c25b541a5422d7e71892a13c55ee91abc34b ]
+
+This patch fixes the tristate configuration for i2c3 function assigned
+to the dtf pins on the Tamonten Tegra20 SoM.
+
+Signed-off-by: Richard Leitner <richard.leitner@skidata.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index dd4d506683de..7f14f0d005c3 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -183,8 +183,8 @@
+ 			};
+ 			conf_ata {
+ 				nvidia,pins = "ata", "atb", "atc", "atd", "ate",
+-					"cdev1", "cdev2", "dap1", "dtb", "gma",
+-					"gmb", "gmc", "gmd", "gme", "gpu7",
++					"cdev1", "cdev2", "dap1", "dtb", "dtf",
++					"gma", "gmb", "gmc", "gmd", "gme", "gpu7",
+ 					"gpv", "i2cp", "irrx", "irtx", "pta",
+ 					"rm", "slxa", "slxk", "spia", "spib",
+ 					"uac";
+@@ -203,7 +203,7 @@
+ 			};
+ 			conf_crtp {
+ 				nvidia,pins = "crtp", "dap2", "dap3", "dap4",
+-					"dtc", "dte", "dtf", "gpu", "sdio1",
++					"dtc", "dte", "gpu", "sdio1",
+ 					"slxc", "slxd", "spdi", "spdo", "spig",
+ 					"uda";
+ 				nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-defconfig-build-imx-sdma-as-a-module.patch b/queue-5.16/arm64-defconfig-build-imx-sdma-as-a-module.patch
new file mode 100644
index 00000000000..3560c71f33e
--- /dev/null
+++ b/queue-5.16/arm64-defconfig-build-imx-sdma-as-a-module.patch
@@ -0,0 +1,39 @@
+From f821ca2d180de64885d7fd4b281cec8ede1795ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 17:00:56 +0100
+Subject: arm64: defconfig: build imx-sdma as a module
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit e95622289f263662240544a9f0009b25c19e64d4 ]
+
+This avoids firmware load error and sysfs fallback reported as follows:
+
+[    0.199448] imx-sdma 302c0000.dma-controller: Direct firmware load
+ for imx/sdma/sdma-imx7d.bin failed with error -2
+[    0.199487] imx-sdma 302c0000.dma-controller: Falling back to sysfs
+ fallback for: imx/sdma/sdma-imx7d.bin
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/configs/defconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index f2e2b9bdd702..d1fdf68be26e 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -931,7 +931,7 @@ CONFIG_DMADEVICES=y
+ CONFIG_DMA_BCM2835=y
+ CONFIG_DMA_SUN6I=m
+ CONFIG_FSL_EDMA=y
+-CONFIG_IMX_SDMA=y
++CONFIG_IMX_SDMA=m
+ CONFIG_K3_DMA=y
+ CONFIG_MV_XOR=y
+ CONFIG_MV_XOR_V2=y
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-broadcom-bcm4908-use-proper-twd-binding.patch b/queue-5.16/arm64-dts-broadcom-bcm4908-use-proper-twd-binding.patch
new file mode 100644
index 00000000000..7b8f7865e6d
--- /dev/null
+++ b/queue-5.16/arm64-dts-broadcom-bcm4908-use-proper-twd-binding.patch
@@ -0,0 +1,57 @@
+From 832cf59d547c712cb72cc1886a8228e462b2dcc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Dec 2021 11:23:14 +0100
+Subject: arm64: dts: broadcom: bcm4908: use proper TWD binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 33826e9c6ba76b265d4e26cb95493fa27ed78974 ]
+
+Block at <ff800400 0x4c> is a TWD that contains timers, watchdog and
+reset. Actual timers happen to be at block beginning but they only span
+across the first 0x28 registers. It means the old block description was
+incorrect (size 0x3c).
+
+Drop timers binding for now and use documented TWD binding. Timers
+should be properly documented and defined as TWD subnode.
+
+Fixes: 2961f69f151c ("arm64: dts: broadcom: add BCM4908 and Asus GT-AC5300 early DTS files")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+index 984c737fa627..6e738f2a3701 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+@@ -273,9 +273,9 @@
+ 		#size-cells = <1>;
+ 		ranges = <0x00 0x00 0xff800000 0x3000>;
+ 
+-		timer: timer@400 {
+-			compatible = "brcm,bcm6328-timer", "syscon";
+-			reg = <0x400 0x3c>;
++		twd: timer-mfd@400 {
++			compatible = "brcm,bcm4908-twd", "simple-mfd", "syscon";
++			reg = <0x400 0x4c>;
+ 		};
+ 
+ 		gpio0: gpio-controller@500 {
+@@ -330,7 +330,7 @@
+ 
+ 	reboot {
+ 		compatible = "syscon-reboot";
+-		regmap = <&timer>;
++		regmap = <&twd>;
+ 		offset = <0x34>;
+ 		mask = <1>;
+ 	};
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-broadcom-fix-sata-nodename.patch b/queue-5.16/arm64-dts-broadcom-fix-sata-nodename.patch
new file mode 100644
index 00000000000..d4020cf9d46
--- /dev/null
+++ b/queue-5.16/arm64-dts-broadcom-fix-sata-nodename.patch
@@ -0,0 +1,41 @@
+From 0e55b71c8e53ffcc72062c2c569c730d9a339781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 16:24:18 +0100
+Subject: arm64: dts: broadcom: Fix sata nodename
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+[ Upstream commit 55927cb44db43a57699fa652e2437a91620385dc ]
+
+After converting ahci-platform txt binding to yaml nodename is reported
+as not matching the standard:
+
+arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dt.yaml:
+ahci@663f2000: $nodename:0: 'ahci@663f2000' does not match '^sata(@.*)?$'
+
+Fix it to match binding.
+
+Fixes: ac9aae00f0fc ("arm64: dts: Add SATA3 AHCI and SATA3 PHY DT nodes for NS2")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 2cfeaf3b0a87..8c218689fef7 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -687,7 +687,7 @@
+ 			};
+ 		};
+ 
+-		sata: ahci@663f2000 {
++		sata: sata@663f2000 {
+ 			compatible = "brcm,iproc-ahci", "generic-ahci";
+ 			reg = <0x663f2000 0x1000>;
+ 			dma-coherent;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch b/queue-5.16/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
new file mode 100644
index 00000000000..6c0c01d8e3f
--- /dev/null
+++ b/queue-5.16/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
@@ -0,0 +1,52 @@
+From 9d882fc077572ff0cbc378860a9ef6fd4a0757aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 16:39:03 +0530
+Subject: arm64: dts: ns2: Fix spi-cpol and spi-cpha property
+
+From: Kuldeep Singh <singh.kuldeep87k@gmail.com>
+
+[ Upstream commit c953c764e505428f59ffe6afb1c73b89b5b1ac35 ]
+
+Broadcom ns2 platform has spi-cpol and spi-cpho properties set
+incorrectly. As per spi-slave-peripheral-prop.yaml, these properties are
+of flag or boolean type and not integer type. Fix the values.
+
+Fixes: d69dbd9f41a7c (arm64: dts: Add ARM PL022 SPI DT nodes for NS2)
+Signed-off-by: Kuldeep Singh <singh.kuldeep87k@gmail.com>
+CC: Ray Jui <rjui@broadcom.com>
+CC: Scott Branden <sbranden@broadcom.com>
+CC: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+index ec19fbf928a1..12a4b1c03390 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+@@ -111,8 +111,8 @@
+ 		compatible = "silabs,si3226x";
+ 		reg = <0>;
+ 		spi-max-frequency = <5000000>;
+-		spi-cpha = <1>;
+-		spi-cpol = <1>;
++		spi-cpha;
++		spi-cpol;
+ 		pl022,hierarchy = <0>;
+ 		pl022,interface = <0>;
+ 		pl022,slave-tx-disable = <0>;
+@@ -135,8 +135,8 @@
+ 		at25,byte-len = <0x8000>;
+ 		at25,addr-mode = <2>;
+ 		at25,page-size = <64>;
+-		spi-cpha = <1>;
+-		spi-cpol = <1>;
++		spi-cpha;
++		spi-cpol;
+ 		pl022,hierarchy = <0>;
+ 		pl022,interface = <0>;
+ 		pl022,slave-tx-disable = <0>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-ipq6018-fix-usb-reference-period.patch b/queue-5.16/arm64-dts-qcom-ipq6018-fix-usb-reference-period.patch
new file mode 100644
index 00000000000..0fc6cfe0d55
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-ipq6018-fix-usb-reference-period.patch
@@ -0,0 +1,39 @@
+From 7dcfea14612265b5ebbce9f07446d58672742a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 20:43:41 +0200
+Subject: arm64: dts: qcom: ipq6018: fix usb reference period
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit d1c10ab1494f09eb12fa6e58fc78bb28d44922ae ]
+
+Reference clock period for rate of 24MHz is 41ns (0x29).
+
+Link: https://lore.kernel.org/r/1965fc315525b8ab26cf9f71f939c24d@codeaurora.org
+Link: https://lore.kernel.org/r/a1932eba-564c-fe32-f220-53aa75250105@seco.com
+Fixes: 20bb9e3dd2e4 ("arm64: dts: qcom: ipq6018: add usb3 DT description")
+Reported-by: Kathiravan T <kathirav@codeaurora.org>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/4f4df55cf44cd0fd7d773aca171d4f48662fb1a5.1642704221.git.baruch@tkos.co.il
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 66ec5615651d..5dea37651adf 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -748,7 +748,7 @@
+ 				snps,hird-threshold = /bits/ 8 <0x0>;
+ 				snps,dis_u2_susphy_quirk;
+ 				snps,dis_u3_susphy_quirk;
+-				snps,ref-clock-period-ns = <0x32>;
++				snps,ref-clock-period-ns = <0x29>;
+ 				dr_mode = "host";
+ 			};
+ 		};
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-msm8994-provide-missing-xo_board-and-.patch b/queue-5.16/arm64-dts-qcom-msm8994-provide-missing-xo_board-and-.patch
new file mode 100644
index 00000000000..8050a5694eb
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-msm8994-provide-missing-xo_board-and-.patch
@@ -0,0 +1,46 @@
+From 3525df94e479d2b1cba3731f1c1c26b096ae9846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 00:33:55 +0100
+Subject: arm64: dts: qcom: msm8994: Provide missing "xo_board" and "sleep_clk"
+ to GCC
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 4dd1ad6192748523878463a285346db408b34a02 ]
+
+This is needed due changes in commit 0519d1d0bf33 ("clk: qcom:
+gcc-msm8994: Modernize the driver"), which removed struct
+clk_fixed_factor. Preparation for next commit for enabling SD/eMMC.
+Inspired by 2c2f64ae36d9.
+
+This is required for both msm8994-huawei-angler (sdhc1 will be enabled
+in next commit) and msm8992-lg-bullhead (where actually fixes sdhc1
+- tested on bullhead rev 1.01).
+
+Fixes: 0519d1d0bf33 ("clk: qcom: gcc-msm8994: Modernize the driver")
+
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220113233358.17972-4-petr.vorel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index 5a9a5ed0565f..215f56daa26c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -713,6 +713,9 @@
+ 			#reset-cells = <1>;
+ 			#power-domain-cells = <1>;
+ 			reg = <0xfc400000 0x2000>;
++
++			clock-names = "xo", "sleep_clk";
++			clocks = <&xo_board>, <&sleep_clk>;
+ 		};
+ 
+ 		rpm_msg_ram: sram@fc428000 {
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-sc7280-fix-gmu-unit-address.patch b/queue-5.16/arm64-dts-qcom-sc7280-fix-gmu-unit-address.patch
new file mode 100644
index 00000000000..09bb51ce37b
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-sc7280-fix-gmu-unit-address.patch
@@ -0,0 +1,43 @@
+From 17c0afc315b4a3e0d846e98ff0f7c5bf8438ba67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 14:44:18 -0800
+Subject: arm64: dts: qcom: sc7280: Fix gmu unit address
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 142a4d995c6adb6bf5b22166f51b525e83c96661 ]
+
+When processing sc7280 device trees, I can see:
+
+  Warning (simple_bus_reg): /soc@0/gmu@3d69000:
+    simple-bus unit address format error, expected "3d6a000"
+
+There's a clear typo in the node name. Fix it.
+
+Fixes: 96c471970b7b ("arm64: dts: qcom: sc7280: Add gpu support")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220125144316.v2.1.I19f60014e9be4b9dda4d66b5d56ef3d9600b6e10@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 6e27a1beaa33..68a5740bc360 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -1785,7 +1785,7 @@
+ 			};
+ 		};
+ 
+-		gmu: gmu@3d69000 {
++		gmu: gmu@3d6a000 {
+ 			compatible="qcom,adreno-gmu-635.0", "qcom,adreno-gmu";
+ 			reg = <0 0x03d6a000 0 0x34000>,
+ 				<0 0x3de0000 0 0x10000>,
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch b/queue-5.16/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch
new file mode 100644
index 00000000000..9406e1d0325
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch
@@ -0,0 +1,58 @@
+From 6a3a1efa36464ddd124e40c3482ce4db201eed43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Dec 2021 20:51:04 +0100
+Subject: arm64: dts: qcom: sdm845: fix microphone bias properties and values
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 625c24460dbbc3b6c9a148c0a30f0830893fc909 ]
+
+replace millivolt with correct microvolt and adjust value to
+the minimal value allowed by documentation.
+
+Found with `make qcom/sdm845-oneplus-fajita.dtb`.
+
+Fixes:
+arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias1-microvolt' is a required property
+        From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml
+arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias2-microvolt' is a required property
+        From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml
+arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias3-microvolt' is a required property
+        From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml
+arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias4-microvolt' is a required property
+        From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml
+arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias1-millivolt', 'qcom,micbias2-millivolt', 'qcom,micbias3-millivolt', 'qcom,micbias4-millivolt' do not match any of the regexes: '^.*@[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Fixes: 27ca1de07dc3 ("arm64: dts: qcom: sdm845: add slimbus nodes")
+
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211213195105.114596-1-david@ixit.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 526087586ba4..0dda3a378158 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -3613,10 +3613,10 @@
+ 					#clock-cells = <0>;
+ 					clock-frequency = <9600000>;
+ 					clock-output-names = "mclk";
+-					qcom,micbias1-millivolt = <1800>;
+-					qcom,micbias2-millivolt = <1800>;
+-					qcom,micbias3-millivolt = <1800>;
+-					qcom,micbias4-millivolt = <1800>;
++					qcom,micbias1-microvolt = <1800000>;
++					qcom,micbias2-microvolt = <1800000>;
++					qcom,micbias3-microvolt = <1800000>;
++					qcom,micbias4-microvolt = <1800000>;
+ 
+ 					#address-cells = <1>;
+ 					#size-cells = <1>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch b/queue-5.16/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
new file mode 100644
index 00000000000..44d6ec8acec
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
@@ -0,0 +1,41 @@
+From f955279c5cca18e5def4006a4df4f6feb0ba4fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jan 2022 22:54:58 +0530
+Subject: arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
+
+From: Maulik Shah <quic_mkshah@quicinc.com>
+
+[ Upstream commit 17ac8af678b6da6a8f1df7da8ebf2c5198741827 ]
+
+Correct the TCS config by updating the number of TCSes for each type.
+
+Cc: devicetree@vger.kernel.org
+Fixes: d8cf9372b654 ("arm64: dts: qcom: sm8150: Add apps shared nodes")
+Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/1641749107-31979-2-git-send-email-quic_mkshah@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 81b4ff2cc4cd..37f758cc4cc7 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -3557,9 +3557,9 @@
+ 			qcom,tcs-offset = <0xd00>;
+ 			qcom,drv-id = <2>;
+ 			qcom,tcs-config = <ACTIVE_TCS  2>,
+-					  <SLEEP_TCS   1>,
+-					  <WAKE_TCS    1>,
+-					  <CONTROL_TCS 0>;
++					  <SLEEP_TCS   3>,
++					  <WAKE_TCS    3>,
++					  <CONTROL_TCS 1>;
+ 
+ 			rpmhcc: clock-controller {
+ 				compatible = "qcom,sm8150-rpmh-clk";
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-sm8250-fix-pcie-bindings-to-follow-sc.patch b/queue-5.16/arm64-dts-qcom-sm8250-fix-pcie-bindings-to-follow-sc.patch
new file mode 100644
index 00000000000..220200d5b2f
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-sm8250-fix-pcie-bindings-to-follow-sc.patch
@@ -0,0 +1,65 @@
+From 67cf9ee774c2371e48c3ecbbc8e357ed9d864910 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Dec 2021 02:14:48 +0300
+Subject: arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d60507200485bc778bf6a5556271d784ab09d913 ]
+
+Replace (unused) enable-gpio binding with schema-defined wake-gpios. The
+GPIO line is still unused, but at least we'd follow the defined schema.
+
+While we are at it, change perst-gpio property to follow the preferred
+naming schema (perst-gpios).
+
+Fixes: 13e948a36db7 ("arm64: dts: qcom: sm8250: Commonize PCIe pins")
+Cc: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211214231448.2044987-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 8a3373c110fc..7d1ec0432020 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -1426,8 +1426,8 @@
+ 			phys = <&pcie0_lane>;
+ 			phy-names = "pciephy";
+ 
+-			perst-gpio = <&tlmm 79 GPIO_ACTIVE_LOW>;
+-			enable-gpio = <&tlmm 81 GPIO_ACTIVE_HIGH>;
++			perst-gpios = <&tlmm 79 GPIO_ACTIVE_LOW>;
++			wake-gpios = <&tlmm 81 GPIO_ACTIVE_HIGH>;
+ 
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pcie0_default_state>;
+@@ -1530,8 +1530,8 @@
+ 			phys = <&pcie1_lane>;
+ 			phy-names = "pciephy";
+ 
+-			perst-gpio = <&tlmm 82 GPIO_ACTIVE_LOW>;
+-			enable-gpio = <&tlmm 84 GPIO_ACTIVE_HIGH>;
++			perst-gpios = <&tlmm 82 GPIO_ACTIVE_LOW>;
++			wake-gpios = <&tlmm 84 GPIO_ACTIVE_HIGH>;
+ 
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pcie1_default_state>;
+@@ -1636,8 +1636,8 @@
+ 			phys = <&pcie2_lane>;
+ 			phy-names = "pciephy";
+ 
+-			perst-gpio = <&tlmm 85 GPIO_ACTIVE_LOW>;
+-			enable-gpio = <&tlmm 87 GPIO_ACTIVE_HIGH>;
++			perst-gpios = <&tlmm 85 GPIO_ACTIVE_LOW>;
++			wake-gpios = <&tlmm 87 GPIO_ACTIVE_HIGH>;
+ 
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pcie2_default_state>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-qcom-sm8350-correct-tcs-configuration-for-.patch b/queue-5.16/arm64-dts-qcom-sm8350-correct-tcs-configuration-for-.patch
new file mode 100644
index 00000000000..65d4cbabfff
--- /dev/null
+++ b/queue-5.16/arm64-dts-qcom-sm8350-correct-tcs-configuration-for-.patch
@@ -0,0 +1,37 @@
+From fcfa68494296799d1d9e3be7a36739f7abc0087d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jan 2022 22:55:00 +0530
+Subject: arm64: dts: qcom: sm8350: Correct TCS configuration for apps rsc
+
+From: Maulik Shah <quic_mkshah@quicinc.com>
+
+[ Upstream commit a131255e4ad1ef8d4873ecba21561ba272b2547a ]
+
+Correct the TCS config by updating the number of TCSes for each type.
+
+Cc: devicetree@vger.kernel.org
+Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC")
+Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/1641749107-31979-4-git-send-email-quic_mkshah@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 1a70a70ed056..7c798c966755 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1124,7 +1124,7 @@
+ 			qcom,tcs-offset = <0xd00>;
+ 			qcom,drv-id = <2>;
+ 			qcom,tcs-config = <ACTIVE_TCS  2>, <SLEEP_TCS   3>,
+-					  <WAKE_TCS    3>, <CONTROL_TCS 1>;
++					  <WAKE_TCS    3>, <CONTROL_TCS 0>;
+ 
+ 			rpmhcc: clock-controller {
+ 				compatible = "qcom,sm8350-rpmh-clk";
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch b/queue-5.16/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
new file mode 100644
index 00000000000..f9f385ecf81
--- /dev/null
+++ b/queue-5.16/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
@@ -0,0 +1,40 @@
+From 4d469a5f4a2a117e9766472d62a203372d273f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 14:25:58 -0600
+Subject: arm64: dts: rockchip: Fix SDIO regulator supply properties on
+ rk3399-firefly
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 37cbd3c522869247ed4525b5042ff4c6a276c813 ]
+
+A label reference without brackets is a path string, not a phandle as
+intended. Add the missing brackets.
+
+Fixes: a5002c41c383 ("arm64: dts: rockchip: add WiFi module support for Firefly-RK3399")
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220304202559.317749-1-robh@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-firefly.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+index c4dd2a6b4836..f81ce3240342 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+@@ -770,8 +770,8 @@
+ 	sd-uhs-sdr104;
+ 
+ 	/* Power supply */
+-	vqmmc-supply = &vcc1v8_s3;	/* IO line */
+-	vmmc-supply = &vcc_sdio;	/* card's power */
++	vqmmc-supply = <&vcc1v8_s3>;	/* IO line */
++	vmmc-supply = <&vcc_sdio>;	/* card's power */
+ 
+ 	#address-cells = <1>;
+ 	#size-cells = <0>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch b/queue-5.16/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch
new file mode 100644
index 00000000000..8d3dbe99e5c
--- /dev/null
+++ b/queue-5.16/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch
@@ -0,0 +1,75 @@
+From db0fe754e3d370205bd6b6760cd8e7599affb853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Feb 2022 19:44:00 +0800
+Subject: arm64/mm: avoid fixmap race condition when create pud mapping
+
+From: Jianyong Wu <jianyong.wu@arm.com>
+
+[ Upstream commit ee017ee353506fcec58e481673e4331ff198a80e ]
+
+The 'fixmap' is a global resource and is used recursively by
+create pud mapping(), leading to a potential race condition in the
+presence of a concurrent call to alloc_init_pud():
+
+kernel_init thread                          virtio-mem workqueue thread
+==================                          ===========================
+
+  alloc_init_pud(...)                       alloc_init_pud(...)
+  pudp = pud_set_fixmap_offset(...)         pudp = pud_set_fixmap_offset(...)
+  READ_ONCE(*pudp)
+  pud_clear_fixmap(...)
+                                            READ_ONCE(*pudp) // CRASH!
+
+As kernel may sleep during creating pud mapping, introduce a mutex lock to
+serialise use of the fixmap entries by alloc_init_pud(). However, there is
+no need for locking in early boot stage and it doesn't work well with
+KASLR enabled when early boot. So, enable lock when system_state doesn't
+equal to "SYSTEM_BOOTING".
+
+Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables")
+Link: https://lore.kernel.org/r/20220201114400.56885-1-jianyong.wu@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/mmu.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index 044d2021c20c..37b8230cda6a 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -63,6 +63,7 @@ static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused;
+ static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused;
+ 
+ static DEFINE_SPINLOCK(swapper_pgdir_lock);
++static DEFINE_MUTEX(fixmap_lock);
+ 
+ void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
+@@ -329,6 +330,12 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+ 	}
+ 	BUG_ON(p4d_bad(p4d));
+ 
++	/*
++	 * No need for locking during early boot. And it doesn't work as
++	 * expected with KASLR enabled.
++	 */
++	if (system_state != SYSTEM_BOOTING)
++		mutex_lock(&fixmap_lock);
+ 	pudp = pud_set_fixmap_offset(p4dp, addr);
+ 	do {
+ 		pud_t old_pud = READ_ONCE(*pudp);
+@@ -359,6 +366,8 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+ 	} while (pudp++, addr = next, addr != end);
+ 
+ 	pud_clear_fixmap();
++	if (system_state != SYSTEM_BOOTING)
++		mutex_unlock(&fixmap_lock);
+ }
+ 
+ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-module-remove-noload-from-linker-script.patch b/queue-5.16/arm64-module-remove-noload-from-linker-script.patch
new file mode 100644
index 00000000000..2891c9bd184
--- /dev/null
+++ b/queue-5.16/arm64-module-remove-noload-from-linker-script.patch
@@ -0,0 +1,54 @@
+From 44e7544d34f97536252808ce949efae46f645352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 00:12:09 -0800
+Subject: arm64: module: remove (NOLOAD) from linker script
+
+From: Fangrui Song <maskray@google.com>
+
+[ Upstream commit 4013e26670c590944abdab56c4fa797527b74325 ]
+
+On ELF, (NOLOAD) sets the section type to SHT_NOBITS[1]. It is conceptually
+inappropriate for .plt and .text.* sections which are always
+SHT_PROGBITS.
+
+In GNU ld, if PLT entries are needed, .plt will be SHT_PROGBITS anyway
+and (NOLOAD) will be essentially ignored. In ld.lld, since
+https://reviews.llvm.org/D118840 ("[ELF] Support (TYPE=<value>) to
+customize the output section type"), ld.lld will report a `section type
+mismatch` error. Just remove (NOLOAD) to fix the error.
+
+[1] https://lld.llvm.org/ELF/linker_script.html As of today, "The
+section should be marked as not loadable" on
+https://sourceware.org/binutils/docs/ld/Output-Section-Type.html is
+outdated for ELF.
+
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Fangrui Song <maskray@google.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20220218081209.354383-1-maskray@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/module.lds.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/module.lds.h b/arch/arm64/include/asm/module.lds.h
+index a11ccadd47d2..094701ec5500 100644
+--- a/arch/arm64/include/asm/module.lds.h
++++ b/arch/arm64/include/asm/module.lds.h
+@@ -1,8 +1,8 @@
+ SECTIONS {
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+-	.plt 0 (NOLOAD) : { BYTE(0) }
+-	.init.plt 0 (NOLOAD) : { BYTE(0) }
+-	.text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) }
++	.plt 0 : { BYTE(0) }
++	.init.plt 0 : { BYTE(0) }
++	.text.ftrace_trampoline 0 : { BYTE(0) }
+ #endif
+ 
+ #ifdef CONFIG_KASAN_SW_TAGS
+-- 
+2.34.1
+
diff --git a/queue-5.16/arm64-prevent-instrumentation-of-bp-hardening-callba.patch b/queue-5.16/arm64-prevent-instrumentation-of-bp-hardening-callba.patch
new file mode 100644
index 00000000000..657166f9b49
--- /dev/null
+++ b/queue-5.16/arm64-prevent-instrumentation-of-bp-hardening-callba.patch
@@ -0,0 +1,153 @@
+From dc03b420bb30626a5389ca122f38870f34fc87a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 18:10:28 +0000
+Subject: arm64: prevent instrumentation of bp hardening callbacks
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 614c0b9fee711dd89b1dd65c88ba83612a373fdc ]
+
+We may call arm64_apply_bp_hardening() early during entry (e.g. in
+el0_ia()) before it is safe to run instrumented code. Unfortunately this
+may result in running instrumented code in two cases:
+
+* The hardening callbacks called by arm64_apply_bp_hardening() are not
+  marked as `noinstr`, and have been observed to be instrumented when
+  compiled with either GCC or LLVM.
+
+* Since arm64_apply_bp_hardening() itself is only marked as `inline`
+  rather than `__always_inline`, it is possible that the compiler
+  decides to place it out-of-line, whereupon it may be instrumented.
+
+For example, with defconfig built with clang 13.0.0,
+call_hvc_arch_workaround_1() is compiled as:
+
+| <call_hvc_arch_workaround_1>:
+|        d503233f        paciasp
+|        f81f0ffe        str     x30, [sp, #-16]!
+|        320183e0        mov     w0, #0x80008000
+|        d503201f        nop
+|        d4000002        hvc     #0x0
+|        f84107fe        ldr     x30, [sp], #16
+|        d50323bf        autiasp
+|        d65f03c0        ret
+
+... but when CONFIG_FTRACE=y and CONFIG_KCOV=y this is compiled as:
+
+| <call_hvc_arch_workaround_1>:
+|        d503245f        bti     c
+|        d503201f        nop
+|        d503201f        nop
+|        d503233f        paciasp
+|        a9bf7bfd        stp     x29, x30, [sp, #-16]!
+|        910003fd        mov     x29, sp
+|        94000000        bl      0 <__sanitizer_cov_trace_pc>
+|        320183e0        mov     w0, #0x80008000
+|        d503201f        nop
+|        d4000002        hvc     #0x0
+|        a8c17bfd        ldp     x29, x30, [sp], #16
+|        d50323bf        autiasp
+|        d65f03c0        ret
+
+... with a patchable function entry registered with ftrace, and a direct
+call to __sanitizer_cov_trace_pc(). Neither of these are safe early
+during entry sequences.
+
+This patch avoids the unsafe instrumentation by marking
+arm64_apply_bp_hardening() as `__always_inline` and by marking the
+hardening functions as `noinstr`. This avoids the potential for
+instrumentation, and causes clang to consistently generate the function
+as with the defconfig sample.
+
+Note: in the defconfig compilation, when CONFIG_SVE=y, x30 is spilled to
+the stack without being placed in a frame record, which will result in a
+missing entry if call_hvc_arch_workaround_1() is backtraced. Similar is
+true of qcom_link_stack_sanitisation(), where inline asm spills the LR
+to a GPR prior to corrupting it. This is not a significant issue
+presently as we will only backtrace here if an exception is taken, and
+in such cases we may omit entries for other reasons today.
+
+The relevant hardening functions were introduced in commits:
+
+  ec82b567a74fbdff ("arm64: Implement branch predictor hardening for Falkor")
+  b092201e00206141 ("arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support")
+
+... and these were subsequently moved in commit:
+
+  d4647f0a2ad71110 ("arm64: Rewrite Spectre-v2 mitigation code")
+
+The arm64_apply_bp_hardening() function was introduced in commit:
+
+  0f15adbb2861ce6f ("arm64: Add skeleton to harden the branch predictor against aliasing attacks")
+
+... and was subsequently moved and reworked in commit:
+
+  6279017e807708a0 ("KVM: arm64: Move BP hardening helpers into spectre.h")
+
+Fixes: ec82b567a74fbdff ("arm64: Implement branch predictor hardening for Falkor")
+Fixes: b092201e00206141 ("arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support")
+Fixes: d4647f0a2ad71110 ("arm64: Rewrite Spectre-v2 mitigation code")
+Fixes: 0f15adbb2861ce6f ("arm64: Add skeleton to harden the branch predictor against aliasing attacks")
+Fixes: 6279017e807708a0 ("KVM: arm64: Move BP hardening helpers into spectre.h")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20220224181028.512873-1-mark.rutland@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/spectre.h | 3 ++-
+ arch/arm64/kernel/proton-pack.c  | 9 ++++++---
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/include/asm/spectre.h b/arch/arm64/include/asm/spectre.h
+index 86e0cc9b9c68..aa3d3607d5c8 100644
+--- a/arch/arm64/include/asm/spectre.h
++++ b/arch/arm64/include/asm/spectre.h
+@@ -67,7 +67,8 @@ struct bp_hardening_data {
+ 
+ DECLARE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
+ 
+-static inline void arm64_apply_bp_hardening(void)
++/* Called during entry so must be __always_inline */
++static __always_inline void arm64_apply_bp_hardening(void)
+ {
+ 	struct bp_hardening_data *d;
+ 
+diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
+index 6d45c63c6454..5777929d35bf 100644
+--- a/arch/arm64/kernel/proton-pack.c
++++ b/arch/arm64/kernel/proton-pack.c
+@@ -233,17 +233,20 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn)
+ 	__this_cpu_write(bp_hardening_data.slot, HYP_VECTOR_SPECTRE_DIRECT);
+ }
+ 
+-static void call_smc_arch_workaround_1(void)
++/* Called during entry so must be noinstr */
++static noinstr void call_smc_arch_workaround_1(void)
+ {
+ 	arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
+ }
+ 
+-static void call_hvc_arch_workaround_1(void)
++/* Called during entry so must be noinstr */
++static noinstr void call_hvc_arch_workaround_1(void)
+ {
+ 	arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
+ }
+ 
+-static void qcom_link_stack_sanitisation(void)
++/* Called during entry so must be noinstr */
++static noinstr void qcom_link_stack_sanitisation(void)
+ {
+ 	u64 tmp;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-acp-check-the-return-value-of-devm_kzalloc-in-a.patch b/queue-5.16/asoc-acp-check-the-return-value-of-devm_kzalloc-in-a.patch
new file mode 100644
index 00000000000..c1648d72da8
--- /dev/null
+++ b/queue-5.16/asoc-acp-check-the-return-value-of-devm_kzalloc-in-a.patch
@@ -0,0 +1,39 @@
+From 5473036a036ad8f4c1e328ccfedeaa2f90c106fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 05:16:45 -0800
+Subject: ASoC: acp: check the return value of devm_kzalloc() in
+ acp_legacy_dai_links_create()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 431f9a77a4a62694ce90742d1f4c5abe1b8b6612 ]
+
+The function devm_kzalloc() in acp_legacy_dai_links_create() can fail,
+so its return value should be checked.
+
+Fixes: d4c750f2c7d4 ("ASoC: amd: acp: Add generic machine driver support for ACP cards")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220225131645.27556-1-baijiaju1990@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-mach-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/amd/acp/acp-mach-common.c b/sound/soc/amd/acp/acp-mach-common.c
+index 7785f12aa006..55ad3c70f0ef 100644
+--- a/sound/soc/amd/acp/acp-mach-common.c
++++ b/sound/soc/amd/acp/acp-mach-common.c
+@@ -531,6 +531,8 @@ int acp_legacy_dai_links_create(struct snd_soc_card *card)
+ 		num_links++;
+ 
+ 	links = devm_kzalloc(dev, sizeof(struct snd_soc_dai_link) * num_links, GFP_KERNEL);
++	if (!links)
++		return -ENOMEM;
+ 
+ 	if (drv_data->hs_cpu_id == I2S_SP) {
+ 		links[i].name = "acp-headset-codec";
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-amd-fix-reference-to-pcm-buffer-address.patch b/queue-5.16/asoc-amd-fix-reference-to-pcm-buffer-address.patch
new file mode 100644
index 00000000000..9f066d5be6f
--- /dev/null
+++ b/queue-5.16/asoc-amd-fix-reference-to-pcm-buffer-address.patch
@@ -0,0 +1,40 @@
+From fa7e4ce347cb550ea3247479b6be6a729c6ef258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 17:13:03 +0800
+Subject: ASoC: amd: Fix reference to PCM buffer address
+
+From: Meng Tang <tangmeng@uniontech.com>
+
+[ Upstream commit 54e1bf9f6177a3ffbd920474f4481a25361163aa ]
+
+PCM buffers might be allocated dynamically when the buffer
+preallocation failed or a larger buffer is requested, and it's not
+guaranteed that substream->dma_buffer points to the actually used
+buffer.  The driver needs to refer to substream->runtime->dma_addr
+instead for the buffer address.
+
+Fixes: cab396d8b22c1 ("ASoC: amd: add ACP5x pcm dma driver ops")
+Signed-off-by: Meng Tang <tangmeng@uniontech.com>
+Link: https://lore.kernel.org/r/20220316091303.9745-1-tangmeng@uniontech.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/vangogh/acp5x-pcm-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/vangogh/acp5x-pcm-dma.c b/sound/soc/amd/vangogh/acp5x-pcm-dma.c
+index f10de38976cb..6abcc2133a2c 100644
+--- a/sound/soc/amd/vangogh/acp5x-pcm-dma.c
++++ b/sound/soc/amd/vangogh/acp5x-pcm-dma.c
+@@ -281,7 +281,7 @@ static int acp5x_dma_hw_params(struct snd_soc_component *component,
+ 		return -EINVAL;
+ 	}
+ 	size = params_buffer_bytes(params);
+-	rtd->dma_addr = substream->dma_buffer.addr;
++	rtd->dma_addr = substream->runtime->dma_addr;
+ 	rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+ 	config_acp5x_dma(rtd, substream->stream);
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-amd-vangogh-fix-uninitialized-symbol-warning-in.patch b/queue-5.16/asoc-amd-vangogh-fix-uninitialized-symbol-warning-in.patch
new file mode 100644
index 00000000000..dcd2a9b9c16
--- /dev/null
+++ b/queue-5.16/asoc-amd-vangogh-fix-uninitialized-symbol-warning-in.patch
@@ -0,0 +1,38 @@
+From 31420a085b2a6f951ff55ee33d56f6320bb1f142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 01:00:25 +0530
+Subject: ASoC: amd: vangogh: fix uninitialized symbol warning in machine
+ driver
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 6f989800639a7a29ab9a02e165b04dc144dd4f2b ]
+
+Fixed below smatch static checker warning.
+sound/soc/amd/vangogh/acp5x-mach.c:190 acp5x_cs35l41_hw_params()
+error: uninitialized symbol 'ret'.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20220225193054.24916-4-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/vangogh/acp5x-mach.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/amd/vangogh/acp5x-mach.c b/sound/soc/amd/vangogh/acp5x-mach.c
+index 14cf325e4b23..5d7a17755fa7 100644
+--- a/sound/soc/amd/vangogh/acp5x-mach.c
++++ b/sound/soc/amd/vangogh/acp5x-mach.c
+@@ -165,6 +165,7 @@ static int acp5x_cs35l41_hw_params(struct snd_pcm_substream *substream,
+ 	unsigned int num_codecs = rtd->num_codecs;
+ 	unsigned int bclk_val;
+ 
++	ret = 0;
+ 	for (i = 0; i < num_codecs; i++) {
+ 		codec_dai = asoc_rtd_to_codec(rtd, i);
+ 		if ((strcmp(codec_dai->name, "spi-VLV1776:00") == 0) ||
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-amd-vg-fix-for-pm-resume-callback-sequence.patch b/queue-5.16/asoc-amd-vg-fix-for-pm-resume-callback-sequence.patch
new file mode 100644
index 00000000000..8b3779d3089
--- /dev/null
+++ b/queue-5.16/asoc-amd-vg-fix-for-pm-resume-callback-sequence.patch
@@ -0,0 +1,119 @@
+From c961a7fc252e8efd746d04bcbcc37b4d24ea96ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 01:00:22 +0530
+Subject: ASoC: amd: vg: fix for pm resume callback sequence
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 83b713619ee1b15e09eae11a92a7f3305534223d ]
+
+The previous condition is used to cross check only the active
+stream status for I2S HS instance playback and capture use cases.
+
+Modified logic to invoke sequence for two i2s controller instances.
+
+This also fixes warnings reported by kernel robot:
+"warning: variable 'frmt_val' set but not used"
+"warning: variable 'reg_val' set but not used"
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20220225193054.24916-1-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/vangogh/acp5x-pcm-dma.c | 66 +++++++++++++--------------
+ 1 file changed, 33 insertions(+), 33 deletions(-)
+
+diff --git a/sound/soc/amd/vangogh/acp5x-pcm-dma.c b/sound/soc/amd/vangogh/acp5x-pcm-dma.c
+index 6abcc2133a2c..bfca4cf423cf 100644
+--- a/sound/soc/amd/vangogh/acp5x-pcm-dma.c
++++ b/sound/soc/amd/vangogh/acp5x-pcm-dma.c
+@@ -426,51 +426,51 @@ static int acp5x_audio_remove(struct platform_device *pdev)
+ static int __maybe_unused acp5x_pcm_resume(struct device *dev)
+ {
+ 	struct i2s_dev_data *adata;
+-	u32 val, reg_val, frmt_val;
++	struct i2s_stream_instance *rtd;
++	u32 val;
+ 
+-	reg_val = 0;
+-	frmt_val = 0;
+ 	adata = dev_get_drvdata(dev);
+ 
+ 	if (adata->play_stream && adata->play_stream->runtime) {
+-		struct i2s_stream_instance *rtd =
+-			adata->play_stream->runtime->private_data;
++		rtd = adata->play_stream->runtime->private_data;
+ 		config_acp5x_dma(rtd, SNDRV_PCM_STREAM_PLAYBACK);
+-		switch (rtd->i2s_instance) {
+-		case I2S_HS_INSTANCE:
+-			reg_val = ACP_HSTDM_ITER;
+-			frmt_val = ACP_HSTDM_TXFRMT;
+-			break;
+-		case I2S_SP_INSTANCE:
+-		default:
+-			reg_val = ACP_I2STDM_ITER;
+-			frmt_val = ACP_I2STDM_TXFRMT;
++		acp_writel((rtd->xfer_resolution  << 3), rtd->acp5x_base + ACP_HSTDM_ITER);
++		if (adata->tdm_mode == TDM_ENABLE) {
++			acp_writel(adata->tdm_fmt, adata->acp5x_base + ACP_HSTDM_TXFRMT);
++			val = acp_readl(adata->acp5x_base + ACP_HSTDM_ITER);
++			acp_writel(val | 0x2, adata->acp5x_base + ACP_HSTDM_ITER);
++		}
++	}
++	if (adata->i2ssp_play_stream && adata->i2ssp_play_stream->runtime) {
++		rtd = adata->i2ssp_play_stream->runtime->private_data;
++		config_acp5x_dma(rtd, SNDRV_PCM_STREAM_PLAYBACK);
++		acp_writel((rtd->xfer_resolution  << 3), rtd->acp5x_base + ACP_I2STDM_ITER);
++		if (adata->tdm_mode == TDM_ENABLE) {
++			acp_writel(adata->tdm_fmt, adata->acp5x_base + ACP_I2STDM_TXFRMT);
++			val = acp_readl(adata->acp5x_base + ACP_I2STDM_ITER);
++			acp_writel(val | 0x2, adata->acp5x_base + ACP_I2STDM_ITER);
+ 		}
+-		acp_writel((rtd->xfer_resolution  << 3),
+-			   rtd->acp5x_base + reg_val);
+ 	}
+ 
+ 	if (adata->capture_stream && adata->capture_stream->runtime) {
+-		struct i2s_stream_instance *rtd =
+-			adata->capture_stream->runtime->private_data;
++		rtd = adata->capture_stream->runtime->private_data;
+ 		config_acp5x_dma(rtd, SNDRV_PCM_STREAM_CAPTURE);
+-		switch (rtd->i2s_instance) {
+-		case I2S_HS_INSTANCE:
+-			reg_val = ACP_HSTDM_IRER;
+-			frmt_val = ACP_HSTDM_RXFRMT;
+-			break;
+-		case I2S_SP_INSTANCE:
+-		default:
+-			reg_val = ACP_I2STDM_IRER;
+-			frmt_val = ACP_I2STDM_RXFRMT;
++		acp_writel((rtd->xfer_resolution  << 3), rtd->acp5x_base + ACP_HSTDM_IRER);
++		if (adata->tdm_mode == TDM_ENABLE) {
++			acp_writel(adata->tdm_fmt, adata->acp5x_base + ACP_HSTDM_RXFRMT);
++			val = acp_readl(adata->acp5x_base + ACP_HSTDM_IRER);
++			acp_writel(val | 0x2, adata->acp5x_base + ACP_HSTDM_IRER);
+ 		}
+-		acp_writel((rtd->xfer_resolution  << 3),
+-			   rtd->acp5x_base + reg_val);
+ 	}
+-	if (adata->tdm_mode == TDM_ENABLE) {
+-		acp_writel(adata->tdm_fmt, adata->acp5x_base + frmt_val);
+-		val = acp_readl(adata->acp5x_base + reg_val);
+-		acp_writel(val | 0x2, adata->acp5x_base + reg_val);
++	if (adata->i2ssp_capture_stream && adata->i2ssp_capture_stream->runtime) {
++		rtd = adata->i2ssp_capture_stream->runtime->private_data;
++		config_acp5x_dma(rtd, SNDRV_PCM_STREAM_CAPTURE);
++		acp_writel((rtd->xfer_resolution  << 3), rtd->acp5x_base + ACP_I2STDM_IRER);
++		if (adata->tdm_mode == TDM_ENABLE) {
++			acp_writel(adata->tdm_fmt, adata->acp5x_base + ACP_I2STDM_RXFRMT);
++			val = acp_readl(adata->acp5x_base + ACP_I2STDM_IRER);
++			acp_writel(val | 0x2, adata->acp5x_base + ACP_I2STDM_IRER);
++		}
+ 	}
+ 	acp_writel(1, adata->acp5x_base + ACP_EXTERNAL_INTR_ENB);
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch b/queue-5.16/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
new file mode 100644
index 00000000000..a2fa5974001
--- /dev/null
+++ b/queue-5.16/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
@@ -0,0 +1,38 @@
+From bb59a59c0ceec668232cdac14927c9254475efca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:45:39 +0000
+Subject: ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ]
+
+This node pointer is returned by of_parse_phandle() with refcount
+incremented in this function.
+Calling of_node_put() to avoid the refcount leak.
+
+Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/sam9g20_wm8731.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
+index 915da92e1ec8..33e43013ff77 100644
+--- a/sound/soc/atmel/sam9g20_wm8731.c
++++ b/sound/soc/atmel/sam9g20_wm8731.c
+@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+ 	cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
+ 	if (!cpu_np) {
+ 		dev_err(&pdev->dev, "dai and pcm info missing\n");
++		of_node_put(codec_np);
+ 		return -EINVAL;
+ 	}
+ 	at91sam9g20ek_dai.cpus->of_node = cpu_np;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch b/queue-5.16/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch
new file mode 100644
index 00000000000..ebf0c6cf390
--- /dev/null
+++ b/queue-5.16/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch
@@ -0,0 +1,71 @@
+From bfa63ac0e8564c797c02ace9d9be62dcca1fe55a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 11:15:30 +0000
+Subject: ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 740dc3e846537c3743da98bf106f376023fd085c ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error path.
+
+Fixes: fdbcb3cba54b ("ASoC: atmel: machine driver for at91sam9x5-wm8731 boards")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220316111530.4551-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/sam9x5_wm8731.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c
+index 7c45dc4f8c1b..99310e40e7a6 100644
+--- a/sound/soc/atmel/sam9x5_wm8731.c
++++ b/sound/soc/atmel/sam9x5_wm8731.c
+@@ -142,7 +142,7 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev)
+ 	if (!cpu_np) {
+ 		dev_err(&pdev->dev, "atmel,ssc-controller node missing\n");
+ 		ret = -EINVAL;
+-		goto out;
++		goto out_put_codec_np;
+ 	}
+ 	dai->cpus->of_node = cpu_np;
+ 	dai->platforms->of_node = cpu_np;
+@@ -153,12 +153,9 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev)
+ 	if (ret != 0) {
+ 		dev_err(&pdev->dev, "Failed to set SSC %d for audio: %d\n",
+ 			ret, priv->ssc_id);
+-		goto out;
++		goto out_put_cpu_np;
+ 	}
+ 
+-	of_node_put(codec_np);
+-	of_node_put(cpu_np);
+-
+ 	ret = devm_snd_soc_register_card(&pdev->dev, card);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Platform device allocation failed\n");
+@@ -167,10 +164,14 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev)
+ 
+ 	dev_dbg(&pdev->dev, "%s ok\n", __func__);
+ 
+-	return ret;
++	goto out_put_cpu_np;
+ 
+ out_put_audio:
+ 	atmel_ssc_put_audio(priv->ssc_id);
++out_put_cpu_np:
++	of_node_put(cpu_np);
++out_put_codec_np:
++	of_node_put(codec_np);
+ out:
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-atmel-fix-error-handling-in-snd_proto_probe.patch b/queue-5.16/asoc-atmel-fix-error-handling-in-snd_proto_probe.patch
new file mode 100644
index 00000000000..26672698af5
--- /dev/null
+++ b/queue-5.16/asoc-atmel-fix-error-handling-in-snd_proto_probe.patch
@@ -0,0 +1,80 @@
+From c7f0652487c3dda1534a63111e5122f42cb5d4e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 01:39:48 +0000
+Subject: ASoC: atmel: Fix error handling in snd_proto_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit b0bfaf0544d08d093d6211d7ef8816fb0b5b6c75 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error paths.
+Fix this by calling of_node_put() in error handling too.
+
+Fixes: a45f8853a5f9 ("ASoC: Add driver for PROTO Audio CODEC (with a WM8731)")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220308013949.20323-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mikroe-proto.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/atmel/mikroe-proto.c b/sound/soc/atmel/mikroe-proto.c
+index f9331f7e80fe..5b513ff7fe2d 100644
+--- a/sound/soc/atmel/mikroe-proto.c
++++ b/sound/soc/atmel/mikroe-proto.c
+@@ -115,7 +115,8 @@ static int snd_proto_probe(struct platform_device *pdev)
+ 	cpu_np = of_parse_phandle(np, "i2s-controller", 0);
+ 	if (!cpu_np) {
+ 		dev_err(&pdev->dev, "i2s-controller missing\n");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto put_codec_node;
+ 	}
+ 	dai->cpus->of_node = cpu_np;
+ 	dai->platforms->of_node = cpu_np;
+@@ -125,7 +126,8 @@ static int snd_proto_probe(struct platform_device *pdev)
+ 						       &bitclkmaster, &framemaster);
+ 	if (bitclkmaster != framemaster) {
+ 		dev_err(&pdev->dev, "Must be the same bitclock and frame master\n");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto put_cpu_node;
+ 	}
+ 	if (bitclkmaster) {
+ 		if (codec_np == bitclkmaster)
+@@ -136,18 +138,20 @@ static int snd_proto_probe(struct platform_device *pdev)
+ 		dai_fmt |= snd_soc_daifmt_parse_clock_provider_as_flag(np, NULL);
+ 	}
+ 
+-	of_node_put(bitclkmaster);
+-	of_node_put(framemaster);
+-	dai->dai_fmt = dai_fmt;
+-
+-	of_node_put(codec_np);
+-	of_node_put(cpu_np);
+ 
++	dai->dai_fmt = dai_fmt;
+ 	ret = snd_soc_register_card(&snd_proto);
+ 	if (ret && ret != -EPROBE_DEFER)
+ 		dev_err(&pdev->dev,
+ 			"snd_soc_register_card() failed: %d\n", ret);
+ 
++
++put_cpu_node:
++	of_node_put(bitclkmaster);
++	of_node_put(framemaster);
++	of_node_put(cpu_np);
++put_codec_node:
++	of_node_put(codec_np);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch b/queue-5.16/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
new file mode 100644
index 00000000000..46317f015a3
--- /dev/null
+++ b/queue-5.16/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
@@ -0,0 +1,40 @@
+From c912509474fbc7edc912bfa4611a75d0ef53ed69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 17:06:37 +0800
+Subject: ASoC: atmel_ssc_dai: Handle errors for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit f9e2ca0640e59d19af0ff285ee5591ed39069b09 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error if fals.
+
+Fixes: cbaadf0f90d6 ("ASoC: atmel_ssc_dai: refactor the startup and shutdown")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301090637.3776558-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/atmel_ssc_dai.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index 26e2bc690d86..c1dea8d62416 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
+ 
+ 	/* Enable PMC peripheral clock for this SSC */
+ 	pr_debug("atmel_ssc_dai: Starting clock\n");
+-	clk_enable(ssc_p->ssc->clk);
++	ret = clk_enable(ssc_p->ssc->clk);
++	if (ret)
++		return ret;
++
+ 	ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
+ 
+ 	/* Reset the SSC unless initialized to keep it in a clean state */
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-check-for-error-pointer-after-calling-de.patch b/queue-5.16/asoc-codecs-check-for-error-pointer-after-calling-de.patch
new file mode 100644
index 00000000000..d424a7ffb7c
--- /dev/null
+++ b/queue-5.16/asoc-codecs-check-for-error-pointer-after-calling-de.patch
@@ -0,0 +1,71 @@
+From e1bdae64ac4f50525cf068f912a3d9eedc3fec07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 01:10:31 +0800
+Subject: ASoC: codecs: Check for error pointer after calling
+ devm_regmap_init_mmio
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit aa505ecccf2ae7546e0e262d574e18a9241f3005 ]
+
+Since the potential failure of the devm_regmap_init_mmio(), it will
+return error pointer and be assigned to the regmap.
+Then the error pointer will be dereferenced.
+For example rx->regmap will be used in rx_macro_mclk_enable().
+Therefore, it should be better to check it.
+
+Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro")
+Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro")
+Fixes: 809bcbcecebf ("ASoC: codecs: lpass-wsa-macro: Add support to WSA Macro")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220121171031.2826198-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c  | 2 ++
+ sound/soc/codecs/lpass-tx-macro.c  | 2 ++
+ sound/soc/codecs/lpass-wsa-macro.c | 2 ++
+ 3 files changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index 6ffe88345de5..2b272a82eabf 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -3542,6 +3542,8 @@ static int rx_macro_probe(struct platform_device *pdev)
+ 		return PTR_ERR(base);
+ 
+ 	rx->regmap = devm_regmap_init_mmio(dev, base, &rx_regmap_config);
++	if (IS_ERR(rx->regmap))
++		return PTR_ERR(rx->regmap);
+ 
+ 	dev_set_drvdata(dev, rx);
+ 
+diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
+index a4c0a155af56..9c96ab1bf84f 100644
+--- a/sound/soc/codecs/lpass-tx-macro.c
++++ b/sound/soc/codecs/lpass-tx-macro.c
+@@ -1821,6 +1821,8 @@ static int tx_macro_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	tx->regmap = devm_regmap_init_mmio(dev, base, &tx_regmap_config);
++	if (IS_ERR(tx->regmap))
++		return PTR_ERR(tx->regmap);
+ 
+ 	dev_set_drvdata(dev, tx);
+ 
+diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c
+index 75baf8eb7029..69d2915f40d8 100644
+--- a/sound/soc/codecs/lpass-wsa-macro.c
++++ b/sound/soc/codecs/lpass-wsa-macro.c
+@@ -2405,6 +2405,8 @@ static int wsa_macro_probe(struct platform_device *pdev)
+ 		return PTR_ERR(base);
+ 
+ 	wsa->regmap = devm_regmap_init_mmio(dev, base, &wsa_regmap_config);
++	if (IS_ERR(wsa->regmap))
++		return PTR_ERR(wsa->regmap);
+ 
+ 	dev_set_drvdata(dev, wsa);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-rx-macro-fix-accessing-array-out-of-boun.patch b/queue-5.16/asoc-codecs-rx-macro-fix-accessing-array-out-of-boun.patch
new file mode 100644
index 00000000000..89bef7cf7a0
--- /dev/null
+++ b/queue-5.16/asoc-codecs-rx-macro-fix-accessing-array-out-of-boun.patch
@@ -0,0 +1,66 @@
+From e7522394fdf17a5a9d8194481f30c5f7afc469af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:05 +0000
+Subject: ASoC: codecs: rx-macro: fix accessing array out of bounds for enum
+ type
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit bcfe5f76cc4051ea3f9eb5d2c8ea621641f290a5 ]
+
+Accessing enums using integer would result in array out of bounds access
+on platforms like aarch64 where sizeof(long) is 8 compared to enum size
+which is 4 bytes.
+
+Fixes: 4f692926f562 ("ASoC: codecs: lpass-rx-macro: add dapm widgets and route")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index 32e85d2e9b90..3a3dc0539d92 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -2272,7 +2272,7 @@ static int rx_macro_mux_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_dapm_to_component(widget->dapm);
+ 	struct rx_macro *rx = snd_soc_component_get_drvdata(component);
+ 
+-	ucontrol->value.integer.value[0] =
++	ucontrol->value.enumerated.item[0] =
+ 			rx->rx_port_value[widget->shift];
+ 	return 0;
+ }
+@@ -2284,7 +2284,7 @@ static int rx_macro_mux_put(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_dapm_to_component(widget->dapm);
+ 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ 	struct snd_soc_dapm_update *update = NULL;
+-	u32 rx_port_value = ucontrol->value.integer.value[0];
++	u32 rx_port_value = ucontrol->value.enumerated.item[0];
+ 	u32 aif_rst;
+ 	struct rx_macro *rx = snd_soc_component_get_drvdata(component);
+ 
+@@ -2396,7 +2396,7 @@ static int rx_macro_get_hph_pwr_mode(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+ 	struct rx_macro *rx = snd_soc_component_get_drvdata(component);
+ 
+-	ucontrol->value.integer.value[0] = rx->hph_pwr_mode;
++	ucontrol->value.enumerated.item[0] = rx->hph_pwr_mode;
+ 	return 0;
+ }
+ 
+@@ -2406,7 +2406,7 @@ static int rx_macro_put_hph_pwr_mode(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+ 	struct rx_macro *rx = snd_soc_component_get_drvdata(component);
+ 
+-	rx->hph_pwr_mode = ucontrol->value.integer.value[0];
++	rx->hph_pwr_mode = ucontrol->value.enumerated.item[0];
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-rx-macro-fix-accessing-compander-for-aux.patch b/queue-5.16/asoc-codecs-rx-macro-fix-accessing-compander-for-aux.patch
new file mode 100644
index 00000000000..5ec0f37369f
--- /dev/null
+++ b/queue-5.16/asoc-codecs-rx-macro-fix-accessing-compander-for-aux.patch
@@ -0,0 +1,42 @@
+From 26017700cd8a210fe9f07a237eb8a87058b02f64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:04 +0000
+Subject: ASoC: codecs: rx-macro: fix accessing compander for aux
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 42c709c4e1ce4c136891530646c9abd5dff3524f ]
+
+AUX interpolator does not have compander, so check before accessing
+compander data for this.
+
+Without this checkan array of out bounds access will be made in
+comp_enabled[] array.
+
+Fixes: 4f692926f562 ("ASoC: codecs: lpass-rx-macro: add dapm widgets and route")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index 2b272a82eabf..32e85d2e9b90 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -2039,6 +2039,10 @@ static int rx_macro_load_compander_coeff(struct snd_soc_component *component,
+ 	int i;
+ 	int hph_pwr_mode;
+ 
++	/* AUX does not have compander */
++	if (comp == INTERP_AUX)
++		return 0;
++
+ 	if (!rx->comp_enabled[comp])
+ 		return 0;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-va-macro-fix-accessing-array-out-of-boun.patch b/queue-5.16/asoc-codecs-va-macro-fix-accessing-array-out-of-boun.patch
new file mode 100644
index 00000000000..3ca23639751
--- /dev/null
+++ b/queue-5.16/asoc-codecs-va-macro-fix-accessing-array-out-of-boun.patch
@@ -0,0 +1,48 @@
+From 1ea00132a6ea67cfc006a4330c53f6e6ff512d82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:07 +0000
+Subject: ASoC: codecs: va-macro: fix accessing array out of bounds for enum
+ type
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 0ea5eff7c6063a8f124188424f8e4c6727f35051 ]
+
+Accessing enums using integer would result in array out of bounds access
+on platforms like aarch64 where sizeof(long) is 8 compared to enum size
+which is 4 bytes.
+
+Fixes: 908e6b1df26e ("ASoC: codecs: lpass-va-macro: Add support to VA Macro")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-va-macro.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c
+index 11147e35689b..e14c277e6a8b 100644
+--- a/sound/soc/codecs/lpass-va-macro.c
++++ b/sound/soc/codecs/lpass-va-macro.c
+@@ -780,7 +780,7 @@ static int va_macro_dec_mode_get(struct snd_kcontrol *kcontrol,
+ 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ 	int path = e->shift_l;
+ 
+-	ucontrol->value.integer.value[0] = va->dec_mode[path];
++	ucontrol->value.enumerated.item[0] = va->dec_mode[path];
+ 
+ 	return 0;
+ }
+@@ -789,7 +789,7 @@ static int va_macro_dec_mode_put(struct snd_kcontrol *kcontrol,
+ 				 struct snd_ctl_elem_value *ucontrol)
+ {
+ 	struct snd_soc_component *comp = snd_soc_kcontrol_component(kcontrol);
+-	int value = ucontrol->value.integer.value[0];
++	int value = ucontrol->value.enumerated.item[0];
+ 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ 	int path = e->shift_l;
+ 	struct va_macro *va = snd_soc_component_get_drvdata(comp);
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-wc938x-fix-accessing-array-out-of-bounds.patch b/queue-5.16/asoc-codecs-wc938x-fix-accessing-array-out-of-bounds.patch
new file mode 100644
index 00000000000..d2ac5d4b943
--- /dev/null
+++ b/queue-5.16/asoc-codecs-wc938x-fix-accessing-array-out-of-bounds.patch
@@ -0,0 +1,49 @@
+From 5cf3830bd15840125471b94abed039e232143bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:09 +0000
+Subject: ASoC: codecs: wc938x: fix accessing array out of bounds for enum type
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit cc587b7c8fbbe128f6bd0dad025a0caea5e6d164 ]
+
+Accessing enums using integer would result in array out of bounds access
+on platforms like aarch64 where sizeof(long) is 8 compared to enum size
+which is 4 bytes.
+
+Fix this by using enumerated items instead of integers.
+
+Fixes: e8ba1e05bdc0 ("ASoC: codecs: wcd938x: add basic controls")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-7-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index bbc261ab2025..54671bbf7471 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -2504,7 +2504,7 @@ static int wcd938x_tx_mode_get(struct snd_kcontrol *kcontrol,
+ 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ 	int path = e->shift_l;
+ 
+-	ucontrol->value.integer.value[0] = wcd938x->tx_mode[path];
++	ucontrol->value.enumerated.item[0] = wcd938x->tx_mode[path];
+ 
+ 	return 0;
+ }
+@@ -2528,7 +2528,7 @@ static int wcd938x_rx_hph_mode_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+ 	struct wcd938x_priv *wcd938x = snd_soc_component_get_drvdata(component);
+ 
+-	ucontrol->value.integer.value[0] = wcd938x->hph_mode;
++	ucontrol->value.enumerated.item[0] = wcd938x->hph_mode;
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch b/queue-5.16/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch
new file mode 100644
index 00000000000..4ee75916324
--- /dev/null
+++ b/queue-5.16/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch
@@ -0,0 +1,39 @@
+From 148c7ca4b8ed3d6acdf4c1dca5ba4c29eb1d50f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 08:36:31 +0000
+Subject: ASoC: codecs: wcd934x: Add missing of_node_put() in
+ wcd934x_codec_parse_data
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 9531a631379169d57756b2411178c6238655df88 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+This is similar to commit 64b92de9603f
+("ASoC: wcd9335: fix a leaked reference by adding missing of_node_put")
+
+Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220316083631.14103-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd934x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
+index 654d847a050e..7b99318070cf 100644
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -5888,6 +5888,7 @@ static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd)
+ 	}
+ 
+ 	wcd->sidev = of_slim_get_device(wcd->sdev->ctrl, ifc_dev_np);
++	of_node_put(ifc_dev_np);
+ 	if (!wcd->sidev) {
+ 		dev_err(dev, "Unable to get SLIM Interface device\n");
+ 		return -EINVAL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-wcd934x-fix-kcontrol-max-values.patch b/queue-5.16/asoc-codecs-wcd934x-fix-kcontrol-max-values.patch
new file mode 100644
index 00000000000..92682f8ed81
--- /dev/null
+++ b/queue-5.16/asoc-codecs-wcd934x-fix-kcontrol-max-values.patch
@@ -0,0 +1,49 @@
+From 4fe3af54b1cb845dc280d161cf4611f746c3938a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:11 +0000
+Subject: ASoC: codecs: wcd934x: fix kcontrol max values
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 61163c3e7480106804269182e24db05244866493 ]
+
+set "HPH Type" Kcontrol max value of WCD_MBHC_HPH_STEREO instead of UINT_MAX.
+set "HPHL/R Impedance" Kcontrols max value to INT_MAX instead of UINT_MAX as
+max field is integer type.
+
+Without this patch amixer for these controls will show -1 as max value to userspace.
+
+Fixes: 9fb9b1690f0b ("ASoC: codecs: wcd934x: add mbhc support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd934x.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
+index e63c6b723d76..68c9d694d379 100644
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -3023,14 +3023,14 @@ static int wcd934x_hph_impedance_get(struct snd_kcontrol *kcontrol,
+ 	return 0;
+ }
+ static const struct snd_kcontrol_new hph_type_detect_controls[] = {
+-	SOC_SINGLE_EXT("HPH Type", 0, 0, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPH Type", 0, 0, WCD_MBHC_HPH_STEREO, 0,
+ 		       wcd934x_get_hph_type, NULL),
+ };
+ 
+ static const struct snd_kcontrol_new impedance_detect_controls[] = {
+-	SOC_SINGLE_EXT("HPHL Impedance", 0, 0, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPHL Impedance", 0, 0, INT_MAX, 0,
+ 		       wcd934x_hph_impedance_get, NULL),
+-	SOC_SINGLE_EXT("HPHR Impedance", 0, 1, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPHR Impedance", 0, 1, INT_MAX, 0,
+ 		       wcd934x_hph_impedance_get, NULL),
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch b/queue-5.16/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch
new file mode 100644
index 00000000000..387c6839f44
--- /dev/null
+++ b/queue-5.16/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch
@@ -0,0 +1,46 @@
+From ec837fee5e08e45001a0cc009132bb2934a7c601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:12 +0000
+Subject: ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 4b0bec6088588a120d33db85b1f0d9f096d1df71 ]
+
+wcd934x_rx_hph_mode_put currently returns zero eventhough it changes the value.
+Fix this, so that change notifications are sent correctly.
+
+Fixes: 1cde8b822332 ("ASoC: wcd934x: add basic controls")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd934x.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c
+index 68c9d694d379..654d847a050e 100644
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -3308,13 +3308,16 @@ static int wcd934x_rx_hph_mode_put(struct snd_kcontrol *kc,
+ 
+ 	mode_val = ucontrol->value.enumerated.item[0];
+ 
++	if (mode_val == wcd->hph_mode)
++		return 0;
++
+ 	if (mode_val == 0) {
+ 		dev_err(wcd->dev, "Invalid HPH Mode, default to ClSH HiFi\n");
+ 		mode_val = CLS_H_LOHIFI;
+ 	}
+ 	wcd->hph_mode = mode_val;
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ static int slim_rx_mux_get(struct snd_kcontrol *kc,
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-codecs-wcd938x-fix-kcontrol-max-values.patch b/queue-5.16/asoc-codecs-wcd938x-fix-kcontrol-max-values.patch
new file mode 100644
index 00000000000..6245bbaa63a
--- /dev/null
+++ b/queue-5.16/asoc-codecs-wcd938x-fix-kcontrol-max-values.patch
@@ -0,0 +1,49 @@
+From 4a0cb221d2634b947f183be5e619013f42753a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 18:32:10 +0000
+Subject: ASoC: codecs: wcd938x: fix kcontrol max values
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit b0217519236924f77a8382b4004e43ef8fd0dcbb ]
+
+set "HPH Type" Kcontrol max value of WCD_MBHC_HPH_STEREO instead of UINT_MAX.
+set "HPHL/R Impedance" Kcontrols max value to INT_MAX instead of UINT_MAX as
+max field is integer type.
+
+Without this patch amixer for these controls will show -1 as max value to userspace.
+
+Fixes: bcee7ed09b8e ("ASoC: codecs: wcd938x: add Multi Button Headset Control support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220222183212.11580-8-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd938x.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wcd938x.c b/sound/soc/codecs/wcd938x.c
+index 54671bbf7471..4480c118ed5d 100644
+--- a/sound/soc/codecs/wcd938x.c
++++ b/sound/soc/codecs/wcd938x.c
+@@ -3577,14 +3577,14 @@ static int wcd938x_hph_impedance_get(struct snd_kcontrol *kcontrol,
+ }
+ 
+ static const struct snd_kcontrol_new hph_type_detect_controls[] = {
+-	SOC_SINGLE_EXT("HPH Type", 0, 0, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPH Type", 0, 0, WCD_MBHC_HPH_STEREO, 0,
+ 		       wcd938x_get_hph_type, NULL),
+ };
+ 
+ static const struct snd_kcontrol_new impedance_detect_controls[] = {
+-	SOC_SINGLE_EXT("HPHL Impedance", 0, 0, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPHL Impedance", 0, 0, INT_MAX, 0,
+ 		       wcd938x_hph_impedance_get, NULL),
+-	SOC_SINGLE_EXT("HPHR Impedance", 0, 1, UINT_MAX, 0,
++	SOC_SINGLE_EXT("HPHR Impedance", 0, 1, INT_MAX, 0,
+ 		       wcd938x_hph_impedance_get, NULL),
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-cs35l41-fix-gpio2-configuration.patch b/queue-5.16/asoc-cs35l41-fix-gpio2-configuration.patch
new file mode 100644
index 00000000000..4a6a74e9aa7
--- /dev/null
+++ b/queue-5.16/asoc-cs35l41-fix-gpio2-configuration.patch
@@ -0,0 +1,39 @@
+From 78ddc6cd2cd76300b0bf6be966754104b6572098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:30:40 +0000
+Subject: ASoC: cs35l41: Fix GPIO2 configuration
+
+From: David Rhodes <drhodes@opensource.cirrus.com>
+
+[ Upstream commit 03a7895ee701e873c88c06bdb830ff40adb2be73 ]
+
+Fix GPIO2 polarity and direction configuration
+
+Fixes: fe1024d50477b ("ASoC: cs35l41: Combine adjacent register writes")
+Signed-off-by: David Rhodes <drhodes@opensource.cirrus.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220303173059.269657-2-tanureal@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c
+index 9c4d481f7614..3188a8ba3507 100644
+--- a/sound/soc/codecs/cs35l41.c
++++ b/sound/soc/codecs/cs35l41.c
+@@ -1071,8 +1071,8 @@ static int cs35l41_irq_gpio_config(struct cs35l41_private *cs35l41)
+ 
+ 	regmap_update_bits(cs35l41->regmap, CS35L41_GPIO2_CTRL1,
+ 			   CS35L41_GPIO_POL_MASK | CS35L41_GPIO_DIR_MASK,
+-			   irq_gpio_cfg1->irq_pol_inv << CS35L41_GPIO_POL_SHIFT |
+-			   !irq_gpio_cfg1->irq_out_en << CS35L41_GPIO_DIR_SHIFT);
++			   irq_gpio_cfg2->irq_pol_inv << CS35L41_GPIO_POL_SHIFT |
++			   !irq_gpio_cfg2->irq_out_en << CS35L41_GPIO_DIR_SHIFT);
+ 
+ 	regmap_update_bits(cs35l41->regmap, CS35L41_GPIO_PAD_CONTROL,
+ 			   CS35L41_GPIO1_CTRL_MASK | CS35L41_GPIO2_CTRL_MASK,
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-cs35l41-fix-max-number-of-tx-channels.patch b/queue-5.16/asoc-cs35l41-fix-max-number-of-tx-channels.patch
new file mode 100644
index 00000000000..d0c8daf69f3
--- /dev/null
+++ b/queue-5.16/asoc-cs35l41-fix-max-number-of-tx-channels.patch
@@ -0,0 +1,37 @@
+From 74f214d6dc96dc6af328b18d88080a44b3b40095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:30:41 +0000
+Subject: ASoC: cs35l41: Fix max number of TX channels
+
+From: Lucas Tanure <tanureal@opensource.cirrus.com>
+
+[ Upstream commit 16639d39bdf577168d3fe34315917a94365c8d19 ]
+
+This device only has 4 TX channels.
+
+Fixes: fe1024d50477b ("ASoC: cs35l41: Combine adjacent register writes")
+Signed-off-by: Lucas Tanure <tanureal@opensource.cirrus.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220303173059.269657-3-tanureal@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l41.c b/sound/soc/codecs/cs35l41.c
+index 3188a8ba3507..8a2d0f9dd9a6 100644
+--- a/sound/soc/codecs/cs35l41.c
++++ b/sound/soc/codecs/cs35l41.c
+@@ -1113,7 +1113,7 @@ static struct snd_soc_dai_driver cs35l41_dai[] = {
+ 		.capture = {
+ 			.stream_name = "AMP Capture",
+ 			.channels_min = 1,
+-			.channels_max = 8,
++			.channels_max = 4,
+ 			.rates = SNDRV_PCM_RATE_KNOT,
+ 			.formats = CS35L41_TX_FORMATS,
+ 		},
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-cs42l42-report-full-jack-status-when-plug-is-de.patch b/queue-5.16/asoc-cs42l42-report-full-jack-status-when-plug-is-de.patch
new file mode 100644
index 00000000000..3663a41286e
--- /dev/null
+++ b/queue-5.16/asoc-cs42l42-report-full-jack-status-when-plug-is-de.patch
@@ -0,0 +1,67 @@
+From f4498f115a6107e9c041ecf8d640556b8c2577fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jan 2022 12:04:10 +0000
+Subject: ASoC: cs42l42: Report full jack status when plug is detected
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 8d06f797f844d04a961f201f886f7f9985edc9bf ]
+
+When a plug event is detect report the full state of all status
+bits, don't assume that there will have been a previous unplug
+event to clear all the bits. Report the state of both HEADPHONE
+and MICROPHONE bits according to detected type, and clear all the
+button status bits. The current button status is already checked
+and reported at the end of the function.
+
+During a system suspend the jack could be unplugged and plugged,
+possibly changing the jack type. On resume the interrupt status will
+indicate a plug event - there will not be an unplug event to clear
+the bits.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220121120412.672284-2-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index a63fba4e6c9c..eb170d106396 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -1630,7 +1630,11 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
+ 
+ 	mutex_lock(&cs42l42->jack_detect_mutex);
+ 
+-	/* Check auto-detect status */
++	/*
++	 * Check auto-detect status. Don't assume a previous unplug event has
++	 * cleared the flags. If the jack is unplugged and plugged during
++	 * system suspend there won't have been an unplug event.
++	 */
+ 	if ((~masks[5]) & irq_params_table[5].mask) {
+ 		if (stickies[5] & CS42L42_HSDET_AUTO_DONE_MASK) {
+ 			cs42l42_process_hs_type_detect(cs42l42);
+@@ -1638,11 +1642,15 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data)
+ 			case CS42L42_PLUG_CTIA:
+ 			case CS42L42_PLUG_OMTP:
+ 				snd_soc_jack_report(cs42l42->jack, SND_JACK_HEADSET,
+-						    SND_JACK_HEADSET);
++						    SND_JACK_HEADSET |
++						    SND_JACK_BTN_0 | SND_JACK_BTN_1 |
++						    SND_JACK_BTN_2 | SND_JACK_BTN_3);
+ 				break;
+ 			case CS42L42_PLUG_HEADPHONE:
+ 				snd_soc_jack_report(cs42l42->jack, SND_JACK_HEADPHONE,
+-						    SND_JACK_HEADPHONE);
++						    SND_JACK_HEADSET |
++						    SND_JACK_BTN_0 | SND_JACK_BTN_1 |
++						    SND_JACK_BTN_2 | SND_JACK_BTN_3);
+ 				break;
+ 			default:
+ 				break;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch b/queue-5.16/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
new file mode 100644
index 00000000000..6e7403f4520
--- /dev/null
+++ b/queue-5.16/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
@@ -0,0 +1,42 @@
+From 4efd202a076fa2116d8b1e36f2396e90cd0da8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 14:21:57 +0200
+Subject: ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit 9a1e13440a4f2e7566fd4c5eae6a53e6400e08a4 ]
+
+Even if struct snd_dmaengine_pcm_config is used, prepare_slave_config()
+callback might not be set. Check if this callback is set before using it.
+
+Fixes: fa654e085300 ("ASoC: dmaengine-pcm: Provide default config")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220307122202.2251639-2-codrin.ciubotariu@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-generic-dmaengine-pcm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index c54c8ca8d715..359987bf76d1 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -86,10 +86,10 @@ static int dmaengine_pcm_hw_params(struct snd_soc_component *component,
+ 
+ 	memset(&slave_config, 0, sizeof(slave_config));
+ 
+-	if (!pcm->config)
+-		prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+-	else
++	if (pcm->config && pcm->config->prepare_slave_config)
+ 		prepare_slave_config = pcm->config->prepare_slave_config;
++	else
++		prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+ 
+ 	if (prepare_slave_config) {
+ 		int ret = prepare_slave_config(substream, params, &slave_config);
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-dwc-i2s-handle-errors-for-clk_enable.patch b/queue-5.16/asoc-dwc-i2s-handle-errors-for-clk_enable.patch
new file mode 100644
index 00000000000..06720360be4
--- /dev/null
+++ b/queue-5.16/asoc-dwc-i2s-handle-errors-for-clk_enable.patch
@@ -0,0 +1,61 @@
+From 69caa90a366b96fc1c7eb4958c2cd4f903eccba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 16:47:42 +0800
+Subject: ASoC: dwc-i2s: Handle errors for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 45ea97d74313bae681328b0c36fa348036777644 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it, as same as clk_prepare_enable().
+
+Fixes: c9afc1834e81 ("ASoC: dwc: Disallow building designware_pcm as a module")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301084742.3751939-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/dwc/dwc-i2s.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c
+index 5cb58929090d..1edac3e10f34 100644
+--- a/sound/soc/dwc/dwc-i2s.c
++++ b/sound/soc/dwc/dwc-i2s.c
+@@ -403,9 +403,13 @@ static int dw_i2s_runtime_suspend(struct device *dev)
+ static int dw_i2s_runtime_resume(struct device *dev)
+ {
+ 	struct dw_i2s_dev *dw_dev = dev_get_drvdata(dev);
++	int ret;
+ 
+-	if (dw_dev->capability & DW_I2S_MASTER)
+-		clk_enable(dw_dev->clk);
++	if (dw_dev->capability & DW_I2S_MASTER) {
++		ret = clk_enable(dw_dev->clk);
++		if (ret)
++			return ret;
++	}
+ 	return 0;
+ }
+ 
+@@ -422,10 +426,13 @@ static int dw_i2s_resume(struct snd_soc_component *component)
+ {
+ 	struct dw_i2s_dev *dev = snd_soc_component_get_drvdata(component);
+ 	struct snd_soc_dai *dai;
+-	int stream;
++	int stream, ret;
+ 
+-	if (dev->capability & DW_I2S_MASTER)
+-		clk_enable(dev->clk);
++	if (dev->capability & DW_I2S_MASTER) {
++		ret = clk_enable(dev->clk);
++		if (ret)
++			return ret;
++	}
+ 
+ 	for_each_component_dais(component, dai) {
+ 		for_each_pcm_streams(stream)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-fsi-add-check-for-clk_enable.patch b/queue-5.16/asoc-fsi-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..a11fa6c99da
--- /dev/null
+++ b/queue-5.16/asoc-fsi-add-check-for-clk_enable.patch
@@ -0,0 +1,60 @@
+From 86b708c28829849c024fcece247df502738bb74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 14:28:44 +0800
+Subject: ASoC: fsi: Add check for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 405afed8a728f23cfaa02f75bbc8bdd6b7322123 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: ab6f6d85210c ("ASoC: fsi: add master clock control functions")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220302062844.46869-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/fsi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
+index cdf3b7f69ba7..e9a1eb6bdf66 100644
+--- a/sound/soc/sh/fsi.c
++++ b/sound/soc/sh/fsi.c
+@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev,
+ 			return ret;
+ 		}
+ 
+-		clk_enable(clock->xck);
+-		clk_enable(clock->ick);
+-		clk_enable(clock->div);
++		ret = clk_enable(clock->xck);
++		if (ret)
++			goto err;
++		ret = clk_enable(clock->ick);
++		if (ret)
++			goto disable_xck;
++		ret = clk_enable(clock->div);
++		if (ret)
++			goto disable_ick;
+ 
+ 		clock->count++;
+ 	}
+ 
+ 	return ret;
++
++disable_ick:
++	clk_disable(clock->ick);
++disable_xck:
++	clk_disable(clock->xck);
++err:
++	return ret;
+ }
+ 
+ static int fsi_clk_disable(struct device *dev,
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-fsl_spdif-disable-tx-clock-when-stop.patch b/queue-5.16/asoc-fsl_spdif-disable-tx-clock-when-stop.patch
new file mode 100644
index 00000000000..fed5a85bf65
--- /dev/null
+++ b/queue-5.16/asoc-fsl_spdif-disable-tx-clock-when-stop.patch
@@ -0,0 +1,41 @@
+From 1d422e5f05cef21e61dca860667ea6290155820e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 10:37:43 +0800
+Subject: ASoC: fsl_spdif: Disable TX clock when stop
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 6ddf611219ba8f7c8fa0d26b39710a641e7d37a5 ]
+
+The TX clock source may be changed in next case, need to
+disable it when stop, otherwise the TX may not work after
+changing the clock source, error log is:
+
+aplay: pcm_write:2058: write error: Input/output error
+
+Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/1646879863-27711-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_spdif.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
+index d178b479c8bd..06d4a014f296 100644
+--- a/sound/soc/fsl/fsl_spdif.c
++++ b/sound/soc/fsl/fsl_spdif.c
+@@ -610,6 +610,8 @@ static void fsl_spdif_shutdown(struct snd_pcm_substream *substream,
+ 		mask = SCR_TXFIFO_AUTOSYNC_MASK | SCR_TXFIFO_CTRL_MASK |
+ 			SCR_TXSEL_MASK | SCR_USRC_SEL_MASK |
+ 			SCR_TXFIFO_FSEL_MASK;
++		/* Disable TX clock */
++		regmap_update_bits(regmap, REG_SPDIF_STC, STC_TXCLK_ALL_EN_MASK, 0);
+ 	} else {
+ 		scr = SCR_RXFIFO_OFF | SCR_RXFIFO_CTL_ZERO;
+ 		mask = SCR_RXFIFO_FSEL_MASK | SCR_RXFIFO_AUTOSYNC_MASK|
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch b/queue-5.16/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
new file mode 100644
index 00000000000..d7e75a7a480
--- /dev/null
+++ b/queue-5.16/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
@@ -0,0 +1,36 @@
+From 164c4bbb5b1b81e0e9ae7cbabe9a9ae57f9d8783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 09:19:02 +0000
+Subject: ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 3b891513f95cba3944e72c1139ea706d04f3781b ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 7e7292dba215 ("ASoC: fsl: add imx-es8328 machine driver")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Link: https://lore.kernel.org/r/20220310091902.129299-1-wangwensheng4@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-es8328.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c
+index 09c674ee79f1..168973035e35 100644
+--- a/sound/soc/fsl/imx-es8328.c
++++ b/sound/soc/fsl/imx-es8328.c
+@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev)
+ 	if (int_port > MUX_PORT_MAX || int_port == 0) {
+ 		dev_err(dev, "mux-int-port: hardware only has %d mux ports\n",
+ 			MUX_PORT_MAX);
++		ret = -EINVAL;
+ 		goto fail;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-revert-asoc-intel-sof_es8336-add-quirk-fo.patch b/queue-5.16/asoc-intel-revert-asoc-intel-sof_es8336-add-quirk-fo.patch
new file mode 100644
index 00000000000..0596945e00b
--- /dev/null
+++ b/queue-5.16/asoc-intel-revert-asoc-intel-sof_es8336-add-quirk-fo.patch
@@ -0,0 +1,51 @@
+From 43d9359c5dc5c23d4be05c7a5e445d261f654e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 13:26:03 -0600
+Subject: ASoC: Intel: Revert "ASoC: Intel: sof_es8336: add quirk for Huawei
+ D15 2021"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 1b5283483a782f6560999d8d5965b1874d104812 ]
+
+This reverts commit ce6a70bfce21bb4edb7c0f29ecfb0522fa34ab71.
+
+The next patch will add run-time detection of the required SSP and
+this hard-coded quirk is not needed.
+
+Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220308192610.392950-14-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index e6d599f0cd26..20d577eaab6d 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -247,14 +247,6 @@ static const struct dmi_system_id sof_es8336_quirk_table[] = {
+ 					SOF_ES8336_TGL_GPIO_QUIRK |
+ 					SOF_ES8336_ENABLE_DMIC)
+ 	},
+-	{
+-		.callback = sof_es8336_quirk_cb,
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
+-			DMI_MATCH(DMI_BOARD_NAME, "BOHB-WAX9-PCB-B2"),
+-		},
+-		.driver_data = (void *)SOF_ES8336_SSP_CODEC(0)
+-	},
+ 	{}
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-soc-acpi-add-more-acpi-hids-for-es83x6-de.patch b/queue-5.16/asoc-intel-soc-acpi-add-more-acpi-hids-for-es83x6-de.patch
new file mode 100644
index 00000000000..e73e5dc4d82
--- /dev/null
+++ b/queue-5.16/asoc-intel-soc-acpi-add-more-acpi-hids-for-es83x6-de.patch
@@ -0,0 +1,162 @@
+From 7c5eb26818f02ba1631a96290a70833a68ca89b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 13:25:58 -0600
+Subject: ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 1cedb6eabf0f2dd8285d3bb0ce1abd2369529084 ]
+
+We only saw ESSX8336 so far, but now with reports of 'ESSX8326' we
+need to expand to a full list. Let's reuse the 'snd_soc_acpi_codecs'
+structure to store the information.
+
+Note that ES8326 will need a dedicated codec driver, but the plan is
+to use the same machine driver for all Everest Audio devices.
+
+Reported-by: anthony tonitch <d.tonitch@gmail.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220308192610.392950-9-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-bxt-match.c | 7 ++++++-
+ sound/soc/intel/common/soc-acpi-intel-cml-match.c | 7 ++++++-
+ sound/soc/intel/common/soc-acpi-intel-glk-match.c | 7 ++++++-
+ sound/soc/intel/common/soc-acpi-intel-jsl-match.c | 7 ++++++-
+ sound/soc/intel/common/soc-acpi-intel-tgl-match.c | 7 ++++++-
+ 5 files changed, 30 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-bxt-match.c b/sound/soc/intel/common/soc-acpi-intel-bxt-match.c
+index 342d34052204..04a92e74d99b 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-bxt-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-bxt-match.c
+@@ -41,6 +41,11 @@ static struct snd_soc_acpi_mach *apl_quirk(void *arg)
+ 	return mach;
+ }
+ 
++static const struct snd_soc_acpi_codecs essx_83x6 = {
++	.num_codecs = 3,
++	.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
++};
++
+ static const struct snd_soc_acpi_codecs bxt_codecs = {
+ 	.num_codecs = 1,
+ 	.codecs = {"MX98357A"}
+@@ -83,7 +88,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_bxt_machines[] = {
+ 		.sof_tplg_filename = "sof-apl-tdf8532.tplg",
+ 	},
+ 	{
+-		.id = "ESSX8336",
++		.comp_ids = &essx_83x6,
+ 		.drv_name = "sof-essx8336",
+ 		.sof_fw_filename = "sof-apl.ri",
+ 		.sof_tplg_filename = "sof-apl-es8336.tplg",
+diff --git a/sound/soc/intel/common/soc-acpi-intel-cml-match.c b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
+index 4eebc79d4b48..14395833d89e 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-cml-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
+@@ -9,6 +9,11 @@
+ #include <sound/soc-acpi.h>
+ #include <sound/soc-acpi-intel-match.h>
+ 
++static const struct snd_soc_acpi_codecs essx_83x6 = {
++	.num_codecs = 3,
++	.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
++};
++
+ static const struct snd_soc_acpi_codecs rt1011_spk_codecs = {
+ 	.num_codecs = 1,
+ 	.codecs = {"10EC1011"}
+@@ -82,7 +87,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_machines[] = {
+ 		.sof_tplg_filename = "sof-cml-da7219-max98390.tplg",
+ 	},
+ 	{
+-		.id = "ESSX8336",
++		.comp_ids = &essx_83x6,
+ 		.drv_name = "sof-essx8336",
+ 		.sof_fw_filename = "sof-cml.ri",
+ 		.sof_tplg_filename = "sof-cml-es8336.tplg",
+diff --git a/sound/soc/intel/common/soc-acpi-intel-glk-match.c b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+index 8492b7e2a945..7aa6a870d5a5 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-glk-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+@@ -9,6 +9,11 @@
+ #include <sound/soc-acpi.h>
+ #include <sound/soc-acpi-intel-match.h>
+ 
++static const struct snd_soc_acpi_codecs essx_83x6 = {
++	.num_codecs = 3,
++	.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
++};
++
+ static const struct snd_soc_acpi_codecs glk_codecs = {
+ 	.num_codecs = 1,
+ 	.codecs = {"MX98357A"}
+@@ -58,7 +63,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = {
+ 		.sof_tplg_filename = "sof-glk-cs42l42.tplg",
+ 	},
+ 	{
+-		.id = "ESSX8336",
++		.comp_ids = &essx_83x6,
+ 		.drv_name = "sof-essx8336",
+ 		.sof_fw_filename = "sof-glk.ri",
+ 		.sof_tplg_filename = "sof-glk-es8336.tplg",
+diff --git a/sound/soc/intel/common/soc-acpi-intel-jsl-match.c b/sound/soc/intel/common/soc-acpi-intel-jsl-match.c
+index 278ec196da7b..9d0d0e1437a4 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-jsl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-jsl-match.c
+@@ -9,6 +9,11 @@
+ #include <sound/soc-acpi.h>
+ #include <sound/soc-acpi-intel-match.h>
+ 
++static const struct snd_soc_acpi_codecs essx_83x6 = {
++	.num_codecs = 3,
++	.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
++};
++
+ static const struct snd_soc_acpi_codecs jsl_7219_98373_codecs = {
+ 	.num_codecs = 1,
+ 	.codecs = {"MX98373"}
+@@ -87,7 +92,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_jsl_machines[] = {
+ 		.sof_tplg_filename = "sof-jsl-cs42l42-mx98360a.tplg",
+ 	},
+ 	{
+-		.id = "ESSX8336",
++		.comp_ids = &essx_83x6,
+ 		.drv_name = "sof-essx8336",
+ 		.sof_fw_filename = "sof-jsl.ri",
+ 		.sof_tplg_filename = "sof-jsl-es8336.tplg",
+diff --git a/sound/soc/intel/common/soc-acpi-intel-tgl-match.c b/sound/soc/intel/common/soc-acpi-intel-tgl-match.c
+index da31bb3cca17..e2658bca6931 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-tgl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-tgl-match.c
+@@ -10,6 +10,11 @@
+ #include <sound/soc-acpi-intel-match.h>
+ #include "soc-acpi-intel-sdw-mockup-match.h"
+ 
++static const struct snd_soc_acpi_codecs essx_83x6 = {
++	.num_codecs = 3,
++	.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
++};
++
+ static const struct snd_soc_acpi_codecs tgl_codecs = {
+ 	.num_codecs = 1,
+ 	.codecs = {"MX98357A"}
+@@ -389,7 +394,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_tgl_machines[] = {
+ 		.sof_tplg_filename = "sof-tgl-rt1011-rt5682.tplg",
+ 	},
+ 	{
+-		.id = "ESSX8336",
++		.comp_ids = &essx_83x6,
+ 		.drv_name = "sof-essx8336",
+ 		.sof_fw_filename = "sof-tgl.ri",
+ 		.sof_tplg_filename = "sof-tgl-es8336.tplg",
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-sof_es8336-add-quirk-for-huawei-d15-2021.patch b/queue-5.16/asoc-intel-sof_es8336-add-quirk-for-huawei-d15-2021.patch
new file mode 100644
index 00000000000..53701e2fbfc
--- /dev/null
+++ b/queue-5.16/asoc-intel-sof_es8336-add-quirk-for-huawei-d15-2021.patch
@@ -0,0 +1,42 @@
+From 9e2be0055544dee83684d31c2b9428305b587f10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Dec 2021 14:09:50 +0100
+Subject: ASoC: Intel: sof_es8336: add quirk for Huawei D15 2021
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit ce6a70bfce21bb4edb7c0f29ecfb0522fa34ab71 ]
+
+Huawei D15 uses SSP_CODEC(0).
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Link: https://lore.kernel.org/r/d560a1c76edb633c37acf04a9a82518b6233a719.1640351150.git.mchehab@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 20d577eaab6d..e6d599f0cd26 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -247,6 +247,14 @@ static const struct dmi_system_id sof_es8336_quirk_table[] = {
+ 					SOF_ES8336_TGL_GPIO_QUIRK |
+ 					SOF_ES8336_ENABLE_DMIC)
+ 	},
++	{
++		.callback = sof_es8336_quirk_cb,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"),
++			DMI_MATCH(DMI_BOARD_NAME, "BOHB-WAX9-PCB-B2"),
++		},
++		.driver_data = (void *)SOF_ES8336_SSP_CODEC(0)
++	},
+ 	{}
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-sof_es8336-log-all-quirks.patch b/queue-5.16/asoc-intel-sof_es8336-log-all-quirks.patch
new file mode 100644
index 00000000000..5adae8d27eb
--- /dev/null
+++ b/queue-5.16/asoc-intel-sof_es8336-log-all-quirks.patch
@@ -0,0 +1,46 @@
+From 519d2ae5311d9fe7e700a72fd268926097701146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 13:26:05 -0600
+Subject: ASoC: Intel: sof_es8336: log all quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 9c818d849192491a8799b1cb14ca0f7aead4fb09 ]
+
+We only logged the SSP quirk, make sure the GPIO and DMIC quirks are
+exposed.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220308192610.392950-16-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 46e453915f82..764560439d46 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -63,7 +63,12 @@ static const struct acpi_gpio_mapping *gpio_mapping = acpi_es8336_gpios;
+ 
+ static void log_quirks(struct device *dev)
+ {
+-	dev_info(dev, "quirk SSP%ld",  SOF_ES8336_SSP_CODEC(quirk));
++	dev_info(dev, "quirk mask %#lx\n", quirk);
++	dev_info(dev, "quirk SSP%ld\n",  SOF_ES8336_SSP_CODEC(quirk));
++	if (quirk & SOF_ES8336_ENABLE_DMIC)
++		dev_info(dev, "quirk DMIC enabled\n");
++	if (quirk & SOF_ES8336_TGL_GPIO_QUIRK)
++		dev_info(dev, "quirk TGL GPIO enabled\n");
+ }
+ 
+ static int sof_es8316_speaker_power_event(struct snd_soc_dapm_widget *w,
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-sof_es8336-use-nhlt-information-to-set-dm.patch b/queue-5.16/asoc-intel-sof_es8336-use-nhlt-information-to-set-dm.patch
new file mode 100644
index 00000000000..47f64bd8682
--- /dev/null
+++ b/queue-5.16/asoc-intel-sof_es8336-use-nhlt-information-to-set-dm.patch
@@ -0,0 +1,129 @@
+From 74f8e20c85e01c5efd9b056ce74c99a1f545e6fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 13:26:04 -0600
+Subject: ASoC: Intel: sof_es8336: use NHLT information to set dmic and SSP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 651c304df7f6e3fbb4779527efa3eb128ef91329 ]
+
+Since we see a proliferation of devices with various configurations,
+we want to automatically set the DMIC and SSP information. This patch
+relies on the information extracted from NHLT and partially reverts
+existing DMI quirks added by commit a164137ce91a ("ASoC: Intel: add
+machine driver for SOF+ES8336")
+
+Note that NHLT can report multiple SSPs, choosing from the
+ssp_link_mask in an MSB-first manner was found experimentally to work
+fine.
+
+The only thing that cannot be detected is the GPIO type, and users may
+want to use the quirk override parameter if the 'wrong' solution is
+provided.
+
+Tested-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220308192610.392950-15-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 56 +++++++++++++++++++++--------
+ 1 file changed, 41 insertions(+), 15 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 20d577eaab6d..46e453915f82 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -228,24 +228,25 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ 	return 1;
+ }
+ 
++/*
++ * this table should only be used to add GPIO or jack-detection quirks
++ * that cannot be detected from ACPI tables. The SSP and DMIC
++ * information are providing by the platform driver and are aligned
++ * with the topology used.
++ *
++ * If the GPIO support is missing, the quirk parameter can be used to
++ * enable speakers. In that case it's recommended to keep the SSP and DMIC
++ * information consistent, overriding the SSP and DMIC can only be done
++ * if the topology file is modified as well.
++ */
+ static const struct dmi_system_id sof_es8336_quirk_table[] = {
+-	{
+-		.callback = sof_es8336_quirk_cb,
+-		.matches = {
+-			DMI_MATCH(DMI_SYS_VENDOR, "CHUWI Innovation And Technology"),
+-			DMI_MATCH(DMI_BOARD_NAME, "Hi10 X"),
+-		},
+-		.driver_data = (void *)SOF_ES8336_SSP_CODEC(2)
+-	},
+ 	{
+ 		.callback = sof_es8336_quirk_cb,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "IP3 tech"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "WN1"),
+ 		},
+-		.driver_data = (void *)(SOF_ES8336_SSP_CODEC(0) |
+-					SOF_ES8336_TGL_GPIO_QUIRK |
+-					SOF_ES8336_ENABLE_DMIC)
++		.driver_data = (void *)(SOF_ES8336_TGL_GPIO_QUIRK)
+ 	},
+ 	{}
+ };
+@@ -470,11 +471,33 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ 	card = &sof_es8336_card;
+ 	card->dev = dev;
+ 
+-	if (!dmi_check_system(sof_es8336_quirk_table))
+-		quirk = SOF_ES8336_SSP_CODEC(2);
++	/* check GPIO DMI quirks */
++	dmi_check_system(sof_es8336_quirk_table);
+ 
+-	if (quirk & SOF_ES8336_ENABLE_DMIC)
+-		dmic_be_num = 2;
++	if (!mach->mach_params.i2s_link_mask) {
++		dev_warn(dev, "No I2S link information provided, using SSP0. This may need to be modified with the quirk module parameter\n");
++	} else {
++		/*
++		 * Set configuration based on platform NHLT.
++		 * In this machine driver, we can only support one SSP for the
++		 * ES8336 link, the else-if below are intentional.
++		 * In some cases multiple SSPs can be reported by NHLT, starting MSB-first
++		 * seems to pick the right connection.
++		 */
++		unsigned long ssp = 0;
++
++		if (mach->mach_params.i2s_link_mask & BIT(2))
++			ssp = SOF_ES8336_SSP_CODEC(2);
++		else if (mach->mach_params.i2s_link_mask & BIT(1))
++			ssp = SOF_ES8336_SSP_CODEC(1);
++		else  if (mach->mach_params.i2s_link_mask & BIT(0))
++			ssp = SOF_ES8336_SSP_CODEC(0);
++
++		quirk |= ssp;
++	}
++
++	if (mach->mach_params.dmic_num)
++		quirk |= SOF_ES8336_ENABLE_DMIC;
+ 
+ 	if (quirk_override != -1) {
+ 		dev_info(dev, "Overriding quirk 0x%lx => 0x%x\n",
+@@ -483,6 +506,9 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ 	}
+ 	log_quirks(dev);
+ 
++	if (quirk & SOF_ES8336_ENABLE_DMIC)
++		dmic_be_num = 2;
++
+ 	sof_es8336_card.num_links += dmic_be_num + hdmi_num;
+ 	dai_links = sof_card_dai_links_create(dev,
+ 					      SOF_ES8336_SSP_CODEC(quirk),
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-intel-sof_sdw-fix-quirks-for-2022-hp-spectre-x3.patch b/queue-5.16/asoc-intel-sof_sdw-fix-quirks-for-2022-hp-spectre-x3.patch
new file mode 100644
index 00000000000..7e2bcd0f5ae
--- /dev/null
+++ b/queue-5.16/asoc-intel-sof_sdw-fix-quirks-for-2022-hp-spectre-x3.patch
@@ -0,0 +1,54 @@
+From 87e597aaa93e53a260116b16d43fe810403cb99d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 14:45:32 -0600
+Subject: ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13"
+
+From: Anthony I Gilea <i@cpp.in>
+
+[ Upstream commit ce73ef6ec67104d1fcc4c5911d77ce83288a0998 ]
+
+HP changed the DMI identification for 2022 devices:
+Product Name: HP Spectre x360 Conv 13-ap0001na
+Product Name: 8709
+This patch relaxes the DMI_MATCH criterion to work with all versions of this product.
+
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Signed-off-by: Anthony I Gilea <i@cpp.in>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220304204532.54675-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c   | 2 +-
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 0ca2a3e3a02e..747983743a14 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -59,7 +59,7 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ 	{
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Conv"),
+ 		},
+ 		.driver_data = (void *)intel_tgl_bios,
+ 	},
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 54eefaff62a7..182e23bc2f34 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -184,7 +184,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ 		.callback = sof_sdw_quirk_cb,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Conv"),
+ 		},
+ 		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+ 					SOF_SDW_PCH_DMIC |
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-madera-add-dependencies-on-mfd.patch b/queue-5.16/asoc-madera-add-dependencies-on-mfd.patch
new file mode 100644
index 00000000000..1bf3a2c05d0
--- /dev/null
+++ b/queue-5.16/asoc-madera-add-dependencies-on-mfd.patch
@@ -0,0 +1,60 @@
+From 2bde986dde81e8e438e9df1642e22a855c5809c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 11:50:25 +0000
+Subject: ASoC: madera: Add dependencies on MFD
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ec29170c724ca30305fc3a19ba2ee73ecac65509 ]
+
+The Madera CODECs use regmap_irq functions but nothing ensures that
+regmap_irq is built into the kernel. Add dependencies on the ASoC
+symbols for the relevant MFD component. There is no point in building
+the ASoC driver if the MFD doesn't support it and the MFD part contains
+the necessary dependencies to ensure everything is built into the
+kernel.
+
+Reported-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220203115025.16464-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/Kconfig | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
+index 3a610ba183ff..0d4e1fb9befc 100644
+--- a/sound/soc/codecs/Kconfig
++++ b/sound/soc/codecs/Kconfig
+@@ -707,6 +707,7 @@ config SND_SOC_CS4349
+ 
+ config SND_SOC_CS47L15
+ 	tristate
++	depends on MFD_CS47L15
+ 
+ config SND_SOC_CS47L24
+ 	tristate
+@@ -714,15 +715,19 @@ config SND_SOC_CS47L24
+ 
+ config SND_SOC_CS47L35
+ 	tristate
++	depends on MFD_CS47L35
+ 
+ config SND_SOC_CS47L85
+ 	tristate
++	depends on MFD_CS47L85
+ 
+ config SND_SOC_CS47L90
+ 	tristate
++	depends on MFD_CS47L90
+ 
+ config SND_SOC_CS47L92
+ 	tristate
++	depends on MFD_CS47L92
+ 
+ # Cirrus Logic Quad-Channel ADC
+ config SND_SOC_CS53L30
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-max98927-add-missing-header-file.patch b/queue-5.16/asoc-max98927-add-missing-header-file.patch
new file mode 100644
index 00000000000..a491b2a937b
--- /dev/null
+++ b/queue-5.16/asoc-max98927-add-missing-header-file.patch
@@ -0,0 +1,53 @@
+From bbdca16ffea2acd92b267961f824af999688a4a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 00:02:59 -0800
+Subject: ASoC: max98927: add missing header file
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bb45f689fa62110c263c86070bfcb9ecbb6e1e23 ]
+
+Add a header file that provides the missing function prototypes
+and macro to fix these build errors (seen on arch/alpha/):
+
+../sound/soc/codecs/max98927.c: In function 'max98927_i2c_probe':
+../sound/soc/codecs/max98927.c:902:19: error: implicit declaration of function 'devm_gpiod_get_optional'; did you mean 'devm_regulator_get_optional'? [-Werror=implicit-function-declaration]
+  902 |                 = devm_gpiod_get_optional(&i2c->dev, "reset", GPIOD_OUT_HIGH);
+      |                   ^~~~~~~~~~~~~~~~~~~~~~~
+../sound/soc/codecs/max98927.c:902:63: error: 'GPIOD_OUT_HIGH' undeclared (first use in this function); did you mean 'GPIOF_INIT_HIGH'?
+  902 |                 = devm_gpiod_get_optional(&i2c->dev, "reset", GPIOD_OUT_HIGH);
+      |                                                               ^~~~~~~~~~~~~~
+../sound/soc/codecs/max98927.c:909:17: error: implicit declaration of function 'gpiod_set_value_cansleep'; did you mean 'gpio_set_value_cansleep'? [-Werror=implicit-function-declaration]
+  909 |                 gpiod_set_value_cansleep(max98927->reset_gpio, 0);
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 4d67dc1998f1 ("ASoC: max98927: Handle reset gpio when probing i2c")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Alejandro Tafalla <atafalla@dnyon.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: alsa-devel@alsa-project.org
+Link: https://lore.kernel.org/r/20220129080259.19964-1-rdunlap@infradead.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98927.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/max98927.c b/sound/soc/codecs/max98927.c
+index 5ba5f876eab8..fd84780bf689 100644
+--- a/sound/soc/codecs/max98927.c
++++ b/sound/soc/codecs/max98927.c
+@@ -16,6 +16,7 @@
+ #include <sound/pcm_params.h>
+ #include <sound/soc.h>
+ #include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
+ #include <linux/of_gpio.h>
+ #include <sound/tlv.h>
+ #include "max98927.h"
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-mediatek-mt8192-mt6359-fix-error-handling-in-mt.patch b/queue-5.16/asoc-mediatek-mt8192-mt6359-fix-error-handling-in-mt.patch
new file mode 100644
index 00000000000..92e5dd5c698
--- /dev/null
+++ b/queue-5.16/asoc-mediatek-mt8192-mt6359-fix-error-handling-in-mt.patch
@@ -0,0 +1,76 @@
+From aaf68792d7286069cf46356cc62c985db592b0b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 01:52:22 +0000
+Subject: ASoC: mediatek: mt8192-mt6359: Fix error handling in
+ mt8192_mt6359_dev_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit e45ac7831ff3e2934d58cce319c17c8ec763c95c ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error paths.
+Fix this by calling of_node_put() in error handling too.
+
+Fixes: 4e28491a7a19 ("ASoC: mediatek: mt8192-mt6359: fix device_node leak")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Link: https://lore.kernel.org/r/20220308015224.23585-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mt8192/mt8192-mt6359-rt1015-rt5682.c       | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+index ab449d0e4e9b..c1d225b49851 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
++++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+@@ -1116,8 +1116,10 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
+-	if (!card)
+-		return -EINVAL;
++	if (!card) {
++		ret = -EINVAL;
++		goto put_platform_node;
++	}
+ 	card->dev = &pdev->dev;
+ 
+ 	hdmi_codec = of_parse_phandle(pdev->dev.of_node,
+@@ -1159,20 +1161,24 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
++	if (!priv) {
++		ret = -ENOMEM;
++		goto put_hdmi_codec;
++	}
+ 	snd_soc_card_set_drvdata(card, priv);
+ 
+ 	ret = mt8192_afe_gpio_init(&pdev->dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "init gpio error %d\n", ret);
+-		return ret;
++		goto put_hdmi_codec;
+ 	}
+ 
+ 	ret = devm_snd_soc_register_card(&pdev->dev, card);
+ 
+-	of_node_put(platform_node);
++put_hdmi_codec:
+ 	of_node_put(hdmi_codec);
++put_platform_node:
++	of_node_put(platform_node);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-mediatek-use-of_device_get_match_data.patch b/queue-5.16/asoc-mediatek-use-of_device_get_match_data.patch
new file mode 100644
index 00000000000..07925d20ec6
--- /dev/null
+++ b/queue-5.16/asoc-mediatek-use-of_device_get_match_data.patch
@@ -0,0 +1,102 @@
+From 1c1f102ef7ece00c6872e5eea9d05c953d9abcf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Dec 2021 14:21:53 +0800
+Subject: ASoC: mediatek: use of_device_get_match_data()
+
+From: Tzung-Bi Shih <tzungbi@google.com>
+
+[ Upstream commit 3667a037e50a31555276a7989435126e501f0f15 ]
+
+Uses of_device_get_match_data() helper to clean some boilerplate code.
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20211227062153.3887447-1-tzungbi@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c         | 7 ++-----
+ sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c | 7 ++-----
+ sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c    | 7 ++-----
+ 3 files changed, 6 insertions(+), 15 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+index bda103211e0b..0ab8b050b305 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+@@ -685,7 +685,6 @@ static int mt8183_da7219_max98357_dev_probe(struct platform_device *pdev)
+ 	struct snd_soc_dai_link *dai_link;
+ 	struct mt8183_da7219_max98357_priv *priv;
+ 	struct pinctrl *pinctrl;
+-	const struct of_device_id *match;
+ 	int ret, i;
+ 
+ 	platform_node = of_parse_phandle(pdev->dev.of_node,
+@@ -695,11 +694,9 @@ static int mt8183_da7219_max98357_dev_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	match = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev);
+-	if (!match || !match->data)
++	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
++	if (!card)
+ 		return -EINVAL;
+-
+-	card = (struct snd_soc_card *)match->data;
+ 	card->dev = &pdev->dev;
+ 
+ 	hdmi_codec = of_parse_phandle(pdev->dev.of_node,
+diff --git a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+index 9f0bf15fe465..8c81c5528f6e 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+@@ -637,7 +637,6 @@ mt8183_mt6358_ts3a227_max98357_dev_probe(struct platform_device *pdev)
+ 	struct device_node *platform_node, *ec_codec, *hdmi_codec;
+ 	struct snd_soc_dai_link *dai_link;
+ 	struct mt8183_mt6358_ts3a227_max98357_priv *priv;
+-	const struct of_device_id *match;
+ 	int ret, i;
+ 
+ 	platform_node = of_parse_phandle(pdev->dev.of_node,
+@@ -647,11 +646,9 @@ mt8183_mt6358_ts3a227_max98357_dev_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	match = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev);
+-	if (!match || !match->data)
++	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
++	if (!card)
+ 		return -EINVAL;
+-
+-	card = (struct snd_soc_card *)match->data;
+ 	card->dev = &pdev->dev;
+ 
+ 	ec_codec = of_parse_phandle(pdev->dev.of_node, "mediatek,ec-codec", 0);
+diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+index 24a5d0adec1b..ab449d0e4e9b 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
++++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+@@ -1106,7 +1106,6 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
+ 	struct device_node *platform_node, *hdmi_codec;
+ 	int ret, i;
+ 	struct snd_soc_dai_link *dai_link;
+-	const struct of_device_id *match;
+ 	struct mt8192_mt6359_priv *priv;
+ 
+ 	platform_node = of_parse_phandle(pdev->dev.of_node,
+@@ -1116,11 +1115,9 @@ static int mt8192_mt6359_dev_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	match = of_match_device(pdev->dev.driver->of_match_table, &pdev->dev);
+-	if (!match || !match->data)
++	card = (struct snd_soc_card *)of_device_get_match_data(&pdev->dev);
++	if (!card)
+ 		return -EINVAL;
+-
+-	card = (struct snd_soc_card *)match->data;
+ 	card->dev = &pdev->dev;
+ 
+ 	hdmi_codec = of_parse_phandle(pdev->dev.of_node,
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch b/queue-5.16/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
new file mode 100644
index 00000000000..feef287e23a
--- /dev/null
+++ b/queue-5.16/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
@@ -0,0 +1,80 @@
+From 3ea2eb35baffdea8f56c888f813de0f15335ed67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 04:19:24 +0000
+Subject: ASoC: msm8916-wcd-analog: Fix error handling in
+ pm8916_wcd_analog_spmi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 9ebd62d60edcd4d9c75485e5ccd0b79581ad3c49 ]
+
+In the error handling path, the clk_prepare_enable() function
+call should be balanced by a corresponding 'clk_disable_unprepare()'
+call , as already done in the remove function.
+
+Fixes: de66b3455023 ("ASoC: codecs: msm8916-wcd-analog: add MBHC support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220316041924.17560-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index 3ddd822240e3..971b8360b5b1 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -1221,8 +1221,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq_byname(pdev, "mbhc_switch_int");
+-	if (irq < 0)
+-		return irq;
++	if (irq < 0) {
++		ret = irq;
++		goto err_disable_clk;
++	}
+ 
+ 	ret = devm_request_threaded_irq(dev, irq, NULL,
+ 			       pm8916_mbhc_switch_irq_handler,
+@@ -1234,8 +1236,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 
+ 	if (priv->mbhc_btn_enabled) {
+ 		irq = platform_get_irq_byname(pdev, "mbhc_but_press_det");
+-		if (irq < 0)
+-			return irq;
++		if (irq < 0) {
++			ret = irq;
++			goto err_disable_clk;
++		}
+ 
+ 		ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				       mbhc_btn_press_irq_handler,
+@@ -1246,8 +1250,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 			dev_err(dev, "cannot request mbhc button press irq\n");
+ 
+ 		irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det");
+-		if (irq < 0)
+-			return irq;
++		if (irq < 0) {
++			ret = irq;
++			goto err_disable_clk;
++		}
+ 
+ 		ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				       mbhc_btn_release_irq_handler,
+@@ -1264,6 +1270,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 	return devm_snd_soc_register_component(dev, &pm8916_wcd_analog,
+ 				      pm8916_wcd_analog_dai,
+ 				      ARRAY_SIZE(pm8916_wcd_analog_dai));
++
++err_disable_clk:
++	clk_disable_unprepare(priv->mclk);
++	return ret;
+ }
+ 
+ static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch b/queue-5.16/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
new file mode 100644
index 00000000000..62d53e7fa5b
--- /dev/null
+++ b/queue-5.16/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
@@ -0,0 +1,48 @@
+From 8fc3ca47b2c226e4232411e68da04efc51af82da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 08:45:22 +0000
+Subject: ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
+ msm8916_wcd_digital_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 375a347da4889f64d86e1ab7f4e6702b6e9bf299 ]
+
+Fix the missing clk_disable_unprepare() before return
+from msm8916_wcd_digital_probe in the error handling case.
+
+Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307084523.28687-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-digital.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
+index fcc10c8bc625..9ad7fc0baf07 100644
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ 	ret = clk_prepare_enable(priv->mclk);
+ 	if (ret < 0) {
+ 		dev_err(dev, "failed to enable mclk %d\n", ret);
+-		return ret;
++		goto err_clk;
+ 	}
+ 
+ 	dev_set_drvdata(dev, priv);
+@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ 	return devm_snd_soc_register_component(dev, &msm8916_wcd_digital,
+ 				      msm8916_wcd_digital_dai,
+ 				      ARRAY_SIZE(msm8916_wcd_digital_dai));
++err_clk:
++	clk_disable_unprepare(priv->ahbclk);
++	return ret;
+ }
+ 
+ static int msm8916_wcd_digital_remove(struct platform_device *pdev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch b/queue-5.16/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
new file mode 100644
index 00000000000..9009743f26c
--- /dev/null
+++ b/queue-5.16/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
@@ -0,0 +1,43 @@
+From f674fcd7a115a39065ece4604bfa6c5914c5645e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 02:01:44 +0000
+Subject: ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6ae0a4d8fec551ec581d620f0eb1fe31f755551c ]
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error paths.
+For example, when codec_np is NULL, saif_np[0] and saif_np[1]
+are not NULL, it will cause leaks.
+
+of_node_put() will check if the node pointer is NULL, so we can
+call it directly to release the refcount of regular pointers.
+
+Fixes: e968194b45c4 ("ASoC: mxs: add device tree support for mxs-sgtl5000")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220308020146.26496-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mxs/mxs-sgtl5000.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c
+index a6407f4388de..fb721bc49949 100644
+--- a/sound/soc/mxs/mxs-sgtl5000.c
++++ b/sound/soc/mxs/mxs-sgtl5000.c
+@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev)
+ 	codec_np = of_parse_phandle(np, "audio-codec", 0);
+ 	if (!saif_np[0] || !saif_np[1] || !codec_np) {
+ 		dev_err(&pdev->dev, "phandle missing or invalid\n");
++		of_node_put(codec_np);
++		of_node_put(saif_np[0]);
++		of_node_put(saif_np[1]);
+ 		return -EINVAL;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-mxs-saif-handle-errors-for-clk_enable.patch b/queue-5.16/asoc-mxs-saif-handle-errors-for-clk_enable.patch
new file mode 100644
index 00000000000..3513e901798
--- /dev/null
+++ b/queue-5.16/asoc-mxs-saif-handle-errors-for-clk_enable.patch
@@ -0,0 +1,40 @@
+From 26ef28978bc7c2a3d24fbf58c16bfafaee22d2cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 16:17:17 +0800
+Subject: ASoC: mxs-saif: Handle errors for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2ecf362d220317debf5da376e0390e9f7a3f7b29 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it, like mxs_saif_trigger().
+
+Fixes: d0ba4c014934 ("ASoC: mxs-saif: set a base clock rate for EXTMASTER mode work")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301081717.3727190-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mxs/mxs-saif.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
+index 6a2d24d48964..879c1221a809 100644
+--- a/sound/soc/mxs/mxs-saif.c
++++ b/sound/soc/mxs/mxs-saif.c
+@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream,
+ 		* basic clock which should be fast enough for the internal
+ 		* logic.
+ 		*/
+-		clk_enable(saif->clk);
++		ret = clk_enable(saif->clk);
++		if (ret)
++			return ret;
++
+ 		ret = clk_set_rate(saif->clk, 24000000);
+ 		clk_disable(saif->clk);
+ 		if (ret)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-rk817-fix-missing-clk_disable_unprepare-in-rk81.patch b/queue-5.16/asoc-rk817-fix-missing-clk_disable_unprepare-in-rk81.patch
new file mode 100644
index 00000000000..72e9b65a145
--- /dev/null
+++ b/queue-5.16/asoc-rk817-fix-missing-clk_disable_unprepare-in-rk81.patch
@@ -0,0 +1,47 @@
+From 8198a63856cadf443461a26281b07965c2899ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 09:01:30 +0000
+Subject: ASoC: rk817: Fix missing clk_disable_unprepare() in
+ rk817_platform_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit a6b44a2518a08348bd0f0401e4d2b99233bbabc2 ]
+
+Fix the missing clk_disable_unprepare() before return
+from rk817_platform_probe() in the error handling case.
+
+Fixes: 0d6a04da9b25 ("ASoC: Add Rockchip rk817 audio CODEC support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Tested-by: Chris Morgan <macromorgan@hotmail.com>
+Link: https://lore.kernel.org/r/20220307090146.4104-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rk817_codec.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rk817_codec.c b/sound/soc/codecs/rk817_codec.c
+index 03f24edfe4f6..8fffe378618d 100644
+--- a/sound/soc/codecs/rk817_codec.c
++++ b/sound/soc/codecs/rk817_codec.c
+@@ -508,12 +508,14 @@ static int rk817_platform_probe(struct platform_device *pdev)
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "%s() register codec error %d\n",
+ 			__func__, ret);
+-		goto err_;
++		goto err_clk;
+ 	}
+ 
+ 	return 0;
+-err_:
+ 
++err_clk:
++	clk_disable_unprepare(rk817_codec_data->mclk);
++err_:
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-rockchip-fix-pm-usage-reference-of-rockchip_i2s.patch b/queue-5.16/asoc-rockchip-fix-pm-usage-reference-of-rockchip_i2s.patch
new file mode 100644
index 00000000000..f6b560f683d
--- /dev/null
+++ b/queue-5.16/asoc-rockchip-fix-pm-usage-reference-of-rockchip_i2s.patch
@@ -0,0 +1,41 @@
+From e7cb81cba19bf68d21a8b07ad2c5b0de7738dbe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 10:54:15 +0800
+Subject: ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume
+
+From: zhangqilong <zhangqilong3@huawei.com>
+
+[ Upstream commit cc5d8ac95663a5813c696008bc524b794d471215 ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes:081068fd64140 ("ASoC: rockchip: add support for i2s-tdm controller")
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20220315025415.2593762-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s_tdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s_tdm.c b/sound/soc/rockchip/rockchip_i2s_tdm.c
+index 5f9cb5c4c7f0..d3b710406941 100644
+--- a/sound/soc/rockchip/rockchip_i2s_tdm.c
++++ b/sound/soc/rockchip/rockchip_i2s_tdm.c
+@@ -1738,7 +1738,7 @@ static int __maybe_unused rockchip_i2s_tdm_resume(struct device *dev)
+ 	struct rk_i2s_tdm_dev *i2s_tdm = dev_get_drvdata(dev);
+ 	int ret;
+ 
+-	ret = pm_runtime_get_sync(dev);
++	ret = pm_runtime_resume_and_get(dev);
+ 	if (ret < 0)
+ 		return ret;
+ 	ret = regcache_sync(i2s_tdm->regmap);
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch b/queue-5.16/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch
new file mode 100644
index 00000000000..46a7cc8e4ed
--- /dev/null
+++ b/queue-5.16/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch
@@ -0,0 +1,67 @@
+From caf4d8756ae90ba66dd47f27f7b0f6ce94ceb450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 08:35:52 +0000
+Subject: ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in
+ rockchip_i2s_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit f725d20579807a68afbe5dba69e78b8fa05f5ef0 ]
+
+Fix the missing clk_disable_unprepare() before return
+from rockchip_i2s_probe() in the error handling case.
+
+Fixes: 01605ad12875 ("ASoC: rockchip-i2s: enable "hclk" for rockchip I2S controller")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307083553.26009-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index a6d7656c206e..4ce5d2579387 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -716,19 +716,23 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ 	i2s->mclk = devm_clk_get(&pdev->dev, "i2s_clk");
+ 	if (IS_ERR(i2s->mclk)) {
+ 		dev_err(&pdev->dev, "Can't retrieve i2s master clock\n");
+-		return PTR_ERR(i2s->mclk);
++		ret = PTR_ERR(i2s->mclk);
++		goto err_clk;
+ 	}
+ 
+ 	regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+-	if (IS_ERR(regs))
+-		return PTR_ERR(regs);
++	if (IS_ERR(regs)) {
++		ret = PTR_ERR(regs);
++		goto err_clk;
++	}
+ 
+ 	i2s->regmap = devm_regmap_init_mmio(&pdev->dev, regs,
+ 					    &rockchip_i2s_regmap_config);
+ 	if (IS_ERR(i2s->regmap)) {
+ 		dev_err(&pdev->dev,
+ 			"Failed to initialise managed register map\n");
+-		return PTR_ERR(i2s->regmap);
++		ret = PTR_ERR(i2s->regmap);
++		goto err_clk;
+ 	}
+ 
+ 	i2s->bclk_ratio = 64;
+@@ -768,7 +772,8 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ 		i2s_runtime_suspend(&pdev->dev);
+ err_pm_disable:
+ 	pm_runtime_disable(&pdev->dev);
+-
++err_clk:
++	clk_disable_unprepare(i2s->hclk);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch b/queue-5.16/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
new file mode 100644
index 00000000000..c9c5f586d3a
--- /dev/null
+++ b/queue-5.16/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
@@ -0,0 +1,39 @@
+From d8b9570ae89f528147e751a72cfb8d384b850258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 05:10:30 -0800
+Subject: ASoC: rt5663: check the return value of devm_kzalloc() in
+ rt5663_parse_dp()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 4d06f92f38b799295ae22c98be7a20cac3e2a1a7 ]
+
+The function devm_kzalloc() in rt5663_parse_dp() can fail, so its return
+value should be checked.
+
+Fixes: 457c25efc592 ("ASoC: rt5663: Add the function of impedance sensing")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220225131030.27248-1-baijiaju1990@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5663.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
+index 2138f62e6af5..3a8fba101b20 100644
+--- a/sound/soc/codecs/rt5663.c
++++ b/sound/soc/codecs/rt5663.c
+@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev)
+ 		table_size = sizeof(struct impedance_mapping_table) *
+ 			rt5663->pdata.impedance_sensing_num;
+ 		rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
++		if (!rt5663->imp_table)
++			return -ENOMEM;
+ 		ret = device_property_read_u32_array(dev,
+ 			"realtek,impedance_sensing_table",
+ 			(u32 *)rt5663->imp_table, table_size);
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-rt5682s-fix-the-wrong-jack-type-detected.patch b/queue-5.16/asoc-rt5682s-fix-the-wrong-jack-type-detected.patch
new file mode 100644
index 00000000000..67d4fa9ad32
--- /dev/null
+++ b/queue-5.16/asoc-rt5682s-fix-the-wrong-jack-type-detected.patch
@@ -0,0 +1,140 @@
+From 4d859f8d71cafa9cdac96c3b9748c8e10d59566e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 18:14:50 +0800
+Subject: ASoC: rt5682s: Fix the wrong jack type detected
+
+From: Derek Fang <derek.fang@realtek.com>
+
+[ Upstream commit c07ac3ee76e5e5506bca9c03fbbb15e40ab28430 ]
+
+Some powers were changed during the jack insert detection and clk's
+enable/disable in CCF.
+If in parallel, the influence has a chance to detect the wrong jack
+type.
+
+We refer to the below commit of the variant codec (rt5682) to fix
+this issue.
+  ASoC: rt5682: Fix deadlock on resume
+
+1. Remove rt5682s_headset_detect in rt5682s_jd_check_handler and
+   use jack_detect_work instead of.
+2. Use dapm mutex used in CCF to protect most of jack_detect_work.
+
+Signed-off-by: Derek Fang <derek.fang@realtek.com>
+Link: https://lore.kernel.org/r/20220223101450.4577-1-derek.fang@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 26 +++++++++-----------------
+ sound/soc/codecs/rt5682s.h |  1 -
+ 2 files changed, 9 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index d79b548d23fa..f2a2f3d60925 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -822,6 +822,7 @@ static void rt5682s_jack_detect_handler(struct work_struct *work)
+ {
+ 	struct rt5682s_priv *rt5682s =
+ 		container_of(work, struct rt5682s_priv, jack_detect_work.work);
++	struct snd_soc_dapm_context *dapm;
+ 	int val, btn_type;
+ 
+ 	if (!rt5682s->component || !rt5682s->component->card ||
+@@ -832,7 +833,9 @@ static void rt5682s_jack_detect_handler(struct work_struct *work)
+ 		return;
+ 	}
+ 
+-	mutex_lock(&rt5682s->jdet_mutex);
++	dapm = snd_soc_component_get_dapm(rt5682s->component);
++
++	snd_soc_dapm_mutex_lock(dapm);
+ 	mutex_lock(&rt5682s->calibrate_mutex);
+ 
+ 	val = snd_soc_component_read(rt5682s->component, RT5682S_AJD1_CTRL)
+@@ -889,6 +892,9 @@ static void rt5682s_jack_detect_handler(struct work_struct *work)
+ 		rt5682s->irq_work_delay_time = 50;
+ 	}
+ 
++	mutex_unlock(&rt5682s->calibrate_mutex);
++	snd_soc_dapm_mutex_unlock(dapm);
++
+ 	snd_soc_jack_report(rt5682s->hs_jack, rt5682s->jack_type,
+ 		SND_JACK_HEADSET | SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+ 		SND_JACK_BTN_2 | SND_JACK_BTN_3);
+@@ -898,9 +904,6 @@ static void rt5682s_jack_detect_handler(struct work_struct *work)
+ 		schedule_delayed_work(&rt5682s->jd_check_work, 0);
+ 	else
+ 		cancel_delayed_work_sync(&rt5682s->jd_check_work);
+-
+-	mutex_unlock(&rt5682s->calibrate_mutex);
+-	mutex_unlock(&rt5682s->jdet_mutex);
+ }
+ 
+ static void rt5682s_jd_check_handler(struct work_struct *work)
+@@ -908,14 +911,9 @@ static void rt5682s_jd_check_handler(struct work_struct *work)
+ 	struct rt5682s_priv *rt5682s =
+ 		container_of(work, struct rt5682s_priv, jd_check_work.work);
+ 
+-	if (snd_soc_component_read(rt5682s->component, RT5682S_AJD1_CTRL)
+-		& RT5682S_JDH_RS_MASK) {
++	if (snd_soc_component_read(rt5682s->component, RT5682S_AJD1_CTRL) & RT5682S_JDH_RS_MASK) {
+ 		/* jack out */
+-		rt5682s->jack_type = rt5682s_headset_detect(rt5682s->component, 0);
+-
+-		snd_soc_jack_report(rt5682s->hs_jack, rt5682s->jack_type,
+-			SND_JACK_HEADSET | SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+-			SND_JACK_BTN_2 | SND_JACK_BTN_3);
++		schedule_delayed_work(&rt5682s->jack_detect_work, 0);
+ 	} else {
+ 		schedule_delayed_work(&rt5682s->jd_check_work, 500);
+ 	}
+@@ -1323,7 +1321,6 @@ static int rt5682s_hp_amp_event(struct snd_soc_dapm_widget *w,
+ 		struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+-	struct rt5682s_priv *rt5682s = snd_soc_component_get_drvdata(component);
+ 
+ 	switch (event) {
+ 	case SND_SOC_DAPM_POST_PMU:
+@@ -1339,8 +1336,6 @@ static int rt5682s_hp_amp_event(struct snd_soc_dapm_widget *w,
+ 		snd_soc_component_write(component, RT5682S_BIAS_CUR_CTRL_11, 0x6666);
+ 		snd_soc_component_write(component, RT5682S_BIAS_CUR_CTRL_12, 0xa82a);
+ 
+-		mutex_lock(&rt5682s->jdet_mutex);
+-
+ 		snd_soc_component_update_bits(component, RT5682S_HP_CTRL_2,
+ 			RT5682S_HPO_L_PATH_MASK | RT5682S_HPO_R_PATH_MASK |
+ 			RT5682S_HPO_SEL_IP_EN_SW, RT5682S_HPO_L_PATH_EN |
+@@ -1348,8 +1343,6 @@ static int rt5682s_hp_amp_event(struct snd_soc_dapm_widget *w,
+ 		usleep_range(5000, 10000);
+ 		snd_soc_component_update_bits(component, RT5682S_HP_AMP_DET_CTL_1,
+ 			RT5682S_CP_SW_SIZE_MASK, RT5682S_CP_SW_SIZE_L | RT5682S_CP_SW_SIZE_S);
+-
+-		mutex_unlock(&rt5682s->jdet_mutex);
+ 		break;
+ 
+ 	case SND_SOC_DAPM_POST_PMD:
+@@ -3075,7 +3068,6 @@ static int rt5682s_i2c_probe(struct i2c_client *i2c,
+ 
+ 	mutex_init(&rt5682s->calibrate_mutex);
+ 	mutex_init(&rt5682s->sar_mutex);
+-	mutex_init(&rt5682s->jdet_mutex);
+ 	rt5682s_calibrate(rt5682s);
+ 
+ 	regmap_update_bits(rt5682s->regmap, RT5682S_MICBIAS_2,
+diff --git a/sound/soc/codecs/rt5682s.h b/sound/soc/codecs/rt5682s.h
+index 1bf2ef7ce578..397a2531b6f6 100644
+--- a/sound/soc/codecs/rt5682s.h
++++ b/sound/soc/codecs/rt5682s.h
+@@ -1446,7 +1446,6 @@ struct rt5682s_priv {
+ 	struct delayed_work jd_check_work;
+ 	struct mutex calibrate_mutex;
+ 	struct mutex sar_mutex;
+-	struct mutex jdet_mutex;
+ 
+ #ifdef CONFIG_COMMON_CLK
+ 	struct clk_hw dai_clks_hw[RT5682S_DAI_NUM_CLKS];
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sh-rz-ssi-drop-calling-rz_ssi_pio_recv-recursiv.patch b/queue-5.16/asoc-sh-rz-ssi-drop-calling-rz_ssi_pio_recv-recursiv.patch
new file mode 100644
index 00000000000..22a7ae2ba79
--- /dev/null
+++ b/queue-5.16/asoc-sh-rz-ssi-drop-calling-rz_ssi_pio_recv-recursiv.patch
@@ -0,0 +1,123 @@
+From 7e6eca054e5c579e05a330f78ac362bf3379c983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 09:47:07 +0000
+Subject: ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 6570f991582e32b7992601d0497c61962a2c5dcc ]
+
+Instead of recursively calling rz_ssi_pio_recv() use a while loop
+to read the samples from RX fifo.
+
+This also fixes an issue where the return value of rz_ssi_pio_recv()
+was ignored when called recursively.
+
+Fixes: 03e786bd4341 ("ASoC: sh: Add RZ/G2L SSIF-2 driver")
+Reported-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20220110094711.8574-2-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rz-ssi.c | 68 ++++++++++++++++++++++---------------------
+ 1 file changed, 35 insertions(+), 33 deletions(-)
+
+diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
+index fa0cc08f70ec..37466f65c2b0 100644
+--- a/sound/soc/sh/rz-ssi.c
++++ b/sound/soc/sh/rz-ssi.c
+@@ -411,54 +411,56 @@ static int rz_ssi_pio_recv(struct rz_ssi_priv *ssi, struct rz_ssi_stream *strm)
+ {
+ 	struct snd_pcm_substream *substream = strm->substream;
+ 	struct snd_pcm_runtime *runtime;
++	bool done = false;
+ 	u16 *buf;
+ 	int fifo_samples;
+ 	int frames_left;
+-	int samples = 0;
++	int samples;
+ 	int i;
+ 
+ 	if (!rz_ssi_stream_is_valid(ssi, strm))
+ 		return -EINVAL;
+ 
+ 	runtime = substream->runtime;
+-	/* frames left in this period */
+-	frames_left = runtime->period_size - (strm->buffer_pos %
+-					      runtime->period_size);
+-	if (frames_left == 0)
+-		frames_left = runtime->period_size;
+ 
+-	/* Samples in RX FIFO */
+-	fifo_samples = (rz_ssi_reg_readl(ssi, SSIFSR) >>
+-			SSIFSR_RDC_SHIFT) & SSIFSR_RDC_MASK;
+-
+-	/* Only read full frames at a time */
+-	while (frames_left && (fifo_samples >= runtime->channels)) {
+-		samples += runtime->channels;
+-		fifo_samples -= runtime->channels;
+-		frames_left--;
+-	}
++	while (!done) {
++		/* frames left in this period */
++		frames_left = runtime->period_size -
++			      (strm->buffer_pos % runtime->period_size);
++		if (!frames_left)
++			frames_left = runtime->period_size;
++
++		/* Samples in RX FIFO */
++		fifo_samples = (rz_ssi_reg_readl(ssi, SSIFSR) >>
++				SSIFSR_RDC_SHIFT) & SSIFSR_RDC_MASK;
++
++		/* Only read full frames at a time */
++		samples = 0;
++		while (frames_left && (fifo_samples >= runtime->channels)) {
++			samples += runtime->channels;
++			fifo_samples -= runtime->channels;
++			frames_left--;
++		}
+ 
+-	/* not enough samples yet */
+-	if (samples == 0)
+-		return 0;
++		/* not enough samples yet */
++		if (!samples)
++			break;
+ 
+-	/* calculate new buffer index */
+-	buf = (u16 *)(runtime->dma_area);
+-	buf += strm->buffer_pos * runtime->channels;
++		/* calculate new buffer index */
++		buf = (u16 *)(runtime->dma_area);
++		buf += strm->buffer_pos * runtime->channels;
+ 
+-	/* Note, only supports 16-bit samples */
+-	for (i = 0; i < samples; i++)
+-		*buf++ = (u16)(rz_ssi_reg_readl(ssi, SSIFRDR) >> 16);
++		/* Note, only supports 16-bit samples */
++		for (i = 0; i < samples; i++)
++			*buf++ = (u16)(rz_ssi_reg_readl(ssi, SSIFRDR) >> 16);
+ 
+-	rz_ssi_reg_mask_setl(ssi, SSIFSR, SSIFSR_RDF, 0);
+-	rz_ssi_pointer_update(strm, samples / runtime->channels);
++		rz_ssi_reg_mask_setl(ssi, SSIFSR, SSIFSR_RDF, 0);
++		rz_ssi_pointer_update(strm, samples / runtime->channels);
+ 
+-	/*
+-	 * If we finished this period, but there are more samples in
+-	 * the RX FIFO, call this function again
+-	 */
+-	if (frames_left == 0 && fifo_samples >= runtime->channels)
+-		rz_ssi_pio_recv(ssi, strm);
++		/* check if there are no more samples in the RX FIFO */
++		if (!(!frames_left && fifo_samples >= runtime->channels))
++			done = true;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sh-rz-ssi-make-the-data-structures-available-be.patch b/queue-5.16/asoc-sh-rz-ssi-make-the-data-structures-available-be.patch
new file mode 100644
index 00000000000..318e9fd8f8c
--- /dev/null
+++ b/queue-5.16/asoc-sh-rz-ssi-make-the-data-structures-available-be.patch
@@ -0,0 +1,49 @@
+From db99a508ea1a03723a2c42f785cd37315fadaba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 09:47:08 +0000
+Subject: ASoC: sh: rz-ssi: Make the data structures available before
+ registering the handlers
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 0788785c78342d422f93b1c9831c2b2b7f137937 ]
+
+Initialize the spinlock and make the data structures available before
+registering the interrupt handlers.
+
+Reported-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20220110094711.8574-3-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rz-ssi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
+index 37466f65c2b0..16de2633a873 100644
+--- a/sound/soc/sh/rz-ssi.c
++++ b/sound/soc/sh/rz-ssi.c
+@@ -977,6 +977,9 @@ static int rz_ssi_probe(struct platform_device *pdev)
+ 	ssi->playback.priv = ssi;
+ 	ssi->capture.priv = ssi;
+ 
++	spin_lock_init(&ssi->lock);
++	dev_set_drvdata(&pdev->dev, ssi);
++
+ 	/* Error Interrupt */
+ 	ssi->irq_int = platform_get_irq_byname(pdev, "int_req");
+ 	if (ssi->irq_int < 0)
+@@ -1024,8 +1027,6 @@ static int rz_ssi_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_resume_and_get(&pdev->dev);
+ 
+-	spin_lock_init(&ssi->lock);
+-	dev_set_drvdata(&pdev->dev, ssi);
+ 	ret = devm_snd_soc_register_component(&pdev->dev, &rz_ssi_soc_component,
+ 					      rz_ssi_soc_dai,
+ 					      ARRAY_SIZE(rz_ssi_soc_dai));
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-simple-card-utils-set-sysclk-on-all-components.patch b/queue-5.16/asoc-simple-card-utils-set-sysclk-on-all-components.patch
new file mode 100644
index 00000000000..0111369e513
--- /dev/null
+++ b/queue-5.16/asoc-simple-card-utils-set-sysclk-on-all-components.patch
@@ -0,0 +1,78 @@
+From d0232e4ec634e8850c268d68f5172efdbf6c1e5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 13:58:30 -0600
+Subject: ASoC: simple-card-utils: Set sysclk on all components
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit ce2f7b8d4290c22e462e465d1da38a1c113ae66a ]
+
+If an mclk-fs value was provided in the device tree configuration, the
+calculated MCLK was fed into the downstream codec DAI and CPU DAI,
+however set_sysclk was not being called on the platform device. Some
+platform devices such as the Xilinx Audio Formatter need to know the MCLK
+as well.
+
+Call snd_soc_component_set_sysclk on each component in the stream to set
+the proper sysclk value in addition to the existing call of
+snd_soc_dai_set_sysclk on the codec DAI and CPU DAI. This may end up
+resulting in redundant calls if one of the snd_soc_dai_set_sysclk calls
+ends up calling snd_soc_component_set_sysclk itself, but that isn't
+expected to cause any significant harm.
+
+Fixes: f48dcbb6d47d ("ASoC: simple-card-utils: share asoc_simple_hw_param()")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Reviewed-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20220120195832.1742271-5-robert.hancock@calian.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card-utils.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
+index 850e968677f1..7d8c9843ad53 100644
+--- a/sound/soc/generic/simple-card-utils.c
++++ b/sound/soc/generic/simple-card-utils.c
+@@ -275,6 +275,7 @@ int asoc_simple_hw_params(struct snd_pcm_substream *substream,
+ 		mclk_fs = props->mclk_fs;
+ 
+ 	if (mclk_fs) {
++		struct snd_soc_component *component;
+ 		mclk = params_rate(params) * mclk_fs;
+ 
+ 		for_each_prop_dai_codec(props, i, pdai) {
+@@ -282,16 +283,30 @@ int asoc_simple_hw_params(struct snd_pcm_substream *substream,
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
+ 		for_each_prop_dai_cpu(props, i, pdai) {
+ 			ret = asoc_simple_set_clk_rate(pdai, mclk);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
++
++		/* Ensure sysclk is set on all components in case any
++		 * (such as platform components) are missed by calls to
++		 * snd_soc_dai_set_sysclk.
++		 */
++		for_each_rtd_components(rtd, i, component) {
++			ret = snd_soc_component_set_sysclk(component, 0, 0,
++							   mclk, SND_SOC_CLOCK_IN);
++			if (ret && ret != -ENOTSUPP)
++				return ret;
++		}
++
+ 		for_each_rtd_codec_dais(rtd, i, sdai) {
+ 			ret = snd_soc_dai_set_sysclk(sdai, 0, mclk, SND_SOC_CLOCK_IN);
+ 			if (ret && ret != -ENOTSUPP)
+ 				return ret;
+ 		}
++
+ 		for_each_rtd_cpu_dais(rtd, i, sdai) {
+ 			ret = snd_soc_dai_set_sysclk(sdai, 0, mclk, SND_SOC_CLOCK_OUT);
+ 			if (ret && ret != -ENOTSUPP)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch b/queue-5.16/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
new file mode 100644
index 00000000000..72bea23fe7c
--- /dev/null
+++ b/queue-5.16/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
@@ -0,0 +1,65 @@
+From 316465ef995e8c916e6d3092165e59691aa71cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 08:13:53 +0000
+Subject: ASoC: soc-compress: prevent the potentially use of null pointer
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit de2c6f98817fa5decb9b7d3b3a8a3ab864c10588 ]
+
+There is one call trace that snd_soc_register_card()
+->snd_soc_bind_card()->soc_init_pcm_runtime()
+->snd_soc_dai_compress_new()->snd_soc_new_compress().
+In the trace the 'codec_dai' transfers from card->dai_link,
+and we can see from the snd_soc_add_pcm_runtime() in
+snd_soc_bind_card() that, if value of card->dai_link->num_codecs
+is 0, then 'codec_dai' could be null pointer caused
+by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'.
+And snd_soc_register_card() is called by various platforms.
+Therefore, it is better to add the check in the case of misusing.
+And because 'cpu_dai' has already checked in soc_init_pcm_runtime(),
+there is no need to check again.
+Adding the check as follow, then if 'codec_dai' is null,
+snd_soc_new_compress() will not pass through the check
+'if (playback + capture != 1)', avoiding the leftover use of
+'codec_dai'.
+
+Fixes: 467fece ("ASoC: soc-dai: move snd_soc_dai_stream_valid() to soc-dai.c")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/1634285633-529368-1-git-send-email-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-compress.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index 8e2494a9f3a7..f4b376a71be8 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -568,12 +568,14 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ 	}
+ 
+ 	/* check client and interface hw capabilities */
+-	if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) &&
+-	    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_PLAYBACK))
+-		playback = 1;
+-	if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) &&
+-	    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_CAPTURE))
+-		capture = 1;
++	if (codec_dai) {
++		if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) &&
++		    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_PLAYBACK))
++			playback = 1;
++		if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) &&
++		    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_CAPTURE))
++			capture = 1;
++	}
+ 
+ 	/*
+ 	 * Compress devices are unidirectional so only one of the directions
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch b/queue-5.16/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
new file mode 100644
index 00000000000..19fa8a2c36b
--- /dev/null
+++ b/queue-5.16/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
@@ -0,0 +1,47 @@
+From 97f460ca2f84980761887da60ef44c54b6c128d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 19:19:12 +0800
+Subject: ASoC: soc-core: skip zero num_dai component in searching dai name
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit f7d344a2bd5ec81fbd1ce76928fd059e57ec9bea ]
+
+In the case like dmaengine which's not a dai but as a component, the
+num_dai is zero, dmaengine component has the same component_of_node
+as cpu dai, when cpu dai component is not ready, but dmaengine component
+is ready, try to get cpu dai name, the snd_soc_get_dai_name() return
+-EINVAL, not -EPROBE_DEFER, that cause below error:
+
+asoc-simple-card <card name>: parse error -22
+asoc-simple-card: probe of <card name> failed with error -22
+
+The sound card failed to probe.
+
+So this patch fixes the issue above by skipping the zero num_dai
+component in searching dai name.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1644491952-7457-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index dcf6be4c4aaa..0dc89f568407 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3184,7 +3184,7 @@ int snd_soc_get_dai_name(const struct of_phandle_args *args,
+ 	for_each_component(pos) {
+ 		struct device_node *component_of_node = soc_component_to_node(pos);
+ 
+-		if (component_of_node != args->np)
++		if (component_of_node != args->np || !pos->num_dai)
+ 			continue;
+ 
+ 		ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name);
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch b/queue-5.16/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch
new file mode 100644
index 00000000000..2aa88d10041
--- /dev/null
+++ b/queue-5.16/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch
@@ -0,0 +1,37 @@
+From 53dacc8cb8b46d656d76f4242f7c150aa2e8bbf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 02:33:23 +0000
+Subject: ASoC: SOF: Add missing of_node_put() in imx8m_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 5575f7f49134c7386a684335c9007737c606d3b5 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: afb93d716533 ("ASoC: SOF: imx: Add i.MX8M HW support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220308023325.31702-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/imx/imx8m.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/sof/imx/imx8m.c b/sound/soc/sof/imx/imx8m.c
+index e4618980cf8b..1b20205ff0d1 100644
+--- a/sound/soc/sof/imx/imx8m.c
++++ b/sound/soc/sof/imx/imx8m.c
+@@ -192,6 +192,7 @@ static int imx8m_probe(struct snd_sof_dev *sdev)
+ 	}
+ 
+ 	ret = of_address_to_resource(res_node, 0, &res);
++	of_node_put(res_node);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to get reserved region address\n");
+ 		goto exit_pdev_unregister;
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sof-intel-enable-dmi-l1-for-playback-streams.patch b/queue-5.16/asoc-sof-intel-enable-dmi-l1-for-playback-streams.patch
new file mode 100644
index 00000000000..e12887e518c
--- /dev/null
+++ b/queue-5.16/asoc-sof-intel-enable-dmi-l1-for-playback-streams.patch
@@ -0,0 +1,41 @@
+From f662f23712d21baf4b5a3006f39b76b0814ef5bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 11:16:47 -0600
+Subject: ASoC: SOF: Intel: enable DMI L1 for playback streams
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit a174e72e2355b9025205b4b6727bf43047eac6c6 ]
+
+Add back logic to mark all playback streams as L1 compatible.
+
+Fixes: 246dd4287dfb ("ASoC: SOF: Intel: make DMI L1 selection more robust")
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220310171651.249385-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c
+index 41cb60955f5c..68834325d8fb 100644
+--- a/sound/soc/sof/intel/hda-pcm.c
++++ b/sound/soc/sof/intel/hda-pcm.c
+@@ -278,6 +278,7 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev,
+ 		runtime->hw.info &= ~SNDRV_PCM_INFO_PAUSE;
+ 
+ 	if (hda_always_enable_dmi_l1 ||
++	    direction == SNDRV_PCM_STREAM_PLAYBACK ||
+ 	    spcm->stream[substream->stream].d0i3_compatible)
+ 		flags |= SOF_HDA_STREAM_DMI_L1_COMPATIBLE;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sof-intel-hda-remove-link-assignment-limitation.patch b/queue-5.16/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
new file mode 100644
index 00000000000..8b2a93e58c7
--- /dev/null
+++ b/queue-5.16/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
@@ -0,0 +1,65 @@
+From 94a93942b75fe96b2cd8f9498befcd25294f9eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 15:00:17 +0200
+Subject: ASoC: SOF: Intel: hda: Remove link assignment limitation
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 2ce0d008dcc59f9c01f43277b9f9743af7b01dad ]
+
+The limitation to assign a link DMA channel for a BE iff the
+corresponding host DMA channel is assigned to a connected FE is only
+applicable if the PROCEN_FMT_QUIRK is set. So, remove it for platforms
+that do not enable the quirk.
+
+Complements: a792bfc1c2bc ("ASoC: SOF: Intel: hda-stream: limit PROCEN workaround")
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220128130017.28508-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 76579383d290..1b7ba7f3e99b 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -62,6 +62,8 @@ static struct hdac_ext_stream *
+ {
+ 	struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream);
+ 	struct sof_intel_hda_stream *hda_stream;
++	const struct sof_intel_dsp_desc *chip;
++	struct snd_sof_dev *sdev;
+ 	struct hdac_ext_stream *res = NULL;
+ 	struct hdac_stream *stream = NULL;
+ 
+@@ -80,9 +82,20 @@ static struct hdac_ext_stream *
+ 			continue;
+ 
+ 		hda_stream = hstream_to_sof_hda_stream(hstream);
++		sdev = hda_stream->sdev;
++		chip = get_chip_info(sdev->pdata);
+ 
+ 		/* check if link is available */
+ 		if (!hstream->link_locked) {
++			/*
++			 * choose the first available link for platforms that do not have the
++			 * PROCEN_FMT_QUIRK set.
++			 */
++			if (!(chip->quirks & SOF_INTEL_PROCEN_FMT_QUIRK)) {
++				res = hstream;
++				break;
++			}
++
+ 			if (stream->opened) {
+ 				/*
+ 				 * check if the stream tag matches the stream
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-sof-intel-match-sdw-version-on-link_slaves_foun.patch b/queue-5.16/asoc-sof-intel-match-sdw-version-on-link_slaves_foun.patch
new file mode 100644
index 00000000000..e3ea436be4e
--- /dev/null
+++ b/queue-5.16/asoc-sof-intel-match-sdw-version-on-link_slaves_foun.patch
@@ -0,0 +1,85 @@
+From 334e0430fddfd46f9f4fc352fb630e42f24330ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 17:21:56 -0600
+Subject: ASoC: SOF: Intel: match sdw version on link_slaves_found
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit f67c0c0d3b9048d86ea6ae52e36a2b78c48f265d ]
+
+Codecs with the same part id, manufacturer id and part id, but different
+sdw version should be treated as different codecs. For example, rt711 and
+rt711-sdca are different. So, we should match sdw version as well.
+
+Reported-by: Reddy Muralidhar <muralidhar.reddy@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220120232157.199919-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index 25200a0e1dc9..fc88296ab898 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -1200,7 +1200,7 @@ static bool link_slaves_found(struct snd_sof_dev *sdev,
+ 	struct hdac_bus *bus = sof_to_bus(sdev);
+ 	struct sdw_intel_slave_id *ids = sdw->ids;
+ 	int num_slaves = sdw->num_slaves;
+-	unsigned int part_id, link_id, unique_id, mfg_id;
++	unsigned int part_id, link_id, unique_id, mfg_id, version;
+ 	int i, j, k;
+ 
+ 	for (i = 0; i < link->num_adr; i++) {
+@@ -1210,12 +1210,14 @@ static bool link_slaves_found(struct snd_sof_dev *sdev,
+ 		mfg_id = SDW_MFG_ID(adr);
+ 		part_id = SDW_PART_ID(adr);
+ 		link_id = SDW_DISCO_LINK_ID(adr);
++		version = SDW_VERSION(adr);
+ 
+ 		for (j = 0; j < num_slaves; j++) {
+ 			/* find out how many identical parts were reported on that link */
+ 			if (ids[j].link_id == link_id &&
+ 			    ids[j].id.part_id == part_id &&
+-			    ids[j].id.mfg_id == mfg_id)
++			    ids[j].id.mfg_id == mfg_id &&
++			    ids[j].id.sdw_version == version)
+ 				reported_part_count++;
+ 		}
+ 
+@@ -1224,21 +1226,24 @@ static bool link_slaves_found(struct snd_sof_dev *sdev,
+ 
+ 			if (ids[j].link_id != link_id ||
+ 			    ids[j].id.part_id != part_id ||
+-			    ids[j].id.mfg_id != mfg_id)
++			    ids[j].id.mfg_id != mfg_id ||
++			    ids[j].id.sdw_version != version)
+ 				continue;
+ 
+ 			/* find out how many identical parts are expected */
+ 			for (k = 0; k < link->num_adr; k++) {
+ 				u64 adr2 = link->adr_d[k].adr;
+-				unsigned int part_id2, link_id2, mfg_id2;
++				unsigned int part_id2, link_id2, mfg_id2, version2;
+ 
+ 				mfg_id2 = SDW_MFG_ID(adr2);
+ 				part_id2 = SDW_PART_ID(adr2);
+ 				link_id2 = SDW_DISCO_LINK_ID(adr2);
++				version2 = SDW_VERSION(adr2);
+ 
+ 				if (link_id2 == link_id &&
+ 				    part_id2 == part_id &&
+-				    mfg_id2 == mfg_id)
++				    mfg_id2 == mfg_id &&
++				    version2 == version)
+ 					expected_part_count++;
+ 			}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch b/queue-5.16/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..40c688e8fbe
--- /dev/null
+++ b/queue-5.16/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
@@ -0,0 +1,49 @@
+From cdac28d86216d87afe890987dc8e2caad0eb8323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 11:15:40 +0800
+Subject: ASoC: ti: davinci-i2s: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ed7c9fef11931fc5d32a83d68017ff390bf5c280 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: 5f9a50c3e55e ("ASoC: Davinci: McBSP: add device tree support for McBSP")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20220228031540.3571959-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/davinci-i2s.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c
+index 6dca51862dd7..0363a088d2e0 100644
+--- a/sound/soc/ti/davinci-i2s.c
++++ b/sound/soc/ti/davinci-i2s.c
+@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev)
+ 	dev->clk = clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(dev->clk))
+ 		return -ENODEV;
+-	clk_enable(dev->clk);
++	ret = clk_enable(dev->clk);
++	if (ret)
++		goto err_put_clk;
+ 
+ 	dev->dev = &pdev->dev;
+ 	dev_set_drvdata(&pdev->dev, dev);
+@@ -730,6 +732,7 @@ static int davinci_i2s_probe(struct platform_device *pdev)
+ 	snd_soc_unregister_component(&pdev->dev);
+ err_release_clk:
+ 	clk_disable(dev->clk);
++err_put_clk:
+ 	clk_put(dev->clk);
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-wm8350-handle-error-for-wm8350_register_irq.patch b/queue-5.16/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
new file mode 100644
index 00000000000..ec73ee2d72a
--- /dev/null
+++ b/queue-5.16/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
@@ -0,0 +1,73 @@
+From 1777f1b997bccc91b7a2c6a3e3b9c82d09383914 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 10:38:21 +0800
+Subject: ASoC: wm8350: Handle error for wm8350_register_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit db0350da8084ad549bca16cc0486c11cc70a1f9b ]
+
+As the potential failure of the wm8350_register_irq(),
+it should be better to check it and return error if fails.
+Also, use 'free_' in order to avoid the same code.
+
+Fixes: a6ba2b2dabb5 ("ASoC: Implement WM8350 headphone jack detection")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220304023821.391936-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8350.c | 28 ++++++++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
+index 15d42ce3b21d..41504ce2a682 100644
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -1537,18 +1537,38 @@ static  int wm8350_component_probe(struct snd_soc_component *component)
+ 	wm8350_clear_bits(wm8350, WM8350_JACK_DETECT,
+ 			  WM8350_JDL_ENA | WM8350_JDR_ENA);
+ 
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
+ 			    wm8350_hpl_jack_handler, 0, "Left jack detect",
+ 			    priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
++	if (ret != 0)
++		goto err;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
+ 			    wm8350_hpr_jack_handler, 0, "Right jack detect",
+ 			    priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
++	if (ret != 0)
++		goto free_jck_det_l;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
+ 			    wm8350_mic_handler, 0, "Microphone short", priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
++	if (ret != 0)
++		goto free_jck_det_r;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
+ 			    wm8350_mic_handler, 0, "Microphone detect", priv);
++	if (ret != 0)
++		goto free_micscd;
+ 
+ 	return 0;
++
++free_micscd:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv);
++free_jck_det_r:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv);
++free_jck_det_l:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv);
++err:
++	return ret;
+ }
+ 
+ static void wm8350_component_remove(struct snd_soc_component *component)
+-- 
+2.34.1
+
diff --git a/queue-5.16/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch b/queue-5.16/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch
new file mode 100644
index 00000000000..9c638af0c71
--- /dev/null
+++ b/queue-5.16/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch
@@ -0,0 +1,92 @@
+From 86e60752c1d890e795c09dc142cfb547eb399190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 13:58:27 -0600
+Subject: ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 1c5091fbe7e0d0804158200b7feac5123f7b4fbd ]
+
+This driver did not set the MM2S Fs Multiplier Register to the proper
+value for playback streams. This needs to be set to the sample rate to
+MCLK multiplier, or random stream underflows can occur on the downstream
+I2S transmitter.
+
+Store the sysclk value provided via the set_sysclk callback and use that
+in conjunction with the sample rate in the hw_params callback to calculate
+the proper value to set for this register.
+
+Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Link: https://lore.kernel.org/r/20220120195832.1742271-2-robert.hancock@calian.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/sound/soc/xilinx/xlnx_formatter_pcm.c b/sound/soc/xilinx/xlnx_formatter_pcm.c
+index ce19a6058b27..5c4158069a5a 100644
+--- a/sound/soc/xilinx/xlnx_formatter_pcm.c
++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c
+@@ -84,6 +84,7 @@ struct xlnx_pcm_drv_data {
+ 	struct snd_pcm_substream *play_stream;
+ 	struct snd_pcm_substream *capture_stream;
+ 	struct clk *axi_clk;
++	unsigned int sysclk;
+ };
+ 
+ /*
+@@ -314,6 +315,15 @@ static irqreturn_t xlnx_s2mm_irq_handler(int irq, void *arg)
+ 	return IRQ_NONE;
+ }
+ 
++static int xlnx_formatter_set_sysclk(struct snd_soc_component *component,
++				     int clk_id, int source, unsigned int freq, int dir)
++{
++	struct xlnx_pcm_drv_data *adata = dev_get_drvdata(component->dev);
++
++	adata->sysclk = freq;
++	return 0;
++}
++
+ static int xlnx_formatter_pcm_open(struct snd_soc_component *component,
+ 				   struct snd_pcm_substream *substream)
+ {
+@@ -450,11 +460,25 @@ static int xlnx_formatter_pcm_hw_params(struct snd_soc_component *component,
+ 	u64 size;
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	struct xlnx_pcm_stream_param *stream_data = runtime->private_data;
++	struct xlnx_pcm_drv_data *adata = dev_get_drvdata(component->dev);
+ 
+ 	active_ch = params_channels(params);
+ 	if (active_ch > stream_data->ch_limit)
+ 		return -EINVAL;
+ 
++	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++	    adata->sysclk) {
++		unsigned int mclk_fs = adata->sysclk / params_rate(params);
++
++		if (adata->sysclk % params_rate(params) != 0) {
++			dev_warn(component->dev, "sysclk %u not divisible by rate %u\n",
++				 adata->sysclk, params_rate(params));
++			return -EINVAL;
++		}
++
++		writel(mclk_fs, stream_data->mmio + XLNX_AUD_FS_MULTIPLIER);
++	}
++
+ 	if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
+ 	    stream_data->xfer_mode == AES_TO_PCM) {
+ 		val = readl(stream_data->mmio + XLNX_AUD_STS);
+@@ -552,6 +576,7 @@ static int xlnx_formatter_pcm_new(struct snd_soc_component *component,
+ 
+ static const struct snd_soc_component_driver xlnx_asoc_component = {
+ 	.name		= DRV_NAME,
++	.set_sysclk	= xlnx_formatter_set_sysclk,
+ 	.open		= xlnx_formatter_pcm_open,
+ 	.close		= xlnx_formatter_pcm_close,
+ 	.hw_params	= xlnx_formatter_pcm_hw_params,
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch b/queue-5.16/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch
new file mode 100644
index 00000000000..af20f41fda2
--- /dev/null
+++ b/queue-5.16/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch
@@ -0,0 +1,45 @@
+From 481b6fcdb93b5335b62825f0570c751f047bb385 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 07:02:38 +0000
+Subject: ath10k: Fix error handling in ath10k_setup_msa_resources
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 9747a78d5f758a5284751a10aee13c30d02bd5f1 ]
+
+The device_node pointer is returned by of_parse_phandle() with refcount
+incremented. We should use of_node_put() on it when done.
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error path.
+
+Fixes: 727fec790ead ("ath10k: Setup the msa resources before qmi init")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220308070238.19295-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/snoc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index 9513ab696fff..f79dd9a71690 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1556,11 +1556,11 @@ static int ath10k_setup_msa_resources(struct ath10k *ar, u32 msa_size)
+ 	node = of_parse_phandle(dev->of_node, "memory-region", 0);
+ 	if (node) {
+ 		ret = of_address_to_resource(node, 0, &r);
++		of_node_put(node);
+ 		if (ret) {
+ 			dev_err(dev, "failed to resolve msa fixed region\n");
+ 			return ret;
+ 		}
+-		of_node_put(node);
+ 
+ 		ar->msa.paddr = r.start;
+ 		ar->msa.mem_size = resource_size(&r);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch b/queue-5.16/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
new file mode 100644
index 00000000000..cb60521cb6c
--- /dev/null
+++ b/queue-5.16/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
@@ -0,0 +1,56 @@
+From ed91f6edd27dbfb74cba491966f9528dee6b733b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 16:24:13 +0200
+Subject: ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit e3fb3d4418fce5484dfe7995fcd94c18b10a431a ]
+
+In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
+the new->pattern, and currently the new->pattern and new->mask is same
+with the old, then the memcpy of new->pattern will also overwrite the
+old->pattern, because the header format of new->pattern is 802.11,
+its length is larger than the old->pattern which is 802.3. Then the
+operation of "Copy frame body" will copy a mistake value because the
+body memory has been overwrite when memcpy the new->pattern.
+
+Assign another empty value to new_pattern to avoid the overwrite issue.
+
+Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049
+
+Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20211222031347.25463-1-quic_wgong@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
+index 7d65c115669f..20b9aa8ddf7d 100644
+--- a/drivers/net/wireless/ath/ath10k/wow.c
++++ b/drivers/net/wireless/ath/ath10k/wow.c
+@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
+ 			if (patterns[i].mask[j / 8] & BIT(j % 8))
+ 				bitmask[j] = 0xff;
+ 		old_pattern.mask = bitmask;
+-		new_pattern = old_pattern;
+ 
+ 		if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
+-			if (patterns[i].pkt_offset < ETH_HLEN)
++			if (patterns[i].pkt_offset < ETH_HLEN) {
+ 				ath10k_wow_convert_8023_to_80211(&new_pattern,
+ 								 &old_pattern);
+-			else
++			} else {
++				new_pattern = old_pattern;
+ 				new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
++			}
+ 		}
+ 
+ 		if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath11k-avoid-active-pdev-check-for-each-msdu.patch b/queue-5.16/ath11k-avoid-active-pdev-check-for-each-msdu.patch
new file mode 100644
index 00000000000..d20be07c2ca
--- /dev/null
+++ b/queue-5.16/ath11k-avoid-active-pdev-check-for-each-msdu.patch
@@ -0,0 +1,184 @@
+From f38be0d17fc4400a8d21f8fae86efa90a8d69876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Nov 2021 11:02:18 +0200
+Subject: ath11k: avoid active pdev check for each msdu
+
+From: P Praneesh <ppranees@codeaurora.org>
+
+[ Upstream commit c4d12cb37ea2e6c2b70880350d7bf1bbbd825c6c ]
+
+The Active Pdev and CAC check are done for each msdu in
+ath11k_dp_rx_process_received_packets which is a overhead.
+To avoid this overhead, collect all msdus in a per mac msdu
+list and pass to function.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1.r2-00012-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01695-QCAHKSWPL_SILICONZ-1
+
+Co-developed-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
+Signed-off-by: P Praneesh <ppranees@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1630560820-21905-6-git-send-email-ppranees@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 70 ++++++++++++-------------
+ 1 file changed, 34 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index 621372c568d2..0bc3baf4af5c 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2596,13 +2596,11 @@ static int ath11k_dp_rx_process_msdu(struct ath11k *ar,
+ static void ath11k_dp_rx_process_received_packets(struct ath11k_base *ab,
+ 						  struct napi_struct *napi,
+ 						  struct sk_buff_head *msdu_list,
+-						  int *quota, int ring_id)
++						  int *quota, int mac_id)
+ {
+-	struct ath11k_skb_rxcb *rxcb;
+ 	struct sk_buff *msdu;
+ 	struct ath11k *ar;
+ 	struct ieee80211_rx_status rx_status = {0};
+-	u8 mac_id;
+ 	int ret;
+ 
+ 	if (skb_queue_empty(msdu_list))
+@@ -2610,20 +2608,20 @@ static void ath11k_dp_rx_process_received_packets(struct ath11k_base *ab,
+ 
+ 	rcu_read_lock();
+ 
+-	while (*quota && (msdu = __skb_dequeue(msdu_list))) {
+-		rxcb = ATH11K_SKB_RXCB(msdu);
+-		mac_id = rxcb->mac_id;
+-		ar = ab->pdevs[mac_id].ar;
+-		if (!rcu_dereference(ab->pdevs_active[mac_id])) {
+-			dev_kfree_skb_any(msdu);
+-			continue;
+-		}
++	ar = ab->pdevs[mac_id].ar;
++	if (!rcu_dereference(ab->pdevs_active[mac_id])) {
++		__skb_queue_purge(msdu_list);
++		rcu_read_unlock();
++		return;
++	}
+ 
+-		if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
+-			dev_kfree_skb_any(msdu);
+-			continue;
+-		}
++	if (test_bit(ATH11K_CAC_RUNNING, &ar->dev_flags)) {
++		__skb_queue_purge(msdu_list);
++		rcu_read_unlock();
++		return;
++	}
+ 
++	while ((msdu = __skb_dequeue(msdu_list))) {
+ 		ret = ath11k_dp_rx_process_msdu(ar, msdu, msdu_list, &rx_status);
+ 		if (ret) {
+ 			ath11k_dbg(ab, ATH11K_DBG_DATA,
+@@ -2645,7 +2643,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct dp_rxdma_ring *rx_ring;
+ 	int num_buffs_reaped[MAX_RADIOS] = {0};
+-	struct sk_buff_head msdu_list;
++	struct sk_buff_head msdu_list[MAX_RADIOS];
+ 	struct ath11k_skb_rxcb *rxcb;
+ 	int total_msdu_reaped = 0;
+ 	struct hal_srng *srng;
+@@ -2654,10 +2652,13 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 	bool done = false;
+ 	int buf_id, mac_id;
+ 	struct ath11k *ar;
+-	u32 *rx_desc;
++	struct hal_reo_dest_ring *desc;
++	enum hal_reo_dest_ring_push_reason push_reason;
++	u32 cookie;
+ 	int i;
+ 
+-	__skb_queue_head_init(&msdu_list);
++	for (i = 0; i < MAX_RADIOS; i++)
++		__skb_queue_head_init(&msdu_list[i]);
+ 
+ 	srng = &ab->hal.srng_list[dp->reo_dst_ring[ring_id].ring_id];
+ 
+@@ -2666,13 +2667,11 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 	ath11k_hal_srng_access_begin(ab, srng);
+ 
+ try_again:
+-	while ((rx_desc = ath11k_hal_srng_dst_get_next_entry(ab, srng))) {
+-		struct hal_reo_dest_ring desc = *(struct hal_reo_dest_ring *)rx_desc;
+-		enum hal_reo_dest_ring_push_reason push_reason;
+-		u32 cookie;
+-
++	while (likely(desc =
++	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
++									     srng))) {
+ 		cookie = FIELD_GET(BUFFER_ADDR_INFO1_SW_COOKIE,
+-				   desc.buf_addr_info.info1);
++				   desc->buf_addr_info.info1);
+ 		buf_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_BUF_ID,
+ 				   cookie);
+ 		mac_id = FIELD_GET(DP_RXDMA_BUF_COOKIE_PDEV_ID, cookie);
+@@ -2700,7 +2699,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 		total_msdu_reaped++;
+ 
+ 		push_reason = FIELD_GET(HAL_REO_DEST_RING_INFO0_PUSH_REASON,
+-					desc.info0);
++					desc->info0);
+ 		if (push_reason !=
+ 		    HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) {
+ 			dev_kfree_skb_any(msdu);
+@@ -2708,21 +2707,21 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 			continue;
+ 		}
+ 
+-		rxcb->is_first_msdu = !!(desc.rx_msdu_info.info0 &
++		rxcb->is_first_msdu = !!(desc->rx_msdu_info.info0 &
+ 					 RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU);
+-		rxcb->is_last_msdu = !!(desc.rx_msdu_info.info0 &
++		rxcb->is_last_msdu = !!(desc->rx_msdu_info.info0 &
+ 					RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU);
+-		rxcb->is_continuation = !!(desc.rx_msdu_info.info0 &
++		rxcb->is_continuation = !!(desc->rx_msdu_info.info0 &
+ 					   RX_MSDU_DESC_INFO0_MSDU_CONTINUATION);
+ 		rxcb->peer_id = FIELD_GET(RX_MPDU_DESC_META_DATA_PEER_ID,
+-					  desc.rx_mpdu_info.meta_data);
++					  desc->rx_mpdu_info.meta_data);
+ 		rxcb->seq_no = FIELD_GET(RX_MPDU_DESC_INFO0_SEQ_NUM,
+-					 desc.rx_mpdu_info.info0);
++					 desc->rx_mpdu_info.info0);
+ 		rxcb->tid = FIELD_GET(HAL_REO_DEST_RING_INFO0_RX_QUEUE_NUM,
+-				      desc.info0);
++				      desc->info0);
+ 
+ 		rxcb->mac_id = mac_id;
+-		__skb_queue_tail(&msdu_list, msdu);
++		__skb_queue_tail(&msdu_list[mac_id], msdu);
+ 
+ 		if (total_msdu_reaped >= quota && !rxcb->is_continuation) {
+ 			done = true;
+@@ -2752,16 +2751,15 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 		if (!num_buffs_reaped[i])
+ 			continue;
+ 
++		ath11k_dp_rx_process_received_packets(ab, napi, &msdu_list[i],
++						      &quota, i);
++
+ 		ar = ab->pdevs[i].ar;
+ 		rx_ring = &ar->dp.rx_refill_buf_ring;
+ 
+ 		ath11k_dp_rxbufs_replenish(ab, i, rx_ring, num_buffs_reaped[i],
+ 					   ab->hw_params.hal_params->rx_buf_rbm);
+ 	}
+-
+-	ath11k_dp_rx_process_received_packets(ab, napi, &msdu_list,
+-					      &quota, ring_id);
+-
+ exit:
+ 	return budget - quota;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath11k-invalidate-cached-reo-ring-entry-before-acces.patch b/queue-5.16/ath11k-invalidate-cached-reo-ring-entry-before-acces.patch
new file mode 100644
index 00000000000..aa48595cb73
--- /dev/null
+++ b/queue-5.16/ath11k-invalidate-cached-reo-ring-entry-before-acces.patch
@@ -0,0 +1,54 @@
+From c1c1375d38f9cdf2476de6098201f14207f731a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 14:02:34 +0530
+Subject: ath11k: Invalidate cached reo ring entry before accessing it
+
+From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+
+[ Upstream commit f2180ccb52b5fd0876291ad2df37e2898cac18cf ]
+
+REO2SW ring descriptor is currently allocated in cacheable memory.
+While reaping reo ring entries on second trial after updating head
+pointer, first entry is not invalidated before accessing it.
+
+This results in host reaping and using cached descriptor which is
+already overwritten in memory by DMA device (HW).
+Since the contents of descriptor(buffer id, peer info and other information
+bits) are outdated host throws errors like below while parsing corresponding
+MSDU's and drops them.
+
+[347712.048904] ath11k_pci 0004:01:00.0: msdu_done bit in attention is not set
+[349173.355503] ath11k_pci 0004:01:00.0: frame rx with invalid buf_id 962
+
+Move the try_again: label above  ath11k_hal_srng_access_begin()
+so that first entry will be invalidated and prefetched.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
+
+Fixes: 6452f0a3d565 ("ath11k: allocate dst ring descriptors from cacheable memory")
+Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/1645000354-32558-1-git-send-email-quic_ramess@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index 0bc3baf4af5c..38102617c342 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2664,9 +2664,9 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,
+ 
+ 	spin_lock_bh(&srng->lock);
+ 
++try_again:
+ 	ath11k_hal_srng_access_begin(ab, srng);
+ 
+-try_again:
+ 	while (likely(desc =
+ 	      (struct hal_reo_dest_ring *)ath11k_hal_srng_dst_get_next_entry(ab,
+ 									     srng))) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath11k-set-wmi_peer_40mhz-while-peer-assoc-for-6-ghz.patch b/queue-5.16/ath11k-set-wmi_peer_40mhz-while-peer-assoc-for-6-ghz.patch
new file mode 100644
index 00000000000..2fc28148266
--- /dev/null
+++ b/queue-5.16/ath11k-set-wmi_peer_40mhz-while-peer-assoc-for-6-ghz.patch
@@ -0,0 +1,41 @@
+From ac0a5607a20f3701171ce30d8f5072e19110cd50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 22:42:11 -0500
+Subject: ath11k: set WMI_PEER_40MHZ while peer assoc for 6 GHz
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit 1cb747192de2edb7e55920af8c458e4792908486 ]
+
+When station connect to AP of 6 GHz with 40 MHz bandwidth, the TX is
+always stay 20 MHz, it is because the flag WMI_PEER_40MHZ is not set
+while peer assoc. Add the flag if remote peer is 40 MHz bandwidth.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2
+
+Fixes: c3a7d7eb4c98 ("ath11k: add 6 GHz params in peer assoc command")
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220119034211.28622-1-quic_wgong@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index a7400ade7a0c..8d8eae438567 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2039,6 +2039,9 @@ static void ath11k_peer_assoc_h_he_6ghz(struct ath11k *ar,
+ 	if (!arg->he_flag || band != NL80211_BAND_6GHZ || !sta->he_6ghz_capa.capa)
+ 		return;
+ 
++	if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
++		arg->bw_40 = true;
++
+ 	if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
+ 		arg->bw_80 = true;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ath9k_htc-fix-uninit-value-bugs.patch b/queue-5.16/ath9k_htc-fix-uninit-value-bugs.patch
new file mode 100644
index 00000000000..5f9cf614eab
--- /dev/null
+++ b/queue-5.16/ath9k_htc-fix-uninit-value-bugs.patch
@@ -0,0 +1,100 @@
+From 2eb3d7556ea24c7b8112f1e3fcd52dc3daec2d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 10:52:37 +0200
+Subject: ath9k_htc: fix uninit value bugs
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit d1e0df1c57bd30871dd1c855742a7c346dbca853 ]
+
+Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
+field initialization.
+
+In htc_connect_service() svc_meta_len and pad are not initialized. Based
+on code it looks like in current skb there is no service data, so simply
+initialize svc_meta_len to 0.
+
+htc_issue_send() does not initialize htc_frame_hdr::control array. Based
+on firmware code, it will initialize it by itself, so simply zero whole
+array to make KMSAN happy
+
+Fail logs:
+
+BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
+ hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
+ htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
+ htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
+...
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:524 [inline]
+ slab_alloc_node mm/slub.c:3251 [inline]
+ __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
+ kmalloc_reserve net/core/skbuff.c:354 [inline]
+ __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
+ alloc_skb include/linux/skbuff.h:1126 [inline]
+ htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
+...
+
+Bytes 4-7 of 18 are uninitialized
+Memory access of size 18 starts at ffff888027377e00
+
+BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
+ hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
+ htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
+ htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
+...
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:524 [inline]
+ slab_alloc_node mm/slub.c:3251 [inline]
+ __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
+ kmalloc_reserve net/core/skbuff.c:354 [inline]
+ __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
+ alloc_skb include/linux/skbuff.h:1126 [inline]
+ htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
+...
+
+Bytes 16-17 of 18 are uninitialized
+Memory access of size 18 starts at ffff888027377e00
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_hst.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 510e61e97dbc..994ec48b2f66 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
+ 	hdr->endpoint_id = epid;
+ 	hdr->flags = flags;
+ 	hdr->payload_len = cpu_to_be16(len);
++	memset(hdr->control, 0, sizeof(hdr->control));
+ 
+ 	status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb);
+ 
+@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target,
+ 	conn_msg->dl_pipeid = endpoint->dl_pipeid;
+ 	conn_msg->ul_pipeid = endpoint->ul_pipeid;
+ 
++	/* To prevent infoleak */
++	conn_msg->svc_meta_len = 0;
++	conn_msg->pad = 0;
++
+ 	ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
+ 	if (ret)
+ 		goto err;
+-- 
+2.34.1
+
diff --git a/queue-5.16/atomics-fix-atomic64_-read_acquire-set_release-fallb.patch b/queue-5.16/atomics-fix-atomic64_-read_acquire-set_release-fallb.patch
new file mode 100644
index 00000000000..558a1c18b1a
--- /dev/null
+++ b/queue-5.16/atomics-fix-atomic64_-read_acquire-set_release-fallb.patch
@@ -0,0 +1,221 @@
+From 5b516517ace4aa477634799d97237d3b11beb118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Feb 2022 10:19:43 +0000
+Subject: atomics: Fix atomic64_{read_acquire,set_release} fallbacks
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit dc1b4df09acdca7a89806b28f235cd6d8dcd3d24 ]
+
+Arnd reports that on 32-bit architectures, the fallbacks for
+atomic64_read_acquire() and atomic64_set_release() are broken as they
+use smp_load_acquire() and smp_store_release() respectively, which do
+not work on types larger than the native word size.
+
+Since those contain compiletime_assert_atomic_type(), any attempt to use
+those fallbacks will result in a build-time error. e.g. with the
+following added to arch/arm/kernel/setup.c:
+
+| void test_atomic64(atomic64_t *v)
+| {
+|        atomic64_set_release(v, 5);
+|        atomic64_read_acquire(v);
+| }
+
+The compiler will complain as follows:
+
+| In file included from <command-line>:
+| In function 'arch_atomic64_set_release',
+|     inlined from 'test_atomic64' at ./include/linux/atomic/atomic-instrumented.h:669:2:
+| ././include/linux/compiler_types.h:346:38: error: call to '__compiletime_assert_9' declared with attribute error: Need native word sized stores/loads for atomicity.
+|   346 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+|       |                                      ^
+| ././include/linux/compiler_types.h:327:4: note: in definition of macro '__compiletime_assert'
+|   327 |    prefix ## suffix();    \
+|       |    ^~~~~~
+| ././include/linux/compiler_types.h:346:2: note: in expansion of macro '_compiletime_assert'
+|   346 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+|       |  ^~~~~~~~~~~~~~~~~~~
+| ././include/linux/compiler_types.h:349:2: note: in expansion of macro 'compiletime_assert'
+|   349 |  compiletime_assert(__native_word(t),    \
+|       |  ^~~~~~~~~~~~~~~~~~
+| ./include/asm-generic/barrier.h:133:2: note: in expansion of macro 'compiletime_assert_atomic_type'
+|   133 |  compiletime_assert_atomic_type(*p);    \
+|       |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+| ./include/asm-generic/barrier.h:164:55: note: in expansion of macro '__smp_store_release'
+|   164 | #define smp_store_release(p, v) do { kcsan_release(); __smp_store_release(p, v); } while (0)
+|       |                                                       ^~~~~~~~~~~~~~~~~~~
+| ./include/linux/atomic/atomic-arch-fallback.h:1270:2: note: in expansion of macro 'smp_store_release'
+|  1270 |  smp_store_release(&(v)->counter, i);
+|       |  ^~~~~~~~~~~~~~~~~
+| make[2]: *** [scripts/Makefile.build:288: arch/arm/kernel/setup.o] Error 1
+| make[1]: *** [scripts/Makefile.build:550: arch/arm/kernel] Error 2
+| make: *** [Makefile:1831: arch/arm] Error 2
+
+Fix this by only using smp_load_acquire() and smp_store_release() for
+native atomic types, and otherwise falling back to the regular barriers
+necessary for acquire/release semantics, as we do in the more generic
+acquire and release fallbacks.
+
+Since the fallback templates are used to generate the atomic64_*() and
+atomic_*() operations, the __native_word() check is added to both. For
+the atomic_*() operations, which are always 32-bit, the __native_word()
+check is redundant but not harmful, as it is always true.
+
+For the example above this works as expected on 32-bit, e.g. for arm
+multi_v7_defconfig:
+
+| <test_atomic64>:
+|         push    {r4, r5}
+|         dmb     ish
+|         pldw    [r0]
+|         mov     r2, #5
+|         mov     r3, #0
+|         ldrexd  r4, [r0]
+|         strexd  r4, r2, [r0]
+|         teq     r4, #0
+|         bne     484 <test_atomic64+0x14>
+|         ldrexd  r2, [r0]
+|         dmb     ish
+|         pop     {r4, r5}
+|         bx      lr
+
+... and also on 64-bit, e.g. for arm64 defconfig:
+
+| <test_atomic64>:
+|         bti     c
+|         paciasp
+|         mov     x1, #0x5
+|         stlr    x1, [x0]
+|         ldar    x0, [x0]
+|         autiasp
+|         ret
+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Boqun Feng <boqun.feng@gmail.com>
+Link: https://lore.kernel.org/r/20220207101943.439825-1-mark.rutland@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/atomic/atomic-arch-fallback.h | 38 ++++++++++++++++++---
+ scripts/atomic/fallbacks/read_acquire       | 11 +++++-
+ scripts/atomic/fallbacks/set_release        |  7 +++-
+ 3 files changed, 49 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/atomic/atomic-arch-fallback.h b/include/linux/atomic/atomic-arch-fallback.h
+index a3dba31df01e..6db58d180866 100644
+--- a/include/linux/atomic/atomic-arch-fallback.h
++++ b/include/linux/atomic/atomic-arch-fallback.h
+@@ -151,7 +151,16 @@
+ static __always_inline int
+ arch_atomic_read_acquire(const atomic_t *v)
+ {
+-	return smp_load_acquire(&(v)->counter);
++	int ret;
++
++	if (__native_word(atomic_t)) {
++		ret = smp_load_acquire(&(v)->counter);
++	} else {
++		ret = arch_atomic_read(v);
++		__atomic_acquire_fence();
++	}
++
++	return ret;
+ }
+ #define arch_atomic_read_acquire arch_atomic_read_acquire
+ #endif
+@@ -160,7 +169,12 @@ arch_atomic_read_acquire(const atomic_t *v)
+ static __always_inline void
+ arch_atomic_set_release(atomic_t *v, int i)
+ {
+-	smp_store_release(&(v)->counter, i);
++	if (__native_word(atomic_t)) {
++		smp_store_release(&(v)->counter, i);
++	} else {
++		__atomic_release_fence();
++		arch_atomic_set(v, i);
++	}
+ }
+ #define arch_atomic_set_release arch_atomic_set_release
+ #endif
+@@ -1258,7 +1272,16 @@ arch_atomic_dec_if_positive(atomic_t *v)
+ static __always_inline s64
+ arch_atomic64_read_acquire(const atomic64_t *v)
+ {
+-	return smp_load_acquire(&(v)->counter);
++	s64 ret;
++
++	if (__native_word(atomic64_t)) {
++		ret = smp_load_acquire(&(v)->counter);
++	} else {
++		ret = arch_atomic64_read(v);
++		__atomic_acquire_fence();
++	}
++
++	return ret;
+ }
+ #define arch_atomic64_read_acquire arch_atomic64_read_acquire
+ #endif
+@@ -1267,7 +1290,12 @@ arch_atomic64_read_acquire(const atomic64_t *v)
+ static __always_inline void
+ arch_atomic64_set_release(atomic64_t *v, s64 i)
+ {
+-	smp_store_release(&(v)->counter, i);
++	if (__native_word(atomic64_t)) {
++		smp_store_release(&(v)->counter, i);
++	} else {
++		__atomic_release_fence();
++		arch_atomic64_set(v, i);
++	}
+ }
+ #define arch_atomic64_set_release arch_atomic64_set_release
+ #endif
+@@ -2358,4 +2386,4 @@ arch_atomic64_dec_if_positive(atomic64_t *v)
+ #endif
+ 
+ #endif /* _LINUX_ATOMIC_FALLBACK_H */
+-// cca554917d7ea73d5e3e7397dd70c484cad9b2c4
++// 8e2cc06bc0d2c0967d2f8424762bd48555ee40ae
+diff --git a/scripts/atomic/fallbacks/read_acquire b/scripts/atomic/fallbacks/read_acquire
+index 803ba7561076..a0ea1d26e6b2 100755
+--- a/scripts/atomic/fallbacks/read_acquire
++++ b/scripts/atomic/fallbacks/read_acquire
+@@ -2,6 +2,15 @@ cat <<EOF
+ static __always_inline ${ret}
+ arch_${atomic}_read_acquire(const ${atomic}_t *v)
+ {
+-	return smp_load_acquire(&(v)->counter);
++	${int} ret;
++
++	if (__native_word(${atomic}_t)) {
++		ret = smp_load_acquire(&(v)->counter);
++	} else {
++		ret = arch_${atomic}_read(v);
++		__atomic_acquire_fence();
++	}
++
++	return ret;
+ }
+ EOF
+diff --git a/scripts/atomic/fallbacks/set_release b/scripts/atomic/fallbacks/set_release
+index 86ede759f24e..05cdb7f42477 100755
+--- a/scripts/atomic/fallbacks/set_release
++++ b/scripts/atomic/fallbacks/set_release
+@@ -2,6 +2,11 @@ cat <<EOF
+ static __always_inline void
+ arch_${atomic}_set_release(${atomic}_t *v, ${int} i)
+ {
+-	smp_store_release(&(v)->counter, i);
++	if (__native_word(${atomic}_t)) {
++		smp_store_release(&(v)->counter, i);
++	} else {
++		__atomic_release_fence();
++		arch_${atomic}_set(v, i);
++	}
+ }
+ EOF
+-- 
+2.34.1
+
diff --git a/queue-5.16/audit-log-audit_time_-records-only-from-rules.patch b/queue-5.16/audit-log-audit_time_-records-only-from-rules.patch
new file mode 100644
index 00000000000..2d492ec4627
--- /dev/null
+++ b/queue-5.16/audit-log-audit_time_-records-only-from-rules.patch
@@ -0,0 +1,167 @@
+From 85ae7f2150cdc94429352041a741df95bb112132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 11:44:51 -0500
+Subject: audit: log AUDIT_TIME_* records only from rules
+
+From: Richard Guy Briggs <rgb@redhat.com>
+
+[ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ]
+
+AUDIT_TIME_* events are generated when there are syscall rules present
+that are not related to time keeping.  This will produce noisy log
+entries that could flood the logs and hide events we really care about.
+
+Rather than immediately produce the AUDIT_TIME_* records, store the data
+in the context and log it at syscall exit time respecting the filter
+rules.
+
+Note: This eats the audit_buffer, unlike any others in show_special().
+
+Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
+
+Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
+Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
+Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
+[PM: fixed style/whitespace issues]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit.h   |  4 +++
+ kernel/auditsc.c | 87 +++++++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 71 insertions(+), 20 deletions(-)
+
+diff --git a/kernel/audit.h b/kernel/audit.h
+index c4498090a5bd..58b66543b4d5 100644
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -201,6 +201,10 @@ struct audit_context {
+ 		struct {
+ 			char			*name;
+ 		} module;
++		struct {
++			struct audit_ntp_data	ntp_data;
++			struct timespec64	tk_injoffset;
++		} time;
+ 	};
+ 	int fds[2];
+ 	struct audit_proctitle proctitle;
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 2dc94a0e3447..321904af2311 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1331,6 +1331,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
+ 			 from_kuid(&init_user_ns, name->fcap.rootid));
+ }
+ 
++static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
++{
++	const struct audit_ntp_data *ntp = &context->time.ntp_data;
++	const struct timespec64 *tk = &context->time.tk_injoffset;
++	static const char * const ntp_name[] = {
++		"offset",
++		"freq",
++		"status",
++		"tai",
++		"tick",
++		"adjust",
++	};
++	int type;
++
++	if (context->type == AUDIT_TIME_ADJNTPVAL) {
++		for (type = 0; type < AUDIT_NTP_NVALS; type++) {
++			if (ntp->vals[type].newval != ntp->vals[type].oldval) {
++				if (!*ab) {
++					*ab = audit_log_start(context,
++							GFP_KERNEL,
++							AUDIT_TIME_ADJNTPVAL);
++					if (!*ab)
++						return;
++				}
++				audit_log_format(*ab, "op=%s old=%lli new=%lli",
++						 ntp_name[type],
++						 ntp->vals[type].oldval,
++						 ntp->vals[type].newval);
++				audit_log_end(*ab);
++				*ab = NULL;
++			}
++		}
++	}
++	if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
++		if (!*ab) {
++			*ab = audit_log_start(context, GFP_KERNEL,
++					      AUDIT_TIME_INJOFFSET);
++			if (!*ab)
++				return;
++		}
++		audit_log_format(*ab, "sec=%lli nsec=%li",
++				 (long long)tk->tv_sec, tk->tv_nsec);
++		audit_log_end(*ab);
++		*ab = NULL;
++	}
++}
++
+ static void show_special(struct audit_context *context, int *call_panic)
+ {
+ 	struct audit_buffer *ab;
+@@ -1445,6 +1492,11 @@ static void show_special(struct audit_context *context, int *call_panic)
+ 			audit_log_format(ab, "(null)");
+ 
+ 		break;
++	case AUDIT_TIME_ADJNTPVAL:
++	case AUDIT_TIME_INJOFFSET:
++		/* this call deviates from the rest, eating the buffer */
++		audit_log_time(context, &ab);
++		break;
+ 	}
+ 	audit_log_end(ab);
+ }
+@@ -2840,31 +2892,26 @@ void __audit_fanotify(unsigned int response)
+ 
+ void __audit_tk_injoffset(struct timespec64 offset)
+ {
+-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
+-		  "sec=%lli nsec=%li",
+-		  (long long)offset.tv_sec, offset.tv_nsec);
+-}
+-
+-static void audit_log_ntp_val(const struct audit_ntp_data *ad,
+-			      const char *op, enum audit_ntp_type type)
+-{
+-	const struct audit_ntp_val *val = &ad->vals[type];
+-
+-	if (val->newval == val->oldval)
+-		return;
++	struct audit_context *context = audit_context();
+ 
+-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
+-		  "op=%s old=%lli new=%lli", op, val->oldval, val->newval);
++	/* only set type if not already set by NTP */
++	if (!context->type)
++		context->type = AUDIT_TIME_INJOFFSET;
++	memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
+ }
+ 
+ void __audit_ntp_log(const struct audit_ntp_data *ad)
+ {
+-	audit_log_ntp_val(ad, "offset",	AUDIT_NTP_OFFSET);
+-	audit_log_ntp_val(ad, "freq",	AUDIT_NTP_FREQ);
+-	audit_log_ntp_val(ad, "status",	AUDIT_NTP_STATUS);
+-	audit_log_ntp_val(ad, "tai",	AUDIT_NTP_TAI);
+-	audit_log_ntp_val(ad, "tick",	AUDIT_NTP_TICK);
+-	audit_log_ntp_val(ad, "adjust",	AUDIT_NTP_ADJUST);
++	struct audit_context *context = audit_context();
++	int type;
++
++	for (type = 0; type < AUDIT_NTP_NVALS; type++)
++		if (ad->vals[type].newval != ad->vals[type].oldval) {
++			/* unconditionally set type, overwriting TK */
++			context->type = AUDIT_TIME_ADJNTPVAL;
++			memcpy(&context->time.ntp_data, ad, sizeof(*ad));
++			break;
++		}
+ }
+ 
+ void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
+-- 
+2.34.1
+
diff --git a/queue-5.16/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch b/queue-5.16/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch
new file mode 100644
index 00000000000..36add5c01af
--- /dev/null
+++ b/queue-5.16/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch
@@ -0,0 +1,92 @@
+From 3f2fe5f7b30f3764e70a0cbf8d139506f684c50c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 14:26:18 +0800
+Subject: bareudp: use ipv6_mod_enabled to check if IPv6 enabled
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit e077ed58c243afc197bc2a2ba0e1ff61135e4ec2 ]
+
+bareudp_create_sock() use AF_INET6 by default if IPv6 CONFIG enabled.
+But if user start kernel with ipv6.disable=1, the bareudp sock will
+created failed, which cause the interface open failed even with ethertype
+ip. e.g.
+
+ # ip link add bareudp1 type bareudp dstport 2 ethertype ip
+ # ip link set bareudp1 up
+ RTNETLINK answers: Address family not supported by protocol
+
+Fix it by using ipv6_mod_enabled() to check if IPv6 enabled. There is
+no need to check IS_ENABLED(CONFIG_IPV6) as ipv6_mod_enabled() will
+return false when CONFIG_IPV6 no enabled in include/linux/ipv6.h.
+
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://lore.kernel.org/r/20220315062618.156230-1-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bareudp.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c
+index edffc3489a12..a7d79100b685 100644
+--- a/drivers/net/bareudp.c
++++ b/drivers/net/bareudp.c
+@@ -141,14 +141,14 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ 	skb_reset_network_header(skb);
+ 	skb_reset_mac_header(skb);
+ 
+-	if (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET)
++	if (!ipv6_mod_enabled() || family == AF_INET)
+ 		err = IP_ECN_decapsulate(oiph, skb);
+ 	else
+ 		err = IP6_ECN_decapsulate(oiph, skb);
+ 
+ 	if (unlikely(err)) {
+ 		if (log_ecn_error) {
+-			if  (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET)
++			if  (!ipv6_mod_enabled() || family == AF_INET)
+ 				net_info_ratelimited("non-ECT from %pI4 "
+ 						     "with TOS=%#x\n",
+ 						     &((struct iphdr *)oiph)->saddr,
+@@ -214,11 +214,12 @@ static struct socket *bareudp_create_sock(struct net *net, __be16 port)
+ 	int err;
+ 
+ 	memset(&udp_conf, 0, sizeof(udp_conf));
+-#if IS_ENABLED(CONFIG_IPV6)
+-	udp_conf.family = AF_INET6;
+-#else
+-	udp_conf.family = AF_INET;
+-#endif
++
++	if (ipv6_mod_enabled())
++		udp_conf.family = AF_INET6;
++	else
++		udp_conf.family = AF_INET;
++
+ 	udp_conf.local_udp_port = port;
+ 	/* Open UDP socket */
+ 	err = udp_sock_create(net, &udp_conf, &sock);
+@@ -441,7 +442,7 @@ static netdev_tx_t bareudp_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 
+ 	rcu_read_lock();
+-	if (IS_ENABLED(CONFIG_IPV6) && info->mode & IP_TUNNEL_INFO_IPV6)
++	if (ipv6_mod_enabled() && info->mode & IP_TUNNEL_INFO_IPV6)
+ 		err = bareudp6_xmit_skb(skb, dev, bareudp, info);
+ 	else
+ 		err = bareudp_xmit_skb(skb, dev, bareudp, info);
+@@ -471,7 +472,7 @@ static int bareudp_fill_metadata_dst(struct net_device *dev,
+ 
+ 	use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ 
+-	if (!IS_ENABLED(CONFIG_IPV6) || ip_tunnel_info_af(info) == AF_INET) {
++	if (!ipv6_mod_enabled() || ip_tunnel_info_af(info) == AF_INET) {
+ 		struct rtable *rt;
+ 		__be32 saddr;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bfq-fix-use-after-free-in-bfq_dispatch_request.patch b/queue-5.16/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
new file mode 100644
index 00000000000..b843c8a641b
--- /dev/null
+++ b/queue-5.16/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
@@ -0,0 +1,183 @@
+From a0a46ce5b327dc4a5dbfdd5ad53773c051061409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 15:03:34 +0800
+Subject: bfq: fix use-after-free in bfq_dispatch_request
+
+From: Zhang Wensheng <zhangwensheng5@huawei.com>
+
+[ Upstream commit ab552fcb17cc9e4afe0e4ac4df95fc7b30e8490a ]
+
+KASAN reports a use-after-free report when doing normal scsi-mq test
+
+[69832.239032] ==================================================================
+[69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0
+[69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155
+[69832.244656]
+[69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8
+[69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+[69832.249069] Workqueue: kblockd blk_mq_run_work_fn
+[69832.250022] Call Trace:
+[69832.250541]  dump_stack+0x9b/0xce
+[69832.251232]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.252243]  print_address_description.constprop.6+0x3e/0x60
+[69832.253381]  ? __cpuidle_text_end+0x5/0x5
+[69832.254211]  ? vprintk_func+0x6b/0x120
+[69832.254994]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.255952]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.256914]  kasan_report.cold.9+0x22/0x3a
+[69832.257753]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.258755]  check_memory_region+0x1c1/0x1e0
+[69832.260248]  bfq_dispatch_request+0x1045/0x44b0
+[69832.261181]  ? bfq_bfqq_expire+0x2440/0x2440
+[69832.262032]  ? blk_mq_delay_run_hw_queues+0xf9/0x170
+[69832.263022]  __blk_mq_do_dispatch_sched+0x52f/0x830
+[69832.264011]  ? blk_mq_sched_request_inserted+0x100/0x100
+[69832.265101]  __blk_mq_sched_dispatch_requests+0x398/0x4f0
+[69832.266206]  ? blk_mq_do_dispatch_ctx+0x570/0x570
+[69832.267147]  ? __switch_to+0x5f4/0xee0
+[69832.267898]  blk_mq_sched_dispatch_requests+0xdf/0x140
+[69832.268946]  __blk_mq_run_hw_queue+0xc0/0x270
+[69832.269840]  blk_mq_run_work_fn+0x51/0x60
+[69832.278170]  process_one_work+0x6d4/0xfe0
+[69832.278984]  worker_thread+0x91/0xc80
+[69832.279726]  ? __kthread_parkme+0xb0/0x110
+[69832.280554]  ? process_one_work+0xfe0/0xfe0
+[69832.281414]  kthread+0x32d/0x3f0
+[69832.282082]  ? kthread_park+0x170/0x170
+[69832.282849]  ret_from_fork+0x1f/0x30
+[69832.283573]
+[69832.283886] Allocated by task 7725:
+[69832.284599]  kasan_save_stack+0x19/0x40
+[69832.285385]  __kasan_kmalloc.constprop.2+0xc1/0xd0
+[69832.286350]  kmem_cache_alloc_node+0x13f/0x460
+[69832.287237]  bfq_get_queue+0x3d4/0x1140
+[69832.287993]  bfq_get_bfqq_handle_split+0x103/0x510
+[69832.289015]  bfq_init_rq+0x337/0x2d50
+[69832.289749]  bfq_insert_requests+0x304/0x4e10
+[69832.290634]  blk_mq_sched_insert_requests+0x13e/0x390
+[69832.291629]  blk_mq_flush_plug_list+0x4b4/0x760
+[69832.292538]  blk_flush_plug_list+0x2c5/0x480
+[69832.293392]  io_schedule_prepare+0xb2/0xd0
+[69832.294209]  io_schedule_timeout+0x13/0x80
+[69832.295014]  wait_for_common_io.constprop.1+0x13c/0x270
+[69832.296137]  submit_bio_wait+0x103/0x1a0
+[69832.296932]  blkdev_issue_discard+0xe6/0x160
+[69832.297794]  blk_ioctl_discard+0x219/0x290
+[69832.298614]  blkdev_common_ioctl+0x50a/0x1750
+[69832.304715]  blkdev_ioctl+0x470/0x600
+[69832.305474]  block_ioctl+0xde/0x120
+[69832.306232]  vfs_ioctl+0x6c/0xc0
+[69832.306877]  __se_sys_ioctl+0x90/0xa0
+[69832.307629]  do_syscall_64+0x2d/0x40
+[69832.308362]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[69832.309382]
+[69832.309701] Freed by task 155:
+[69832.310328]  kasan_save_stack+0x19/0x40
+[69832.311121]  kasan_set_track+0x1c/0x30
+[69832.311868]  kasan_set_free_info+0x1b/0x30
+[69832.312699]  __kasan_slab_free+0x111/0x160
+[69832.313524]  kmem_cache_free+0x94/0x460
+[69832.314367]  bfq_put_queue+0x582/0x940
+[69832.315112]  __bfq_bfqd_reset_in_service+0x166/0x1d0
+[69832.317275]  bfq_bfqq_expire+0xb27/0x2440
+[69832.318084]  bfq_dispatch_request+0x697/0x44b0
+[69832.318991]  __blk_mq_do_dispatch_sched+0x52f/0x830
+[69832.319984]  __blk_mq_sched_dispatch_requests+0x398/0x4f0
+[69832.321087]  blk_mq_sched_dispatch_requests+0xdf/0x140
+[69832.322225]  __blk_mq_run_hw_queue+0xc0/0x270
+[69832.323114]  blk_mq_run_work_fn+0x51/0x60
+[69832.323942]  process_one_work+0x6d4/0xfe0
+[69832.324772]  worker_thread+0x91/0xc80
+[69832.325518]  kthread+0x32d/0x3f0
+[69832.326205]  ret_from_fork+0x1f/0x30
+[69832.326932]
+[69832.338297] The buggy address belongs to the object at ffff88802622b968
+[69832.338297]  which belongs to the cache bfq_queue of size 512
+[69832.340766] The buggy address is located 288 bytes inside of
+[69832.340766]  512-byte region [ffff88802622b968, ffff88802622bb68)
+[69832.343091] The buggy address belongs to the page:
+[69832.344097] page:ffffea0000988a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802622a528 pfn:0x26228
+[69832.346214] head:ffffea0000988a00 order:2 compound_mapcount:0 compound_pincount:0
+[69832.347719] flags: 0x1fffff80010200(slab|head)
+[69832.348625] raw: 001fffff80010200 ffffea0000dbac08 ffff888017a57650 ffff8880179fe840
+[69832.354972] raw: ffff88802622a528 0000000000120008 00000001ffffffff 0000000000000000
+[69832.356547] page dumped because: kasan: bad access detected
+[69832.357652]
+[69832.357970] Memory state around the buggy address:
+[69832.358926]  ffff88802622b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.360358]  ffff88802622ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.361810] >ffff88802622ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.363273]                       ^
+[69832.363975]  ffff88802622bb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
+[69832.375960]  ffff88802622bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[69832.377405] ==================================================================
+
+In bfq_dispatch_requestfunction, it may have function call:
+
+bfq_dispatch_request
+	__bfq_dispatch_request
+		bfq_select_queue
+			bfq_bfqq_expire
+				__bfq_bfqd_reset_in_service
+					bfq_put_queue
+						kmem_cache_free
+In this function call, in_serv_queue has beed expired and meet the
+conditions to free. In the function bfq_dispatch_request, the address
+of in_serv_queue pointing to has been released. For getting the value
+of idle_timer_disabled, it will get flags value from the address which
+in_serv_queue pointing to, then the problem of use-after-free happens;
+
+Fix the problem by check in_serv_queue == bfqd->in_service_queue, to
+get the value of idle_timer_disabled if in_serve_queue is equel to
+bfqd->in_service_queue. If the space of in_serv_queue pointing has
+been released, this judge will aviod use-after-free problem.
+And if in_serv_queue may be expired or finished, the idle_timer_disabled
+will be false which would not give effects to bfq_update_dispatch_stats.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Wensheng <zhangwensheng5@huawei.com>
+Link: https://lore.kernel.org/r/20220303070334.3020168-1-zhangwensheng5@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 8c0950c9a1a2..7eecd3200d83 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5061,7 +5061,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ 	struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
+ 	struct request *rq;
+ 	struct bfq_queue *in_serv_queue;
+-	bool waiting_rq, idle_timer_disabled;
++	bool waiting_rq, idle_timer_disabled = false;
+ 
+ 	spin_lock_irq(&bfqd->lock);
+ 
+@@ -5069,14 +5069,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ 	waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue);
+ 
+ 	rq = __bfq_dispatch_request(hctx);
+-
+-	idle_timer_disabled =
+-		waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++	if (in_serv_queue == bfqd->in_service_queue) {
++		idle_timer_disabled =
++			waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++	}
+ 
+ 	spin_unlock_irq(&bfqd->lock);
+-
+-	bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue,
+-				  idle_timer_disabled);
++	bfq_update_dispatch_stats(hctx->queue, rq,
++			idle_timer_disabled ? in_serv_queue : NULL,
++				idle_timer_disabled);
+ 
+ 	return rq;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch b/queue-5.16/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
new file mode 100644
index 00000000000..4f9d2d43a5f
--- /dev/null
+++ b/queue-5.16/blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
@@ -0,0 +1,58 @@
+From 7d13821c5d5cbc7195ada41ca653bc1281454418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Feb 2022 16:59:02 +0800
+Subject: blk-cgroup: set blkg iostat after percpu stat aggregation
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit f122d103b564e5fb7c82de902c6f8f6cbdf50ec9 ]
+
+Don't need to do blkg_iostat_set for top blkg iostat on each CPU,
+so move it after percpu stat aggregation.
+
+Fixes: ef45fe470e1e ("blk-cgroup: show global disk stats in root cgroup io.stat")
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220213085902.88884-1-zhouchengming@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 663aabfeba18..f896f4982665 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -856,11 +856,11 @@ static void blkcg_fill_root_iostats(void)
+ 			blk_queue_root_blkg(bdev_get_queue(bdev));
+ 		struct blkg_iostat tmp;
+ 		int cpu;
++		unsigned long flags;
+ 
+ 		memset(&tmp, 0, sizeof(tmp));
+ 		for_each_possible_cpu(cpu) {
+ 			struct disk_stats *cpu_dkstats;
+-			unsigned long flags;
+ 
+ 			cpu_dkstats = per_cpu_ptr(bdev->bd_stats, cpu);
+ 			tmp.ios[BLKG_IOSTAT_READ] +=
+@@ -876,11 +876,11 @@ static void blkcg_fill_root_iostats(void)
+ 				cpu_dkstats->sectors[STAT_WRITE] << 9;
+ 			tmp.bytes[BLKG_IOSTAT_DISCARD] +=
+ 				cpu_dkstats->sectors[STAT_DISCARD] << 9;
+-
+-			flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync);
+-			blkg_iostat_set(&blkg->iostat.cur, &tmp);
+-			u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
+ 		}
++
++		flags = u64_stats_update_begin_irqsave(&blkg->iostat.sync);
++		blkg_iostat_set(&blkg->iostat.cur, &tmp);
++		u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
+ 	}
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/block-bfq-don-t-move-oom_bfqq.patch b/queue-5.16/block-bfq-don-t-move-oom_bfqq.patch
new file mode 100644
index 00000000000..b1f52dc806d
--- /dev/null
+++ b/queue-5.16/block-bfq-don-t-move-oom_bfqq.patch
@@ -0,0 +1,142 @@
+From 2d2d519a27d412cedf975d507954c65868d7cdd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 09:59:24 +0800
+Subject: block, bfq: don't move oom_bfqq
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 8410f70977734f21b8ed45c37e925d311dfda2e7 ]
+
+Our test report a UAF:
+
+[ 2073.019181] ==================================================================
+[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168
+[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584
+[ 2073.019192]
+[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5
+[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
+[ 2073.019200] Call trace:
+[ 2073.019203]  dump_backtrace+0x0/0x310
+[ 2073.019206]  show_stack+0x28/0x38
+[ 2073.019210]  dump_stack+0xec/0x15c
+[ 2073.019216]  print_address_description+0x68/0x2d0
+[ 2073.019220]  kasan_report+0x238/0x2f0
+[ 2073.019224]  __asan_store8+0x88/0xb0
+[ 2073.019229]  __bfq_put_async_bfqq+0xa0/0x168
+[ 2073.019233]  bfq_put_async_queues+0xbc/0x208
+[ 2073.019236]  bfq_pd_offline+0x178/0x238
+[ 2073.019240]  blkcg_deactivate_policy+0x1f0/0x420
+[ 2073.019244]  bfq_exit_queue+0x128/0x178
+[ 2073.019249]  blk_mq_exit_sched+0x12c/0x160
+[ 2073.019252]  elevator_exit+0xc8/0xd0
+[ 2073.019256]  blk_exit_queue+0x50/0x88
+[ 2073.019259]  blk_cleanup_queue+0x228/0x3d8
+[ 2073.019267]  null_del_dev+0xfc/0x1e0 [null_blk]
+[ 2073.019274]  null_exit+0x90/0x114 [null_blk]
+[ 2073.019278]  __arm64_sys_delete_module+0x358/0x5a0
+[ 2073.019282]  el0_svc_common+0xc8/0x320
+[ 2073.019287]  el0_svc_handler+0xf8/0x160
+[ 2073.019290]  el0_svc+0x10/0x218
+[ 2073.019291]
+[ 2073.019294] Allocated by task 14163:
+[ 2073.019301]  kasan_kmalloc+0xe0/0x190
+[ 2073.019305]  kmem_cache_alloc_node_trace+0x1cc/0x418
+[ 2073.019308]  bfq_pd_alloc+0x54/0x118
+[ 2073.019313]  blkcg_activate_policy+0x250/0x460
+[ 2073.019317]  bfq_create_group_hierarchy+0x38/0x110
+[ 2073.019321]  bfq_init_queue+0x6d0/0x948
+[ 2073.019325]  blk_mq_init_sched+0x1d8/0x390
+[ 2073.019330]  elevator_switch_mq+0x88/0x170
+[ 2073.019334]  elevator_switch+0x140/0x270
+[ 2073.019338]  elv_iosched_store+0x1a4/0x2a0
+[ 2073.019342]  queue_attr_store+0x90/0xe0
+[ 2073.019348]  sysfs_kf_write+0xa8/0xe8
+[ 2073.019351]  kernfs_fop_write+0x1f8/0x378
+[ 2073.019359]  __vfs_write+0xe0/0x360
+[ 2073.019363]  vfs_write+0xf0/0x270
+[ 2073.019367]  ksys_write+0xdc/0x1b8
+[ 2073.019371]  __arm64_sys_write+0x50/0x60
+[ 2073.019375]  el0_svc_common+0xc8/0x320
+[ 2073.019380]  el0_svc_handler+0xf8/0x160
+[ 2073.019383]  el0_svc+0x10/0x218
+[ 2073.019385]
+[ 2073.019387] Freed by task 72584:
+[ 2073.019391]  __kasan_slab_free+0x120/0x228
+[ 2073.019394]  kasan_slab_free+0x10/0x18
+[ 2073.019397]  kfree+0x94/0x368
+[ 2073.019400]  bfqg_put+0x64/0xb0
+[ 2073.019404]  bfqg_and_blkg_put+0x90/0xb0
+[ 2073.019408]  bfq_put_queue+0x220/0x228
+[ 2073.019413]  __bfq_put_async_bfqq+0x98/0x168
+[ 2073.019416]  bfq_put_async_queues+0xbc/0x208
+[ 2073.019420]  bfq_pd_offline+0x178/0x238
+[ 2073.019424]  blkcg_deactivate_policy+0x1f0/0x420
+[ 2073.019429]  bfq_exit_queue+0x128/0x178
+[ 2073.019433]  blk_mq_exit_sched+0x12c/0x160
+[ 2073.019437]  elevator_exit+0xc8/0xd0
+[ 2073.019440]  blk_exit_queue+0x50/0x88
+[ 2073.019443]  blk_cleanup_queue+0x228/0x3d8
+[ 2073.019451]  null_del_dev+0xfc/0x1e0 [null_blk]
+[ 2073.019459]  null_exit+0x90/0x114 [null_blk]
+[ 2073.019462]  __arm64_sys_delete_module+0x358/0x5a0
+[ 2073.019467]  el0_svc_common+0xc8/0x320
+[ 2073.019471]  el0_svc_handler+0xf8/0x160
+[ 2073.019474]  el0_svc+0x10/0x218
+[ 2073.019475]
+[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00
+ which belongs to the cache kmalloc-1024 of size 1024
+[ 2073.019484] The buggy address is located 552 bytes inside of
+ 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)
+[ 2073.019486] The buggy address belongs to the page:
+[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0
+[ 2073.020123] flags: 0x7ffff0000008100(slab|head)
+[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00
+[ 2073.020409] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000
+[ 2073.020411] page dumped because: kasan: bad access detected
+[ 2073.020412]
+[ 2073.020414] Memory state around the buggy address:
+[ 2073.020420]  ffff8000ccf64000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020424]  ffff8000ccf64080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020428] >ffff8000ccf64100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020430]                                   ^
+[ 2073.020434]  ffff8000ccf64180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020438]  ffff8000ccf64200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020439] ==================================================================
+
+The same problem exist in mainline as well.
+
+This is because oom_bfqq is moved to a non-root group, thus root_group
+is freed earlier.
+
+Thus fix the problem by don't move oom_bfqq.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Acked-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20220129015924.3958918-4-yukuai3@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 24a5c5329bcd..809bc612d96b 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -646,6 +646,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ 	struct bfq_entity *entity = &bfqq->entity;
+ 
++	/*
++	 * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group
++	 * until elevator exit.
++	 */
++	if (bfqq == &bfqd->oom_bfqq)
++		return;
+ 	/*
+ 	 * Get extra reference to prevent bfqq from being freed in
+ 	 * next possible expire or deactivate.
+-- 
+2.34.1
+
diff --git a/queue-5.16/block-bfq_wf2q-correct-weight-to-ioprio.patch b/queue-5.16/block-bfq_wf2q-correct-weight-to-ioprio.patch
new file mode 100644
index 00000000000..b602304e024
--- /dev/null
+++ b/queue-5.16/block-bfq_wf2q-correct-weight-to-ioprio.patch
@@ -0,0 +1,38 @@
+From 86a91ef0771dbae486cec79265d5ae61cf5d2b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 14:58:59 +0800
+Subject: block/bfq_wf2q: correct weight to ioprio
+
+From: Yahu Gao <gaoyahu19@gmail.com>
+
+[ Upstream commit bcd2be763252f3a4d5fc4d6008d4d96c601ee74b ]
+
+The return value is ioprio * BFQ_WEIGHT_CONVERSION_COEFF or 0.
+What we want is ioprio or 0.
+Correct this by changing the calculation.
+
+Signed-off-by: Yahu Gao <gaoyahu19@gmail.com>
+Acked-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20220107065859.25689-1-gaoyahu19@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-wf2q.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index b74cc0da118e..709b901de3ca 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -519,7 +519,7 @@ unsigned short bfq_ioprio_to_weight(int ioprio)
+ static unsigned short bfq_weight_to_ioprio(int weight)
+ {
+ 	return max_t(int, 0,
+-		     IOPRIO_NR_LEVELS * BFQ_WEIGHT_CONVERSION_COEFF - weight);
++		     IOPRIO_NR_LEVELS - weight / BFQ_WEIGHT_CONVERSION_COEFF);
+ }
+ 
+ static void bfq_get_entity(struct bfq_entity *entity)
+-- 
+2.34.1
+
diff --git a/queue-5.16/block-don-t-delete-queue-kobject-before-its-children.patch b/queue-5.16/block-don-t-delete-queue-kobject-before-its-children.patch
new file mode 100644
index 00000000000..7e930540f67
--- /dev/null
+++ b/queue-5.16/block-don-t-delete-queue-kobject-before-its-children.patch
@@ -0,0 +1,72 @@
+From 60015c2ab15967a8256b4e65d347ac2615cfe2df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 13:59:37 -0800
+Subject: block: don't delete queue kobject before its children
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ]
+
+kobjects aren't supposed to be deleted before their child kobjects are
+deleted.  Apparently this is usually benign; however, a WARN will be
+triggered if one of the child kobjects has a named attribute group:
+
+    sysfs group 'modes' not found for kobject 'crypto'
+    WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80
+    ...
+    Call Trace:
+      sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312
+      __kobject_del+0x20/0x80 lib/kobject.c:611
+      kobject_cleanup+0xa4/0x140 lib/kobject.c:696
+      kobject_release lib/kobject.c:736 [inline]
+      kref_put include/linux/kref.h:65 [inline]
+      kobject_put+0x53/0x70 lib/kobject.c:753
+      blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159
+      blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962
+      del_gendisk+0x117/0x250 block/genhd.c:610
+
+Fix this by moving the kobject_del() and the corresponding
+kobject_uevent() to the correct place.
+
+Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}register_queue()")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-sysfs.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index cd75b0f73dc6..2fe8da2a7216 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -949,9 +949,6 @@ void blk_unregister_queue(struct gendisk *disk)
+ 	 */
+ 	if (queue_is_mq(q))
+ 		blk_mq_unregister_dev(disk_to_dev(disk), q);
+-
+-	kobject_uevent(&q->kobj, KOBJ_REMOVE);
+-	kobject_del(&q->kobj);
+ 	blk_trace_remove_sysfs(disk_to_dev(disk));
+ 
+ 	mutex_lock(&q->sysfs_lock);
+@@ -959,6 +956,11 @@ void blk_unregister_queue(struct gendisk *disk)
+ 		elv_unregister_queue(q);
+ 	disk_unregister_independent_access_ranges(disk);
+ 	mutex_unlock(&q->sysfs_lock);
++
++	/* Now that we've deleted all child objects, we can delete the queue. */
++	kobject_uevent(&q->kobj, KOBJ_REMOVE);
++	kobject_del(&q->kobj);
++
+ 	mutex_unlock(&q->sysfs_dir_lock);
+ 
+ 	kobject_put(&disk_to_dev(disk)->kobj);
+-- 
+2.34.1
+
diff --git a/queue-5.16/block-throttle-split-bio-in-case-of-iops-limit.patch b/queue-5.16/block-throttle-split-bio-in-case-of-iops-limit.patch
new file mode 100644
index 00000000000..05ef2c3a015
--- /dev/null
+++ b/queue-5.16/block-throttle-split-bio-in-case-of-iops-limit.patch
@@ -0,0 +1,106 @@
+From c6e427c6899fd11c17c30b57ef00bf7db41e7ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 12:45:12 +0800
+Subject: block: throttle split bio in case of iops limit
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 9f5ede3c01f9951b0ae7d68b28762ad51d9bacc8 ]
+
+Commit 111be8839817 ("block-throttle: avoid double charge") marks bio as
+BIO_THROTTLED unconditionally if __blk_throtl_bio() is called on this bio,
+then this bio won't be called into __blk_throtl_bio() any more. This way
+is to avoid double charge in case of bio splitting. It is reasonable for
+read/write throughput limit, but not reasonable for IOPS limit because
+block layer provides io accounting against split bio.
+
+Chunguang Xu has already observed this issue and fixed it in commit
+4f1e9630afe6 ("blk-throtl: optimize IOPS throttle for large IO scenarios").
+However, that patch only covers bio splitting in __blk_queue_split(), and
+we have other kind of bio splitting, such as bio_split() &
+submit_bio_noacct() and other ways.
+
+This patch tries to fix the issue in one generic way by always charging
+the bio for iops limit in blk_throtl_bio(). This way is reasonable:
+re-submission & fast-cloned bio is charged if it is submitted to same
+disk/queue, and BIO_THROTTLED will be cleared if bio->bi_bdev is changed.
+
+This new approach can get much more smooth/stable iops limit compared with
+commit 4f1e9630afe6 ("blk-throtl: optimize IOPS throttle for large IO
+scenarios") since that commit can't throttle current split bios actually.
+
+Also this way won't cause new double bio iops charge in
+blk_throtl_dispatch_work_fn() in which blk_throtl_bio() won't be called
+any more.
+
+Reported-by: Ning Li <lining2020x@163.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Cc: Chunguang Xu <brookxu@tencent.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20220216044514.2903784-7-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c    |  2 --
+ block/blk-throttle.c | 10 +++++++---
+ block/blk-throttle.h |  2 --
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index a5b73bad9462..09bf679dc132 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -367,8 +367,6 @@ void __blk_queue_split(struct request_queue *q, struct bio **bio,
+ 		trace_block_split(split, (*bio)->bi_iter.bi_sector);
+ 		submit_bio_noacct(*bio);
+ 		*bio = split;
+-
+-		blk_throtl_charge_bio_split(*bio);
+ 	}
+ }
+ 
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 39bb6e68a9a2..96573fa4edf2 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -807,7 +807,8 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio,
+ 	unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;
+ 	unsigned int bio_size = throtl_bio_data_size(bio);
+ 
+-	if (bps_limit == U64_MAX) {
++	/* no need to throttle if this bio's bytes have been accounted */
++	if (bps_limit == U64_MAX || bio_flagged(bio, BIO_THROTTLED)) {
+ 		if (wait)
+ 			*wait = 0;
+ 		return true;
+@@ -919,9 +920,12 @@ static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio)
+ 	unsigned int bio_size = throtl_bio_data_size(bio);
+ 
+ 	/* Charge the bio to the group */
+-	tg->bytes_disp[rw] += bio_size;
++	if (!bio_flagged(bio, BIO_THROTTLED)) {
++		tg->bytes_disp[rw] += bio_size;
++		tg->last_bytes_disp[rw] += bio_size;
++	}
++
+ 	tg->io_disp[rw]++;
+-	tg->last_bytes_disp[rw] += bio_size;
+ 	tg->last_io_disp[rw]++;
+ 
+ 	/*
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index 175f03abd9e4..cb43f4417d6e 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -170,8 +170,6 @@ static inline bool blk_throtl_bio(struct bio *bio)
+ {
+ 	struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg);
+ 
+-	if (bio_flagged(bio, BIO_THROTTLED))
+-		return false;
+ 	if (!tg->has_rules[bio_data_dir(bio)])
+ 		return false;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bluetooth-btintel-fix-wbs-setting-for-intel-legacy-r.patch b/queue-5.16/bluetooth-btintel-fix-wbs-setting-for-intel-legacy-r.patch
new file mode 100644
index 00000000000..0a9a7061092
--- /dev/null
+++ b/queue-5.16/bluetooth-btintel-fix-wbs-setting-for-intel-legacy-r.patch
@@ -0,0 +1,94 @@
+From 4c2719cbcef810ad8c0a6ee562d5ad4155ec81e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 11:44:18 -0800
+Subject: Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products
+
+From: Tedd Ho-Jeong An <tedd.an@intel.com>
+
+[ Upstream commit 55235304c2560d4a94ccfff2a47ea927b4114064 ]
+
+This patch adds the flag to identify the Intel legacy ROM products that
+don't support WBS like WP and StP.
+
+Fixes: 3df4dfbec0f29 ("Bluetooth: btintel: Move hci quirks to setup routine")
+Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btintel.c | 11 ++++++++---
+ drivers/bluetooth/btintel.h |  1 +
+ drivers/bluetooth/btusb.c   |  6 ++++++
+ 3 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
+index 851a0c9b8fae..a224e5337ef8 100644
+--- a/drivers/bluetooth/btintel.c
++++ b/drivers/bluetooth/btintel.c
+@@ -2426,10 +2426,15 @@ static int btintel_setup_combined(struct hci_dev *hdev)
+ 
+ 			/* Apply the device specific HCI quirks
+ 			 *
+-			 * WBS for SdP - SdP and Stp have a same hw_varaint but
+-			 * different fw_variant
++			 * WBS for SdP - For the Legacy ROM products, only SdP
++			 * supports the WBS. But the version information is not
++			 * enough to use here because the StP2 and SdP have same
++			 * hw_variant and fw_variant. So, this flag is set by
++			 * the transport driver (btusb) based on the HW info
++			 * (idProduct)
+ 			 */
+-			if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
++			if (!btintel_test_flag(hdev,
++					       INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
+ 				set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
+ 					&hdev->quirks);
+ 
+diff --git a/drivers/bluetooth/btintel.h b/drivers/bluetooth/btintel.h
+index c9b24e9299e2..e0060e58573c 100644
+--- a/drivers/bluetooth/btintel.h
++++ b/drivers/bluetooth/btintel.h
+@@ -152,6 +152,7 @@ enum {
+ 	INTEL_BROKEN_INITIAL_NCMD,
+ 	INTEL_BROKEN_SHUTDOWN_LED,
+ 	INTEL_ROM_LEGACY,
++	INTEL_ROM_LEGACY_NO_WBS_SUPPORT,
+ 
+ 	__INTEL_NUM_FLAGS,
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c1f1237ddc76..8bb67c56eb7d 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -61,6 +61,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_QCA_WCN6855	0x1000000
+ #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED	0x2000000
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD 0x4000000
++#define BTUSB_INTEL_NO_WBS_SUPPORT	0x8000000
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -384,9 +385,11 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
+ 	{ USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
+ 	{ USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
++						     BTUSB_INTEL_NO_WBS_SUPPORT |
+ 						     BTUSB_INTEL_BROKEN_INITIAL_NCMD |
+ 						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
+ 	{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
++						     BTUSB_INTEL_NO_WBS_SUPPORT |
+ 						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
+ 	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
+ 	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
+@@ -3902,6 +3905,9 @@ static int btusb_probe(struct usb_interface *intf,
+ 		hdev->send = btusb_send_frame_intel;
+ 		hdev->cmd_timeout = btusb_intel_cmd_timeout;
+ 
++		if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT)
++			btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT);
++
+ 		if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
+ 			btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch b/queue-5.16/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
new file mode 100644
index 00000000000..c62c7e25c7b
--- /dev/null
+++ b/queue-5.16/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
@@ -0,0 +1,72 @@
+From 417cdf3543678c21cd91a289bb152971c175fc22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 07:15:19 +0800
+Subject: Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
+
+From: Yake Yang <yake.yang@mediatek.com>
+
+[ Upstream commit b062a0b9c1dc1ff63094337dccfe1568d5b62023 ]
+
+Fix the following kernel oops in btmtksdio_interrrupt
+
+[   14.339134]  btmtksdio_interrupt+0x28/0x54
+[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0
+[   14.339144]  sdio_irq_work+0x40/0x70
+[   14.339154]  process_one_work+0x184/0x39c
+[   14.339160]  worker_thread+0x228/0x3e8
+[   14.339168]  kthread+0x148/0x3ac
+[   14.339176]  ret_from_fork+0x10/0x30
+
+That happened because hdev->power_on is already called before
+sdio_set_drvdata which btmtksdio_interrupt handler relies on is not
+properly set up.
+
+The details are shown as the below: hci_register_dev would run
+queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI
+workqueue_struct to complete the power-on sequeunce and thus hci_power_on
+may run before sdio_set_drvdata is done in btmtksdio_probe.
+
+The hci_dev_do_open in hci_power_on would initialize the device and enable
+the interrupt and thus it is possible that btmtksdio_interrupt is being
+called right before sdio_set_drvdata is filled out.
+
+When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled
+, the kernel oops is going to happen because btmtksdio_interrupt access an
+uninitialized pointer.
+
+Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
+Reviewed-by: Mark Chen <markyawenchen@gmail.com>
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Yake Yang <yake.yang@mediatek.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtksdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
+index 1cbdeca1fdc4..ff1f5dfbb6db 100644
+--- a/drivers/bluetooth/btmtksdio.c
++++ b/drivers/bluetooth/btmtksdio.c
+@@ -981,6 +981,8 @@ static int btmtksdio_probe(struct sdio_func *func,
+ 	hdev->manufacturer = 70;
+ 	set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
+ 
++	sdio_set_drvdata(func, bdev);
++
+ 	err = hci_register_dev(hdev);
+ 	if (err < 0) {
+ 		dev_err(&func->dev, "Can't register HCI device\n");
+@@ -988,8 +990,6 @@ static int btmtksdio_probe(struct sdio_func *func,
+ 		return err;
+ 	}
+ 
+-	sdio_set_drvdata(func, bdev);
+-
+ 	/* pm_runtime_enable would be done after the firmware is being
+ 	 * downloaded because the core layer probably already enables
+ 	 * runtime PM for this func such as the case host->caps &
+-- 
+2.34.1
+
diff --git a/queue-5.16/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch b/queue-5.16/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch
new file mode 100644
index 00000000000..5eede790e42
--- /dev/null
+++ b/queue-5.16/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch
@@ -0,0 +1,41 @@
+From 709308ddc0f4f619d12124749f7ed2ee4d9e5aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 16:33:50 +0100
+Subject: Bluetooth: call hci_le_conn_failed with hdev lock in
+ hci_le_conn_failed
+
+From: Niels Dossche <dossche.niels@gmail.com>
+
+[ Upstream commit 9fa6b4cda3b414e990f008f45f9bcecbcb54d4d1 ]
+
+hci_le_conn_failed function's documentation says that the caller must
+hold hdev->lock. The only callsite that does not hold that lock is
+hci_le_conn_failed. The other 3 callsites hold the hdev->lock very
+locally. The solution is to hold the lock during the call to
+hci_le_conn_failed.
+
+Fixes: 3c857757ef6e ("Bluetooth: Add directed advertising support through connect()")
+Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd669c95b9a7..55900496ac33 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -669,7 +669,9 @@ static void le_conn_timeout(struct work_struct *work)
+ 	if (conn->role == HCI_ROLE_SLAVE) {
+ 		/* Disable LE Advertising */
+ 		le_disable_advertising(hdev);
++		hci_dev_lock(hdev);
+ 		hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
++		hci_dev_unlock(hdev);
+ 		return;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch b/queue-5.16/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
new file mode 100644
index 00000000000..e1522e39aff
--- /dev/null
+++ b/queue-5.16/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
@@ -0,0 +1,71 @@
+From 6bfabe32ed1792264019beacc939702ac418dd1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jan 2022 16:27:04 +0300
+Subject: Bluetooth: hci_serdev: call init_rwsem() before p->open()
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 9d7cbe2b9cf5f650067df4f402fdd799d4bbb4e1 ]
+
+kvartet reported, that hci_uart_tx_wakeup() uses uninitialized rwsem.
+The problem was in wrong place for percpu_init_rwsem() call.
+
+hci_uart_proto::open() may register a timer whose callback may call
+hci_uart_tx_wakeup(). There is a chance, that hci_uart_register_device()
+thread won't be fast enough to call percpu_init_rwsem().
+
+Fix it my moving percpu_init_rwsem() call before p->open().
+
+INFO: trying to register non-static key.
+The code is fine but needs lockdep annotation, or maybe
+you didn't initialize this object before use?
+turning off the locking correctness validator.
+CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9
+...
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ assign_lock_key kernel/locking/lockdep.c:951 [inline]
+ register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263
+ __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906
+ lock_acquire kernel/locking/lockdep.c:5637 [inline]
+ lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602
+ percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline]
+ hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124
+ h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188
+ call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
+
+Fixes: d73e17281665 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
+Reported-by: Yiru Xu <xyru1999@gmail.com>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_serdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 3b00d82d36cf..4cda890ce647 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -305,6 +305,8 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 	if (err)
+ 		return err;
+ 
++	percpu_init_rwsem(&hu->proto_lock);
++
+ 	err = p->open(hu);
+ 	if (err)
+ 		goto err_open;
+@@ -327,7 +329,6 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 
+ 	INIT_WORK(&hu->init_ready, hci_uart_init_work);
+ 	INIT_WORK(&hu->write_work, hci_uart_write_work);
+-	percpu_init_rwsem(&hu->proto_lock);
+ 
+ 	/* Only when vendor specific setup callback is provided, consider
+ 	 * the manufacturer information valid. This avoids filling in the
+-- 
+2.34.1
+
diff --git a/queue-5.16/bluetooth-hci_uart-add-missing-null-check-in-h5_enqu.patch b/queue-5.16/bluetooth-hci_uart-add-missing-null-check-in-h5_enqu.patch
new file mode 100644
index 00000000000..fbf052fda97
--- /dev/null
+++ b/queue-5.16/bluetooth-hci_uart-add-missing-null-check-in-h5_enqu.patch
@@ -0,0 +1,46 @@
+From 162e7707c4855de2a693e0dbd44aad6a4fd3b36a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Mar 2022 20:49:36 +0300
+Subject: Bluetooth: hci_uart: add missing NULL check in h5_enqueue
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 32cb08e958696908a9aad5e49a78d74f7e32fffb ]
+
+Syzbot hit general protection fault in __pm_runtime_resume(). The problem
+was in missing NULL check.
+
+hu->serdev can be NULL and we should not blindly pass &serdev->dev
+somewhere, since it will cause GPF.
+
+Reported-by: syzbot+b9bd12fbed3485a3e51f@syzkaller.appspotmail.com
+Fixes: d9dd833cf6d2 ("Bluetooth: hci_h5: Add runtime suspend")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 34286ffe0568..7ac6908a4dfb 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -629,9 +629,11 @@ static int h5_enqueue(struct hci_uart *hu, struct sk_buff *skb)
+ 		break;
+ 	}
+ 
+-	pm_runtime_get_sync(&hu->serdev->dev);
+-	pm_runtime_mark_last_busy(&hu->serdev->dev);
+-	pm_runtime_put_autosuspend(&hu->serdev->dev);
++	if (hu->serdev) {
++		pm_runtime_get_sync(&hu->serdev->dev);
++		pm_runtime_mark_last_busy(&hu->serdev->dev);
++		pm_runtime_put_autosuspend(&hu->serdev->dev);
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch b/queue-5.16/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
new file mode 100644
index 00000000000..cb6c26fa402
--- /dev/null
+++ b/queue-5.16/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
@@ -0,0 +1,53 @@
+From 7170febc6bd59b37661f9699a63f599a625d93f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 20:19:05 +0800
+Subject: bpf, arm64: Call build_prologue() first in first JIT pass
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 68e4f238b0e9d3670a1612ad900a6e98b2b3f7dd ]
+
+BPF line info needs ctx->offset to be the instruction offset in the whole JITed
+image instead of the body itself, so also call build_prologue() first in first
+JIT pass.
+
+Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220226121906.5709-2-houtao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 71ef9dcd9b57..3c6d0d60820f 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -1049,15 +1049,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 		goto out_off;
+ 	}
+ 
+-	/* 1. Initial fake pass to compute ctx->idx. */
+-
+-	/* Fake pass to fill in ctx->offset. */
+-	if (build_body(&ctx, extra_pass)) {
++	/*
++	 * 1. Initial fake pass to compute ctx->idx and ctx->offset.
++	 *
++	 * BPF line info needs ctx->offset[i] to be the offset of
++	 * instruction[i] in jited image, so build prologue first.
++	 */
++	if (build_prologue(&ctx, was_classic)) {
+ 		prog = orig_prog;
+ 		goto out_off;
+ 	}
+ 
+-	if (build_prologue(&ctx, was_classic)) {
++	if (build_body(&ctx, extra_pass)) {
+ 		prog = orig_prog;
+ 		goto out_off;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch b/queue-5.16/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
new file mode 100644
index 00000000000..107335e061f
--- /dev/null
+++ b/queue-5.16/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
@@ -0,0 +1,46 @@
+From fd583b3fc709e5943d36677cca76e51f5f1f419b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 20:19:06 +0800
+Subject: bpf, arm64: Feed byte-offset into bpf line info
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit dda7596c109fc382876118627e29db7607cde35d ]
+
+insn_to_jit_off passed to bpf_prog_fill_jited_linfo() is calculated in
+instruction granularity instead of bytes granularity, but BPF line info
+requires byte offset.
+
+bpf_prog_fill_jited_linfo() will be the last user of ctx.offset before
+it is freed, so convert the offset into byte-offset before calling into
+bpf_prog_fill_jited_linfo() in order to fix the line info dump on arm64.
+
+Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info")
+Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220226121906.5709-3-houtao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 3c6d0d60820f..4d4e6ae39e56 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -1133,6 +1133,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 	prog->jited_len = prog_size;
+ 
+ 	if (!prog->is_func || extra_pass) {
++		int i;
++
++		/* offset[prog->len] is the size of program */
++		for (i = 0; i <= prog->len; i++)
++			ctx.offset[i] *= AARCH64_INSN_SIZE;
+ 		bpf_prog_fill_jited_linfo(prog, ctx.offset + 1);
+ out_off:
+ 		kfree(ctx.offset);
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-fix-a-btf-decl_tag-bug-when-tagging-a-function.patch b/queue-5.16/bpf-fix-a-btf-decl_tag-bug-when-tagging-a-function.patch
new file mode 100644
index 00000000000..edb4f52bdc9
--- /dev/null
+++ b/queue-5.16/bpf-fix-a-btf-decl_tag-bug-when-tagging-a-function.patch
@@ -0,0 +1,141 @@
+From f52c385be161ea9f2a981b4d6b70a8febb56a3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 11:17:27 -0800
+Subject: bpf: Fix a btf decl_tag bug when tagging a function
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit d7e7b42f4f956f2c68ad8cda87d750093dbba737 ]
+
+syzbot reported a btf decl_tag bug with stack trace below:
+
+  general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
+  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+  CPU: 0 PID: 3592 Comm: syz-executor914 Not tainted 5.16.0-syzkaller-11424-gb7892f7d5cb2 #0
+  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+  RIP: 0010:btf_type_vlen include/linux/btf.h:231 [inline]
+  RIP: 0010:btf_decl_tag_resolve+0x83e/0xaa0 kernel/bpf/btf.c:3910
+  ...
+  Call Trace:
+   <TASK>
+   btf_resolve+0x251/0x1020 kernel/bpf/btf.c:4198
+   btf_check_all_types kernel/bpf/btf.c:4239 [inline]
+   btf_parse_type_sec kernel/bpf/btf.c:4280 [inline]
+   btf_parse kernel/bpf/btf.c:4513 [inline]
+   btf_new_fd+0x19fe/0x2370 kernel/bpf/btf.c:6047
+   bpf_btf_load kernel/bpf/syscall.c:4039 [inline]
+   __sys_bpf+0x1cbb/0x5970 kernel/bpf/syscall.c:4679
+   __do_sys_bpf kernel/bpf/syscall.c:4738 [inline]
+   __se_sys_bpf kernel/bpf/syscall.c:4736 [inline]
+   __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4736
+   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+   entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+The kasan error is triggered with an illegal BTF like below:
+   type 0: void
+   type 1: int
+   type 2: decl_tag to func type 3
+   type 3: func to func_proto type 8
+The total number of types is 4 and the type 3 is illegal
+since its func_proto type is out of range.
+
+Currently, the target type of decl_tag can be struct/union, var or func.
+Both struct/union and var implemented their own 'resolve' callback functions
+and hence handled properly in kernel.
+But func type doesn't have 'resolve' callback function. When
+btf_decl_tag_resolve() tries to check func type, it tries to get
+vlen of its func_proto type, which triggered the above kasan error.
+
+To fix the issue, btf_decl_tag_resolve() needs to do btf_func_check()
+before trying to accessing func_proto type.
+In the current implementation, func type is checked with
+btf_func_check() in the main checking function btf_check_all_types().
+To fix the above kasan issue, let us implement 'resolve' callback
+func type properly. The 'resolve' callback will be also called
+in btf_check_all_types() for func types.
+
+Fixes: b5ea834dde6b ("bpf: Support for new btf kind BTF_KIND_TAG")
+Reported-by: syzbot+53619be9444215e785ed@syzkaller.appspotmail.com
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20220203191727.741862-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 1f7967ab9e46..ebbb2f4d3b9c 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -401,6 +401,9 @@ static struct btf_type btf_void;
+ static int btf_resolve(struct btf_verifier_env *env,
+ 		       const struct btf_type *t, u32 type_id);
+ 
++static int btf_func_check(struct btf_verifier_env *env,
++			  const struct btf_type *t);
++
+ static bool btf_type_is_modifier(const struct btf_type *t)
+ {
+ 	/* Some of them is not strictly a C modifier
+@@ -576,6 +579,7 @@ static bool btf_type_needs_resolve(const struct btf_type *t)
+ 	       btf_type_is_struct(t) ||
+ 	       btf_type_is_array(t) ||
+ 	       btf_type_is_var(t) ||
++	       btf_type_is_func(t) ||
+ 	       btf_type_is_decl_tag(t) ||
+ 	       btf_type_is_datasec(t);
+ }
+@@ -3521,9 +3525,24 @@ static s32 btf_func_check_meta(struct btf_verifier_env *env,
+ 	return 0;
+ }
+ 
++static int btf_func_resolve(struct btf_verifier_env *env,
++			    const struct resolve_vertex *v)
++{
++	const struct btf_type *t = v->t;
++	u32 next_type_id = t->type;
++	int err;
++
++	err = btf_func_check(env, t);
++	if (err)
++		return err;
++
++	env_stack_pop_resolved(env, next_type_id, 0);
++	return 0;
++}
++
+ static struct btf_kind_operations func_ops = {
+ 	.check_meta = btf_func_check_meta,
+-	.resolve = btf_df_resolve,
++	.resolve = btf_func_resolve,
+ 	.check_member = btf_df_check_member,
+ 	.check_kflag_member = btf_df_check_kflag_member,
+ 	.log_details = btf_ref_type_log,
+@@ -4143,7 +4162,7 @@ static bool btf_resolve_valid(struct btf_verifier_env *env,
+ 		return !btf_resolved_type_id(btf, type_id) &&
+ 		       !btf_resolved_type_size(btf, type_id);
+ 
+-	if (btf_type_is_decl_tag(t))
++	if (btf_type_is_decl_tag(t) || btf_type_is_func(t))
+ 		return btf_resolved_type_id(btf, type_id) &&
+ 		       !btf_resolved_type_size(btf, type_id);
+ 
+@@ -4233,12 +4252,6 @@ static int btf_check_all_types(struct btf_verifier_env *env)
+ 			if (err)
+ 				return err;
+ 		}
+-
+-		if (btf_type_is_func(t)) {
+-			err = btf_func_check(env, t);
+-			if (err)
+-				return err;
+-		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-fix-uaf-due-to-race-between-btf_try_get_module-a.patch b/queue-5.16/bpf-fix-uaf-due-to-race-between-btf_try_get_module-a.patch
new file mode 100644
index 00000000000..bf5b1c0747b
--- /dev/null
+++ b/queue-5.16/bpf-fix-uaf-due-to-race-between-btf_try_get_module-a.patch
@@ -0,0 +1,165 @@
+From a4ea97586e1168c0719e0874e33fd117343e59d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 22:09:44 +0530
+Subject: bpf: Fix UAF due to race between btf_try_get_module and load_module
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+[ Upstream commit 18688de203b47e5d8d9d0953385bf30b5949324f ]
+
+While working on code to populate kfunc BTF ID sets for module BTF from
+its initcall, I noticed that by the time the initcall is invoked, the
+module BTF can already be seen by userspace (and the BPF verifier). The
+existing btf_try_get_module calls try_module_get which only fails if
+mod->state == MODULE_STATE_GOING, i.e. it can increment module reference
+when module initcall is happening in parallel.
+
+Currently, BTF parsing happens from MODULE_STATE_COMING notifier
+callback. At this point, the module initcalls have not been invoked.
+The notifier callback parses and prepares the module BTF, allocates an
+ID, which publishes it to userspace, and then adds it to the btf_modules
+list allowing the kernel to invoke btf_try_get_module for the BTF.
+
+However, at this point, the module has not been fully initialized (i.e.
+its initcalls have not finished). The code in module.c can still fail
+and free the module, without caring for other users. However, nothing
+stops btf_try_get_module from succeeding between the state transition
+from MODULE_STATE_COMING to MODULE_STATE_LIVE.
+
+This leads to a use-after-free issue when BPF program loads
+successfully in the state transition, load_module's do_init_module call
+fails and frees the module, and BPF program fd on close calls module_put
+for the freed module. Future patch has test case to verify we don't
+regress in this area in future.
+
+There are multiple points after prepare_coming_module (in load_module)
+where failure can occur and module loading can return error. We
+illustrate and test for the race using the last point where it can
+practically occur (in module __init function).
+
+An illustration of the race:
+
+CPU 0                           CPU 1
+			  load_module
+			    notifier_call(MODULE_STATE_COMING)
+			      btf_parse_module
+			      btf_alloc_id	// Published to userspace
+			      list_add(&btf_mod->list, btf_modules)
+			    mod->init(...)
+...				^
+bpf_check		        |
+check_pseudo_btf_id             |
+  btf_try_get_module            |
+    returns true                |  ...
+...                             |  module __init in progress
+return prog_fd                  |  ...
+...                             V
+			    if (ret < 0)
+			      free_module(mod)
+			    ...
+close(prog_fd)
+ ...
+ bpf_prog_free_deferred
+  module_put(used_btf.mod) // use-after-free
+
+We fix this issue by setting a flag BTF_MODULE_F_LIVE, from the notifier
+callback when MODULE_STATE_LIVE state is reached for the module, so that
+we return NULL from btf_try_get_module for modules that are not fully
+formed. Since try_module_get already checks that module is not in
+MODULE_STATE_GOING state, and that is the only transition a live module
+can make before being removed from btf_modules list, this is enough to
+close the race and prevent the bug.
+
+A later selftest patch crafts the race condition artifically to verify
+that it has been fixed, and that verifier fails to load program (with
+ENXIO).
+
+Lastly, a couple of comments:
+
+ 1. Even if this race didn't exist, it seems more appropriate to only
+    access resources (ksyms and kfuncs) of a fully formed module which
+    has been initialized completely.
+
+ 2. This patch was born out of need for synchronization against module
+    initcall for the next patch, so it is needed for correctness even
+    without the aforementioned race condition. The BTF resources
+    initialized by module initcall are set up once and then only looked
+    up, so just waiting until the initcall has finished ensures correct
+    behavior.
+
+Fixes: 541c3bad8dc5 ("bpf: Support BPF ksym variables in kernel modules")
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/r/20220114163953.1455836-2-memxor@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index c9da250fee38..1f7967ab9e46 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -6189,12 +6189,17 @@ bool btf_id_set_contains(const struct btf_id_set *set, u32 id)
+ 	return bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func) != NULL;
+ }
+ 
++enum {
++	BTF_MODULE_F_LIVE = (1 << 0),
++};
++
+ #ifdef CONFIG_DEBUG_INFO_BTF_MODULES
+ struct btf_module {
+ 	struct list_head list;
+ 	struct module *module;
+ 	struct btf *btf;
+ 	struct bin_attribute *sysfs_attr;
++	int flags;
+ };
+ 
+ static LIST_HEAD(btf_modules);
+@@ -6220,7 +6225,8 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,
+ 	int err = 0;
+ 
+ 	if (mod->btf_data_size == 0 ||
+-	    (op != MODULE_STATE_COMING && op != MODULE_STATE_GOING))
++	    (op != MODULE_STATE_COMING && op != MODULE_STATE_LIVE &&
++	     op != MODULE_STATE_GOING))
+ 		goto out;
+ 
+ 	switch (op) {
+@@ -6277,6 +6283,17 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,
+ 			btf_mod->sysfs_attr = attr;
+ 		}
+ 
++		break;
++	case MODULE_STATE_LIVE:
++		mutex_lock(&btf_module_mutex);
++		list_for_each_entry_safe(btf_mod, tmp, &btf_modules, list) {
++			if (btf_mod->module != module)
++				continue;
++
++			btf_mod->flags |= BTF_MODULE_F_LIVE;
++			break;
++		}
++		mutex_unlock(&btf_module_mutex);
+ 		break;
+ 	case MODULE_STATE_GOING:
+ 		mutex_lock(&btf_module_mutex);
+@@ -6323,7 +6340,12 @@ struct module *btf_try_get_module(const struct btf *btf)
+ 		if (btf_mod->btf != btf)
+ 			continue;
+ 
+-		if (try_module_get(btf_mod->module))
++		/* We must only consider module whose __init routine has
++		 * finished, hence we must check for BTF_MODULE_F_LIVE flag,
++		 * which is set from the notifier callback for
++		 * MODULE_STATE_LIVE.
++		 */
++		if ((btf_mod->flags & BTF_MODULE_F_LIVE) && try_module_get(btf_mod->module))
+ 			res = btf_mod->module;
+ 
+ 		break;
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch b/queue-5.16/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
new file mode 100644
index 00000000000..3075f72c1aa
--- /dev/null
+++ b/queue-5.16/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
@@ -0,0 +1,72 @@
+From cdddc0c3e68fbad566b9f7879d4c5b4e39041a7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:45 +0800
+Subject: bpf, sockmap: Fix double uncharge the mem of sk_msg
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 2486ab434b2c2a14e9237296db00b1e1b7ae3273 ]
+
+If tcp_bpf_sendmsg is running during a tear down operation, psock may be
+freed.
+
+tcp_bpf_sendmsg()
+ tcp_bpf_send_verdict()
+  sk_msg_return()
+  tcp_bpf_sendmsg_redir()
+   unlikely(!psock))
+     sk_msg_free()
+
+The mem of msg has been uncharged in tcp_bpf_send_verdict() by
+sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock
+is null, we can simply returning an error code, this would then trigger
+the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have
+the side effect of throwing an error up to user space. This would be a
+slight change in behavior from user side but would look the same as an
+error if the redirect on the socket threw an error.
+
+This issue can cause the following info:
+WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ worker_thread+0x30/0x350
+ ? process_one_work+0x3c0/0x3c0
+ kthread+0xe6/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-5-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 304800c60427..1cdcb4df0eb7 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -138,10 +138,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg,
+ 	struct sk_psock *psock = sk_psock_get(sk);
+ 	int ret;
+ 
+-	if (unlikely(!psock)) {
+-		sk_msg_free(sk, msg);
+-		return 0;
+-	}
++	if (unlikely(!psock))
++		return -EPIPE;
++
+ 	ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) :
+ 			tcp_bpf_push_locked(sk, msg, bytes, flags, false);
+ 	sk_psock_put(sk, psock);
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-sockmap-fix-memleak-in-sk_psock_queue_msg.patch b/queue-5.16/bpf-sockmap-fix-memleak-in-sk_psock_queue_msg.patch
new file mode 100644
index 00000000000..46066850176
--- /dev/null
+++ b/queue-5.16/bpf-sockmap-fix-memleak-in-sk_psock_queue_msg.patch
@@ -0,0 +1,117 @@
+From f6f2736dee1d5da678964ad478ad5bd04b3658f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:42 +0800
+Subject: bpf, sockmap: Fix memleak in sk_psock_queue_msg
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 938d3480b92fa5e454b7734294f12a7b75126f09 ]
+
+If tcp_bpf_sendmsg is running during a tear down operation we may enqueue
+data on the ingress msg queue while tear down is trying to free it.
+
+ sk1 (redirect sk2)                         sk2
+ -------------------                      ---------------
+tcp_bpf_sendmsg()
+ tcp_bpf_send_verdict()
+  tcp_bpf_sendmsg_redir()
+   bpf_tcp_ingress()
+                                          sock_map_close()
+                                           lock_sock()
+    lock_sock() ... blocking
+                                           sk_psock_stop
+                                            sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
+                                           release_sock(sk);
+    lock_sock()
+    sk_mem_charge()
+    get_page()
+    sk_psock_queue_msg()
+     sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED);
+      drop_sk_msg()
+    release_sock()
+
+While drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge
+and has sg pages need to put. To fix we use sk_msg_free() and then kfee()
+msg.
+
+This issue can cause the following info:
+WARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0
+Call Trace:
+ <IRQ>
+ inet_csk_destroy_sock+0x55/0x110
+ tcp_rcv_state_process+0xe5f/0xe90
+ ? sk_filter_trim_cap+0x10d/0x230
+ ? tcp_v4_do_rcv+0x161/0x250
+ tcp_v4_do_rcv+0x161/0x250
+ tcp_v4_rcv+0xc3a/0xce0
+ ip_protocol_deliver_rcu+0x3d/0x230
+ ip_local_deliver_finish+0x54/0x60
+ ip_local_deliver+0xfd/0x110
+ ? ip_protocol_deliver_rcu+0x230/0x230
+ ip_rcv+0xd6/0x100
+ ? ip_local_deliver+0x110/0x110
+ __netif_receive_skb_one_core+0x85/0xa0
+ process_backlog+0xa4/0x160
+ __napi_poll+0x29/0x1b0
+ net_rx_action+0x287/0x300
+ __do_softirq+0xff/0x2fc
+ do_softirq+0x79/0x90
+ </IRQ>
+
+WARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ ? process_one_work+0x3c0/0x3c0
+ worker_thread+0x30/0x350
+ ? process_one_work+0x3c0/0x3c0
+ kthread+0xe6/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 9635720b7c88 ("bpf, sockmap: Fix memleak on ingress msg enqueue")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-2-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/skmsg.h | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
+index 18a717fe62eb..7f32dd59e751 100644
+--- a/include/linux/skmsg.h
++++ b/include/linux/skmsg.h
+@@ -310,21 +310,16 @@ static inline void sock_drop(struct sock *sk, struct sk_buff *skb)
+ 	kfree_skb(skb);
+ }
+ 
+-static inline void drop_sk_msg(struct sk_psock *psock, struct sk_msg *msg)
+-{
+-	if (msg->skb)
+-		sock_drop(psock->sk, msg->skb);
+-	kfree(msg);
+-}
+-
+ static inline void sk_psock_queue_msg(struct sk_psock *psock,
+ 				      struct sk_msg *msg)
+ {
+ 	spin_lock_bh(&psock->ingress_lock);
+ 	if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
+ 		list_add_tail(&msg->list, &psock->ingress_msg);
+-	else
+-		drop_sk_msg(psock, msg);
++	else {
++		sk_msg_free(psock->sk, msg);
++		kfree(msg);
++	}
+ 	spin_unlock_bh(&psock->ingress_lock);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch b/queue-5.16/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
new file mode 100644
index 00000000000..0e36b36cbc4
--- /dev/null
+++ b/queue-5.16/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
@@ -0,0 +1,109 @@
+From b8e7d8eb8fa46fa5bff7a98f415e97d9b97c4f45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:43 +0800
+Subject: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8 ]
+
+If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc()
+returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial
+memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is
+greater than osize after sk_msg_alloc(), memleak occurs. To fix we use
+sk_msg_trim() to release the allocated memory, then goto wait for memory.
+
+Other call paths of sk_msg_alloc() have the similar issue, such as
+tls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(),
+as Cong Wang suggested.
+
+This issue can cause the following info:
+WARNING: CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0
+Call Trace:
+ <TASK>
+ inet_csk_destroy_sock+0x55/0x110
+ __tcp_close+0x279/0x470
+ tcp_close+0x1f/0x60
+ inet_release+0x3f/0x80
+ __sock_release+0x3d/0xb0
+ sock_close+0x11/0x20
+ __fput+0x92/0x250
+ task_work_run+0x6a/0xa0
+ do_exit+0x33b/0xb60
+ do_group_exit+0x2f/0xa0
+ get_signal+0xb6/0x950
+ arch_do_signal_or_restart+0xac/0x2a0
+ exit_to_user_mode_prepare+0xa9/0x200
+ syscall_exit_to_user_mode+0x12/0x30
+ do_syscall_64+0x46/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ </TASK>
+
+WARNING: CPU: 3 PID: 2094 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ kthread+0xe6/0x110
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-3-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 929a2b096b04..cc381165ea08 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 		 int elem_first_coalesce)
+ {
+ 	struct page_frag *pfrag = sk_page_frag(sk);
++	u32 osize = msg->sg.size;
+ 	int ret = 0;
+ 
+ 	len -= msg->sg.size;
+@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 		u32 orig_offset;
+ 		int use, i;
+ 
+-		if (!sk_page_frag_refill(sk, pfrag))
+-			return -ENOMEM;
++		if (!sk_page_frag_refill(sk, pfrag)) {
++			ret = -ENOMEM;
++			goto msg_trim;
++		}
+ 
+ 		orig_offset = pfrag->offset;
+ 		use = min_t(int, len, pfrag->size - orig_offset);
+-		if (!sk_wmem_schedule(sk, use))
+-			return -ENOMEM;
++		if (!sk_wmem_schedule(sk, use)) {
++			ret = -ENOMEM;
++			goto msg_trim;
++		}
+ 
+ 		i = msg->sg.end;
+ 		sk_msg_iter_var_prev(i);
+@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 	}
+ 
+ 	return ret;
++
++msg_trim:
++	sk_msg_trim(sk, msg, osize);
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(sk_msg_alloc);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch b/queue-5.16/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
new file mode 100644
index 00000000000..381958b49c9
--- /dev/null
+++ b/queue-5.16/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
@@ -0,0 +1,100 @@
+From 523e17cfaa90ff5b2fecca77808b6dce3ecba845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:44 +0800
+Subject: bpf, sockmap: Fix more uncharged while msg has more_data
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 84472b436e760ba439e1969a9e3c5ae7c86de39d ]
+
+In tcp_bpf_send_verdict(), if msg has more data after
+tcp_bpf_sendmsg_redir():
+
+tcp_bpf_send_verdict()
+ tosend = msg->sg.size  //msg->sg.size = 22220
+ case __SK_REDIRECT:
+  sk_msg_return()  //uncharged msg->sg.size(22220) sk->sk_forward_alloc
+  tcp_bpf_sendmsg_redir() //after tcp_bpf_sendmsg_redir, msg->sg.size=11000
+ goto more_data;
+ tosend = msg->sg.size  //msg->sg.size = 11000
+ case __SK_REDIRECT:
+  sk_msg_return()  //uncharged msg->sg.size(11000) to sk->sk_forward_alloc
+
+The msg->sg.size(11000) has been uncharged twice, to fix we can charge the
+remaining msg->sg.size before goto more data.
+
+This issue can cause the following info:
+WARNING: CPU: 0 PID: 9860 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0
+Call Trace:
+ <TASK>
+ inet_csk_destroy_sock+0x55/0x110
+ __tcp_close+0x279/0x470
+ tcp_close+0x1f/0x60
+ inet_release+0x3f/0x80
+ __sock_release+0x3d/0xb0
+ sock_close+0x11/0x20
+ __fput+0x92/0x250
+ task_work_run+0x6a/0xa0
+ do_exit+0x33b/0xb60
+ do_group_exit+0x2f/0xa0
+ get_signal+0xb6/0x950
+ arch_do_signal_or_restart+0xac/0x2a0
+ ? vfs_write+0x237/0x290
+ exit_to_user_mode_prepare+0xa9/0x200
+ syscall_exit_to_user_mode+0x12/0x30
+ do_syscall_64+0x46/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ </TASK>
+
+WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ worker_thread+0x30/0x350
+ ? process_one_work+0x3c0/0x3c0
+ kthread+0xe6/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-4-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 9b9b02052fd3..304800c60427 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -335,7 +335,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
+ 			cork = true;
+ 			psock->cork = NULL;
+ 		}
+-		sk_msg_return(sk, msg, tosend);
++		sk_msg_return(sk, msg, msg->sg.size);
+ 		release_sock(sk);
+ 
+ 		ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
+@@ -375,8 +375,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
+ 		}
+ 		if (msg &&
+ 		    msg->sg.data[msg->sg.start].page_link &&
+-		    msg->sg.data[msg->sg.start].length)
++		    msg->sg.data[msg->sg.start].length) {
++			if (eval == __SK_REDIRECT)
++				sk_mem_charge(sk, msg->sg.size);
+ 			goto more_data;
++		}
+ 	}
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpftool-fix-error-check-when-calling-hashmap__new.patch b/queue-5.16/bpftool-fix-error-check-when-calling-hashmap__new.patch
new file mode 100644
index 00000000000..0b135ce458f
--- /dev/null
+++ b/queue-5.16/bpftool-fix-error-check-when-calling-hashmap__new.patch
@@ -0,0 +1,121 @@
+From 3c064874af4a1b6092700b091da352f07f7c35b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 10:26:20 -0500
+Subject: bpftool: Fix error check when calling hashmap__new()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mauricio Vásquez <mauricio@kinvolk.io>
+
+[ Upstream commit 622a5b582cc27d3deedc38fcef68da2972e8e58d ]
+
+hashmap__new() encodes errors with ERR_PTR(), hence it's not valid to
+check the returned pointer against NULL and IS_ERR() has to be used
+instead.
+
+libbpf_get_error() can't be used in this case as hashmap__new() is not
+part of the public libbpf API and it'll continue using ERR_PTR() after
+libbpf 1.0.
+
+Fixes: 8f184732b60b ("bpftool: Switch to libbpf's hashmap for pinned paths of BPF objects")
+Fixes: 2828d0d75b73 ("bpftool: Switch to libbpf's hashmap for programs/maps in BTF listing")
+Fixes: d6699f8e0f83 ("bpftool: Switch to libbpf's hashmap for PIDs/names references")
+Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20220107152620.192327-2-mauricio@kinvolk.io
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf.c  | 2 +-
+ tools/bpf/bpftool/link.c | 3 ++-
+ tools/bpf/bpftool/map.c  | 2 +-
+ tools/bpf/bpftool/pids.c | 3 ++-
+ tools/bpf/bpftool/prog.c | 2 +-
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
+index 015d2758f826..4a561ec848c0 100644
+--- a/tools/bpf/bpftool/btf.c
++++ b/tools/bpf/bpftool/btf.c
+@@ -899,7 +899,7 @@ static int do_show(int argc, char **argv)
+ 				      equal_fn_for_key_as_id, NULL);
+ 	btf_map_table = hashmap__new(hash_fn_for_key_as_id,
+ 				     equal_fn_for_key_as_id, NULL);
+-	if (!btf_prog_table || !btf_map_table) {
++	if (IS_ERR(btf_prog_table) || IS_ERR(btf_map_table)) {
+ 		hashmap__free(btf_prog_table);
+ 		hashmap__free(btf_map_table);
+ 		if (fd >= 0)
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index 2c258db0d352..97dec81950e5 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -2,6 +2,7 @@
+ /* Copyright (C) 2020 Facebook */
+ 
+ #include <errno.h>
++#include <linux/err.h>
+ #include <net/if.h>
+ #include <stdio.h>
+ #include <unistd.h>
+@@ -306,7 +307,7 @@ static int do_show(int argc, char **argv)
+ 	if (show_pinned) {
+ 		link_table = hashmap__new(hash_fn_for_key_as_id,
+ 					  equal_fn_for_key_as_id, NULL);
+-		if (!link_table) {
++		if (IS_ERR(link_table)) {
+ 			p_err("failed to create hashmap for pinned paths");
+ 			return -1;
+ 		}
+diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
+index cae1f1119296..af83ae37d247 100644
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -698,7 +698,7 @@ static int do_show(int argc, char **argv)
+ 	if (show_pinned) {
+ 		map_table = hashmap__new(hash_fn_for_key_as_id,
+ 					 equal_fn_for_key_as_id, NULL);
+-		if (!map_table) {
++		if (IS_ERR(map_table)) {
+ 			p_err("failed to create hashmap for pinned paths");
+ 			return -1;
+ 		}
+diff --git a/tools/bpf/bpftool/pids.c b/tools/bpf/bpftool/pids.c
+index 56b598eee043..7c384d10e95f 100644
+--- a/tools/bpf/bpftool/pids.c
++++ b/tools/bpf/bpftool/pids.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+ /* Copyright (C) 2020 Facebook */
+ #include <errno.h>
++#include <linux/err.h>
+ #include <stdbool.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -101,7 +102,7 @@ int build_obj_refs_table(struct hashmap **map, enum bpf_obj_type type)
+ 	libbpf_print_fn_t default_print;
+ 
+ 	*map = hashmap__new(hash_fn_for_key_as_id, equal_fn_for_key_as_id, NULL);
+-	if (!*map) {
++	if (IS_ERR(*map)) {
+ 		p_err("failed to create hashmap for PID references");
+ 		return -1;
+ 	}
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 6ccd17b8eb56..41ed566e8c73 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -571,7 +571,7 @@ static int do_show(int argc, char **argv)
+ 	if (show_pinned) {
+ 		prog_table = hashmap__new(hash_fn_for_key_as_id,
+ 					  equal_fn_for_key_as_id, NULL);
+-		if (!prog_table) {
++		if (IS_ERR(prog_table)) {
+ 			p_err("failed to create hashmap for pinned paths");
+ 			return -1;
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpftool-fix-print-error-when-show-bpf-map.patch b/queue-5.16/bpftool-fix-print-error-when-show-bpf-map.patch
new file mode 100644
index 00000000000..2355128a20a
--- /dev/null
+++ b/queue-5.16/bpftool-fix-print-error-when-show-bpf-map.patch
@@ -0,0 +1,60 @@
+From 1c826df9ab6a2d5f1d8003c627385fad12450e48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Mar 2022 06:08:14 +0000
+Subject: bpftool: Fix print error when show bpf map
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 1824d8ea75f275a5e69e5f6bc0ffe122ea9b938c ]
+
+If there is no btf_id or frozen, it will not show the pids, but the pids don't
+depend on any one of them.
+
+Below is the result after this change:
+
+  $ ./bpftool map show
+  2: lpm_trie  flags 0x1
+	key 8B  value 8B  max_entries 1  memlock 4096B
+	pids systemd(1)
+  3: lpm_trie  flags 0x1
+	key 20B  value 8B  max_entries 1  memlock 4096B
+	pids systemd(1)
+
+While before this change, the 'pids systemd(1)' can't be displayed.
+
+Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220320060815.7716-1-laoar.shao@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/map.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
+index 285fb2cbaef6..59d8e72851da 100644
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -619,17 +619,14 @@ static int show_map_close_plain(int fd, struct bpf_map_info *info)
+ 					    u32_as_hash_field(info->id))
+ 			printf("\n\tpinned %s", (char *)entry->value);
+ 	}
+-	printf("\n");
+ 
+ 	if (frozen_str) {
+ 		frozen = atoi(frozen_str);
+ 		free(frozen_str);
+ 	}
+ 
+-	if (!info->btf_id && !frozen)
+-		return 0;
+-
+-	printf("\t");
++	if (info->btf_id || frozen)
++		printf("\n\t");
+ 
+ 	if (info->btf_id)
+ 		printf("btf_id %d", info->btf_id);
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpftool-fix-the-error-when-lookup-in-no-btf-maps.patch b/queue-5.16/bpftool-fix-the-error-when-lookup-in-no-btf-maps.patch
new file mode 100644
index 00000000000..6c72df0beab
--- /dev/null
+++ b/queue-5.16/bpftool-fix-the-error-when-lookup-in-no-btf-maps.patch
@@ -0,0 +1,56 @@
+From 088a80aa5562dc7e257fa74b57caadcc90df9eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 00:00:25 +0800
+Subject: bpftool: Fix the error when lookup in no-btf maps
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yinjun Zhang <yinjun.zhang@corigine.com>
+
+[ Upstream commit edc21dc909c6c133a2727f063eadd7907af51f94 ]
+
+When reworking btf__get_from_id() in commit a19f93cfafdf the error
+handling when calling bpf_btf_get_fd_by_id() changed. Before the rework
+if bpf_btf_get_fd_by_id() failed the error would not be propagated to
+callers of btf__get_from_id(), after the rework it is. This lead to a
+change in behavior in print_key_value() that now prints an error when
+trying to lookup keys in maps with no btf available.
+
+Fix this by following the way used in dumping maps to allow to look up
+keys in no-btf maps, by which it decides whether and where to get the
+btf info according to the btf value type.
+
+Fixes: a19f93cfafdf ("libbpf: Add internal helper to load BTF data by FD")
+Signed-off-by: Yinjun Zhang <yinjun.zhang@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/1644249625-22479-1-git-send-email-yinjun.zhang@corigine.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/map.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
+index af83ae37d247..285fb2cbaef6 100644
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -1053,11 +1053,9 @@ static void print_key_value(struct bpf_map_info *info, void *key,
+ 	json_writer_t *btf_wtr;
+ 	struct btf *btf;
+ 
+-	btf = btf__load_from_kernel_by_id(info->btf_id);
+-	if (libbpf_get_error(btf)) {
+-		p_err("failed to get btf");
++	btf = get_map_kv_btf(info);
++	if (libbpf_get_error(btf))
+ 		return;
+-	}
+ 
+ 	if (json_output) {
+ 		print_entry_json(info, key, value, btf);
+-- 
+2.34.1
+
diff --git a/queue-5.16/bpftool-only-set-obj-skeleton-on-complete-success.patch b/queue-5.16/bpftool-only-set-obj-skeleton-on-complete-success.patch
new file mode 100644
index 00000000000..0a97ead87df
--- /dev/null
+++ b/queue-5.16/bpftool-only-set-obj-skeleton-on-complete-success.patch
@@ -0,0 +1,51 @@
+From 4632e604425429fcf4940f3facce6ac53f6342bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 16:40:08 +0800
+Subject: bpftool: Only set obj->skeleton on complete success
+
+From: Wei Fu <fuweid89@gmail.com>
+
+[ Upstream commit 0991f6a38f576aa9a5e34713e23c998a3310d4d0 ]
+
+After `bpftool gen skeleton`, the ${bpf_app}.skel.h will provide that
+${bpf_app_name}__open helper to load bpf. If there is some error
+like ENOMEM, the ${bpf_app_name}__open will rollback(free) the allocated
+object, including `bpf_object_skeleton`.
+
+Since the ${bpf_app_name}__create_skeleton set the obj->skeleton first
+and not rollback it when error, it will cause double-free in
+${bpf_app_name}__destory at ${bpf_app_name}__open. Therefore, we should
+set the obj->skeleton before return 0;
+
+Fixes: 5dc7a8b21144 ("bpftool, selftests/bpf: Embed object file inside skeleton")
+Signed-off-by: Wei Fu <fuweid89@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220108084008.1053111-1-fuweid89@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/gen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c
+index 5c18351290f0..587027050f43 100644
+--- a/tools/bpf/bpftool/gen.c
++++ b/tools/bpf/bpftool/gen.c
+@@ -928,7 +928,6 @@ static int do_skeleton(int argc, char **argv)
+ 			s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));\n\
+ 			if (!s)						    \n\
+ 				goto err;				    \n\
+-			obj->skeleton = s;				    \n\
+ 									    \n\
+ 			s->sz = sizeof(*s);				    \n\
+ 			s->name = \"%1$s\";				    \n\
+@@ -1001,6 +1000,7 @@ static int do_skeleton(int argc, char **argv)
+ 									    \n\
+ 			s->data = (void *)%2$s__elf_bytes(&s->data_sz);	    \n\
+ 									    \n\
++			obj->skeleton = s;				    \n\
+ 			return 0;					    \n\
+ 		err:							    \n\
+ 			bpf_object__destroy_skeleton(s);		    \n\
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-do-not-clean-up-repair-bio-if-submit-fails.patch b/queue-5.16/btrfs-do-not-clean-up-repair-bio-if-submit-fails.patch
new file mode 100644
index 00000000000..1d34d5ef7ba
--- /dev/null
+++ b/queue-5.16/btrfs-do-not-clean-up-repair-bio-if-submit-fails.patch
@@ -0,0 +1,61 @@
+From 1db9674144b01f5e49bf99ca290e982f8efe4b4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:03:29 -0500
+Subject: btrfs: do not clean up repair bio if submit fails
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 8cbc3001a3264d998d6b6db3e23f935c158abd4d ]
+
+The submit helper will always run bio_endio() on the bio if it fails to
+submit, so cleaning up the bio just leads to a variety of use-after-free
+and NULL pointer dereference bugs because we race with the endio
+function that is cleaning up the bio.  Instead just return BLK_STS_OK as
+the repair function has to continue to process the rest of the pages,
+and the endio for the repair bio will do the appropriate cleanup for the
+page that it was given.
+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index c3f466362103..ced0195f3390 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2640,7 +2640,6 @@ int btrfs_repair_one_sector(struct inode *inode,
+ 	const int icsum = bio_offset >> fs_info->sectorsize_bits;
+ 	struct bio *repair_bio;
+ 	struct btrfs_bio *repair_bbio;
+-	blk_status_t status;
+ 
+ 	btrfs_debug(fs_info,
+ 		   "repair read error: read error at %llu", start);
+@@ -2679,13 +2678,13 @@ int btrfs_repair_one_sector(struct inode *inode,
+ 		    "repair read error: submitting new read to mirror %d",
+ 		    failrec->this_mirror);
+ 
+-	status = submit_bio_hook(inode, repair_bio, failrec->this_mirror,
+-				 failrec->bio_flags);
+-	if (status) {
+-		free_io_failure(failure_tree, tree, failrec);
+-		bio_put(repair_bio);
+-	}
+-	return blk_status_to_errno(status);
++	/*
++	 * At this point we have a bio, so any errors from submit_bio_hook()
++	 * will be handled by the endio on the repair_bio, so we can't return an
++	 * error here.
++	 */
++	submit_bio_hook(inode, repair_bio, failrec->this_mirror, failrec->bio_flags);
++	return BLK_STS_OK;
+ }
+ 
+ static void end_page_read(struct page *page, bool uptodate, u64 start, u32 len)
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-do-not-double-complete-bio-on-errors-during-co.patch b/queue-5.16/btrfs-do-not-double-complete-bio-on-errors-during-co.patch
new file mode 100644
index 00000000000..9121c8cde23
--- /dev/null
+++ b/queue-5.16/btrfs-do-not-double-complete-bio-on-errors-during-co.patch
@@ -0,0 +1,130 @@
+From d5a0d42ce1816705c6c8ae672eb4c517979e1d7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:03:27 -0500
+Subject: btrfs: do not double complete bio on errors during compressed reads
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit f9f15de85d74e7eef021af059ca53a15f041cdd8 ]
+
+I hit some weird panics while fixing up the error handling from
+btrfs_lookup_bio_sums().  Turns out the compression path will complete
+the bio we use if we set up any of the compression bios and then return
+an error, and then btrfs_submit_data_bio() will also call bio_endio() on
+the bio.
+
+Fix this by making btrfs_submit_compressed_read() responsible for
+calling bio_endio() on the bio if there are any errors.  Currently it
+was only doing it if we created the compression bios, otherwise it was
+depending on btrfs_submit_data_bio() to do the right thing.  This
+creates the above problem, so fix up btrfs_submit_compressed_read() to
+always call bio_endio() in case of an error, and then simply return from
+btrfs_submit_data_bio() if we had to call
+btrfs_submit_compressed_read().
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/compression.c | 20 ++++++++++++++------
+ fs/btrfs/inode.c       |  8 +++++++-
+ 2 files changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
+index 32da97c3c19d..66d6a414b2ca 100644
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -807,7 +807,7 @@ blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+ 	u64 em_len;
+ 	u64 em_start;
+ 	struct extent_map *em;
+-	blk_status_t ret = BLK_STS_RESOURCE;
++	blk_status_t ret;
+ 	int faili = 0;
+ 	u8 *sums;
+ 
+@@ -820,14 +820,18 @@ blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+ 	read_lock(&em_tree->lock);
+ 	em = lookup_extent_mapping(em_tree, file_offset, fs_info->sectorsize);
+ 	read_unlock(&em_tree->lock);
+-	if (!em)
+-		return BLK_STS_IOERR;
++	if (!em) {
++		ret = BLK_STS_IOERR;
++		goto out;
++	}
+ 
+ 	ASSERT(em->compress_type != BTRFS_COMPRESS_NONE);
+ 	compressed_len = em->block_len;
+ 	cb = kmalloc(compressed_bio_size(fs_info, compressed_len), GFP_NOFS);
+-	if (!cb)
++	if (!cb) {
++		ret = BLK_STS_RESOURCE;
+ 		goto out;
++	}
+ 
+ 	refcount_set(&cb->pending_sectors, compressed_len >> fs_info->sectorsize_bits);
+ 	cb->errors = 0;
+@@ -850,8 +854,10 @@ blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+ 	nr_pages = DIV_ROUND_UP(compressed_len, PAGE_SIZE);
+ 	cb->compressed_pages = kcalloc(nr_pages, sizeof(struct page *),
+ 				       GFP_NOFS);
+-	if (!cb->compressed_pages)
++	if (!cb->compressed_pages) {
++		ret = BLK_STS_RESOURCE;
+ 		goto fail1;
++	}
+ 
+ 	for (pg_index = 0; pg_index < nr_pages; pg_index++) {
+ 		cb->compressed_pages[pg_index] = alloc_page(GFP_NOFS);
+@@ -937,7 +943,7 @@ blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+ 			comp_bio = NULL;
+ 		}
+ 	}
+-	return 0;
++	return BLK_STS_OK;
+ 
+ fail2:
+ 	while (faili >= 0) {
+@@ -950,6 +956,8 @@ blk_status_t btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
+ 	kfree(cb);
+ out:
+ 	free_extent_map(em);
++	bio->bi_status = ret;
++	bio_endio(bio);
+ 	return ret;
+ finish_cb:
+ 	if (comp_bio) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index cc957cce23a1..68f5a94c82b7 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2536,10 +2536,15 @@ blk_status_t btrfs_submit_data_bio(struct inode *inode, struct bio *bio,
+ 			goto out;
+ 
+ 		if (bio_flags & EXTENT_BIO_COMPRESSED) {
++			/*
++			 * btrfs_submit_compressed_read will handle completing
++			 * the bio if there were any errors, so just return
++			 * here.
++			 */
+ 			ret = btrfs_submit_compressed_read(inode, bio,
+ 							   mirror_num,
+ 							   bio_flags);
+-			goto out;
++			goto out_no_endio;
+ 		} else {
+ 			/*
+ 			 * Lookup bio sums does extra checks around whether we
+@@ -2573,6 +2578,7 @@ blk_status_t btrfs_submit_data_bio(struct inode *inode, struct bio *bio,
+ 		bio->bi_status = ret;
+ 		bio_endio(bio);
+ 	}
++out_no_endio:
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch b/queue-5.16/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch
new file mode 100644
index 00000000000..973d263a8ea
--- /dev/null
+++ b/queue-5.16/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch
@@ -0,0 +1,50 @@
+From 631851e41d3afd4f2a2724cc997746128a801171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 12:12:07 +0000
+Subject: btrfs: fix unexpected error path when reflinking an inline extent
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 1f4613cdbe7739ce291554b316bff8e551383389 ]
+
+When reflinking an inline extent, we assert that its file offset is 0 and
+that its uncompressed length is not greater than the sector size. We then
+return an error if one of those conditions is not satisfied. However we
+use a return statement, which results in returning from btrfs_clone()
+without freeing the path and buffer that were allocated before, as well as
+not clearing the flag BTRFS_INODE_NO_DELALLOC_FLUSH for the destination
+inode.
+
+Fix that by jumping to the 'out' label instead, and also add a WARN_ON()
+for each condition so that in case assertions are disabled, we get to
+known which of the unexpected conditions triggered the error.
+
+Fixes: a61e1e0df9f321 ("Btrfs: simplify inline extent handling when doing reflinks")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/reflink.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/reflink.c b/fs/btrfs/reflink.c
+index e0f93b357548..157d72e330d6 100644
+--- a/fs/btrfs/reflink.c
++++ b/fs/btrfs/reflink.c
+@@ -505,8 +505,11 @@ static int btrfs_clone(struct inode *src, struct inode *inode,
+ 			 */
+ 			ASSERT(key.offset == 0);
+ 			ASSERT(datal <= fs_info->sectorsize);
+-			if (key.offset != 0 || datal > fs_info->sectorsize)
+-				return -EUCLEAN;
++			if (WARN_ON(key.offset != 0) ||
++			    WARN_ON(datal > fs_info->sectorsize)) {
++				ret = -EUCLEAN;
++				goto out;
++			}
+ 
+ 			ret = clone_copy_inline_extent(inode, path, &new_key,
+ 						       drop_start, datal, size,
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-handle-csum-lookup-errors-properly-on-reads.patch b/queue-5.16/btrfs-handle-csum-lookup-errors-properly-on-reads.patch
new file mode 100644
index 00000000000..58451604ec7
--- /dev/null
+++ b/queue-5.16/btrfs-handle-csum-lookup-errors-properly-on-reads.patch
@@ -0,0 +1,114 @@
+From 861c0cf6654e73b99739679d8e4d643660451ef7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:03:23 -0500
+Subject: btrfs: handle csum lookup errors properly on reads
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 1784b7d502a94b561eae58249adde5f72c26eb3c ]
+
+Currently any error we get while trying to lookup csums during reads
+shows up as a missing csum, and then on the read completion side we
+print an error saying there was a csum mismatch and we increase the
+device corruption count.
+
+However we could have gotten an EIO from the lookup.  We could also be
+inside of a memory constrained container and gotten a ENOMEM while
+trying to do the read.  In either case we don't want to make this look
+like a file system corruption problem, we want to make it look like the
+actual error it is.  Capture any negative value, convert it to the
+appropriate blk_status_t, free the csum array if we have one and bail.
+
+Note: a possible improvement would be to make the relocation code look
+up the owning inode and see if it's marked as NODATASUM and set
+EXTENT_NODATASUM there, that way if there's corruption and there isn't a
+checksum when we want it we can fail here rather than later.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 36 ++++++++++++++++++++++--------------
+ 1 file changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index 91ae1caa1bdb..a68d9cab12ea 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -366,6 +366,7 @@ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u8 *dst
+ {
+ 	struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+ 	struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
++	struct btrfs_bio *bbio = NULL;
+ 	struct btrfs_path *path;
+ 	const u32 sectorsize = fs_info->sectorsize;
+ 	const u32 csum_size = fs_info->csum_size;
+@@ -375,6 +376,7 @@ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u8 *dst
+ 	u8 *csum;
+ 	const unsigned int nblocks = orig_len >> fs_info->sectorsize_bits;
+ 	int count = 0;
++	blk_status_t ret = BLK_STS_OK;
+ 
+ 	if (!fs_info->csum_root || (BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM))
+ 		return BLK_STS_OK;
+@@ -397,7 +399,7 @@ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u8 *dst
+ 		return BLK_STS_RESOURCE;
+ 
+ 	if (!dst) {
+-		struct btrfs_bio *bbio = btrfs_bio(bio);
++		bbio = btrfs_bio(bio);
+ 
+ 		if (nblocks * csum_size > BTRFS_BIO_INLINE_CSUM_SIZE) {
+ 			bbio->csum = kmalloc_array(nblocks, csum_size, GFP_NOFS);
+@@ -453,21 +455,27 @@ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u8 *dst
+ 
+ 		count = search_csum_tree(fs_info, path, cur_disk_bytenr,
+ 					 search_len, csum_dst);
+-		if (count <= 0) {
+-			/*
+-			 * Either we hit a critical error or we didn't find
+-			 * the csum.
+-			 * Either way, we put zero into the csums dst, and skip
+-			 * to the next sector.
+-			 */
++		if (count < 0) {
++			ret = errno_to_blk_status(count);
++			if (bbio)
++				btrfs_bio_free_csum(bbio);
++			break;
++		}
++
++		/*
++		 * We didn't find a csum for this range.  We need to make sure
++		 * we complain loudly about this, because we are not NODATASUM.
++		 *
++		 * However for the DATA_RELOC inode we could potentially be
++		 * relocating data extents for a NODATASUM inode, so the inode
++		 * itself won't be marked with NODATASUM, but the extent we're
++		 * copying is in fact NODATASUM.  If we don't find a csum we
++		 * assume this is the case.
++		 */
++		if (count == 0) {
+ 			memset(csum_dst, 0, csum_size);
+ 			count = 1;
+ 
+-			/*
+-			 * For data reloc inode, we need to mark the range
+-			 * NODATASUM so that balance won't report false csum
+-			 * error.
+-			 */
+ 			if (BTRFS_I(inode)->root->root_key.objectid ==
+ 			    BTRFS_DATA_RELOC_TREE_OBJECTID) {
+ 				u64 file_offset;
+@@ -488,7 +496,7 @@ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u8 *dst
+ 	}
+ 
+ 	btrfs_free_path(path);
+-	return BLK_STS_OK;
++	return ret;
+ }
+ 
+ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-harden-identification-of-a-stale-device.patch b/queue-5.16/btrfs-harden-identification-of-a-stale-device.patch
new file mode 100644
index 00000000000..b4c207969db
--- /dev/null
+++ b/queue-5.16/btrfs-harden-identification-of-a-stale-device.patch
@@ -0,0 +1,101 @@
+From 8c9e642326b043078cbfac8922627386348243d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 13:05:59 +0800
+Subject: btrfs: harden identification of a stale device
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit 770c79fb65506fc7c16459855c3839429f46cb32 ]
+
+Identifying and removing the stale device from the fs_uuids list is done
+by btrfs_free_stale_devices().  btrfs_free_stale_devices() in turn
+depends on device_path_matched() to check if the device appears in more
+than one btrfs_device structure.
+
+The matching of the device happens by its path, the device path. However,
+when device mapper is in use, the dm device paths are nothing but a link
+to the actual block device, which leads to the device_path_matched()
+failing to match.
+
+Fix this by matching the dev_t as provided by lookup_bdev() instead of
+plain string compare of the device paths.
+
+Reported-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 45 ++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 38 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 42391d4aeb11..02ee42d461be 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -530,15 +530,48 @@ btrfs_get_bdev_and_sb(const char *device_path, fmode_t flags, void *holder,
+ 	return ret;
+ }
+ 
+-static bool device_path_matched(const char *path, struct btrfs_device *device)
++/*
++ * Check if the device in the path matches the device in the given struct device.
++ *
++ * Returns:
++ *   true  If it is the same device.
++ *   false If it is not the same device or on error.
++ */
++static bool device_matched(const struct btrfs_device *device, const char *path)
+ {
+-	int found;
++	char *device_name;
++	dev_t dev_old;
++	dev_t dev_new;
++	int ret;
++
++	/*
++	 * If we are looking for a device with the matching dev_t, then skip
++	 * device without a name (a missing device).
++	 */
++	if (!device->name)
++		return false;
++
++	device_name = kzalloc(BTRFS_PATH_NAME_MAX, GFP_KERNEL);
++	if (!device_name)
++		return false;
+ 
+ 	rcu_read_lock();
+-	found = strcmp(rcu_str_deref(device->name), path);
++	scnprintf(device_name, BTRFS_PATH_NAME_MAX, "%s", rcu_str_deref(device->name));
+ 	rcu_read_unlock();
+ 
+-	return found == 0;
++	ret = lookup_bdev(device_name, &dev_old);
++	kfree(device_name);
++	if (ret)
++		return false;
++
++	ret = lookup_bdev(path, &dev_new);
++	if (ret)
++		return false;
++
++	if (dev_old == dev_new)
++		return true;
++
++	return false;
+ }
+ 
+ /*
+@@ -571,9 +604,7 @@ static int btrfs_free_stale_devices(const char *path,
+ 					 &fs_devices->devices, dev_list) {
+ 			if (skip_device && skip_device == device)
+ 				continue;
+-			if (path && !device->name)
+-				continue;
+-			if (path && !device_path_matched(path, device))
++			if (path && !device_matched(device, path))
+ 				continue;
+ 			if (fs_devices->opened) {
+ 				/* for an already deleted device return 0 */
+-- 
+2.34.1
+
diff --git a/queue-5.16/btrfs-make-search_csum_tree-return-0-if-we-get-efbig.patch b/queue-5.16/btrfs-make-search_csum_tree-return-0-if-we-get-efbig.patch
new file mode 100644
index 00000000000..9ec4769ae33
--- /dev/null
+++ b/queue-5.16/btrfs-make-search_csum_tree-return-0-if-we-get-efbig.patch
@@ -0,0 +1,51 @@
+From ba170ec15081014162be31ac383a9acd12444e03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:03:22 -0500
+Subject: btrfs: make search_csum_tree return 0 if we get -EFBIG
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 03ddb19d2ea745228879b9334f3b550c88acb10a ]
+
+We can either fail to find a csum entry at all and return -ENOENT, or we
+can find a range that is close, but return -EFBIG.  In essence these
+both mean the same thing when we are doing a lookup for a csum in an
+existing range, we didn't find a csum.  We want to treat both of these
+errors the same way, complain loudly that there wasn't a csum.  This
+currently happens anyway because we do
+
+	count = search_csum_tree();
+	if (count <= 0) {
+		// reloc and error handling
+	}
+
+However it forces us to incorrectly treat EIO or ENOMEM errors as on
+disk corruption.  Fix this by returning 0 if we get either -ENOENT or
+-EFBIG from btrfs_lookup_csum() so we can do proper error handling.
+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index d1cbb64a78f3..91ae1caa1bdb 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -303,7 +303,7 @@ static int search_csum_tree(struct btrfs_fs_info *fs_info,
+ 	read_extent_buffer(path->nodes[0], dst, (unsigned long)item,
+ 			ret * csum_size);
+ out:
+-	if (ret == -ENOENT)
++	if (ret == -ENOENT || ret == -EFBIG)
+ 		ret = 0;
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch b/queue-5.16/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch
new file mode 100644
index 00000000000..4ec82af7524
--- /dev/null
+++ b/queue-5.16/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch
@@ -0,0 +1,49 @@
+From 46149ac7ca2ad50cad468f289002410c4d6fb5e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 17:42:57 +0100
+Subject: can: isotp: return -EADDRNOTAVAIL when reading from unbound socket
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 30ffd5332e06316bd69a654c06aa033872979b7c ]
+
+When reading from an unbound can-isotp socket the syscall blocked
+indefinitely. As unbound sockets (without given CAN address information)
+do not make sense anyway we directly return -EADDRNOTAVAIL on read()
+analogue to the known behavior from sendmsg().
+
+Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
+Link: https://github.com/linux-can/can-utils/issues/349
+Link: https://lore.kernel.org/all/20220316164258.54155-2-socketcan@hartkopp.net
+Suggested-by: Derek Will <derekrobertwill@gmail.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/isotp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index f8e3aeb79e3f..8966f06e0660 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -1005,12 +1005,16 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ {
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
++	struct isotp_sock *so = isotp_sk(sk);
+ 	int err = 0;
+ 	int noblock;
+ 
+ 	noblock = flags & MSG_DONTWAIT;
+ 	flags &= ~MSG_DONTWAIT;
+ 
++	if (!so->bound)
++		return -EADDRNOTAVAIL;
++
+ 	skb = skb_recv_datagram(sk, flags, noblock, &err);
+ 	if (!skb)
+ 		return err;
+-- 
+2.34.1
+
diff --git a/queue-5.16/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch b/queue-5.16/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch
new file mode 100644
index 00000000000..b5781d7225c
--- /dev/null
+++ b/queue-5.16/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch
@@ -0,0 +1,86 @@
+From fce7adf609620c55d7e8bd2665a3a356a3093f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 17:42:58 +0100
+Subject: can: isotp: support MSG_TRUNC flag when reading from socket
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 42bf50a1795a1854d48717b7361dbdbce496b16b ]
+
+When providing the MSG_TRUNC flag via recvmsg() syscall the return value
+provides the real length of the packet or datagram, even when it was longer
+than the passed buffer.
+
+Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
+Link: https://github.com/linux-can/can-utils/issues/347#issuecomment-1065932671
+Link: https://lore.kernel.org/all/20220316164258.54155-3-socketcan@hartkopp.net
+Suggested-by: Derek Will <derekrobertwill@gmail.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/isotp.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index 8966f06e0660..ad61342d2e16 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -1006,29 +1006,28 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 	struct sock *sk = sock->sk;
+ 	struct sk_buff *skb;
+ 	struct isotp_sock *so = isotp_sk(sk);
+-	int err = 0;
+-	int noblock;
++	int noblock = flags & MSG_DONTWAIT;
++	int ret = 0;
+ 
+-	noblock = flags & MSG_DONTWAIT;
+-	flags &= ~MSG_DONTWAIT;
++	if (flags & ~(MSG_DONTWAIT | MSG_TRUNC))
++		return -EINVAL;
+ 
+ 	if (!so->bound)
+ 		return -EADDRNOTAVAIL;
+ 
+-	skb = skb_recv_datagram(sk, flags, noblock, &err);
++	flags &= ~MSG_DONTWAIT;
++	skb = skb_recv_datagram(sk, flags, noblock, &ret);
+ 	if (!skb)
+-		return err;
++		return ret;
+ 
+ 	if (size < skb->len)
+ 		msg->msg_flags |= MSG_TRUNC;
+ 	else
+ 		size = skb->len;
+ 
+-	err = memcpy_to_msg(msg, skb->data, size);
+-	if (err < 0) {
+-		skb_free_datagram(sk, skb);
+-		return err;
+-	}
++	ret = memcpy_to_msg(msg, skb->data, size);
++	if (ret < 0)
++		goto out_err;
+ 
+ 	sock_recv_timestamp(msg, sk, skb);
+ 
+@@ -1038,9 +1037,13 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ 		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
+ 	}
+ 
++	/* set length of return value */
++	ret = (flags & MSG_TRUNC) ? skb->len : size;
++
++out_err:
+ 	skb_free_datagram(sk, skb);
+ 
+-	return size;
++	return ret;
+ }
+ 
+ static int isotp_release(struct socket *sock)
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-actions-terminate-clk_div_table-with-sentinel-el.patch b/queue-5.16/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
new file mode 100644
index 00000000000..93d0f9b64af
--- /dev/null
+++ b/queue-5.16/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
@@ -0,0 +1,58 @@
+From b35e5c4e4b05b659297bcb6a42a18c4a162dde0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:17 +0100
+Subject: clk: actions: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit d8a441e53e2434b1401e52dfd66b05263e442edc ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+In owl-s900.s, the { 0, 8 } element was probably meant to be just that,
+so this patch changes { 0, 8 } to { 0, 0 }.
+
+Fixes: d47317ca4ade1 ("clk: actions: Add S700 SoC clock support")
+Fixes: d85d20053e195 ("clk: actions: Add S900 SoC clock support")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/20220218000922.134857-2-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-s700.c | 1 +
+ drivers/clk/actions/owl-s900.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c
+index a2f34d13fb54..6ea7da1d6d75 100644
+--- a/drivers/clk/actions/owl-s700.c
++++ b/drivers/clk/actions/owl-s700.c
+@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = {
+ 
+ static struct clk_div_table rmii_div_table[] = {
+ 	{0, 4},   {1, 10},
++	{0, 0}
+ };
+ 
+ /* divider clocks */
+diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c
+index 790890978424..5144ada2c7e1 100644
+--- a/drivers/clk/actions/owl-s900.c
++++ b/drivers/clk/actions/owl-s900.c
+@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = {
+ 
+ static struct clk_div_table usb3_mac_div_table[] = {
+ 	{ 1, 2 }, { 2, 3 }, { 3, 4 },
+-	{ 0, 8 },
++	{ 0, 0 }
+ };
+ 
+ static struct clk_div_table i2s_div_table[] = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch b/queue-5.16/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch
new file mode 100644
index 00000000000..cc762de8db4
--- /dev/null
+++ b/queue-5.16/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch
@@ -0,0 +1,49 @@
+From 6f04d4a1d507a547a31547f49626ea6cf7d227d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 20:26:16 +0200
+Subject: clk: at91: sama7g5: fix parents of PDMCs' GCLK
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit 1a944729d8635fa59638f24e8727d5ccaa0c8c19 ]
+
+Audio PLL can be used as parent by the GCLKs of PDMCs.
+
+Fixes: cb783bbbcf54 ("clk: at91: sama7g5: add clock support for sama7g5")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20220304182616.1920392-1-codrin.ciubotariu@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sama7g5.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c
+index 369dfafabbca..060e908086a1 100644
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -696,16 +696,16 @@ static const struct {
+ 	{ .n  = "pdmc0_gclk",
+ 	  .id = 68,
+ 	  .r = { .max = 50000000  },
+-	  .pp = { "syspll_divpmcck", "baudpll_divpmcck", },
+-	  .pp_mux_table = { 5, 8, },
++	  .pp = { "syspll_divpmcck", "audiopll_divpmcck", },
++	  .pp_mux_table = { 5, 9, },
+ 	  .pp_count = 2,
+ 	  .pp_chg_id = INT_MIN, },
+ 
+ 	{ .n  = "pdmc1_gclk",
+ 	  .id = 69,
+ 	  .r = { .max = 50000000, },
+-	  .pp = { "syspll_divpmcck", "baudpll_divpmcck", },
+-	  .pp_mux_table = { 5, 8, },
++	  .pp = { "syspll_divpmcck", "audiopll_divpmcck", },
++	  .pp_mux_table = { 5, 9, },
+ 	  .pp_count = 2,
+ 	  .pp_chg_id = INT_MIN, },
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch b/queue-5.16/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
new file mode 100644
index 00000000000..7e57f137d99
--- /dev/null
+++ b/queue-5.16/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
@@ -0,0 +1,45 @@
+From 1fb7bf494000ef486cd3efb293c1e08df0b2cae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:20 +0100
+Subject: clk: clps711x: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 8bed4ed5aa3431085d9d27afc35d684856460eda ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+Fixes: 631c53478973d ("clk: Add CLPS711X clk driver")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Link: https://lore.kernel.org/r/20220218000922.134857-5-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-clps711x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c
+index a2c6486ef170..f8417ee2961a 100644
+--- a/drivers/clk/clk-clps711x.c
++++ b/drivers/clk/clk-clps711x.c
+@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = {
+ 	{ .val = 1, .div = 8, },
+ 	{ .val = 2, .div = 2, },
+ 	{ .val = 3, .div = 1, },
++	{ /* sentinel */ }
+ };
+ 
+ static const struct clk_div_table timer_div_table[] = {
+ 	{ .val = 0, .div = 256, },
+ 	{ .val = 1, .div = 1, },
++	{ /* sentinel */ }
+ };
+ 
+ struct clps711x_clk {
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-fix-clk_hw_get_clk-when-dev-is-null.patch b/queue-5.16/clk-fix-clk_hw_get_clk-when-dev-is-null.patch
new file mode 100644
index 00000000000..dd35f1d4490
--- /dev/null
+++ b/queue-5.16/clk-fix-clk_hw_get_clk-when-dev-is-null.patch
@@ -0,0 +1,49 @@
+From 0dbd21627bf19f9845e1c590eed2b48613a353a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 15:35:23 +0100
+Subject: clk: Fix clk_hw_get_clk() when dev is NULL
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 0c1b56df451716ba207bbf59f303473643eee4fd ]
+
+Any registered clk_core structure can have a NULL pointer in its dev
+field. While never actually documented, this is evidenced by the wide
+usage of clk_register and clk_hw_register with a NULL device pointer,
+and the fact that the core of_clk_hw_register() function also passes a
+NULL device pointer.
+
+A call to clk_hw_get_clk() on a clk_hw struct whose clk_core is in that
+case will result in a NULL pointer derefence when it calls dev_name() on
+that NULL device pointer.
+
+Add a test for this case and use NULL as the dev_id if the device
+pointer is NULL.
+
+Fixes: 30d6f8c15d2c ("clk: add api to get clk consumer from clk_hw")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220225143534.405820-2-maxime@cerno.tech
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 21b17d6ced6d..e55ddc12ed53 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3733,8 +3733,9 @@ struct clk *clk_hw_create_clk(struct device *dev, struct clk_hw *hw,
+ struct clk *clk_hw_get_clk(struct clk_hw *hw, const char *con_id)
+ {
+ 	struct device *dev = hw->core->dev;
++	const char *name = dev ? dev_name(dev) : NULL;
+ 
+-	return clk_hw_create_clk(dev, hw, dev_name(dev), con_id);
++	return clk_hw_create_clk(dev, hw, name, con_id);
+ }
+ EXPORT_SYMBOL(clk_hw_get_clk);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-hisilicon-terminate-clk_div_table-with-sentinel-.patch b/queue-5.16/clk-hisilicon-terminate-clk_div_table-with-sentinel-.patch
new file mode 100644
index 00000000000..35afc6f960f
--- /dev/null
+++ b/queue-5.16/clk-hisilicon-terminate-clk_div_table-with-sentinel-.patch
@@ -0,0 +1,42 @@
+From a30a9be55e0fdc0d5d240c066f49d781d7b18bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:19 +0100
+Subject: clk: hisilicon: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 113b261bdf2b4fd34e7769a147a7acd0a4d9137f ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+Fixes: 6c81966107dc0 ("clk: hisilicon: Add clock driver for hi3559A SoC")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Link: https://lore.kernel.org/r/20220218000922.134857-4-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3559a.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3559a.c b/drivers/clk/hisilicon/clk-hi3559a.c
+index 56012a3d0219..9ea1a80acbe8 100644
+--- a/drivers/clk/hisilicon/clk-hi3559a.c
++++ b/drivers/clk/hisilicon/clk-hi3559a.c
+@@ -611,8 +611,8 @@ static struct hisi_mux_clock hi3559av100_shub_mux_clks[] = {
+ 
+ 
+ /* shub div clk */
+-static struct clk_div_table shub_spi_clk_table[] = {{0, 8}, {1, 4}, {2, 2}};
+-static struct clk_div_table shub_uart_div_clk_table[] = {{1, 8}, {2, 4}};
++static struct clk_div_table shub_spi_clk_table[] = {{0, 8}, {1, 4}, {2, 2}, {/*sentinel*/}};
++static struct clk_div_table shub_uart_div_clk_table[] = {{1, 8}, {2, 4}, {/*sentinel*/}};
+ 
+ static struct hisi_divider_clock hi3559av100_shub_div_clks[] = {
+ 	{ HI3559AV100_SHUB_SPI_SOURCE_CLK, "clk_spi_clk", "shub_clk", 0, 0x20, 24, 2,
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-imx-off-by-one-in-imx_lpcg_parse_clks_from_dt.patch b/queue-5.16/clk-imx-off-by-one-in-imx_lpcg_parse_clks_from_dt.patch
new file mode 100644
index 00000000000..4b07b368e1e
--- /dev/null
+++ b/queue-5.16/clk-imx-off-by-one-in-imx_lpcg_parse_clks_from_dt.patch
@@ -0,0 +1,38 @@
+From 4bffc7b7baa0df591f80b5bb3281154089b9e79c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 10:50:14 +0300
+Subject: clk: imx: off by one in imx_lpcg_parse_clks_from_dt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 135efc3a76d127691afaf1864e4ab627bf09d53d ]
+
+The > needs to be >= to prevent an off by one access.
+
+Fixes: d5f1e6a2bb61 ("clk: imx: imx8qxp-lpcg: add parsing clocks from device tree")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
+Link: https://lore.kernel.org/r/20220228075014.GD13685@kili
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8qxp-lpcg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
+index b23758083ce5..5e31a6a24b3a 100644
+--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
++++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
+@@ -248,7 +248,7 @@ static int imx_lpcg_parse_clks_from_dt(struct platform_device *pdev,
+ 
+ 	for (i = 0; i < count; i++) {
+ 		idx = bit_offset[i] / 4;
+-		if (idx > IMX_LPCG_MAX_CLKS) {
++		if (idx >= IMX_LPCG_MAX_CLKS) {
+ 			dev_warn(&pdev->dev, "invalid bit offset of clock %d\n",
+ 				 i);
+ 			ret = -EINVAL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-imx7d-remove-audio_mclk_root_clk.patch b/queue-5.16/clk-imx7d-remove-audio_mclk_root_clk.patch
new file mode 100644
index 00000000000..5bfac90083a
--- /dev/null
+++ b/queue-5.16/clk-imx7d-remove-audio_mclk_root_clk.patch
@@ -0,0 +1,38 @@
+From 7d468322d437e3547cf0341b7b23f8cf443ee4ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 16:10:52 +0200
+Subject: clk: imx7d: Remove audio_mclk_root_clk
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit eccac77ede3946c90143447cdc785dc16aec4b24 ]
+
+The audio_mclk_root_clk was added as a gate with the CCGR121 (0x4790),
+but according to the reference manual, there is no such gate. The
+CCGR121 belongs to ECSPI2 and it is not shared.
+
+Fixes: 8f6d8094b215b57 ("ARM: imx: add imx7d clk tree support")
+Reported-by: David Wolfe <david.wolfe@nxp.com>
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20220127141052.1900174-2-abel.vesa@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index c4e0f1c07192..3f6fd7ef2a68 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -849,7 +849,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ 	hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0);
+ 	hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0);
+ 	hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0);
+-	hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0);
+ 	hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0);
+ 	hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0);
+ 	hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0);
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-initialize-orphan-req_rate.patch b/queue-5.16/clk-initialize-orphan-req_rate.patch
new file mode 100644
index 00000000000..ae5c9a8b0c6
--- /dev/null
+++ b/queue-5.16/clk-initialize-orphan-req_rate.patch
@@ -0,0 +1,68 @@
+From 81c90dab683ccd81fa5aa9ea5f903fe448e613ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 17:11:42 +0100
+Subject: clk: Initialize orphan req_rate
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 5f7e2af00807f2117650e711a58b7f0e986ce1df ]
+
+When registering a clock that doesn't have a recalc_rate implementation,
+and doesn't have its parent registered yet, we initialize the clk_core
+rate and 'req_rate' fields to 0.
+
+The rate field is later updated when the parent is registered in
+clk_core_reparent_orphans_nolock() using __clk_recalc_rates(), but the
+'req_rate' field is never updated.
+
+This leads to an issue in clk_set_rate_range() and clk_put(), since
+those functions will call clk_set_rate() with the content of 'req_rate'
+to provide drivers with the opportunity to change the rate based on the
+new boundaries. In this case, we would call clk_set_rate() with a rate
+of 0, effectively enforcing the minimum allowed for this clock whenever
+we would call one of those two functions, even though the actual rate
+might be within range.
+
+Let's fix this by setting 'req_rate' in
+clk_core_reparent_orphans_nolock() with the rate field content just
+updated by the call to __clk_recalc_rates().
+
+Fixes: 1c8e600440c7 ("clk: Add rate constraints to clocks")
+Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> # T30 Nexus7
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220325161144.1901695-2-maxime@cerno.tech
+[sboyd@kernel.org: Reword comment]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index e55ddc12ed53..2c5db2df9d42 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3413,6 +3413,19 @@ static void clk_core_reparent_orphans_nolock(void)
+ 			__clk_set_parent_after(orphan, parent, NULL);
+ 			__clk_recalc_accuracies(orphan);
+ 			__clk_recalc_rates(orphan, 0);
++
++			/*
++			 * __clk_init_parent() will set the initial req_rate to
++			 * 0 if the clock doesn't have clk_ops::recalc_rate and
++			 * is an orphan when it's registered.
++			 *
++			 * 'req_rate' is used by clk_set_rate_range() and
++			 * clk_put() to trigger a clk_set_rate() call whenever
++			 * the boundaries are modified. Let's make sure
++			 * 'req_rate' is set to something non-zero so that
++			 * clk_set_rate_range() doesn't drop the frequency.
++			 */
++			orphan->req_rate = orphan->rate;
+ 		}
+ 	}
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch b/queue-5.16/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
new file mode 100644
index 00000000000..3a6fa755c95
--- /dev/null
+++ b/queue-5.16/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
@@ -0,0 +1,40 @@
+From bb27be7f495cf99179f1f4277d654a6691fac714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:18 +0100
+Subject: clk: loongson1: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 3eb00f89162e80083dfcaa842468b510462cfeaa ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+Fixes: b4626a7f4892 ("CLK: Add Loongson1C clock support")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Link: https://lore.kernel.org/r/20220218000922.134857-3-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/loongson1/clk-loongson1c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c
+index 703f87622cf5..1ebf740380ef 100644
+--- a/drivers/clk/loongson1/clk-loongson1c.c
++++ b/drivers/clk/loongson1/clk-loongson1c.c
+@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = {
+ 	[1] = { .val = 1, .div = 4 },
+ 	[2] = { .val = 2, .div = 3 },
+ 	[3] = { .val = 3, .div = 3 },
++	[4] = { /* sentinel */ }
+ };
+ 
+ void __init ls1x_clk_init(void)
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch b/queue-5.16/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
new file mode 100644
index 00000000000..7cd27375398
--- /dev/null
+++ b/queue-5.16/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
@@ -0,0 +1,60 @@
+From 8051cab7ed1218fe2253257c6d3fcdee98b1d823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Feb 2022 23:25:35 +0530
+Subject: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit 58922910add18583d5273c2edcdb9fd7bf4eca02 ]
+
+The display pixel clock has a requirement on certain newer platforms to
+support M/N as (2/3) and the final D value calculated results in
+underflow errors.
+As the current implementation does not check for D value is within
+the accepted range for a given M & N value. Update the logic to
+calculate the final D value based on the range.
+
+Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220227175536.3131-1-tdas@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index e1b1b426fae4..b831975a9606 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -264,7 +264,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw,
+ 
+ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f)
+ {
+-	u32 cfg, mask;
++	u32 cfg, mask, d_val, not2d_val, n_minus_m;
+ 	struct clk_hw *hw = &rcg->clkr.hw;
+ 	int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src);
+ 
+@@ -283,8 +283,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f)
+ 		if (ret)
+ 			return ret;
+ 
++		/* Calculate 2d value */
++		d_val = f->n;
++
++		n_minus_m = f->n - f->m;
++		n_minus_m *= 2;
++
++		d_val = clamp_t(u32, d_val, f->m, n_minus_m);
++		not2d_val = ~d_val & mask;
++
+ 		ret = regmap_update_bits(rcg->clkr.regmap,
+-				RCG_D_OFFSET(rcg), mask, ~f->n);
++				RCG_D_OFFSET(rcg), mask, not2d_val);
+ 		if (ret)
+ 			return ret;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch b/queue-5.16/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
new file mode 100644
index 00000000000..d1601d26188
--- /dev/null
+++ b/queue-5.16/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
@@ -0,0 +1,37 @@
+From 3e267cd0761afb870bbbdad2644f90f3763bb156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Feb 2022 23:25:36 +0530
+Subject: clk: qcom: clk-rcg2: Update the frac table for pixel clock
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit b527358cb4cd58a8279c9062b0786f1fab628fdc ]
+
+Support the new numerator and denominator for pixel clock on SM8350 and
+support rgb101010, RGB888 use cases on SM8450.
+
+Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220227175536.3131-2-tdas@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index b831975a9606..f675fd969c4d 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -729,6 +729,7 @@ static const struct frac_entry frac_table_pixel[] = {
+ 	{ 2, 9 },
+ 	{ 4, 9 },
+ 	{ 1, 1 },
++	{ 2, 3 },
+ 	{ }
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-qcom-gcc-msm8994-fix-gpll4-width.patch b/queue-5.16/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
new file mode 100644
index 00000000000..cdf6bbf9f6c
--- /dev/null
+++ b/queue-5.16/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
@@ -0,0 +1,43 @@
+From 7aa80272e5ecfa1cb986b083d27ad4187d10da8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Mar 2022 18:49:40 +0100
+Subject: clk: qcom: gcc-msm8994: Fix gpll4 width
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+[ Upstream commit 71021db1c532c2545ae53b9ee85b37b7154f51d4 ]
+
+The gpll4 postdiv is actually a div4, so make sure that Linux is aware of
+this.
+
+This fixes the following error messages:
+
+ mmc1: Card appears overclocked; req 200000000 Hz, actual 343999999 Hz
+ mmc1: Card appears overclocked; req 400000000 Hz, actual 687999999 Hz
+
+Fixes: aec89f78cf01 ("clk: qcom: Add support for msm8994 global clock controller")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20220319174940.341137-1-konrad.dybcio@somainline.org
+Tested-by: Petr Vorel <petr.vorel@gmail.com>
+Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8994.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c
+index 5df9f1ead48e..4a9eb845b050 100644
+--- a/drivers/clk/qcom/gcc-msm8994.c
++++ b/drivers/clk/qcom/gcc-msm8994.c
+@@ -76,6 +76,7 @@ static struct clk_alpha_pll gpll4_early = {
+ 
+ static struct clk_alpha_pll_postdiv gpll4 = {
+ 	.offset = 0x1dc0,
++	.width = 4,
+ 	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4",
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch b/queue-5.16/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch
new file mode 100644
index 00000000000..85bfd5763cc
--- /dev/null
+++ b/queue-5.16/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch
@@ -0,0 +1,163 @@
+From 3a7da2b625e657208d8425d312527f58c551d193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Dec 2021 12:41:19 +0100
+Subject: clk: qcom: ipq8074: fix PCI-E clock oops
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit bf8f5182b8f59309809b41c1d1730ed9ca6134b1 ]
+
+Fix PCI-E clock related kernel oops that are caused by a missing clock
+parent.
+
+pcie0_rchng_clk_src has num_parents set to 2 but only one parent is
+actually set via parent_hws, it should also have "XO" defined.
+This will cause the kernel to panic on a NULL pointer in
+clk_core_get_parent_by_index().
+
+So, to fix this utilize clk_parent_data to provide gcc_xo_gpll0 parent
+data.
+Since there is already an existing static const char * const gcc_xo_gpll0[]
+used to provide the same parents via parent_names convert those users to
+clk_parent_data as well.
+
+Without this earlycon is needed to even catch the OOPS as it will reset
+the board before serial is initialized with the following:
+
+[    0.232279] Unable to handle kernel paging request at virtual address 0000a00000000000
+[    0.232322] Mem abort info:
+[    0.239094]   ESR = 0x96000004
+[    0.241778]   EC = 0x25: DABT (current EL), IL = 32 bits
+[    0.244908]   SET = 0, FnV = 0
+[    0.250377]   EA = 0, S1PTW = 0
+[    0.253236]   FSC = 0x04: level 0 translation fault
+[    0.256277] Data abort info:
+[    0.261141]   ISV = 0, ISS = 0x00000004
+[    0.264262]   CM = 0, WnR = 0
+[    0.267820] [0000a00000000000] address between user and kernel address ranges
+[    0.270954] Internal error: Oops: 96000004 [#1] SMP
+[    0.278067] Modules linked in:
+[    0.282751] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.10 #0
+[    0.285882] Hardware name: Xiaomi AX3600 (DT)
+[    0.292043] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[    0.296299] pc : clk_core_get_parent_by_index+0x68/0xec
+[    0.303067] lr : __clk_register+0x1d8/0x820
+[    0.308273] sp : ffffffc01111b7d0
+[    0.312438] x29: ffffffc01111b7d0 x28: 0000000000000000 x27: 0000000000000040
+[    0.315919] x26: 0000000000000002 x25: 0000000000000000 x24: ffffff8000308800
+[    0.323037] x23: ffffff8000308850 x22: ffffff8000308880 x21: ffffff8000308828
+[    0.330155] x20: 0000000000000028 x19: ffffff8000309700 x18: 0000000000000020
+[    0.337272] x17: 000000005cc86990 x16: 0000000000000004 x15: ffffff80001d9d0a
+[    0.344391] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000006
+[    0.351508] x11: 0000000000000003 x10: 0101010101010101 x9 : 0000000000000000
+[    0.358626] x8 : 7f7f7f7f7f7f7f7f x7 : 6468626f5e626266 x6 : 17000a3a403c1b06
+[    0.365744] x5 : 061b3c403a0a0017 x4 : 0000000000000000 x3 : 0000000000000001
+[    0.372863] x2 : 0000a00000000000 x1 : 0000000000000001 x0 : ffffff8000309700
+[    0.379982] Call trace:
+[    0.387091]  clk_core_get_parent_by_index+0x68/0xec
+[    0.389351]  __clk_register+0x1d8/0x820
+[    0.394210]  devm_clk_hw_register+0x5c/0xe0
+[    0.398030]  devm_clk_register_regmap+0x44/0x8c
+[    0.402198]  qcom_cc_really_probe+0x17c/0x1d0
+[    0.406711]  qcom_cc_probe+0x34/0x44
+[    0.411224]  gcc_ipq8074_probe+0x18/0x30
+[    0.414869]  platform_probe+0x68/0xe0
+[    0.418776]  really_probe.part.0+0x9c/0x30c
+[    0.422336]  __driver_probe_device+0x98/0x144
+[    0.426329]  driver_probe_device+0x44/0x11c
+[    0.430842]  __device_attach_driver+0xb4/0x120
+[    0.434836]  bus_for_each_drv+0x68/0xb0
+[    0.439349]  __device_attach+0xb0/0x170
+[    0.443081]  device_initial_probe+0x14/0x20
+[    0.446901]  bus_probe_device+0x9c/0xa4
+[    0.451067]  device_add+0x35c/0x834
+[    0.454886]  of_device_add+0x54/0x64
+[    0.458360]  of_platform_device_create_pdata+0xc0/0x100
+[    0.462181]  of_platform_bus_create+0x114/0x370
+[    0.467128]  of_platform_bus_create+0x15c/0x370
+[    0.471641]  of_platform_populate+0x50/0xcc
+[    0.476155]  of_platform_default_populate_init+0xa8/0xc8
+[    0.480324]  do_one_initcall+0x50/0x1b0
+[    0.485877]  kernel_init_freeable+0x234/0x29c
+[    0.489436]  kernel_init+0x24/0x120
+[    0.493948]  ret_from_fork+0x10/0x20
+[    0.497253] Code: d50323bf d65f03c0 f94002a2 b4000302 (f9400042)
+[    0.501079] ---[ end trace 4ca7e1129da2abce ]---
+
+Fixes: f0cfcf1a ("clk: qcom: ipq8074: Add missing clocks for pcie")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211220114119.465247-1-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index 108fe27bee10..b09d99343e09 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -60,11 +60,6 @@ static const struct parent_map gcc_xo_gpll0_gpll0_out_main_div2_map[] = {
+ 	{ P_GPLL0_DIV2, 4 },
+ };
+ 
+-static const char * const gcc_xo_gpll0[] = {
+-	"xo",
+-	"gpll0",
+-};
+-
+ static const struct parent_map gcc_xo_gpll0_map[] = {
+ 	{ P_XO, 0 },
+ 	{ P_GPLL0, 1 },
+@@ -956,6 +951,11 @@ static struct clk_rcg2 blsp1_uart6_apps_clk_src = {
+ 	},
+ };
+ 
++static const struct clk_parent_data gcc_xo_gpll0[] = {
++	{ .fw_name = "xo" },
++	{ .hw = &gpll0.clkr.hw },
++};
++
+ static const struct freq_tbl ftbl_pcie_axi_clk_src[] = {
+ 	F(19200000, P_XO, 1, 0, 0),
+ 	F(200000000, P_GPLL0, 4, 0, 0),
+@@ -969,7 +969,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie0_axi_clk_src",
+-		.parent_names = gcc_xo_gpll0,
++		.parent_data = gcc_xo_gpll0,
+ 		.num_parents = 2,
+ 		.ops = &clk_rcg2_ops,
+ 	},
+@@ -1016,7 +1016,7 @@ static struct clk_rcg2 pcie1_axi_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie1_axi_clk_src",
+-		.parent_names = gcc_xo_gpll0,
++		.parent_data = gcc_xo_gpll0,
+ 		.num_parents = 2,
+ 		.ops = &clk_rcg2_ops,
+ 	},
+@@ -1330,7 +1330,7 @@ static struct clk_rcg2 nss_ce_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "nss_ce_clk_src",
+-		.parent_names = gcc_xo_gpll0,
++		.parent_data = gcc_xo_gpll0,
+ 		.num_parents = 2,
+ 		.ops = &clk_rcg2_ops,
+ 	},
+@@ -4329,8 +4329,7 @@ static struct clk_rcg2 pcie0_rchng_clk_src = {
+ 	.parent_map = gcc_xo_gpll0_map,
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "pcie0_rchng_clk_src",
+-		.parent_hws = (const struct clk_hw *[]) {
+-				&gpll0.clkr.hw },
++		.parent_data = gcc_xo_gpll0,
+ 		.num_parents = 2,
+ 		.ops = &clk_rcg2_ops,
+ 	},
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch b/queue-5.16/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
new file mode 100644
index 00000000000..bec10366535
--- /dev/null
+++ b/queue-5.16/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
@@ -0,0 +1,49 @@
+From 5d08990c2e27a82d4402a3d8130fa5c8ac1ad5ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 18:31:00 +0100
+Subject: clk: qcom: ipq8074: Use floor ops for SDCC1 clock
+
+From: Dirk Buchwalder <buchwalder@posteo.de>
+
+[ Upstream commit b77d8306d84f83d1da68028a68c91da9c867b6f6 ]
+
+Use floor ops on SDCC1 APPS clock in order to round down selected clock
+frequency and avoid overclocking SD/eMMC cards.
+
+For example, currently HS200 cards were failling tuning as they were
+actually being clocked at 384MHz instead of 192MHz.
+This caused some boards to disable 1.8V I/O and force the eMMC into the
+standard HS mode (50MHz) and that appeared to work despite the eMMC being
+overclocked to 96Mhz in that case.
+
+There was a previous commit to use floor ops on SDCC clocks, but it looks
+to have only covered SDCC2 clock.
+
+Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks")
+
+Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220210173100.505128-1-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index b09d99343e09..541016db3c4b 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ 		.name = "sdcc1_apps_clk_src",
+ 		.parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ 		.num_parents = 4,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-renesas-r9a07g044-update-multiplier-and-divider-.patch b/queue-5.16/clk-renesas-r9a07g044-update-multiplier-and-divider-.patch
new file mode 100644
index 00000000000..d13fb4c187b
--- /dev/null
+++ b/queue-5.16/clk-renesas-r9a07g044-update-multiplier-and-divider-.patch
@@ -0,0 +1,45 @@
+From 374d11e2fba0d763f15cabb6b29ea917d61123c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 09:32:23 +0000
+Subject: clk: renesas: r9a07g044: Update multiplier and divider values for
+ PLL2/3
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit b289cdecc7c3e25e001cde260c882e4d9a8b0772 ]
+
+As per the HW manual (Rev.1.00 Sep, 2021) PLL2 and PLL3 should be
+1600 MHz, but with current multiplier and divider values this resulted
+to 1596 MHz.
+
+This patch updates the multiplier and divider values for PLL2 and PLL3
+so that we get the exact (1600 MHz) values.
+
+Fixes: 17f0ff3d49ff1 ("clk: renesas: Add support for R9A07G044 SoC")
+Suggested-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20211223093223.4725-1-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r9a07g044-cpg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/r9a07g044-cpg.c b/drivers/clk/renesas/r9a07g044-cpg.c
+index 47c16265fca9..3e72dd060ffa 100644
+--- a/drivers/clk/renesas/r9a07g044-cpg.c
++++ b/drivers/clk/renesas/r9a07g044-cpg.c
+@@ -78,8 +78,8 @@ static const struct cpg_core_clk r9a07g044_core_clks[] __initconst = {
+ 	DEF_FIXED(".osc", R9A07G044_OSCCLK, CLK_EXTAL, 1, 1),
+ 	DEF_FIXED(".osc_div1000", CLK_OSC_DIV1000, CLK_EXTAL, 1, 1000),
+ 	DEF_SAMPLL(".pll1", CLK_PLL1, CLK_EXTAL, PLL146_CONF(0)),
+-	DEF_FIXED(".pll2", CLK_PLL2, CLK_EXTAL, 133, 2),
+-	DEF_FIXED(".pll3", CLK_PLL3, CLK_EXTAL, 133, 2),
++	DEF_FIXED(".pll2", CLK_PLL2, CLK_EXTAL, 200, 3),
++	DEF_FIXED(".pll3", CLK_PLL3, CLK_EXTAL, 200, 3),
+ 	DEF_FIXED(".pll3_400", CLK_PLL3_400, CLK_PLL3, 1, 4),
+ 	DEF_FIXED(".pll3_533", CLK_PLL3_533, CLK_PLL3, 1, 3),
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch b/queue-5.16/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
new file mode 100644
index 00000000000..f3b21788a3a
--- /dev/null
+++ b/queue-5.16/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
@@ -0,0 +1,39 @@
+From 494524ef475e5c3080216cfa85f4d1b1e47bdcb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 10:45:01 +0000
+Subject: clk: tegra: tegra124-emc: Fix missing put_device() call in
+ emc_ensure_emc_driver
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6d6ef58c2470da85a99119f74d34216c8074b9f0 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling path.
+
+Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20220112104501.30655-1-linmq006@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra124-emc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
+index 74c1d894cca8..219c80653dbd 100644
+--- a/drivers/clk/tegra/clk-tegra124-emc.c
++++ b/drivers/clk/tegra/clk-tegra124-emc.c
+@@ -198,6 +198,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra)
+ 
+ 	tegra->emc = platform_get_drvdata(pdev);
+ 	if (!tegra->emc) {
++		put_device(&pdev->dev);
+ 		pr_err("%s: cannot find EMC driver\n", __func__);
+ 		return NULL;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch b/queue-5.16/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
new file mode 100644
index 00000000000..d385ef19db3
--- /dev/null
+++ b/queue-5.16/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
@@ -0,0 +1,50 @@
+From 5bea63aae5e730a09ccc438bd4de184560d34377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 08:39:39 -0700
+Subject: clocksource: acpi_pm: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6a861abceecb68497dd82a324fee45a5332dcece ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) environment strings.
+
+The __setup() handler interface isn't meant to handle negative return
+values -- they are non-zero, so they mean "handled" (like a return
+value of 1 does), but that's just a quirk. So return 1 from
+parse_pmtmr(). Also print a warning message if kstrtouint() returns
+an error.
+
+Fixes: 6b148507d3d0 ("pmtmr: allow command line override of ioport")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/acpi_pm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
+index eb596ff9e7bb..279ddff81ab4 100644
+--- a/drivers/clocksource/acpi_pm.c
++++ b/drivers/clocksource/acpi_pm.c
+@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg)
+ 	int ret;
+ 
+ 	ret = kstrtouint(arg, 16, &base);
+-	if (ret)
+-		return ret;
++	if (ret) {
++		pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg);
++		return 1;
++	}
+ 
+ 	pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport,
+ 		base);
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch b/queue-5.16/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch
new file mode 100644
index 00000000000..9625cdef6b7
--- /dev/null
+++ b/queue-5.16/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch
@@ -0,0 +1,65 @@
+From d15f2c053fec108b2f880def8d5cfcb7e5d538e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 11:38:15 +0100
+Subject: clocksource/drivers/exynos_mct: Handle DTS with higher number of
+ interrupts
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit ab8da93dc06d82f464c47ab30e6c75190702f369 ]
+
+The driver statically defines maximum number of interrupts it can
+handle, however it does not respect that limit when configuring them.
+When provided with a DTS with more interrupts than assumed, the driver
+will overwrite static array mct_irqs leading to silent memory
+corruption.
+
+Validate the interrupts coming from DTS to avoid this.  This does not
+change the fact that such DTS might not boot at all, because it is
+simply incompatible, however at least some warning will be printed.
+
+Fixes: 36ba5d527e95 ("ARM: EXYNOS: add device tree support for MCT controller driver")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Link: https://lore.kernel.org/r/20220220103815.135380-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 857cf12ebe57..cc2a961ddd3b 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -541,6 +541,11 @@ static int __init exynos4_timer_interrupts(struct device_node *np,
+ 	 * irqs are specified.
+ 	 */
+ 	nr_irqs = of_irq_count(np);
++	if (nr_irqs > ARRAY_SIZE(mct_irqs)) {
++		pr_err("exynos-mct: too many (%d) interrupts configured in DT\n",
++			nr_irqs);
++		nr_irqs = ARRAY_SIZE(mct_irqs);
++	}
+ 	for (i = MCT_L0_IRQ; i < nr_irqs; i++)
+ 		mct_irqs[i] = irq_of_parse_and_map(np, i);
+ 
+@@ -553,11 +558,14 @@ static int __init exynos4_timer_interrupts(struct device_node *np,
+ 		     mct_irqs[MCT_L0_IRQ], err);
+ 	} else {
+ 		for_each_possible_cpu(cpu) {
+-			int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
++			int mct_irq;
+ 			struct mct_clock_event_device *pcpu_mevt =
+ 				per_cpu_ptr(&percpu_mct_tick, cpu);
+ 
+ 			pcpu_mevt->evt.irq = -1;
++			if (MCT_L0_IRQ + cpu >= ARRAY_SIZE(mct_irqs))
++				break;
++			mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
+ 
+ 			irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
+ 			if (request_irq(mct_irq,
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-drivers-exynos_mct-refactor-resources-al.patch b/queue-5.16/clocksource-drivers-exynos_mct-refactor-resources-al.patch
new file mode 100644
index 00000000000..b20575f8ce3
--- /dev/null
+++ b/queue-5.16/clocksource-drivers-exynos_mct-refactor-resources-al.patch
@@ -0,0 +1,111 @@
+From 70557733431fd405a93969a6c15bbbe047186370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Nov 2021 21:35:30 +0200
+Subject: clocksource/drivers/exynos_mct: Refactor resources allocation
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 7cd925a8823d16de5614d3f0aabea9948747accd ]
+
+Move interrupts allocation from exynos4_timer_resources() into separate
+function together with the interrupt number parsing code from
+mct_init_dt(), so the code for managing interrupts is kept together.
+While touching exynos4_timer_resources() function, move of_iomap() to it.
+No functional changes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Tested-by: Chanwoo Choi <cw00.choi@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20211101193531.15078-2-semen.protsenko@linaro.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 50 +++++++++++++++++++-------------
+ 1 file changed, 30 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 5e3e96d3d1b9..857cf12ebe57 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -504,11 +504,14 @@ static int exynos4_mct_dying_cpu(unsigned int cpu)
+ 	return 0;
+ }
+ 
+-static int __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
++static int __init exynos4_timer_resources(struct device_node *np)
+ {
+-	int err, cpu;
+ 	struct clk *mct_clk, *tick_clk;
+ 
++	reg_base = of_iomap(np, 0);
++	if (!reg_base)
++		panic("%s: unable to ioremap mct address space\n", __func__);
++
+ 	tick_clk = of_clk_get_by_name(np, "fin_pll");
+ 	if (IS_ERR(tick_clk))
+ 		panic("%s: unable to determine tick clock rate\n", __func__);
+@@ -519,9 +522,27 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ 		panic("%s: unable to retrieve mct clock instance\n", __func__);
+ 	clk_prepare_enable(mct_clk);
+ 
+-	reg_base = base;
+-	if (!reg_base)
+-		panic("%s: unable to ioremap mct address space\n", __func__);
++	return 0;
++}
++
++static int __init exynos4_timer_interrupts(struct device_node *np,
++					   unsigned int int_type)
++{
++	int nr_irqs, i, err, cpu;
++
++	mct_int_type = int_type;
++
++	/* This driver uses only one global timer interrupt */
++	mct_irqs[MCT_G0_IRQ] = irq_of_parse_and_map(np, MCT_G0_IRQ);
++
++	/*
++	 * Find out the number of local irqs specified. The local
++	 * timer irqs are specified after the four global timer
++	 * irqs are specified.
++	 */
++	nr_irqs = of_irq_count(np);
++	for (i = MCT_L0_IRQ; i < nr_irqs; i++)
++		mct_irqs[i] = irq_of_parse_and_map(np, i);
+ 
+ 	if (mct_int_type == MCT_INT_PPI) {
+ 
+@@ -581,24 +602,13 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ 
+ static int __init mct_init_dt(struct device_node *np, unsigned int int_type)
+ {
+-	u32 nr_irqs, i;
+ 	int ret;
+ 
+-	mct_int_type = int_type;
+-
+-	/* This driver uses only one global timer interrupt */
+-	mct_irqs[MCT_G0_IRQ] = irq_of_parse_and_map(np, MCT_G0_IRQ);
+-
+-	/*
+-	 * Find out the number of local irqs specified. The local
+-	 * timer irqs are specified after the four global timer
+-	 * irqs are specified.
+-	 */
+-	nr_irqs = of_irq_count(np);
+-	for (i = MCT_L0_IRQ; i < nr_irqs; i++)
+-		mct_irqs[i] = irq_of_parse_and_map(np, i);
++	ret = exynos4_timer_resources(np);
++	if (ret)
++		return ret;
+ 
+-	ret = exynos4_timer_resources(np, of_iomap(np, 0));
++	ret = exynos4_timer_interrupts(np, int_type);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-drivers-timer-microchip-pit64b-use-notra.patch b/queue-5.16/clocksource-drivers-timer-microchip-pit64b-use-notra.patch
new file mode 100644
index 00000000000..02f8a529be7
--- /dev/null
+++ b/queue-5.16/clocksource-drivers-timer-microchip-pit64b-use-notra.patch
@@ -0,0 +1,38 @@
+From 4728a0bb954bafff75131b8fd74bc61e03611885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 15:35:57 +0200
+Subject: clocksource/drivers/timer-microchip-pit64b: Use notrace
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit ff10ee97cb203262e88d9c8bc87369cbd4004a0c ]
+
+Use notrace for mchp_pit64b_sched_read_clk() to avoid recursive call of
+prepare_ftrace_return() when issuing:
+echo function_graph > /sys/kernel/debug/tracing/current_tracer
+
+Fixes: 625022a5f160 ("clocksource/drivers/timer-microchip-pit64b: Add Microchip PIT64B support")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20220304133601.2404086-3-claudiu.beznea@microchip.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-microchip-pit64b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-microchip-pit64b.c b/drivers/clocksource/timer-microchip-pit64b.c
+index cfa4ec7ef396..790d2c9b42a7 100644
+--- a/drivers/clocksource/timer-microchip-pit64b.c
++++ b/drivers/clocksource/timer-microchip-pit64b.c
+@@ -165,7 +165,7 @@ static u64 mchp_pit64b_clksrc_read(struct clocksource *cs)
+ 	return mchp_pit64b_cnt_read(mchp_pit64b_cs_base);
+ }
+ 
+-static u64 mchp_pit64b_sched_read_clk(void)
++static u64 notrace mchp_pit64b_sched_read_clk(void)
+ {
+ 	return mchp_pit64b_cnt_read(mchp_pit64b_cs_base);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-drivers-timer-of-check-return-value-of-o.patch b/queue-5.16/clocksource-drivers-timer-of-check-return-value-of-o.patch
new file mode 100644
index 00000000000..d3d33605ced
--- /dev/null
+++ b/queue-5.16/clocksource-drivers-timer-of-check-return-value-of-o.patch
@@ -0,0 +1,45 @@
+From 0fd37c9079426cdc5ec9057b1a38dfd7fe52badb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 18:26:56 +0100
+Subject: clocksource/drivers/timer-of: Check return value of of_iomap in
+ timer_of_base_init()
+
+From: Guillaume Ranquet <granquet@baylibre.com>
+
+[ Upstream commit 4467b8bad2401794fb89a0268c8c8257180bf60f ]
+
+of_base->base can either be iomapped using of_io_request_and_map() or
+of_iomap() depending whether or not an of_base->name has been set.
+
+Thus check of_base->base against NULL as of_iomap() does not return a
+PTR_ERR() in case of error.
+
+Fixes: 9aea417afa6b ("clocksource/drivers/timer-of: Don't request the resource by name")
+Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>
+Link: https://lore.kernel.org/r/20220307172656.4836-1-granquet@baylibre.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-of.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
+index 529cc6a51cdb..c3f54d9912be 100644
+--- a/drivers/clocksource/timer-of.c
++++ b/drivers/clocksource/timer-of.c
+@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np,
+ 	of_base->base = of_base->name ?
+ 		of_io_request_and_map(np, of_base->index, of_base->name) :
+ 		of_iomap(np, of_base->index);
+-	if (IS_ERR(of_base->base)) {
+-		pr_err("Failed to iomap (%s)\n", of_base->name);
+-		return PTR_ERR(of_base->base);
++	if (IS_ERR_OR_NULL(of_base->base)) {
++		pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name);
++		return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM;
+ 	}
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch b/queue-5.16/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch
new file mode 100644
index 00000000000..90af6ed94c9
--- /dev/null
+++ b/queue-5.16/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch
@@ -0,0 +1,133 @@
+From 1153055ac13ecc96852ac50d1ab9f6526b7bdb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 21:35:05 -0800
+Subject: clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix
+
+From: Drew Fustini <dfustini@baylibre.com>
+
+[ Upstream commit bceaae3bac0ce27c549bb050336d8d08abc2ee54 ]
+
+The existing fix for errata i940 causes a conflict for IPU2 which is
+using timer 3 and 4. From arch/arm/boot/dts/dra7-ipu-dsp-common.dtsi:
+
+  &ipu2 {
+          mboxes = <&mailbox6 &mbox_ipu2_ipc3x>;
+          ti,timers = <&timer3>;
+          ti,watchdog-timers = <&timer4>, <&timer9>;
+  };
+
+The conflict was noticed when booting mainline on the BeagleBoard X15
+which has a TI AM5728 SoC:
+
+  remoteproc remoteproc1: 55020000.ipu is available
+  remoteproc remoteproc1: powering up 55020000.ipu
+  remoteproc remoteproc1: Booting fw image dra7-ipu2-fw.xem4
+  omap-rproc 55020000.ipu: could not get timer platform device
+  omap-rproc 55020000.ipu: omap_rproc_enable_timers failed: -19
+  remoteproc remoteproc1: can't start rproc 55020000.ipu: -19
+
+This change modifies the errata fix to instead use timer 15 and 16 which
+resolves the timer conflict.
+
+It does not appear to introduce any latency regression. Results from
+cyclictest with original errata fix using dmtimer 3 and 4:
+
+  # cyclictest --mlockall --smp --priority=80 --interval=200 --distance=0
+  policy: fifo: loadavg: 0.02 0.03 0.05
+
+  T: 0 ( 1449) P:80 I:200 C: 800368 Min:   0 Act:   32 Avg:   22 Max:  128
+  T: 1 ( 1450) P:80 I:200 C: 800301 Min:   0 Act:   12 Avg:   23 Max:   70
+
+The results after the change to dmtimer 15 and 16:
+
+  # cyclictest --mlockall --smp --priority=80 --interval=200 --distance=0
+  policy: fifo: loadavg: 0.36 0.19 0.07
+
+  T: 0 ( 1711) P:80 I:200 C: 759599 Min:   0 Act:    6 Avg:   22 Max:  108
+  T: 1 ( 1712) P:80 I:200 C: 759539 Min:   0 Act:   19 Avg:   23 Max:   79
+
+Fixes: 25de4ce5ed02 ("clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940")
+Link: https://lore.kernel.org/linux-omap/YfWsG0p6to3IJuvE@x1/
+Suggested-by: Suman Anna <s-anna@ti.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Drew Fustini <dfustini@baylibre.com>
+Link: https://lore.kernel.org/r/20220204053503.1409162-1-dfustini@baylibre.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dra7-l4.dtsi             | 5 ++---
+ arch/arm/boot/dts/dra7.dtsi                | 8 ++++----
+ drivers/clocksource/timer-ti-dm-systimer.c | 4 ++--
+ 3 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
+index 956a26d52a4c..0a11bacffc1f 100644
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -3482,8 +3482,7 @@
+ 				ti,timer-pwm;
+ 			};
+ 		};
+-
+-		target-module@2c000 {			/* 0x4882c000, ap 17 02.0 */
++		timer15_target: target-module@2c000 {	/* 0x4882c000, ap 17 02.0 */
+ 			compatible = "ti,sysc-omap4-timer", "ti,sysc";
+ 			reg = <0x2c000 0x4>,
+ 			      <0x2c010 0x4>;
+@@ -3511,7 +3510,7 @@
+ 			};
+ 		};
+ 
+-		target-module@2e000 {			/* 0x4882e000, ap 19 14.0 */
++		timer16_target: target-module@2e000 {	/* 0x4882e000, ap 19 14.0 */
+ 			compatible = "ti,sysc-omap4-timer", "ti,sysc";
+ 			reg = <0x2e000 0x4>,
+ 			      <0x2e010 0x4>;
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 6b485cbed8d5..8f7ffe2f66e9 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -1339,20 +1339,20 @@
+ };
+ 
+ /* Local timers, see ARM architected timer wrap erratum i940 */
+-&timer3_target {
++&timer15_target {
+ 	ti,no-reset-on-init;
+ 	ti,no-idle;
+ 	timer@0 {
+-		assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER3_CLKCTRL 24>;
++		assigned-clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>;
+ 		assigned-clock-parents = <&timer_sys_clk_div>;
+ 	};
+ };
+ 
+-&timer4_target {
++&timer16_target {
+ 	ti,no-reset-on-init;
+ 	ti,no-idle;
+ 	timer@0 {
+-		assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER4_CLKCTRL 24>;
++		assigned-clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>;
+ 		assigned-clock-parents = <&timer_sys_clk_div>;
+ 	};
+ };
+diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c
+index 1fccb457fcc5..2737407ff069 100644
+--- a/drivers/clocksource/timer-ti-dm-systimer.c
++++ b/drivers/clocksource/timer-ti-dm-systimer.c
+@@ -694,9 +694,9 @@ static int __init dmtimer_percpu_quirk_init(struct device_node *np, u32 pa)
+ 		return 0;
+ 	}
+ 
+-	if (pa == 0x48034000)		/* dra7 dmtimer3 */
++	if (pa == 0x4882c000)           /* dra7 dmtimer15 */
+ 		return dmtimer_percpu_timer_init(np, 0);
+-	else if (pa == 0x48036000)	/* dra7 dmtimer4 */
++	else if (pa == 0x4882e000)      /* dra7 dmtimer16 */
+ 		return dmtimer_percpu_timer_init(np, 1);
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch b/queue-5.16/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch
new file mode 100644
index 00000000000..734076197dd
--- /dev/null
+++ b/queue-5.16/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch
@@ -0,0 +1,38 @@
+From ef10a13eb6f10c6c45ac4e430d9de566cd224a35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jan 2022 12:45:35 +0100
+Subject: cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit 4a8a77abf0e2b6468ba0281e33384cbec5fb476a ]
+
+The fuse consists of 64 bits, with this statement we're supposed to get
+the upper 32 bits but it actually read out of bounds and got 0 instead
+of the desired value which lead to the "PVS bin not set." codepath being
+run resetting our pvs value.
+
+Fixes: a8811ec764f9 ("cpufreq: qcom: Add support for krait based socs")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+index d1744b5d9619..6dfa86971a75 100644
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -130,7 +130,7 @@ static void get_krait_bin_format_b(struct device *cpu_dev,
+ 	}
+ 
+ 	/* Check PVS_BLOW_STATUS */
+-	pte_efuse = *(((u32 *)buf) + 4);
++	pte_efuse = *(((u32 *)buf) + 1);
+ 	pte_efuse &= BIT(21);
+ 	if (pte_efuse) {
+ 		dev_dbg(cpu_dev, "PVS bin: %d\n", *pvs);
+-- 
+2.34.1
+
diff --git a/queue-5.16/cpuidle-qcom-spm-check-if-any-cpu-is-managed-by-spm.patch b/queue-5.16/cpuidle-qcom-spm-check-if-any-cpu-is-managed-by-spm.patch
new file mode 100644
index 00000000000..aa8850bf442
--- /dev/null
+++ b/queue-5.16/cpuidle-qcom-spm-check-if-any-cpu-is-managed-by-spm.patch
@@ -0,0 +1,78 @@
+From 285eb83dfe7bb0f783424e7bec42f9e409e58517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Dec 2021 14:05:02 +0100
+Subject: cpuidle: qcom-spm: Check if any CPU is managed by SPM
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 0ee30ace67e425ab83a1673bf51f50b577328cf9 ]
+
+At the moment, the "qcom-spm-cpuidle" platform device is always created,
+even if none of the CPUs is actually managed by the SPM. On non-qcom
+platforms this will result in infinite probe-deferral due to the
+failing qcom_scm_is_available() call.
+
+To avoid this, look through the CPU DT nodes and check if there is
+actually any CPU managed by a SPM (as indicated by the qcom,saw property).
+It should also be available because e.g. MSM8916 has qcom,saw defined
+but it's typically not enabled with ARM64/PSCI firmwares.
+
+This is needed in preparation of a follow-up change that calls
+qcom_scm_set_warm_boot_addr() a single time before registering any
+cpuidle drivers. Otherwise this call might be made even on devices
+that have this driver enabled but actually make use of PSCI.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/86e3e09f-a8d7-3dff-3fc6-ddd7d30c5d78@samsung.com/
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211201130505.257379-2-stephan@gerhold.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index 01e77913a414..5f27dcc6c110 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -155,6 +155,22 @@ static struct platform_driver spm_cpuidle_driver = {
+ 	},
+ };
+ 
++static bool __init qcom_spm_find_any_cpu(void)
++{
++	struct device_node *cpu_node, *saw_node;
++
++	for_each_of_cpu_node(cpu_node) {
++		saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++		if (of_device_is_available(saw_node)) {
++			of_node_put(saw_node);
++			of_node_put(cpu_node);
++			return true;
++		}
++		of_node_put(saw_node);
++	}
++	return false;
++}
++
+ static int __init qcom_spm_cpuidle_init(void)
+ {
+ 	struct platform_device *pdev;
+@@ -164,6 +180,10 @@ static int __init qcom_spm_cpuidle_init(void)
+ 	if (ret)
+ 		return ret;
+ 
++	/* Make sure there is actually any CPU managed by the SPM */
++	if (!qcom_spm_find_any_cpu())
++		return 0;
++
+ 	pdev = platform_device_register_simple("qcom-spm-cpuidle",
+ 					       -1, NULL, 0);
+ 	if (IS_ERR(pdev)) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-amlogic-call-finalize-with-bh-disabled.patch b/queue-5.16/crypto-amlogic-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..b828e99f38c
--- /dev/null
+++ b/queue-5.16/crypto-amlogic-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,37 @@
+From 033d1c4b97d7379073859457cba7c275972268da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 12:08:31 +0000
+Subject: crypto: amlogic - call finalize with bh disabled
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit dba633342994ce47d347bcf5522ba28301247b79 ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to not disabling BH during crypto completion function.
+
+Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/amlogic/amlogic-gxl-cipher.c b/drivers/crypto/amlogic/amlogic-gxl-cipher.c
+index c6865cbd334b..e79514fce731 100644
+--- a/drivers/crypto/amlogic/amlogic-gxl-cipher.c
++++ b/drivers/crypto/amlogic/amlogic-gxl-cipher.c
+@@ -265,7 +265,9 @@ static int meson_handle_cipher_request(struct crypto_engine *engine,
+ 	struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);
+ 
+ 	err = meson_cipher(breq);
++	local_bh_disable();
+ 	crypto_finalize_skcipher_request(engine, breq, err);
++	local_bh_enable();
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch b/queue-5.16/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
new file mode 100644
index 00000000000..0c747da157a
--- /dev/null
+++ b/queue-5.16/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
@@ -0,0 +1,42 @@
+From 9bc2331a84fa2bdc56e3cc1ad6f153d83b92cd94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 17:58:40 +1100
+Subject: crypto: authenc - Fix sleep in atomic context in decrypt_tail
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 66eae850333d639fc278d6f915c6fc01499ea893 ]
+
+The function crypto_authenc_decrypt_tail discards its flags
+argument and always relies on the flags from the original request
+when starting its sub-request.
+
+This is clearly wrong as it may cause the SLEEPABLE flag to be
+set when it shouldn't.
+
+Fixes: 92d95ba91772 ("crypto: authenc - Convert to new AEAD interface")
+Reported-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/authenc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 670bf1a01d00..17f674a7cdff 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -253,7 +253,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req,
+ 		dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
+ 
+ 	skcipher_request_set_tfm(skreq, ctx->enc);
+-	skcipher_request_set_callback(skreq, aead_request_flags(req),
++	skcipher_request_set_callback(skreq, flags,
+ 				      req->base.complete, req->base.data);
+ 	skcipher_request_set_crypt(skreq, src, dst,
+ 				   req->cryptlen - authsize, req->iv);
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch b/queue-5.16/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
new file mode 100644
index 00000000000..dc7e2647fd4
--- /dev/null
+++ b/queue-5.16/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
@@ -0,0 +1,69 @@
+From a8181d5304a0e9982908f84d64e3eb13d7c8a4a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 05:15:45 +0200
+Subject: crypto: ccp - ccp_dmaengine_unregister release dma channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dāvis Mosāns <davispuh@gmail.com>
+
+[ Upstream commit 54cce8ecb9254f971b40a72911c6da403720a2d2 ]
+
+ccp_dmaengine_register adds dma_chan->device_node to dma_dev->channels list
+but ccp_dmaengine_unregister didn't remove them.
+That can cause crashes in various dmaengine methods that tries to use dma_dev->channels
+
+Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA...")
+Signed-off-by: Dāvis Mosāns <davispuh@gmail.com>
+Acked-by: John Allen <john.allen@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-dmaengine.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index d718db224be4..7d4b4ad1db1f 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -632,6 +632,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ 	return 0;
+ }
+ 
++static void ccp_dma_release(struct ccp_device *ccp)
++{
++	struct ccp_dma_chan *chan;
++	struct dma_chan *dma_chan;
++	unsigned int i;
++
++	for (i = 0; i < ccp->cmd_q_count; i++) {
++		chan = ccp->ccp_dma_chan + i;
++		dma_chan = &chan->dma_chan;
++		tasklet_kill(&chan->cleanup_tasklet);
++		list_del_rcu(&dma_chan->device_node);
++	}
++}
++
+ int ccp_dmaengine_register(struct ccp_device *ccp)
+ {
+ 	struct ccp_dma_chan *chan;
+@@ -736,6 +750,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ 	return 0;
+ 
+ err_reg:
++	ccp_dma_release(ccp);
+ 	kmem_cache_destroy(ccp->dma_desc_cache);
+ 
+ err_cache:
+@@ -752,6 +767,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)
+ 		return;
+ 
+ 	dma_async_device_unregister(dma_dev);
++	ccp_dma_release(ccp);
+ 
+ 	kmem_cache_destroy(ccp->dma_desc_cache);
+ 	kmem_cache_destroy(ccp->dma_cmd_cache);
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-ccp-ensure-psp_ret-is-always-init-d-in-__sev_.patch b/queue-5.16/crypto-ccp-ensure-psp_ret-is-always-init-d-in-__sev_.patch
new file mode 100644
index 00000000000..8258fb577ff
--- /dev/null
+++ b/queue-5.16/crypto-ccp-ensure-psp_ret-is-always-init-d-in-__sev_.patch
@@ -0,0 +1,48 @@
+From 197ac37eab826478a996498ac26d7c12740bc80f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 13:18:37 -0800
+Subject: crypto: ccp - Ensure psp_ret is always init'd in
+ __sev_platform_init_locked()
+
+From: Peter Gonda <pgonda@google.com>
+
+[ Upstream commit 1e1ec11d3ec3134e05d4710f4dee5f9bd05e828d ]
+
+Initialize psp_ret inside of __sev_platform_init_locked() because there
+are many failure paths with PSP initialization that do not set
+__sev_do_cmd_locked().
+
+Fixes: e423b9d75e77: ("crypto: ccp - Move SEV_INIT retry for corrupted data")
+
+Signed-off-by: Peter Gonda <pgonda@google.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Brijesh Singh <brijesh.singh@amd.com>
+Cc: Marc Orr <marcorr@google.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: John Allen <john.allen@amd.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 581a1b13d5c3..de015995189f 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -241,7 +241,7 @@ static int __sev_platform_init_locked(int *error)
+ 	struct psp_device *psp = psp_master;
+ 	struct sev_data_init data;
+ 	struct sev_device *sev;
+-	int psp_ret, rc = 0;
++	int psp_ret = -1, rc = 0;
+ 
+ 	if (!psp || !psp->sev_data)
+ 		return -ENODEV;
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch b/queue-5.16/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
new file mode 100644
index 00000000000..9d0cde12a73
--- /dev/null
+++ b/queue-5.16/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
@@ -0,0 +1,45 @@
+From 39bdc79409c8e2b49274d20bf9d4273b5b214c12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 21:27:26 +0200
+Subject: crypto: ccree - don't attempt 0 len DMA mappings
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+[ Upstream commit 1fb37b5692c915edcc2448a6b37255738c7c77e0 ]
+
+Refuse to try mapping zero bytes as this may cause a fault
+on some configurations / platforms and it seems the prev.
+attempt is not enough and we need to be more explicit.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Reported-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Fixes: ce0fc6db38de ("crypto: ccree - protect against empty or NULL
+scatterlists")
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_buffer_mgr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
+index a5e041d9d2cf..11e0278c8631 100644
+--- a/drivers/crypto/ccree/cc_buffer_mgr.c
++++ b/drivers/crypto/ccree/cc_buffer_mgr.c
+@@ -258,6 +258,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg,
+ {
+ 	int ret = 0;
+ 
++	if (!nbytes) {
++		*mapped_nents = 0;
++		*lbytes = 0;
++		*nents = 0;
++		return 0;
++	}
++
+ 	*nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes);
+ 	if (*nents > max_sg_nents) {
+ 		*nents = 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch b/queue-5.16/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch
new file mode 100644
index 00000000000..6c8c0749aa9
--- /dev/null
+++ b/queue-5.16/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch
@@ -0,0 +1,40 @@
+From 7a9f4f0760751928d7de654cd77ff90b7ca4a53f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 10:23:37 +0800
+Subject: crypto: ccree - Fix use after free in cc_cipher_exit()
+
+From: Jianglei Nie <niejianglei2021@163.com>
+
+[ Upstream commit 3d950c34074ed74d2713c3856ba01264523289e6 ]
+
+kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But
+ctx_p->user.key is still used in the next line, which will lead to a
+use after free.
+
+We can call kfree_sensitive() after dev_dbg() to avoid the uaf.
+
+Fixes: 63ee04c8b491 ("crypto: ccree - add skcipher support")
+Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_cipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 78833491f534..309da6334a0a 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -257,8 +257,8 @@ static void cc_cipher_exit(struct crypto_tfm *tfm)
+ 		&ctx_p->user.key_dma_addr);
+ 
+ 	/* Free key buffer in context */
+-	kfree_sensitive(ctx_p->user.key);
+ 	dev_dbg(dev, "Free key buffer in context. key=@%p\n", ctx_p->user.key);
++	kfree_sensitive(ctx_p->user.key);
+ }
+ 
+ struct tdes_keys {
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-gemini-call-finalize-with-bh-disabled.patch b/queue-5.16/crypto-gemini-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..74a028f6a5e
--- /dev/null
+++ b/queue-5.16/crypto-gemini-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,37 @@
+From 4a0906ca9a1b7862919a96d5b226913e019101ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 12:08:32 +0000
+Subject: crypto: gemini - call finalize with bh disabled
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 7f22421103c5a7f9a1726f0ed125274c38174ddb ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to not disabling BH during crypto completion function.
+
+Fixes: 46c5338db7bd45b2 ("crypto: sl3516 - Add sl3516 crypto engine")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/gemini/sl3516-ce-cipher.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/gemini/sl3516-ce-cipher.c b/drivers/crypto/gemini/sl3516-ce-cipher.c
+index c1c2b1d86663..f2be0a7d7f7a 100644
+--- a/drivers/crypto/gemini/sl3516-ce-cipher.c
++++ b/drivers/crypto/gemini/sl3516-ce-cipher.c
+@@ -264,7 +264,9 @@ static int sl3516_ce_handle_cipher_request(struct crypto_engine *engine, void *a
+ 	struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);
+ 
+ 	err = sl3516_ce_cipher(breq);
++	local_bh_disable();
+ 	crypto_finalize_skcipher_request(engine, breq, err);
++	local_bh_enable();
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-hisilicon-qm-cleanup-warning-in-qm_vf_read_qo.patch b/queue-5.16/crypto-hisilicon-qm-cleanup-warning-in-qm_vf_read_qo.patch
new file mode 100644
index 00000000000..161a41946a7
--- /dev/null
+++ b/queue-5.16/crypto-hisilicon-qm-cleanup-warning-in-qm_vf_read_qo.patch
@@ -0,0 +1,36 @@
+From 3bb11e9b3507248eca3191dcd7ac3a0a51158a77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 17:30:42 +0800
+Subject: crypto: hisilicon/qm - cleanup warning in qm_vf_read_qos
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit 05b3bade290d6c940701f97f3233c07cfe27205d ]
+
+The kernel test rebot report this warning: Uninitialized variable: ret.
+The code flow may return value of ret directly. This value is an
+uninitialized variable, here is fix it.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 1dc6a27ba0e0..82d2b117e162 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4145,7 +4145,7 @@ static void qm_vf_get_qos(struct hisi_qm *qm, u32 fun_num)
+ static int qm_vf_read_qos(struct hisi_qm *qm)
+ {
+ 	int cnt = 0;
+-	int ret;
++	int ret = -EINVAL;
+ 
+ 	/* reset mailbox qos val */
+ 	qm->mb_qos = 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-hisilicon-sec-fix-the-aead-software-fallback-.patch b/queue-5.16/crypto-hisilicon-sec-fix-the-aead-software-fallback-.patch
new file mode 100644
index 00000000000..d29aa4dbaa2
--- /dev/null
+++ b/queue-5.16/crypto-hisilicon-sec-fix-the-aead-software-fallback-.patch
@@ -0,0 +1,67 @@
+From 10db3603ac9f6f2f84bfd36f9778d97ab8382b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Feb 2022 16:08:08 +0800
+Subject: crypto: hisilicon/sec - fix the aead software fallback for engine
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit 0a2a464f863187f97e96ebc6384c052cafd4a54c ]
+
+Due to the subreq pointer misuse the private context memory. The aead
+soft crypto occasionally casues the OS panic as setting the 64K page.
+Here is fix it.
+
+Fixes: 6c46a3297bea ("crypto: hisilicon/sec - add fallback tfm...")
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 6a45bd23b363..090920ed50c8 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -2284,9 +2284,10 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx,
+ 				struct aead_request *aead_req,
+ 				bool encrypt)
+ {
+-	struct aead_request *subreq = aead_request_ctx(aead_req);
+ 	struct sec_auth_ctx *a_ctx = &ctx->a_ctx;
+ 	struct device *dev = ctx->dev;
++	struct aead_request *subreq;
++	int ret;
+ 
+ 	/* Kunpeng920 aead mode not support input 0 size */
+ 	if (!a_ctx->fallback_aead_tfm) {
+@@ -2294,6 +2295,10 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx,
+ 		return -EINVAL;
+ 	}
+ 
++	subreq = aead_request_alloc(a_ctx->fallback_aead_tfm, GFP_KERNEL);
++	if (!subreq)
++		return -ENOMEM;
++
+ 	aead_request_set_tfm(subreq, a_ctx->fallback_aead_tfm);
+ 	aead_request_set_callback(subreq, aead_req->base.flags,
+ 				  aead_req->base.complete, aead_req->base.data);
+@@ -2301,8 +2306,13 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx,
+ 			       aead_req->cryptlen, aead_req->iv);
+ 	aead_request_set_ad(subreq, aead_req->assoclen);
+ 
+-	return encrypt ? crypto_aead_encrypt(subreq) :
+-		   crypto_aead_decrypt(subreq);
++	if (encrypt)
++		ret = crypto_aead_encrypt(subreq);
++	else
++		ret = crypto_aead_decrypt(subreq);
++	aead_request_free(subreq);
++
++	return ret;
+ }
+ 
+ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt)
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-hisilicon-sec-not-need-to-enable-sm4-extra-mo.patch b/queue-5.16/crypto-hisilicon-sec-not-need-to-enable-sm4-extra-mo.patch
new file mode 100644
index 00000000000..1d822cf28cd
--- /dev/null
+++ b/queue-5.16/crypto-hisilicon-sec-not-need-to-enable-sm4-extra-mo.patch
@@ -0,0 +1,40 @@
+From 4b7ba81957e9b0beee58d4891d939aff283906c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 17:08:18 +0800
+Subject: crypto: hisilicon/sec - not need to enable sm4 extra mode at HW V3
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit f8a2652826444d13181061840b96a5d975d5b6c6 ]
+
+It is not need to enable sm4 extra mode in at HW V3. Here is fix it.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_main.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 90551bf38b52..03d239cfdf8c 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -443,9 +443,11 @@ static int sec_engine_init(struct hisi_qm *qm)
+ 
+ 	writel(SEC_SAA_ENABLE, qm->io_base + SEC_SAA_EN_REG);
+ 
+-	/* Enable sm4 extra mode, as ctr/ecb */
+-	writel_relaxed(SEC_BD_ERR_CHK_EN0,
+-		       qm->io_base + SEC_BD_ERR_CHK_EN_REG0);
++	/* HW V2 enable sm4 extra mode, as ctr/ecb */
++	if (qm->ver < QM_HW_V3)
++		writel_relaxed(SEC_BD_ERR_CHK_EN0,
++			       qm->io_base + SEC_BD_ERR_CHK_EN_REG0);
++
+ 	/* Enable sm4 xts mode multiple iv */
+ 	writel_relaxed(SEC_BD_ERR_CHK_EN1,
+ 		       qm->io_base + SEC_BD_ERR_CHK_EN_REG1);
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-mxs-dcp-fix-scatterlist-processing.patch b/queue-5.16/crypto-mxs-dcp-fix-scatterlist-processing.patch
new file mode 100644
index 00000000000..2b6c0a87deb
--- /dev/null
+++ b/queue-5.16/crypto-mxs-dcp-fix-scatterlist-processing.patch
@@ -0,0 +1,35 @@
+From d4e02e5cce9db28ce1cd5b68989a46ba1ca6bafb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 18:07:53 +0100
+Subject: crypto: mxs-dcp - Fix scatterlist processing
+
+From: Tomas Paukrt <tomaspaukrt@email.cz>
+
+[ Upstream commit 28e9b6d8199a3f124682b143800c2dacdc3d70dd ]
+
+This patch fixes a bug in scatterlist processing that may cause incorrect AES block encryption/decryption.
+
+Fixes: 2e6d793e1bf0 ("crypto: mxs-dcp - Use sg_mapping_iter to copy data")
+Signed-off-by: Tomas Paukrt <tomaspaukrt@email.cz>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index d19e5ffb5104..d6f9e2fe863d 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -331,7 +331,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ 		memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
+ 	}
+ 
+-	for_each_sg(req->src, src, sg_nents(src), i) {
++	for_each_sg(req->src, src, sg_nents(req->src), i) {
+ 		src_buf = sg_virt(src);
+ 		len = sg_dma_len(src);
+ 		tlen += len;
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-octeontx2-remove-config_dm_crypt-check.patch b/queue-5.16/crypto-octeontx2-remove-config_dm_crypt-check.patch
new file mode 100644
index 00000000000..a415add161f
--- /dev/null
+++ b/queue-5.16/crypto-octeontx2-remove-config_dm_crypt-check.patch
@@ -0,0 +1,67 @@
+From 9f08d6296f5e4f60cbada363bc54b0af688d839e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 19:27:42 +0530
+Subject: crypto: octeontx2 - remove CONFIG_DM_CRYPT check
+
+From: Shijith Thotton <sthotton@marvell.com>
+
+[ Upstream commit 2d841af23ae8f398c85dd1ff2dc24b5ec8ba4569 ]
+
+No issues were found while using the driver with dm-crypt enabled. So
+CONFIG_DM_CRYPT check in the driver can be removed.
+
+This also fixes the NULL pointer dereference in driver release if
+CONFIG_DM_CRYPT is enabled.
+
+...
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+...
+Call trace:
+ crypto_unregister_alg+0x68/0xfc
+ crypto_unregister_skciphers+0x44/0x60
+ otx2_cpt_crypto_exit+0x100/0x1a0
+ otx2_cptvf_remove+0xf8/0x200
+ pci_device_remove+0x3c/0xd4
+ __device_release_driver+0x188/0x234
+ device_release_driver+0x2c/0x4c
+...
+
+Fixes: 6f03f0e8b6c8 ("crypto: octeontx2 - register with linux crypto framework")
+Signed-off-by: Shijith Thotton <sthotton@marvell.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/marvell/octeontx2/otx2_cptvf_algs.c  | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+index 877a948469bd..570074e23b60 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+@@ -1634,16 +1634,13 @@ static inline int cpt_register_algs(void)
+ {
+ 	int i, err = 0;
+ 
+-	if (!IS_ENABLED(CONFIG_DM_CRYPT)) {
+-		for (i = 0; i < ARRAY_SIZE(otx2_cpt_skciphers); i++)
+-			otx2_cpt_skciphers[i].base.cra_flags &=
+-							~CRYPTO_ALG_DEAD;
+-
+-		err = crypto_register_skciphers(otx2_cpt_skciphers,
+-						ARRAY_SIZE(otx2_cpt_skciphers));
+-		if (err)
+-			return err;
+-	}
++	for (i = 0; i < ARRAY_SIZE(otx2_cpt_skciphers); i++)
++		otx2_cpt_skciphers[i].base.cra_flags &= ~CRYPTO_ALG_DEAD;
++
++	err = crypto_register_skciphers(otx2_cpt_skciphers,
++					ARRAY_SIZE(otx2_cpt_skciphers));
++	if (err)
++		return err;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(otx2_cpt_aeads); i++)
+ 		otx2_cpt_aeads[i].base.cra_flags &= ~CRYPTO_ALG_DEAD;
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-rockchip-ecb-does-not-need-iv.patch b/queue-5.16/crypto-rockchip-ecb-does-not-need-iv.patch
new file mode 100644
index 00000000000..8d74f6a1b1a
--- /dev/null
+++ b/queue-5.16/crypto-rockchip-ecb-does-not-need-iv.patch
@@ -0,0 +1,36 @@
+From 13df83640d18afbc129e3fb7a3255ba9c92ee62a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 12:16:17 +0000
+Subject: crypto: rockchip - ECB does not need IV
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 973d74e93820d99d8ea203882631c76edab699c9 ]
+
+When loading rockchip crypto module, testmgr complains that ivsize of ecb-des3-ede-rk
+is not the same than generic implementation.
+In fact ECB does not use an IV.
+
+Fixes: ce0183cb6464b ("crypto: rockchip - switch to skcipher API")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/rockchip/rk3288_crypto_skcipher.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c b/drivers/crypto/rockchip/rk3288_crypto_skcipher.c
+index 1cece1a7d3f0..5bbf0d2722e1 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c
++++ b/drivers/crypto/rockchip/rk3288_crypto_skcipher.c
+@@ -506,7 +506,6 @@ struct rk_crypto_tmp rk_ecb_des3_ede_alg = {
+ 		.exit			= rk_ablk_exit_tfm,
+ 		.min_keysize		= DES3_EDE_KEY_SIZE,
+ 		.max_keysize		= DES3_EDE_KEY_SIZE,
+-		.ivsize			= DES_BLOCK_SIZE,
+ 		.setkey			= rk_tdes_setkey,
+ 		.encrypt		= rk_des3_ede_ecb_encrypt,
+ 		.decrypt		= rk_des3_ede_ecb_decrypt,
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch b/queue-5.16/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..be5afc9d13b
--- /dev/null
+++ b/queue-5.16/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,67 @@
+From 5821d33899e43a6017d4ff0423be15ce565830b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 12:08:30 +0000
+Subject: crypto: sun8i-ce - call finalize with bh disabled
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit f75a749b6d78aeae2ce90e14fcc4b7b3ba46126d ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to not disabling BH during crypto completion function.
+
+Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 +++
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c   | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+index 54ae8d16e493..35e3cadccac2 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+@@ -11,6 +11,7 @@
+  * You could find a link for the datasheet in Documentation/arm/sunxi.rst
+  */
+ 
++#include <linux/bottom_half.h>
+ #include <linux/crypto.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
+@@ -283,7 +284,9 @@ static int sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq)
+ 
+ 	flow = rctx->flow;
+ 	err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm));
++	local_bh_disable();
+ 	crypto_finalize_skcipher_request(engine, breq, err);
++	local_bh_enable();
+ 	return 0;
+ }
+ 
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+index 88194718a806..859b7522faaa 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+@@ -9,6 +9,7 @@
+  *
+  * You could find the datasheet in Documentation/arm/sunxi.rst
+  */
++#include <linux/bottom_half.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/scatterlist.h>
+@@ -414,6 +415,8 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ theend:
+ 	kfree(buf);
+ 	kfree(result);
++	local_bh_disable();
+ 	crypto_finalize_hash_request(engine, breq, err);
++	local_bh_enable();
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch b/queue-5.16/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..824367cb58a
--- /dev/null
+++ b/queue-5.16/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,67 @@
+From 18b7d6edad4f4aeaea335a2a270f7115627f856c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 12:08:29 +0000
+Subject: crypto: sun8i-ss - call finalize with bh disabled
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit b169b3766242b6f3336e24a6c8ee1522978b57a7 ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to not disabling BH during crypto completion function.
+
+Fixes: f08fcced6d00 ("crypto: allwinner - Add sun8i-ss cryptographic offloader")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 +++
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c   | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
+index 9ef1c85c4aaa..554e400d41ca 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
+@@ -11,6 +11,7 @@
+  * You could find a link for the datasheet in Documentation/arm/sunxi.rst
+  */
+ 
++#include <linux/bottom_half.h>
+ #include <linux/crypto.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
+@@ -274,7 +275,9 @@ static int sun8i_ss_handle_cipher_request(struct crypto_engine *engine, void *ar
+ 	struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);
+ 
+ 	err = sun8i_ss_cipher(breq);
++	local_bh_disable();
+ 	crypto_finalize_skcipher_request(engine, breq, err);
++	local_bh_enable();
+ 
+ 	return 0;
+ }
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+index 3c073eb3db03..1a71ed49d233 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+@@ -9,6 +9,7 @@
+  *
+  * You could find the datasheet in Documentation/arm/sunxi.rst
+  */
++#include <linux/bottom_half.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/scatterlist.h>
+@@ -442,6 +443,8 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
+ theend:
+ 	kfree(pad);
+ 	kfree(result);
++	local_bh_disable();
+ 	crypto_finalize_hash_request(engine, breq, err);
++	local_bh_enable();
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-sun8i-ss-really-disable-hash-on-a80.patch b/queue-5.16/crypto-sun8i-ss-really-disable-hash-on-a80.patch
new file mode 100644
index 00000000000..5710b82722c
--- /dev/null
+++ b/queue-5.16/crypto-sun8i-ss-really-disable-hash-on-a80.patch
@@ -0,0 +1,40 @@
+From af1fe1b1aa2abda7aa6ab5e3c836b09530750ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jan 2022 10:07:14 +0000
+Subject: crypto: sun8i-ss - really disable hash on A80
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 881fc7fba6c3e7d77d608b9a50b01a89d5e0c61b ]
+
+When adding hashes support to sun8i-ss, I have added them only on A83T.
+But I forgot that 0 is a valid algorithm ID, so hashes are enabled on A80 but
+with an incorrect ID.
+Anyway, even with correct IDs, hashes do not work on A80 and I cannot
+find why.
+So let's disable all of them on A80.
+
+Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c
+index 80e89066dbd1..319fe3279a71 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c
+@@ -30,6 +30,8 @@
+ static const struct ss_variant ss_a80_variant = {
+ 	.alg_cipher = { SS_ALG_AES, SS_ALG_DES, SS_ALG_3DES,
+ 	},
++	.alg_hash = { SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUPP,
++	},
+ 	.op_mode = { SS_OP_ECB, SS_OP_CBC,
+ 	},
+ 	.ss_clks = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-vmx-add-missing-dependencies.patch b/queue-5.16/crypto-vmx-add-missing-dependencies.patch
new file mode 100644
index 00000000000..5502f63443e
--- /dev/null
+++ b/queue-5.16/crypto-vmx-add-missing-dependencies.patch
@@ -0,0 +1,62 @@
+From b9a7d81febac989e79c2b7afd2e3d17dce33553d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 16:11:15 +0100
+Subject: crypto: vmx - add missing dependencies
+
+From: Petr Vorel <pvorel@suse.cz>
+
+[ Upstream commit 647d41d3952d726d4ae49e853a9eff68ebad3b3f ]
+
+vmx-crypto module depends on CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or
+CRYPTO_XTS, thus add them.
+
+These dependencies are likely to be enabled, but if
+CRYPTO_DEV_VMX=y && !CRYPTO_MANAGER_DISABLE_TESTS
+and either of CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or CRYPTO_XTS is built
+as module or disabled, alg_test() from crypto/testmgr.c complains during
+boot about failing to allocate the generic fallback implementations
+(2 == ENOENT):
+
+[    0.540953] Failed to allocate xts(aes) fallback: -2
+[    0.541014] alg: skcipher: failed to allocate transform for p8_aes_xts: -2
+[    0.541120] alg: self-tests for p8_aes_xts (xts(aes)) failed (rc=-2)
+[    0.544440] Failed to allocate ctr(aes) fallback: -2
+[    0.544497] alg: skcipher: failed to allocate transform for p8_aes_ctr: -2
+[    0.544603] alg: self-tests for p8_aes_ctr (ctr(aes)) failed (rc=-2)
+[    0.547992] Failed to allocate cbc(aes) fallback: -2
+[    0.548052] alg: skcipher: failed to allocate transform for p8_aes_cbc: -2
+[    0.548156] alg: self-tests for p8_aes_cbc (cbc(aes)) failed (rc=-2)
+[    0.550745] Failed to allocate transformation for 'aes': -2
+[    0.550801] alg: cipher: Failed to load transform for p8_aes: -2
+[    0.550892] alg: self-tests for p8_aes (aes) failed (rc=-2)
+
+Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS")
+Fixes: d2e3ae6f3aba ("crypto: vmx - Enabling VMX module for PPC64")
+
+Suggested-by: Nicolai Stange <nstange@suse.de>
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/vmx/Kconfig | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig
+index c85fab7ef0bd..b2c28b87f14b 100644
+--- a/drivers/crypto/vmx/Kconfig
++++ b/drivers/crypto/vmx/Kconfig
+@@ -2,7 +2,11 @@
+ config CRYPTO_DEV_VMX_ENCRYPT
+ 	tristate "Encryption acceleration support on P8 CPU"
+ 	depends on CRYPTO_DEV_VMX
++	select CRYPTO_AES
++	select CRYPTO_CBC
++	select CRYPTO_CTR
+ 	select CRYPTO_GHASH
++	select CRYPTO_XTS
+ 	default m
+ 	help
+ 	  Support for VMX cryptographic acceleration instructions on Power8 CPU.
+-- 
+2.34.1
+
diff --git a/queue-5.16/crypto-xts-add-softdep-on-ecb.patch b/queue-5.16/crypto-xts-add-softdep-on-ecb.patch
new file mode 100644
index 00000000000..631c5cc08e5
--- /dev/null
+++ b/queue-5.16/crypto-xts-add-softdep-on-ecb.patch
@@ -0,0 +1,32 @@
+From 812b3d224ce93fcf9b760fc999f0ef8c0d49a270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 13:09:40 +1100
+Subject: crypto: xts - Add softdep on ecb
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit dfe085d8dcd0bb1fe20cc2327e81c8064cead441 ]
+
+The xts module needs ecb to be present as it's meant to work
+on top of ecb.  This patch adds a softdep so ecb can be included
+automatically into the initramfs.
+
+Reported-by: rftc <rftc@gmx.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/xts.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/crypto/xts.c b/crypto/xts.c
+index 6c12f30dbdd6..63c85b9e64e0 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -466,3 +466,4 @@ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("XTS block cipher mode");
+ MODULE_ALIAS_CRYPTO("xts");
+ MODULE_IMPORT_NS(CRYPTO_INTERNAL);
++MODULE_SOFTDEP("pre: ecb");
+-- 
+2.34.1
+
diff --git a/queue-5.16/cxl-core-fix-cxl_probe_component_regs-error-message.patch b/queue-5.16/cxl-core-fix-cxl_probe_component_regs-error-message.patch
new file mode 100644
index 00000000000..d523dc90934
--- /dev/null
+++ b/queue-5.16/cxl-core-fix-cxl_probe_component_regs-error-message.patch
@@ -0,0 +1,37 @@
+From 460f92d2df1c896754ad184dd0aa9cdd8fe6ead2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jan 2022 16:29:42 -0800
+Subject: cxl/core: Fix cxl_probe_component_regs() error message
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit d621bc2e7282f9955033a6359877fd4ac4be60e1 ]
+
+Fix a '\n' vs '/n' typo.
+
+Fixes: 08422378c4ad ("cxl/pci: Add HDM decoder capabilities")
+Acked-by: Ben Widawsky <ben.widawsky@intel.com
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/164298418268.3018233.17790073375430834911.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/regs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
+index 41de4a136ecd..b8aa583a7642 100644
+--- a/drivers/cxl/core/regs.c
++++ b/drivers/cxl/core/regs.c
+@@ -49,7 +49,7 @@ void cxl_probe_component_regs(struct device *dev, void __iomem *base,
+ 
+ 	if (FIELD_GET(CXL_CM_CAP_HDR_ID_MASK, cap_array) != CM_CAP_HDR_CAP_ID) {
+ 		dev_err(dev,
+-			"Couldn't locate the CXL.cache and CXL.mem capability array header./n");
++			"Couldn't locate the CXL.cache and CXL.mem capability array header.\n");
+ 		return;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/cxl-port-hold-port-reference-until-decoder-release.patch b/queue-5.16/cxl-port-hold-port-reference-until-decoder-release.patch
new file mode 100644
index 00000000000..d7ec14dc6c3
--- /dev/null
+++ b/queue-5.16/cxl-port-hold-port-reference-until-decoder-release.patch
@@ -0,0 +1,73 @@
+From 3f583fa9c2ac56e7e03584bd6d613bf4503b554a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 16:25:11 -0800
+Subject: cxl/port: Hold port reference until decoder release
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit 74be98774dfbc5b8b795db726bd772e735d2edd4 ]
+
+KASAN + DEBUG_KOBJECT_RELEASE reports a potential use-after-free in
+cxl_decoder_release() where it goes to reference its parent, a cxl_port,
+to free its id back to port->decoder_ida.
+
+ BUG: KASAN: use-after-free in to_cxl_port+0x18/0x90 [cxl_core]
+ Read of size 8 at addr ffff888119270908 by task kworker/35:2/379
+
+ CPU: 35 PID: 379 Comm: kworker/35:2 Tainted: G           OE     5.17.0-rc2+ #198
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+ Workqueue: events kobject_delayed_cleanup
+ Call Trace:
+  <TASK>
+  dump_stack_lvl+0x59/0x73
+  print_address_description.constprop.0+0x1f/0x150
+  ? to_cxl_port+0x18/0x90 [cxl_core]
+  kasan_report.cold+0x83/0xdf
+  ? to_cxl_port+0x18/0x90 [cxl_core]
+  to_cxl_port+0x18/0x90 [cxl_core]
+  cxl_decoder_release+0x2a/0x60 [cxl_core]
+  device_release+0x5f/0x100
+  kobject_cleanup+0x80/0x1c0
+
+The device core only guarantees parent lifetime until all children are
+unregistered. If a child needs a parent to complete its ->release()
+callback that child needs to hold a reference to extend the lifetime of
+the parent.
+
+Fixes: 40ba17afdfab ("cxl/acpi: Introduce cxl_decoder objects")
+Reported-by: Ben Widawsky <ben.widawsky@intel.com>
+Tested-by: Ben Widawsky <ben.widawsky@intel.com>
+Reviewed-by: Ben Widawsky <ben.widawsky@intel.com>
+Link: https://lore.kernel.org/r/164505751190.4175768.13324905271463416712.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/bus.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/cxl/core/bus.c b/drivers/cxl/core/bus.c
+index 46ce58376580..55e120350a29 100644
+--- a/drivers/cxl/core/bus.c
++++ b/drivers/cxl/core/bus.c
+@@ -182,6 +182,7 @@ static void cxl_decoder_release(struct device *dev)
+ 
+ 	ida_free(&port->decoder_ida, cxld->id);
+ 	kfree(cxld);
++	put_device(&port->dev);
+ }
+ 
+ static const struct device_type cxl_decoder_switch_type = {
+@@ -500,7 +501,10 @@ struct cxl_decoder *cxl_decoder_alloc(struct cxl_port *port, int nr_targets)
+ 	if (rc < 0)
+ 		goto err;
+ 
++	/* need parent to stick around to release the id */
++	get_device(&port->dev);
+ 	cxld->id = rc;
++
+ 	cxld->nr_targets = nr_targets;
+ 	dev = &cxld->dev;
+ 	device_initialize(dev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/cxl-regs-fix-size-of-cxl-capability-header-register.patch b/queue-5.16/cxl-regs-fix-size-of-cxl-capability-header-register.patch
new file mode 100644
index 00000000000..db50d5c2200
--- /dev/null
+++ b/queue-5.16/cxl-regs-fix-size-of-cxl-capability-header-register.patch
@@ -0,0 +1,74 @@
+From cea23ff3fe42479cc0c62fee48a824212f87f697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Feb 2022 15:34:37 +0000
+Subject: cxl/regs: Fix size of CXL Capability Header Register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 74b0fe80409733055971bbfaf33c80a33fddeeb3 ]
+
+In CXL 2.0, 8.2.5.1 CXL Capability Header Register: this register
+is given as 32 bits.
+
+8.2.3 which covers the CXL 2.0 Component registers, including the
+CXL Capability Header Register states that access restrictions
+specified in Section 8.2.2 apply.
+
+8.2.2 includes:
+* A 32 bit register shall be accessed as a 4 Byte quantity.
+...
+If these rules are not followed, the behavior is undefined.
+
+Discovered during review of CXL QEMU emulation. Alex Bennée pointed
+out there was a comment saying that 4 byte registers must be read
+with a 4 byte read, but 8 byte reads were being emulated.
+
+https://lore.kernel.org/qemu-devel/87bkzyd3c7.fsf@linaro.org/
+
+Fixing that, led to this code failing. Whilst a given hardware
+implementation 'might' work with an 8 byte read, it should not be relied
+upon. The QEMU emulation v5 will return 0 and log the wrong access width.
+
+The code moved, so one fixes tag for where this will directly apply and
+also a reference to the earlier introduction of the code for backports.
+
+Fixes: 0f06157e0135 ("cxl/core: Move register mapping infrastructure")
+Fixes: 08422378c4ad ("cxl/pci: Add HDM decoder capabilities")
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Ben Widawsky <ben.widawsky@intel.com>
+Link: https://lore.kernel.org/r/20220201153437.2873-1-Jonathan.Cameron@huawei.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/regs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
+index b8aa583a7642..2e7027a3fef3 100644
+--- a/drivers/cxl/core/regs.c
++++ b/drivers/cxl/core/regs.c
+@@ -35,7 +35,7 @@ void cxl_probe_component_regs(struct device *dev, void __iomem *base,
+ 			      struct cxl_component_reg_map *map)
+ {
+ 	int cap, cap_count;
+-	u64 cap_array;
++	u32 cap_array;
+ 
+ 	*map = (struct cxl_component_reg_map) { 0 };
+ 
+@@ -45,7 +45,7 @@ void cxl_probe_component_regs(struct device *dev, void __iomem *base,
+ 	 */
+ 	base += CXL_CM_OFFSET;
+ 
+-	cap_array = readq(base + CXL_CM_CAP_HDR_OFFSET);
++	cap_array = readl(base + CXL_CM_CAP_HDR_OFFSET);
+ 
+ 	if (FIELD_GET(CXL_CM_CAP_HDR_ID_MASK, cap_array) != CM_CAP_HDR_CAP_ID) {
+ 		dev_err(dev,
+-- 
+2.34.1
+
diff --git a/queue-5.16/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch b/queue-5.16/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
new file mode 100644
index 00000000000..b76b4f0657f
--- /dev/null
+++ b/queue-5.16/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
@@ -0,0 +1,51 @@
+From bfb4b5b89a71e7fad578ff3f44ee133ac07a1c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 23:11:11 -0800
+Subject: dax: make sure inodes are flushed before destroy cache
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit a7e8de822e0b1979f08767c751f6c8a9c1d4ad86 ]
+
+A bug can be triggered by following command
+
+$ modprobe nd_pmem && modprobe -r nd_pmem
+
+[   10.060014] BUG dax_cache (Not tainted): Objects remaining in dax_cache on __kmem_cache_shutdown()
+[   10.060938] Slab 0x0000000085b729ac objects=9 used=1 fp=0x000000004f5ae469 flags=0x200000000010200(slab|head|node)
+[   10.062433] Call Trace:
+[   10.062673]  dump_stack_lvl+0x34/0x44
+[   10.062865]  slab_err+0x90/0xd0
+[   10.063619]  __kmem_cache_shutdown+0x13b/0x2f0
+[   10.063848]  kmem_cache_destroy+0x4a/0x110
+[   10.064058]  __x64_sys_delete_module+0x265/0x300
+
+This is caused by dax_fs_exit() not flushing inodes before destroy cache.
+To fix this issue, call rcu_barrier() before destroy cache.
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220212071111.148575-1-ztong0001@gmail.com
+Fixes: 7b6be8444e0f ("dax: refactor dax-fs into a generic provider of 'struct dax_device' instances")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dax/super.c b/drivers/dax/super.c
+index e20d0cef10a1..0e55dde937d2 100644
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -612,6 +612,7 @@ static int dax_fs_init(void)
+ static void dax_fs_exit(void)
+ {
+ 	kern_unmount(dax_mnt);
++	rcu_barrier();
+ 	kmem_cache_destroy(dax_cache);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch b/queue-5.16/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
new file mode 100644
index 00000000000..f1e799efe3d
--- /dev/null
+++ b/queue-5.16/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
@@ -0,0 +1,40 @@
+From f50ca026698be8f04896a6c004bb5be69d899e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 12:15:38 +0000
+Subject: dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
+
+From: Aashish Sharma <shraash@google.com>
+
+[ Upstream commit 6fc51504388c1a1a53db8faafe9fff78fccc7c87 ]
+
+Explicitly convert unsigned int in the right of the conditional
+expression to int to match the left side operand and the return type,
+fixing the following compiler warning:
+
+drivers/md/dm-crypt.c:2593:43: warning: signed and unsigned
+type in conditional expression [-Wsign-compare]
+
+Fixes: c538f6ec9f56 ("dm crypt: add ability to use keys from the kernel key retention service")
+Signed-off-by: Aashish Sharma <shraash@google.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-crypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index d4ae31558826..f51aea71cb03 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2590,7 +2590,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
+ 
+ static int get_key_size(char **key_string)
+ {
+-	return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1;
++	return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1);
+ }
+ 
+ #endif /* CONFIG_KEYS */
+-- 
+2.34.1
+
diff --git a/queue-5.16/dma-debug-fix-return-value-of-__setup-handlers.patch b/queue-5.16/dma-debug-fix-return-value-of-__setup-handlers.patch
new file mode 100644
index 00000000000..5be2f88c20d
--- /dev/null
+++ b/queue-5.16/dma-debug-fix-return-value-of-__setup-handlers.patch
@@ -0,0 +1,72 @@
+From 82e4188b6589a091d733846e1624752efcf939e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:04:53 -0800
+Subject: dma-debug: fix return value of __setup handlers
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 80e4390981618e290616dbd06ea190d4576f219d ]
+
+When valid kernel command line parameters
+  dma_debug=off dma_debug_entries=100
+are used, they are reported as Unknown parameters and added to init's
+environment strings, polluting it.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5
+    dma_debug=off dma_debug_entries=100", will be passed to user space.
+
+and
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     dma_debug=off
+     dma_debug_entries=100
+
+Return 1 from these __setup handlers to indicate that the command line
+option has been handled.
+
+Fixes: 59d3daafa1726 ("dma-debug: add kernel command line parameters")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: iommu@lists.linux-foundation.org
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 7a14ca29c377..f8ff598596b8 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -927,7 +927,7 @@ static __init int dma_debug_cmdline(char *str)
+ 		global_disable = true;
+ 	}
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ static __init int dma_debug_entries_cmdline(char *str)
+@@ -936,7 +936,7 @@ static __init int dma_debug_entries_cmdline(char *str)
+ 		return -EINVAL;
+ 	if (!get_option(&str, &nr_prealloc_entries))
+ 		nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("dma_debug=", dma_debug_cmdline);
+-- 
+2.34.1
+
diff --git a/queue-5.16/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch b/queue-5.16/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch
new file mode 100644
index 00000000000..3207fced5f1
--- /dev/null
+++ b/queue-5.16/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch
@@ -0,0 +1,53 @@
+From b4da184858f8b172c9f66e4104ae2bcb343c1377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 15:21:01 +0800
+Subject: dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma
+
+From: Jie Hai <haijie1@huawei.com>
+
+[ Upstream commit b95044b38425f563404234d96bbb20cc6360c7e1 ]
+
+Remove the loaded hisi_dma driver and reload it, the driver fails
+to work properly. The following error is reported in the kernel log:
+
+[ 1475.597609] hisi_dma 0000:7b:00.0: Failed to allocate MSI vectors!
+[ 1475.604915] hisi_dma: probe of 0000:7b:00.0 failed with error -28
+
+As noted in "The MSI Driver Guide HOWTO"[1], the number of MSI
+interrupt must be a power of two. The Kunpeng DMA driver allocates 30
+MSI interrupts. As a result, no space left on device is reported
+when the driver is reloaded and allocates interrupt vectors from the
+interrupt domain.
+
+This patch changes the number of interrupt vectors allocated by
+hisi_dma driver to 32 to avoid this problem.
+
+[1] https://www.kernel.org/doc/html/latest/PCI/msi-howto.html
+
+Fixes: e9f08b65250d ("dmaengine: hisilicon: Add Kunpeng DMA engine support")
+
+Signed-off-by: Jie Hai <haijie1@huawei.com>
+Acked-by: Zhou Wang <wangzhou1@hisilicon.com>
+Link: https://lore.kernel.org/r/20220216072101.34473-1-haijie1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hisi_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/hisi_dma.c b/drivers/dma/hisi_dma.c
+index 97c87a7cba87..43817ced3a3e 100644
+--- a/drivers/dma/hisi_dma.c
++++ b/drivers/dma/hisi_dma.c
+@@ -30,7 +30,7 @@
+ #define HISI_DMA_MODE			0x217c
+ #define HISI_DMA_OFFSET			0x100
+ 
+-#define HISI_DMA_MSI_NUM		30
++#define HISI_DMA_MSI_NUM		32
+ #define HISI_DMA_CHAN_NUM		30
+ #define HISI_DMA_Q_DEPTH_VAL		1024
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/dmaengine-idxd-change-bandwidth-token-to-read-buffer.patch b/queue-5.16/dmaengine-idxd-change-bandwidth-token-to-read-buffer.patch
new file mode 100644
index 00000000000..689d3451c93
--- /dev/null
+++ b/queue-5.16/dmaengine-idxd-change-bandwidth-token-to-read-buffer.patch
@@ -0,0 +1,311 @@
+From 44807483624a1e1b7b2b927201acaa9b123945ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 13:23:09 -0700
+Subject: dmaengine: idxd: change bandwidth token to read buffers
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 7ed6f1b85fb613e5e44ef3e14d73f2dc96860935 ]
+
+DSA spec v1.2 has changed the term of "bandwidth tokens" to "read buffers"
+in order to make the concept clearer. Deprecate bandwidth token
+naming in the driver and convert to read buffers in order to match with
+the spec and reduce confusion when reading the spec.
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/163951338932.2988321.6162640806935567317.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c    | 25 +++++++++++----------
+ drivers/dma/idxd/idxd.h      | 12 +++++------
+ drivers/dma/idxd/init.c      |  6 +++---
+ drivers/dma/idxd/registers.h | 14 ++++++------
+ drivers/dma/idxd/sysfs.c     | 42 ++++++++++++++++++------------------
+ 5 files changed, 49 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index cd855097bfdb..83aa0c79f830 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -688,9 +688,9 @@ static void idxd_groups_clear_state(struct idxd_device *idxd)
+ 		memset(&group->grpcfg, 0, sizeof(group->grpcfg));
+ 		group->num_engines = 0;
+ 		group->num_wqs = 0;
+-		group->use_token_limit = false;
+-		group->tokens_allowed = 0;
+-		group->tokens_reserved = 0;
++		group->use_rdbuf_limit = false;
++		group->rdbufs_allowed = 0;
++		group->rdbufs_reserved = 0;
+ 		group->tc_a = -1;
+ 		group->tc_b = -1;
+ 	}
+@@ -788,10 +788,10 @@ static int idxd_groups_config_write(struct idxd_device *idxd)
+ 	int i;
+ 	struct device *dev = &idxd->pdev->dev;
+ 
+-	/* Setup bandwidth token limit */
+-	if (idxd->hw.gen_cap.config_en && idxd->token_limit) {
++	/* Setup bandwidth rdbuf limit */
++	if (idxd->hw.gen_cap.config_en && idxd->rdbuf_limit) {
+ 		reg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
+-		reg.token_limit = idxd->token_limit;
++		reg.rdbuf_limit = idxd->rdbuf_limit;
+ 		iowrite32(reg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET);
+ 	}
+ 
+@@ -932,13 +932,12 @@ static void idxd_group_flags_setup(struct idxd_device *idxd)
+ 			group->tc_b = group->grpcfg.flags.tc_b = 1;
+ 		else
+ 			group->grpcfg.flags.tc_b = group->tc_b;
+-		group->grpcfg.flags.use_token_limit = group->use_token_limit;
+-		group->grpcfg.flags.tokens_reserved = group->tokens_reserved;
+-		if (group->tokens_allowed)
+-			group->grpcfg.flags.tokens_allowed =
+-				group->tokens_allowed;
++		group->grpcfg.flags.use_rdbuf_limit = group->use_rdbuf_limit;
++		group->grpcfg.flags.rdbufs_reserved = group->rdbufs_reserved;
++		if (group->rdbufs_allowed)
++			group->grpcfg.flags.rdbufs_allowed = group->rdbufs_allowed;
+ 		else
+-			group->grpcfg.flags.tokens_allowed = idxd->max_tokens;
++			group->grpcfg.flags.rdbufs_allowed = idxd->max_rdbufs;
+ 	}
+ }
+ 
+@@ -1131,7 +1130,7 @@ int idxd_device_load_config(struct idxd_device *idxd)
+ 	int i, rc;
+ 
+ 	reg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
+-	idxd->token_limit = reg.token_limit;
++	idxd->rdbuf_limit = reg.rdbuf_limit;
+ 
+ 	for (i = 0; i < idxd->max_groups; i++) {
+ 		struct idxd_group *group = idxd->groups[i];
+diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
+index 0cf8d3145870..ca1e7bd05839 100644
+--- a/drivers/dma/idxd/idxd.h
++++ b/drivers/dma/idxd/idxd.h
+@@ -84,9 +84,9 @@ struct idxd_group {
+ 	int id;
+ 	int num_engines;
+ 	int num_wqs;
+-	bool use_token_limit;
+-	u8 tokens_allowed;
+-	u8 tokens_reserved;
++	bool use_rdbuf_limit;
++	u8 rdbufs_allowed;
++	u8 rdbufs_reserved;
+ 	int tc_a;
+ 	int tc_b;
+ };
+@@ -276,11 +276,11 @@ struct idxd_device {
+ 	u32 max_batch_size;
+ 	int max_groups;
+ 	int max_engines;
+-	int max_tokens;
++	int max_rdbufs;
+ 	int max_wqs;
+ 	int max_wq_size;
+-	int token_limit;
+-	int nr_tokens;		/* non-reserved tokens */
++	int rdbuf_limit;
++	int nr_rdbufs;		/* non-reserved read buffers */
+ 	unsigned int wqcfg_size;
+ 
+ 	union sw_err_reg sw_err;
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 7bf03f371ce1..6263d9825250 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -464,9 +464,9 @@ static void idxd_read_caps(struct idxd_device *idxd)
+ 	dev_dbg(dev, "group_cap: %#llx\n", idxd->hw.group_cap.bits);
+ 	idxd->max_groups = idxd->hw.group_cap.num_groups;
+ 	dev_dbg(dev, "max groups: %u\n", idxd->max_groups);
+-	idxd->max_tokens = idxd->hw.group_cap.total_tokens;
+-	dev_dbg(dev, "max tokens: %u\n", idxd->max_tokens);
+-	idxd->nr_tokens = idxd->max_tokens;
++	idxd->max_rdbufs = idxd->hw.group_cap.total_rdbufs;
++	dev_dbg(dev, "max read buffers: %u\n", idxd->max_rdbufs);
++	idxd->nr_rdbufs = idxd->max_rdbufs;
+ 
+ 	/* read engine capabilities */
+ 	idxd->hw.engine_cap.bits =
+diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h
+index 262c8220adbd..ac4fe0b1dd8a 100644
+--- a/drivers/dma/idxd/registers.h
++++ b/drivers/dma/idxd/registers.h
+@@ -64,9 +64,9 @@ union wq_cap_reg {
+ union group_cap_reg {
+ 	struct {
+ 		u64 num_groups:8;
+-		u64 total_tokens:8;
+-		u64 token_en:1;
+-		u64 token_limit:1;
++		u64 total_rdbufs:8;	/* formerly total_tokens */
++		u64 rdbuf_ctrl:1;	/* formerly token_en */
++		u64 rdbuf_limit:1;	/* formerly token_limit */
+ 		u64 rsvd:46;
+ 	};
+ 	u64 bits;
+@@ -110,7 +110,7 @@ union offsets_reg {
+ #define IDXD_GENCFG_OFFSET		0x80
+ union gencfg_reg {
+ 	struct {
+-		u32 token_limit:8;
++		u32 rdbuf_limit:8;
+ 		u32 rsvd:4;
+ 		u32 user_int_en:1;
+ 		u32 rsvd2:19;
+@@ -287,10 +287,10 @@ union group_flags {
+ 		u32 tc_a:3;
+ 		u32 tc_b:3;
+ 		u32 rsvd:1;
+-		u32 use_token_limit:1;
+-		u32 tokens_reserved:8;
++		u32 use_rdbuf_limit:1;
++		u32 rdbufs_reserved:8;
+ 		u32 rsvd2:4;
+-		u32 tokens_allowed:8;
++		u32 rdbufs_allowed:8;
+ 		u32 rsvd3:4;
+ 	};
+ 	u32 bits;
+diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
+index a9025be940db..999ce13a93ad 100644
+--- a/drivers/dma/idxd/sysfs.c
++++ b/drivers/dma/idxd/sysfs.c
+@@ -99,17 +99,17 @@ struct device_type idxd_engine_device_type = {
+ 
+ /* Group attributes */
+ 
+-static void idxd_set_free_tokens(struct idxd_device *idxd)
++static void idxd_set_free_rdbufs(struct idxd_device *idxd)
+ {
+-	int i, tokens;
++	int i, rdbufs;
+ 
+-	for (i = 0, tokens = 0; i < idxd->max_groups; i++) {
++	for (i = 0, rdbufs = 0; i < idxd->max_groups; i++) {
+ 		struct idxd_group *g = idxd->groups[i];
+ 
+-		tokens += g->tokens_reserved;
++		rdbufs += g->rdbufs_reserved;
+ 	}
+ 
+-	idxd->nr_tokens = idxd->max_tokens - tokens;
++	idxd->nr_rdbufs = idxd->max_rdbufs - rdbufs;
+ }
+ 
+ static ssize_t group_tokens_reserved_show(struct device *dev,
+@@ -118,7 +118,7 @@ static ssize_t group_tokens_reserved_show(struct device *dev,
+ {
+ 	struct idxd_group *group = confdev_to_group(dev);
+ 
+-	return sysfs_emit(buf, "%u\n", group->tokens_reserved);
++	return sysfs_emit(buf, "%u\n", group->rdbufs_reserved);
+ }
+ 
+ static ssize_t group_tokens_reserved_store(struct device *dev,
+@@ -143,14 +143,14 @@ static ssize_t group_tokens_reserved_store(struct device *dev,
+ 	if (idxd->state == IDXD_DEV_ENABLED)
+ 		return -EPERM;
+ 
+-	if (val > idxd->max_tokens)
++	if (val > idxd->max_rdbufs)
+ 		return -EINVAL;
+ 
+-	if (val > idxd->nr_tokens + group->tokens_reserved)
++	if (val > idxd->nr_rdbufs + group->rdbufs_reserved)
+ 		return -EINVAL;
+ 
+-	group->tokens_reserved = val;
+-	idxd_set_free_tokens(idxd);
++	group->rdbufs_reserved = val;
++	idxd_set_free_rdbufs(idxd);
+ 	return count;
+ }
+ 
+@@ -164,7 +164,7 @@ static ssize_t group_tokens_allowed_show(struct device *dev,
+ {
+ 	struct idxd_group *group = confdev_to_group(dev);
+ 
+-	return sysfs_emit(buf, "%u\n", group->tokens_allowed);
++	return sysfs_emit(buf, "%u\n", group->rdbufs_allowed);
+ }
+ 
+ static ssize_t group_tokens_allowed_store(struct device *dev,
+@@ -190,10 +190,10 @@ static ssize_t group_tokens_allowed_store(struct device *dev,
+ 		return -EPERM;
+ 
+ 	if (val < 4 * group->num_engines ||
+-	    val > group->tokens_reserved + idxd->nr_tokens)
++	    val > group->rdbufs_reserved + idxd->nr_rdbufs)
+ 		return -EINVAL;
+ 
+-	group->tokens_allowed = val;
++	group->rdbufs_allowed = val;
+ 	return count;
+ }
+ 
+@@ -207,7 +207,7 @@ static ssize_t group_use_token_limit_show(struct device *dev,
+ {
+ 	struct idxd_group *group = confdev_to_group(dev);
+ 
+-	return sysfs_emit(buf, "%u\n", group->use_token_limit);
++	return sysfs_emit(buf, "%u\n", group->use_rdbuf_limit);
+ }
+ 
+ static ssize_t group_use_token_limit_store(struct device *dev,
+@@ -232,10 +232,10 @@ static ssize_t group_use_token_limit_store(struct device *dev,
+ 	if (idxd->state == IDXD_DEV_ENABLED)
+ 		return -EPERM;
+ 
+-	if (idxd->token_limit == 0)
++	if (idxd->rdbuf_limit == 0)
+ 		return -EPERM;
+ 
+-	group->use_token_limit = !!val;
++	group->use_rdbuf_limit = !!val;
+ 	return count;
+ }
+ 
+@@ -1161,7 +1161,7 @@ static ssize_t max_tokens_show(struct device *dev,
+ {
+ 	struct idxd_device *idxd = confdev_to_idxd(dev);
+ 
+-	return sysfs_emit(buf, "%u\n", idxd->max_tokens);
++	return sysfs_emit(buf, "%u\n", idxd->max_rdbufs);
+ }
+ static DEVICE_ATTR_RO(max_tokens);
+ 
+@@ -1170,7 +1170,7 @@ static ssize_t token_limit_show(struct device *dev,
+ {
+ 	struct idxd_device *idxd = confdev_to_idxd(dev);
+ 
+-	return sysfs_emit(buf, "%u\n", idxd->token_limit);
++	return sysfs_emit(buf, "%u\n", idxd->rdbuf_limit);
+ }
+ 
+ static ssize_t token_limit_store(struct device *dev,
+@@ -1191,13 +1191,13 @@ static ssize_t token_limit_store(struct device *dev,
+ 	if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags))
+ 		return -EPERM;
+ 
+-	if (!idxd->hw.group_cap.token_limit)
++	if (!idxd->hw.group_cap.rdbuf_limit)
+ 		return -EPERM;
+ 
+-	if (val > idxd->hw.group_cap.total_tokens)
++	if (val > idxd->hw.group_cap.total_rdbufs)
+ 		return -EINVAL;
+ 
+-	idxd->token_limit = val;
++	idxd->rdbuf_limit = val;
+ 	return count;
+ }
+ static DEVICE_ATTR_RW(token_limit);
+-- 
+2.34.1
+
diff --git a/queue-5.16/dmaengine-idxd-restore-traffic-class-defaults-after-.patch b/queue-5.16/dmaengine-idxd-restore-traffic-class-defaults-after-.patch
new file mode 100644
index 00000000000..b1e479216d7
--- /dev/null
+++ b/queue-5.16/dmaengine-idxd-restore-traffic-class-defaults-after-.patch
@@ -0,0 +1,46 @@
+From d664415bdd764dcd29da889227e45e13f8444d23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 09:20:33 -0700
+Subject: dmaengine: idxd: restore traffic class defaults after wq reset
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit ea7c8f598c323f6ebaf9ddae01fb2a981fe8c56a ]
+
+When clearing the group configurations, the driver fails to restore the
+default setting for DSA 1.x based devices. Add defaults in
+idxd_groups_clear_state() for traffic class configuration.
+
+Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class")
+Reported-by: Binuraj Ravindran <binuraj.ravindran@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/164304123369.824298.6952463420266592087.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index 83aa0c79f830..4bafc88f425f 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -691,8 +691,13 @@ static void idxd_groups_clear_state(struct idxd_device *idxd)
+ 		group->use_rdbuf_limit = false;
+ 		group->rdbufs_allowed = 0;
+ 		group->rdbufs_reserved = 0;
+-		group->tc_a = -1;
+-		group->tc_b = -1;
++		if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) {
++			group->tc_a = 1;
++			group->tc_b = 1;
++		} else {
++			group->tc_a = -1;
++			group->tc_b = -1;
++		}
+ 	}
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/driver-core-dd-fix-return-value-of-__setup-handler.patch b/queue-5.16/driver-core-dd-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..62153ecf719
--- /dev/null
+++ b/queue-5.16/driver-core-dd-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,59 @@
+From 32b83e7098b815ffe70f5ceaed59326518fcf22e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 20:18:29 -0800
+Subject: driver core: dd: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f2aad54703dbe630f9d8b235eb58e8c8cc78f37d ]
+
+When "driver_async_probe=nulltty" is used on the kernel boot command line,
+it causes an Unknown parameter message and the string is added to init's
+environment strings, polluting them.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc6
+  driver_async_probe=nulltty", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc6
+     driver_async_probe=nulltty
+
+Change the return value of the __setup function to 1 to indicate
+that the __setup option has been handled.
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 1ea61b68d0f8 ("async: Add cmdline option to specify drivers to be async probed")
+Cc: Feng Tang <feng.tang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Feng Tang <feng.tang@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220301041829.15137-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 6b6630693201..64ce42b6c6b6 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -809,7 +809,7 @@ static int __init save_async_options(char *buf)
+ 		pr_warn("Too long list of driver names for 'driver_async_probe'!\n");
+ 
+ 	strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN);
+-	return 0;
++	return 1;
+ }
+ __setup("driver_async_probe=", save_async_options);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drivers-base-memory-add-memory-block-to-memory-group.patch b/queue-5.16/drivers-base-memory-add-memory-block-to-memory-group.patch
new file mode 100644
index 00000000000..68ece662073
--- /dev/null
+++ b/queue-5.16/drivers-base-memory-add-memory-block-to-memory-group.patch
@@ -0,0 +1,58 @@
+From 328ca27f0f6aca219e5bb8ece260799e203534c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:47:09 -0700
+Subject: drivers/base/memory: add memory block to memory group after
+ registration succeeded
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit 7ea0d2d79da09d1f7d71c96a9c9bc1b5229360b5 ]
+
+If register_memory() fails, we freed the memory block but already added
+the memory block to the group list, not good.  Let's defer adding the
+block to the memory group to after registering the memory block device.
+
+We do handle it properly during unregister_memory(), but that's not
+called when the registration fails.
+
+Link: https://lkml.kernel.org/r/20220128144540.153902-1-david@redhat.com
+Fixes: 028fc57a1c36 ("drivers/base/memory: introduce "memory groups" to logically group memory blocks")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/memory.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 365cd4a7f239..60c38f9cf1a7 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -663,14 +663,16 @@ static int init_memory_block(unsigned long block_id, unsigned long state,
+ 	mem->nr_vmemmap_pages = nr_vmemmap_pages;
+ 	INIT_LIST_HEAD(&mem->group_next);
+ 
++	ret = register_memory(mem);
++	if (ret)
++		return ret;
++
+ 	if (group) {
+ 		mem->group = group;
+ 		list_add(&mem->group_next, &group->memory_blocks);
+ 	}
+ 
+-	ret = register_memory(mem);
+-
+-	return ret;
++	return 0;
+ }
+ 
+ static int add_memory_block(unsigned long base_section_nr)
+-- 
+2.34.1
+
diff --git a/queue-5.16/drivers-ethernet-cpsw-fix-panic-when-interrupt-coale.patch b/queue-5.16/drivers-ethernet-cpsw-fix-panic-when-interrupt-coale.patch
new file mode 100644
index 00000000000..d5096fd82f4
--- /dev/null
+++ b/queue-5.16/drivers-ethernet-cpsw-fix-panic-when-interrupt-coale.patch
@@ -0,0 +1,58 @@
+From 3f9e513928e98a6ecdfb9c9d2c80a97159c37c65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 08:47:33 +0000
+Subject: drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set
+ via ethtool
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sondhauß, Jan <Jan.Sondhauss@wago.com>
+
+[ Upstream commit 2844e2434385819f674d1fb4130c308c50ba681e ]
+
+cpsw_ethtool_begin directly returns the result of pm_runtime_get_sync
+when successful.
+pm_runtime_get_sync returns -error code on failure and 0 on successful
+resume but also 1 when the device is already active. So the common case
+for cpsw_ethtool_begin is to return 1. That leads to inconsistent calls
+to pm_runtime_put in the call-chain so that pm_runtime_put is called
+one too many times and as result leaving the cpsw dev behind suspended.
+
+The suspended cpsw dev leads to an access violation later on by
+different parts of the cpsw driver.
+
+Fix this by calling the return-friendly pm_runtime_resume_and_get
+function.
+
+Fixes: d43c65b05b84 ("ethtool: runtime-resume netdev parent in ethnl_ops_begin")
+Signed-off-by: Jan Sondhauss <jan.sondhauss@wago.com>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20220323084725.65864-1-jan.sondhauss@wago.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpsw_ethtool.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/cpsw_ethtool.c b/drivers/net/ethernet/ti/cpsw_ethtool.c
+index 158c8d3793f4..b5bae6324970 100644
+--- a/drivers/net/ethernet/ti/cpsw_ethtool.c
++++ b/drivers/net/ethernet/ti/cpsw_ethtool.c
+@@ -364,11 +364,9 @@ int cpsw_ethtool_op_begin(struct net_device *ndev)
+ 	struct cpsw_common *cpsw = priv->cpsw;
+ 	int ret;
+ 
+-	ret = pm_runtime_get_sync(cpsw->dev);
+-	if (ret < 0) {
++	ret = pm_runtime_resume_and_get(cpsw->dev);
++	if (ret < 0)
+ 		cpsw_err(priv, drv, "ethtool begin failed %d\n", ret);
+-		pm_runtime_put_noidle(cpsw->dev);
+-	}
+ 
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch b/queue-5.16/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
new file mode 100644
index 00000000000..7997644baf0
--- /dev/null
+++ b/queue-5.16/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
@@ -0,0 +1,58 @@
+From fa07da8a8c461aacc710a530554e6d36ad6f112c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 17:39:57 -0500
+Subject: drm/amd/display: Add affected crtcs to atomic state for dsc mst
+ unplug
+
+From: Roman Li <Roman.Li@amd.com>
+
+[ Upstream commit 128f8ed5902a287a6bb4afe0ffdae8a80b2a64ec ]
+
+[Why]
+When display topology changed on DSC hub we add all crtcs with dsc support to
+atomic state.
+Refer to patch:"drm/amd/display: Trigger modesets on MST DSC connectors"
+However the original implementation may skip crtc if the topology change
+caused by unplug.
+That potentially could lead to no-lightup or corruption on DSC hub after
+unplug event on one of the connectors.
+
+[How]
+Update add_affected_mst_dsc_crtcs() to use old connector state
+if new connector state has no crtc (undergoes modeset due to unplug)
+
+Fixes: 44be939ff7ac58 ("drm/amd/display: Trigger modesets on MST DSC connectors")
+
+Reviewed-by: Hersen Wu <hersenwu@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Signed-off-by: Roman Li <Roman.Li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 0ec8051cdfb4..7cadb9e81d9d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10752,10 +10752,13 @@ static int dm_check_crtc_cursor(struct drm_atomic_state *state,
+ static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc)
+ {
+ 	struct drm_connector *connector;
+-	struct drm_connector_state *conn_state;
++	struct drm_connector_state *conn_state, *old_conn_state;
+ 	struct amdgpu_dm_connector *aconnector = NULL;
+ 	int i;
+-	for_each_new_connector_in_state(state, connector, conn_state, i) {
++	for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) {
++		if (!conn_state->crtc)
++			conn_state = old_conn_state;
++
+ 		if (conn_state->crtc != crtc)
+ 			continue;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch b/queue-5.16/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
new file mode 100644
index 00000000000..90e330a1c9f
--- /dev/null
+++ b/queue-5.16/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
@@ -0,0 +1,49 @@
+From c1f828db10c6e83287646e731da6ca244d356a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 00:57:29 +0800
+Subject: drm/amd/display: Fix a NULL pointer dereference in
+ amdgpu_dm_connector_add_common_modes()
+
+From: Zhou Qingyang <zhou1615@umn.edu>
+
+[ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ]
+
+In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode()
+is assigned to mode and is passed to drm_mode_probed_add() directly after
+that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and
+there is a dereference of it in list_add_tail() without recoveries, which
+could lead to NULL pointer dereference on failure of
+amdgpu_dm_create_common_mode().
+
+Fix this by adding a NULL check of mode.
+
+This bug was found by a static analyzer.
+
+Builds with 'make allyesconfig' show no new warnings,
+and our static analyzer no longer warns about this code.
+
+Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm")
+Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 7a5bb5a3456a..0ec8051cdfb4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8030,6 +8030,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder,
+ 		mode = amdgpu_dm_create_common_mode(encoder,
+ 				common_modes[i].name, common_modes[i].w,
+ 				common_modes[i].h);
++		if (!mode)
++			continue;
++
+ 		drm_mode_probed_add(connector, mode);
+ 		amdgpu_dm_connector->num_modes++;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-amd-display-remove-vupdate_int_entry-definition.patch b/queue-5.16/drm-amd-display-remove-vupdate_int_entry-definition.patch
new file mode 100644
index 00000000000..4685dbf66ce
--- /dev/null
+++ b/queue-5.16/drm-amd-display-remove-vupdate_int_entry-definition.patch
@@ -0,0 +1,162 @@
+From 4236cd7e4644e2f9113fae3d6d8768d445a90f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 10:16:57 -0300
+Subject: drm/amd/display: Remove vupdate_int_entry definition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <maira.canal@usp.br>
+
+[ Upstream commit 3679b8518cd213c25d555553ef212e233faf698c ]
+
+Remove the vupdate_int_entry definition and utilization to avoid the
+following warning by Clang:
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:410:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(0),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:404:2:
+note: previous initialization is here
+    vupdate_int_entry(0),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:411:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(1),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:405:2:
+note: previous initialization is here
+    vupdate_int_entry(1),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:412:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(2),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:406:2:
+note: previous initialization is here
+    vupdate_int_entry(2),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:413:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(3),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:407:2:
+note: previous initialization is here
+    vupdate_int_entry(3),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:414:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(4),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:408:2:
+note: previous initialization is here
+    vupdate_int_entry(4),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:415:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(5),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:409:2:
+note: previous initialization is here
+    vupdate_int_entry(5),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+        [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+        ^~
+6 warnings generated.
+
+Fixes: 688f97ed3f5e ("drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1")
+Signed-off-by: Maíra Canal <maira.canal@usp.br>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/irq/dcn21/irq_service_dcn21.c   | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
+index ed54e1c819be..a728087b3f3d 100644
+--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
+@@ -266,14 +266,6 @@ static const struct irq_source_info_funcs vline0_irq_info_funcs = {
+ 		.funcs = &pflip_irq_info_funcs\
+ 	}
+ 
+-#define vupdate_int_entry(reg_num)\
+-	[DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+-		IRQ_REG_ENTRY(OTG, reg_num,\
+-			OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\
+-			OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\
+-		.funcs = &vblank_irq_info_funcs\
+-	}
+-
+ /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic
+  * of DCE's DC_IRQ_SOURCE_VUPDATEx.
+  */
+@@ -402,12 +394,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = {
+ 	dc_underflow_int_entry(6),
+ 	[DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(),
+ 	[DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(),
+-	vupdate_int_entry(0),
+-	vupdate_int_entry(1),
+-	vupdate_int_entry(2),
+-	vupdate_int_entry(3),
+-	vupdate_int_entry(4),
+-	vupdate_int_entry(5),
+ 	vupdate_no_lock_int_entry(0),
+ 	vupdate_no_lock_int_entry(1),
+ 	vupdate_no_lock_int_entry(2),
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch b/queue-5.16/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch
new file mode 100644
index 00000000000..d14edb83f14
--- /dev/null
+++ b/queue-5.16/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch
@@ -0,0 +1,42 @@
+From 1915215b32f2c79ceebd70da860654af90a5c0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 16:11:20 +0800
+Subject: drm/amd/pm: enable pm sysfs write for one VF mode
+
+From: Yiqing Yao <yiqing.yao@amd.com>
+
+[ Upstream commit e610941c45bad75aa839af015c27d236ab6749e5 ]
+
+[why]
+pm sysfs should be writable in one VF mode as is in passthrough
+
+[how]
+do not remove write access on pm sysfs if device is in one VF mode
+
+Fixes: 11c9cc95f818 ("amdgpu/pm: Make sysfs pm attributes as read-only for VFs")
+Signed-off-by: Yiqing Yao <yiqing.yao@amd.com>
+Reviewed-by: Monk Liu <Monk.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+index d31719b3418f..8744bda59474 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -2123,8 +2123,8 @@ static int default_attr_update(struct amdgpu_device *adev, struct amdgpu_device_
+ 		}
+ 	}
+ 
+-	/* setting should not be allowed from VF */
+-	if (amdgpu_sriov_vf(adev)) {
++	/* setting should not be allowed from VF if not in one VF mode */
++	if (amdgpu_sriov_vf(adev) && !amdgpu_sriov_is_pp_one_vf(adev)) {
+ 		dev_attr->attr.mode &= ~S_IWUGO;
+ 		dev_attr->store = NULL;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch b/queue-5.16/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch
new file mode 100644
index 00000000000..8b19763c2a4
--- /dev/null
+++ b/queue-5.16/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch
@@ -0,0 +1,43 @@
+From 4cccaf810e40648a80b2eb9c07286c5c4fdf4291 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 12:18:12 -0800
+Subject: drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq
+ function
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 430e6a0212b2a0eb1de5e9d47a016fa79edf3978 ]
+
+clang static analysis reports this represenative problem
+amdgpu_smu.c:144:18: warning: The left operand of '*' is a garbage value
+        return clk_freq * 100;
+               ~~~~~~~~ ^
+
+If there is no get_dpm_ultimate_freq function,
+smu_get_dpm_freq_range returns success without setting the
+output min,max parameters.  So return an -ENOTSUPP error.
+
+Fixes: e5ef784b1e17 ("drm/amd/powerplay: revise calling chain on retrieving frequency range")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+index 9d7d64fdf410..9b54c1b89ea4 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -138,7 +138,7 @@ int smu_get_dpm_freq_range(struct smu_context *smu,
+ 			   uint32_t *min,
+ 			   uint32_t *max)
+ {
+-	int ret = 0;
++	int ret = -ENOTSUPP;
+ 
+ 	if (!min && !max)
+ 		return -EINVAL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch b/queue-5.16/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
new file mode 100644
index 00000000000..5fe69db158d
--- /dev/null
+++ b/queue-5.16/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
@@ -0,0 +1,38 @@
+From bd1c191ad21be51765bf6d6692977650d3360757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jan 2022 10:41:09 +0000
+Subject: drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 96211b7c56b109a52768e6cc5e23a1f79316eca0 ]
+
+If the probe fails, we should use pm_runtime_disable() to balance
+pm_runtime_enable().
+Add missing pm_runtime_disable() for __dw_mipi_dsi_probe.
+
+Fixes: 46fc51546d44 ("drm/bridge/synopsys: Add MIPI DSI host controller bridge")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220105104113.31415-1-linmq006@gmail.com
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+index e44e18a0112a..56c3fd08c6a0 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+@@ -1199,6 +1199,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev,
+ 	ret = mipi_dsi_host_register(&dsi->dsi_host);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to register MIPI host: %d\n", ret);
++		pm_runtime_disable(dev);
+ 		dw_mipi_dsi_debugfs_remove(dsi);
+ 		return ERR_PTR(ret);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch b/queue-5.16/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch
new file mode 100644
index 00000000000..67c2ae3218c
--- /dev/null
+++ b/queue-5.16/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch
@@ -0,0 +1,100 @@
+From 4edb21901cbaa9d09e49f54a75c632fbea375124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jan 2022 22:59:49 +0530
+Subject: drm: bridge: adv7511: Fix ADV7535 HPD enablement
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit 3dbc84a595d17f64f14fcea00120d31e33e98880 ]
+
+Existing HPD enablement logic is not compatible with ADV7535
+bridge, thus any runtime plug-in of HDMI cable is not working
+on these bridge designs.
+
+Unlike other ADV7511 family of bridges, the ADV7535 require
+HPD_OVERRIDE bit to set and reset for proper handling of HPD
+functionality.
+
+Fix it.
+
+Fixes: 8501fe4b14a3 ("drm: bridge: adv7511: Add support for ADV7535")
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220109172949.168167-1-jagan@amarulasolutions.com
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511.h     |  1 +
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 +++++++++++++++-----
+ 2 files changed, 23 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+index 05e3abb5a0c9..1b00dfda6e0d 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+@@ -169,6 +169,7 @@
+ #define ADV7511_PACKET_ENABLE_SPARE2		BIT(1)
+ #define ADV7511_PACKET_ENABLE_SPARE1		BIT(0)
+ 
++#define ADV7535_REG_POWER2_HPD_OVERRIDE		BIT(6)
+ #define ADV7511_REG_POWER2_HPD_SRC_MASK		0xc0
+ #define ADV7511_REG_POWER2_HPD_SRC_BOTH		0x00
+ #define ADV7511_REG_POWER2_HPD_SRC_HPD		0x40
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 76555ae64e9c..c02f3ec60b04 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -351,11 +351,17 @@ static void __adv7511_power_on(struct adv7511 *adv7511)
+ 	 * from standby or are enabled. When the HPD goes low the adv7511 is
+ 	 * reset and the outputs are disabled which might cause the monitor to
+ 	 * go to standby again. To avoid this we ignore the HPD pin for the
+-	 * first few seconds after enabling the output.
++	 * first few seconds after enabling the output. On the other hand
++	 * adv7535 require to enable HPD Override bit for proper HPD.
+ 	 */
+-	regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
+-			   ADV7511_REG_POWER2_HPD_SRC_MASK,
+-			   ADV7511_REG_POWER2_HPD_SRC_NONE);
++	if (adv7511->type == ADV7535)
++		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
++				   ADV7535_REG_POWER2_HPD_OVERRIDE,
++				   ADV7535_REG_POWER2_HPD_OVERRIDE);
++	else
++		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
++				   ADV7511_REG_POWER2_HPD_SRC_MASK,
++				   ADV7511_REG_POWER2_HPD_SRC_NONE);
+ }
+ 
+ static void adv7511_power_on(struct adv7511 *adv7511)
+@@ -375,6 +381,10 @@ static void adv7511_power_on(struct adv7511 *adv7511)
+ static void __adv7511_power_off(struct adv7511 *adv7511)
+ {
+ 	/* TODO: setup additional power down modes */
++	if (adv7511->type == ADV7535)
++		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
++				   ADV7535_REG_POWER2_HPD_OVERRIDE, 0);
++
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER,
+ 			   ADV7511_POWER_POWER_DOWN,
+ 			   ADV7511_POWER_POWER_DOWN);
+@@ -672,9 +682,14 @@ adv7511_detect(struct adv7511 *adv7511, struct drm_connector *connector)
+ 			status = connector_status_disconnected;
+ 	} else {
+ 		/* Renable HPD sensing */
+-		regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
+-				   ADV7511_REG_POWER2_HPD_SRC_MASK,
+-				   ADV7511_REG_POWER2_HPD_SRC_BOTH);
++		if (adv7511->type == ADV7535)
++			regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
++					   ADV7535_REG_POWER2_HPD_OVERRIDE,
++					   ADV7535_REG_POWER2_HPD_OVERRIDE);
++		else
++			regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2,
++					   ADV7511_REG_POWER2_HPD_SRC_MASK,
++					   ADV7511_REG_POWER2_HPD_SRC_BOTH);
+ 	}
+ 
+ 	adv7511->status = status;
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-anx7625-fix-overflow-issue-on-reading-edi.patch b/queue-5.16/drm-bridge-anx7625-fix-overflow-issue-on-reading-edi.patch
new file mode 100644
index 00000000000..a2119d43de9
--- /dev/null
+++ b/queue-5.16/drm-bridge-anx7625-fix-overflow-issue-on-reading-edi.patch
@@ -0,0 +1,39 @@
+From 3a20f384dc3ee3ae3742bcac05fa6e9c123a3b01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 18:38:27 +0800
+Subject: drm/bridge: anx7625: Fix overflow issue on reading EDID
+
+From: Pin-Yen Lin <treapking@chromium.org>
+
+[ Upstream commit d5c6f647aec9ed524aedd04a3aec5ebc21d39007 ]
+
+The length of EDID block can be longer than 256 bytes, so we should use
+`int` instead of `u8` for the `edid_pos` variable.
+
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Signed-off-by: Pin-Yen Lin <treapking@chromium.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220210103827.402436-1-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 1a871f6b6822..9b2421040926 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -791,7 +791,8 @@ static int segments_edid_read(struct anx7625_data *ctx,
+ static int sp_tx_edid_read(struct anx7625_data *ctx,
+ 			   u8 *pedid_blocks_buf)
+ {
+-	u8 offset, edid_pos;
++	u8 offset;
++	int edid_pos;
+ 	int count, blocks_num;
+ 	u8 pblock_buf[MAX_DPCD_BUFFER_SIZE];
+ 	u8 i, j;
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch b/queue-5.16/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
new file mode 100644
index 00000000000..39d501ff74b
--- /dev/null
+++ b/queue-5.16/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
@@ -0,0 +1,38 @@
+From d47862bc1c8048e8f95e3cf078e48cefbf8bf21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 12:40:59 -0500
+Subject: drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit ffb5c099aaa13ab7f73c29ea6ae26bce8d7575ae ]
+
+Add MODULE_DEVICE_TABLE to the device tree table to create required
+aliases needed for module to be loaded with device tree based platform.
+
+Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210921174059.17946-1-nm@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cdns-dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c
+index d8a15c459b42..829e1a144656 100644
+--- a/drivers/gpu/drm/bridge/cdns-dsi.c
++++ b/drivers/gpu/drm/bridge/cdns-dsi.c
+@@ -1284,6 +1284,7 @@ static const struct of_device_id cdns_dsi_of_match[] = {
+ 	{ .compatible = "cdns,dsi" },
+ 	{ },
+ };
++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match);
+ 
+ static struct platform_driver cdns_dsi_platform_driver = {
+ 	.probe  = cdns_dsi_drm_probe,
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch b/queue-5.16/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch
new file mode 100644
index 00000000000..c5b13659ead
--- /dev/null
+++ b/queue-5.16/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch
@@ -0,0 +1,58 @@
+From 10608493bbec58810aba1d87489a972c399501d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Feb 2022 15:33:37 +0100
+Subject: drm/bridge: dw-hdmi: use safe format when first in bridge chain
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 1528038385c0a706aac9ac165eeb24044fef6825 ]
+
+When the dw-hdmi bridge is in first place of the bridge chain, this
+means there is no way to select an input format of the dw-hdmi HW
+component.
+
+Since introduction of display-connector, negotiation was broken since
+the dw-hdmi negotiation code only worked when the dw-hdmi bridge was
+in last position of the bridge chain or behind another bridge also
+supporting input & output format negotiation.
+
+Commit 7cd70656d128 ("drm/bridge: display-connector: implement bus fmts callbacks")
+was introduced to make negotiation work again by making display-connector
+act as a pass-through concerning input & output format negotiation.
+
+But in the case where the dw-hdmi is single in the bridge chain, for
+example on Renesas SoCs, with the display-connector bridge the dw-hdmi
+is no more single, breaking output format.
+
+Reported-by: Biju Das <biju.das.jz@bp.renesas.com>
+Bisected-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Tested-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Fixes: 6c3c719936da ("drm/bridge: synopsys: dw-hdmi: add bus format negociation")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+[narmstrong: add proper fixes commit]
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220204143337.89221-1-narmstrong@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index e1211a5b334b..25d58dcfc87e 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -2551,8 +2551,9 @@ static u32 *dw_hdmi_bridge_atomic_get_output_bus_fmts(struct drm_bridge *bridge,
+ 	if (!output_fmts)
+ 		return NULL;
+ 
+-	/* If dw-hdmi is the only bridge, avoid negociating with ourselves */
+-	if (list_is_singular(&bridge->encoder->bridge_chain)) {
++	/* If dw-hdmi is the first or only bridge, avoid negociating with ourselves */
++	if (list_is_singular(&bridge->encoder->bridge_chain) ||
++	    list_is_first(&bridge->chain_node, &bridge->encoder->bridge_chain)) {
+ 		*num_output_fmts = 1;
+ 		output_fmts[0] = MEDIA_BUS_FMT_FIXED;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch b/queue-5.16/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
new file mode 100644
index 00000000000..8d8880af442
--- /dev/null
+++ b/queue-5.16/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
@@ -0,0 +1,39 @@
+From 172fe0e61a8af918bfeeb35e555ee38dfdab13d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Dec 2021 09:25:22 +0000
+Subject: drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 7c442e76c06cb1bef16a6c523487438175584eea ]
+
+rc_dev is allocated by rc_allocate_device(), and doesn't assigned to
+ctx->rc_dev before calling  rc_free_device(ctx->rc_dev).
+So it should call rc_free_device(rc_dev);
+
+Fixes: e25f1f7c94e1 ("drm/bridge/sii8620: add remote control support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211227092522.21755-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index 843265d7f1b1..ec7745c31da0 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -2120,7 +2120,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx)
+ 	if (ret) {
+ 		dev_err(ctx->dev, "Failed to register RC device\n");
+ 		ctx->error = ret;
+-		rc_free_device(ctx->rc_dev);
++		rc_free_device(rc_dev);
+ 		return;
+ 	}
+ 	ctx->rc_dev = rc_dev;
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch b/queue-5.16/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch
new file mode 100644
index 00000000000..88bb0d8b755
--- /dev/null
+++ b/queue-5.16/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch
@@ -0,0 +1,38 @@
+From df90748b641a5fc2ba276b76e1db0c39ead011fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jan 2022 10:48:26 +0000
+Subject: drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit b146e343a9e05605b491b1bf4a2b62a39d5638d8 ]
+
+The pm_runtime_enable will increase power disable depth.
+Thus a pairing decrement is needed on the error handling
+path to keep it balanced according to context.
+
+Fixes: 44cfc6233447 ("drm/bridge: Add NWL MIPI DSI host controller support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220105104826.1418-1-linmq006@gmail.com
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/nwl-dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
+index af07eeb47ca0..6e484d836cfe 100644
+--- a/drivers/gpu/drm/bridge/nwl-dsi.c
++++ b/drivers/gpu/drm/bridge/nwl-dsi.c
+@@ -1204,6 +1204,7 @@ static int nwl_dsi_probe(struct platform_device *pdev)
+ 
+ 	ret = nwl_dsi_select_input(dsi);
+ 	if (ret < 0) {
++		pm_runtime_disable(dev);
+ 		mipi_dsi_host_unregister(&dsi->dsi_host);
+ 		return ret;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-edid-don-t-clear-formats-if-using-deep-color.patch b/queue-5.16/drm-edid-don-t-clear-formats-if-using-deep-color.patch
new file mode 100644
index 00000000000..a45ddf52d5a
--- /dev/null
+++ b/queue-5.16/drm-edid-don-t-clear-formats-if-using-deep-color.patch
@@ -0,0 +1,76 @@
+From a433c6607bfdbd59e304d2edc37c4632c7effb3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 16:16:11 +0100
+Subject: drm/edid: Don't clear formats if using deep color
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 75478b3b393bcbdca4e6da76fe3a9f1a4133ec5d ]
+
+The current code, when parsing the EDID Deep Color depths, that the
+YUV422 cannot be used, referring to the HDMI 1.3 Specification.
+
+This specification, in its section 6.2.4, indeed states:
+
+  For each supported Deep Color mode, RGB 4:4:4 shall be supported and
+  optionally YCBCR 4:4:4 may be supported.
+
+  YCBCR 4:2:2 is not permitted for any Deep Color mode.
+
+This indeed can be interpreted like the code does, but the HDMI 1.4
+specification further clarifies that statement in its section 6.2.4:
+
+  For each supported Deep Color mode, RGB 4:4:4 shall be supported and
+  optionally YCBCR 4:4:4 may be supported.
+
+  YCBCR 4:2:2 is also 36-bit mode but does not require the further use
+  of the Deep Color modes described in section 6.5.2 and 6.5.3.
+
+This means that, even though YUV422 can be used with 12 bit per color,
+it shouldn't be treated as a deep color mode.
+
+This is also broken with YUV444 if it's supported by the display, but
+DRM_EDID_HDMI_DC_Y444 isn't set. In such a case, the code will clear
+color_formats of the YUV444 support set previously in
+drm_parse_cea_ext(), but will not set it back.
+
+Since the formats supported are already setup properly in
+drm_parse_cea_ext(), let's just remove the code modifying the formats in
+drm_parse_hdmi_deep_color_info()
+
+Fixes: d0c94692e0a3 ("drm/edid: Parse and handle HDMI deep color modes.")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220120151625.594595-3-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index f5f5de362ff2..aa9eea2c9598 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5104,16 +5104,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector,
+ 		  connector->name, dc_bpc);
+ 	info->bpc = dc_bpc;
+ 
+-	/*
+-	 * Deep color support mandates RGB444 support for all video
+-	 * modes and forbids YCRCB422 support for all video modes per
+-	 * HDMI 1.3 spec.
+-	 */
+-	info->color_formats = DRM_COLOR_FORMAT_RGB444;
+-
+ 	/* YCRCB444 is optional according to spec. */
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) {
+-		info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
+ 		DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n",
+ 			  connector->name);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-edid-split-deep-color-modes-between-rgb-and-yuv4.patch b/queue-5.16/drm-edid-split-deep-color-modes-between-rgb-and-yuv4.patch
new file mode 100644
index 00000000000..436fc3edf56
--- /dev/null
+++ b/queue-5.16/drm-edid-split-deep-color-modes-between-rgb-and-yuv4.patch
@@ -0,0 +1,153 @@
+From 644414eaaa6db7dd87fdf22c3d4362586813dc3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 16:16:12 +0100
+Subject: drm/edid: Split deep color modes between RGB and YUV444
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 4adc33f36d80489339f1b43dfeee96bb9ea8e459 ]
+
+The current code assumes that the RGB444 and YUV444 formats are the
+same, but the HDMI 2.0 specification states that:
+
+   The three DC_XXbit bits above only indicate support for RGB 4:4:4 at
+   that pixel size. Support for YCBCR 4:4:4 in Deep Color modes is
+   indicated with the DC_Y444 bit. If DC_Y444 is set, then YCBCR 4:4:4
+   is supported for all modes indicated by the DC_XXbit flags.
+
+So if we have YUV444 support and any DC_XXbit flag set but the DC_Y444
+flag isn't, we'll assume that we support that deep colour mode for
+YUV444 which breaks the specification.
+
+In order to fix this, let's split the edid_hdmi_dc_modes field in struct
+drm_display_info into two fields, one for RGB444 and one for YUV444.
+
+Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Fixes: d0c94692e0a3 ("drm/edid: Parse and handle HDMI deep color modes.")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220120151625.594595-4-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c |  2 +-
+ drivers/gpu/drm/drm_edid.c                     |  7 ++++---
+ drivers/gpu/drm/i915/display/intel_hdmi.c      |  4 ++--
+ drivers/gpu/drm/radeon/radeon_connectors.c     |  2 +-
+ include/drm/drm_connector.h                    | 12 +++++++++---
+ 5 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index df1f9b88a53f..a09876bb7ec8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -175,7 +175,7 @@ int amdgpu_connector_get_monitor_bpc(struct drm_connector *connector)
+ 
+ 			/* Check if bpc is within clock limit. Try to degrade gracefully otherwise */
+ 			if ((bpc == 12) && (mode_clock * 3/2 > max_tmds_clock)) {
+-				if ((connector->display_info.edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_30) &&
++				if ((connector->display_info.edid_hdmi_rgb444_dc_modes & DRM_EDID_HDMI_DC_30) &&
+ 				    (mode_clock * 5/4 <= max_tmds_clock))
+ 					bpc = 10;
+ 				else
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index aa9eea2c9598..027c413f2aab 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5075,21 +5075,21 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector,
+ 
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_30) {
+ 		dc_bpc = 10;
+-		info->edid_hdmi_dc_modes |= DRM_EDID_HDMI_DC_30;
++		info->edid_hdmi_rgb444_dc_modes |= DRM_EDID_HDMI_DC_30;
+ 		DRM_DEBUG("%s: HDMI sink does deep color 30.\n",
+ 			  connector->name);
+ 	}
+ 
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_36) {
+ 		dc_bpc = 12;
+-		info->edid_hdmi_dc_modes |= DRM_EDID_HDMI_DC_36;
++		info->edid_hdmi_rgb444_dc_modes |= DRM_EDID_HDMI_DC_36;
+ 		DRM_DEBUG("%s: HDMI sink does deep color 36.\n",
+ 			  connector->name);
+ 	}
+ 
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_48) {
+ 		dc_bpc = 16;
+-		info->edid_hdmi_dc_modes |= DRM_EDID_HDMI_DC_48;
++		info->edid_hdmi_rgb444_dc_modes |= DRM_EDID_HDMI_DC_48;
+ 		DRM_DEBUG("%s: HDMI sink does deep color 48.\n",
+ 			  connector->name);
+ 	}
+@@ -5106,6 +5106,7 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector,
+ 
+ 	/* YCRCB444 is optional according to spec. */
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) {
++		info->edid_hdmi_ycbcr444_dc_modes = info->edid_hdmi_rgb444_dc_modes;
+ 		DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n",
+ 			  connector->name);
+ 	}
+diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
+index 371736bdc01f..965fa8a9bdf7 100644
+--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
+@@ -1892,7 +1892,7 @@ static bool intel_hdmi_bpc_possible(struct drm_connector *connector,
+ 		if (ycbcr420_output)
+ 			return hdmi->y420_dc_modes & DRM_EDID_YCBCR420_DC_36;
+ 		else
+-			return info->edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_36;
++			return info->edid_hdmi_rgb444_dc_modes & DRM_EDID_HDMI_DC_36;
+ 	case 10:
+ 		if (DISPLAY_VER(i915) < 11)
+ 			return false;
+@@ -1903,7 +1903,7 @@ static bool intel_hdmi_bpc_possible(struct drm_connector *connector,
+ 		if (ycbcr420_output)
+ 			return hdmi->y420_dc_modes & DRM_EDID_YCBCR420_DC_30;
+ 		else
+-			return info->edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_30;
++			return info->edid_hdmi_rgb444_dc_modes & DRM_EDID_HDMI_DC_30;
+ 	case 8:
+ 		return true;
+ 	default:
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 607ad5620bd9..1546abcadacf 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -204,7 +204,7 @@ int radeon_get_monitor_bpc(struct drm_connector *connector)
+ 
+ 			/* Check if bpc is within clock limit. Try to degrade gracefully otherwise */
+ 			if ((bpc == 12) && (mode_clock * 3/2 > max_tmds_clock)) {
+-				if ((connector->display_info.edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_30) &&
++				if ((connector->display_info.edid_hdmi_rgb444_dc_modes & DRM_EDID_HDMI_DC_30) &&
+ 					(mode_clock * 5/4 <= max_tmds_clock))
+ 					bpc = 10;
+ 				else
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index 379746d3266f..dc3fa6408d7a 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -566,10 +566,16 @@ struct drm_display_info {
+ 	bool rgb_quant_range_selectable;
+ 
+ 	/**
+-	 * @edid_hdmi_dc_modes: Mask of supported hdmi deep color modes. Even
+-	 * more stuff redundant with @bus_formats.
++	 * @edid_hdmi_dc_rgb444_modes: Mask of supported hdmi deep color modes
++	 * in RGB 4:4:4. Even more stuff redundant with @bus_formats.
+ 	 */
+-	u8 edid_hdmi_dc_modes;
++	u8 edid_hdmi_rgb444_dc_modes;
++
++	/**
++	 * @edid_hdmi_dc_ycbcr444_modes: Mask of supported hdmi deep color
++	 * modes in YCbCr 4:4:4. Even more stuff redundant with @bus_formats.
++	 */
++	u8 edid_hdmi_ycbcr444_dc_modes;
+ 
+ 	/**
+ 	 * @cea_rev: CEA revision of the HDMI sink.
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-i915-display-do-not-re-enable-psr-after-it-was-m.patch b/queue-5.16/drm-i915-display-do-not-re-enable-psr-after-it-was-m.patch
new file mode 100644
index 00000000000..f259ef04042
--- /dev/null
+++ b/queue-5.16/drm-i915-display-do-not-re-enable-psr-after-it-was-m.patch
@@ -0,0 +1,63 @@
+From 15cad04b94dd948c16bb0fc83df3d834ae2540a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 10:51:49 -0800
+Subject: drm/i915/display: Do not re-enable PSR after it was marked as not
+ reliable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+[ Upstream commit 278da06c03655c2bb9bc36ebdf45b90a079b3bfd ]
+
+If a error happens and sink_not_reliable is set, PSR should be disabled
+for good but that is not happening.
+It would be disabled by the function handling the PSR error but then
+on the next fastset it would be enabled again in
+_intel_psr_post_plane_update().
+It would only be disabled for good in the next modeset where has_psr
+will be set false.
+
+v2:
+- release psr lock before continue
+
+Fixes: 9ce5884e5139 ("drm/i915/display: Only keep PSR enabled if there is active planes")
+Reported-by: Khaled Almahallawy <khaled.almahallawy@intel.com>
+Reported-by: Charlton Lin <charlton.lin@intel.com>
+Cc: Jouni Högander <jouni.hogander@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220311185149.110527-2-jose.souza@intel.com
+(cherry picked from commit 15f26bdc81f7f03561aaea5a10d87bd6638e1459)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
+index 3ba8b717e176..f7ade9c06386 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -1793,6 +1793,9 @@ static void _intel_psr_post_plane_update(const struct intel_atomic_state *state,
+ 
+ 		mutex_lock(&psr->lock);
+ 
++		if (psr->sink_not_reliable)
++			goto exit;
++
+ 		drm_WARN_ON(&dev_priv->drm, psr->enabled && !crtc_state->active_planes);
+ 
+ 		/* Only enable if there is active planes */
+@@ -1803,6 +1806,7 @@ static void _intel_psr_post_plane_update(const struct intel_atomic_state *state,
+ 		if (crtc_state->crc_enabled && psr->enabled)
+ 			psr_force_hw_tracking_exit(intel_dp);
+ 
++exit:
+ 		mutex_unlock(&psr->lock);
+ 	}
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-i915-display-fix-hpd-short-pulse-handling-for-ed.patch b/queue-5.16/drm-i915-display-fix-hpd-short-pulse-handling-for-ed.patch
new file mode 100644
index 00000000000..c5d1754eed4
--- /dev/null
+++ b/queue-5.16/drm-i915-display-fix-hpd-short-pulse-handling-for-ed.patch
@@ -0,0 +1,97 @@
+From 5147f901f5c789105e126bbd075c6fefe0961ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 10:51:48 -0800
+Subject: drm/i915/display: Fix HPD short pulse handling for eDP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+[ Upstream commit 3a84fd1ed53582b31e843a152ee3219e9e4ccb8c ]
+
+Commit 13ea6db2cf24 ("drm/i915/edp: Ignore short pulse when panel
+powered off") completely broke short pulse handling for eDP as it is
+usually generated by sink when it is displaying image and there is
+some error or status that source needs to handle.
+
+When power panel is enabled, this state is enough to power aux
+transactions and VDD override is disabled, so intel_pps_have_power()
+is always returning false causing short pulses to be ignored.
+
+So here better naming this function that intends to check if aux
+lines are powered to avoid the endless cycle mentioned in the commit
+being fixed and fixing the check for what it is intended.
+
+v2:
+- renamed to intel_pps_have_panel_power_or_vdd()
+- fixed indentation
+
+Fixes: 13ea6db2cf24 ("drm/i915/edp: Ignore short pulse when panel powered off")
+Cc: Anshuman Gupta <anshuman.gupta@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Uma Shankar <uma.shankar@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220311185149.110527-1-jose.souza@intel.com
+(cherry picked from commit 8f0c1c0949b609acfad62b8d5f742a3b5e7b05ab)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_dp.c  | 2 +-
+ drivers/gpu/drm/i915/display/intel_pps.c | 6 +++---
+ drivers/gpu/drm/i915/display/intel_pps.h | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
+index a552f05a67e5..3ee0f2fc9c21 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -4742,7 +4742,7 @@ intel_dp_hpd_pulse(struct intel_digital_port *dig_port, bool long_hpd)
+ 	struct intel_dp *intel_dp = &dig_port->dp;
+ 
+ 	if (dig_port->base.type == INTEL_OUTPUT_EDP &&
+-	    (long_hpd || !intel_pps_have_power(intel_dp))) {
++	    (long_hpd || !intel_pps_have_panel_power_or_vdd(intel_dp))) {
+ 		/*
+ 		 * vdd off can generate a long/short pulse on eDP which
+ 		 * would require vdd on to handle it, and thus we
+diff --git a/drivers/gpu/drm/i915/display/intel_pps.c b/drivers/gpu/drm/i915/display/intel_pps.c
+index e9c679bb1b2e..5edd188d9747 100644
+--- a/drivers/gpu/drm/i915/display/intel_pps.c
++++ b/drivers/gpu/drm/i915/display/intel_pps.c
+@@ -1075,14 +1075,14 @@ static void intel_pps_vdd_sanitize(struct intel_dp *intel_dp)
+ 	edp_panel_vdd_schedule_off(intel_dp);
+ }
+ 
+-bool intel_pps_have_power(struct intel_dp *intel_dp)
++bool intel_pps_have_panel_power_or_vdd(struct intel_dp *intel_dp)
+ {
+ 	intel_wakeref_t wakeref;
+ 	bool have_power = false;
+ 
+ 	with_intel_pps_lock(intel_dp, wakeref) {
+-		have_power = edp_have_panel_power(intel_dp) &&
+-						  edp_have_panel_vdd(intel_dp);
++		have_power = edp_have_panel_power(intel_dp) ||
++			     edp_have_panel_vdd(intel_dp);
+ 	}
+ 
+ 	return have_power;
+diff --git a/drivers/gpu/drm/i915/display/intel_pps.h b/drivers/gpu/drm/i915/display/intel_pps.h
+index fbb47f6f453e..e64144659d31 100644
+--- a/drivers/gpu/drm/i915/display/intel_pps.h
++++ b/drivers/gpu/drm/i915/display/intel_pps.h
+@@ -37,7 +37,7 @@ void intel_pps_vdd_on(struct intel_dp *intel_dp);
+ void intel_pps_on(struct intel_dp *intel_dp);
+ void intel_pps_off(struct intel_dp *intel_dp);
+ void intel_pps_vdd_off_sync(struct intel_dp *intel_dp);
+-bool intel_pps_have_power(struct intel_dp *intel_dp);
++bool intel_pps_have_panel_power_or_vdd(struct intel_dp *intel_dp);
+ void intel_pps_wait_power_cycle(struct intel_dp *intel_dp);
+ 
+ void intel_pps_init(struct intel_dp *intel_dp);
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-locking-fix-drm_modeset_acquire_ctx-kernel-doc.patch b/queue-5.16/drm-locking-fix-drm_modeset_acquire_ctx-kernel-doc.patch
new file mode 100644
index 00000000000..41c732835d0
--- /dev/null
+++ b/queue-5.16/drm-locking-fix-drm_modeset_acquire_ctx-kernel-doc.patch
@@ -0,0 +1,41 @@
+From cbf76a5ccc16fe0de4b584be146d87611f7f1613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 11:48:56 +0200
+Subject: drm/locking: fix drm_modeset_acquire_ctx kernel-doc
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit 6f043b5969a4d6d385ca429388ded37e30e0d179 ]
+
+The stack_depot member was added without kernel-doc, leading to below
+warning. Fix it.
+
+./include/drm/drm_modeset_lock.h:74: warning: Function parameter or
+member 'stack_depot' not described in 'drm_modeset_acquire_ctx'
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: cd06ab2fd48f ("drm/locking: add backtrace for locking contended locks without backoff")
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Tested-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220120094856.3004147-1-jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_modeset_lock.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/drm/drm_modeset_lock.h b/include/drm/drm_modeset_lock.h
+index b84693fbd2b5..ec4f543c3d95 100644
+--- a/include/drm/drm_modeset_lock.h
++++ b/include/drm/drm_modeset_lock.h
+@@ -34,6 +34,7 @@ struct drm_modeset_lock;
+  * struct drm_modeset_acquire_ctx - locking context (see ww_acquire_ctx)
+  * @ww_ctx: base acquire ctx
+  * @contended: used internally for -EDEADLK handling
++ * @stack_depot: used internally for contention debugging
+  * @locked: list of held locks
+  * @trylock_only: trylock mode used in atomic contexts/panic notifiers
+  * @interruptible: whether interruptible locking should be used.
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch b/queue-5.16/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch
new file mode 100644
index 00000000000..11d31c15cd6
--- /dev/null
+++ b/queue-5.16/drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch
@@ -0,0 +1,91 @@
+From 200056b983f1c2a6fd022ea1c3dd391d5c2e9558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Dec 2021 00:55:15 +0100
+Subject: drm/meson: Fix error handling when afbcd.ops->init fails
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit fa747d75f65d1b1cbc3f4691fa67b695e8a399c8 ]
+
+When afbcd.ops->init fails we need to free the struct drm_device. Also
+all errors which come after afbcd.ops->init was successful need to exit
+the AFBCD, just like meson_drv_unbind() does.
+
+Fixes: d1b5e41e13a7e9 ("drm/meson: Add AFBCD module driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211230235515.1627522-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 45bfe9451db8..c98525d60df5 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -302,42 +302,42 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
+ 	if (priv->afbcd.ops) {
+ 		ret = priv->afbcd.ops->init(priv);
+ 		if (ret)
+-			return ret;
++			goto free_drm;
+ 	}
+ 
+ 	/* Encoder Initialization */
+ 
+ 	ret = meson_venc_cvbs_create(priv);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	if (has_components) {
+ 		ret = component_bind_all(drm->dev, drm);
+ 		if (ret) {
+ 			dev_err(drm->dev, "Couldn't bind all components\n");
+-			goto free_drm;
++			goto exit_afbcd;
+ 		}
+ 	}
+ 
+ 	ret = meson_encoder_hdmi_init(priv);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	ret = meson_plane_create(priv);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	ret = meson_overlay_create(priv);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	ret = meson_crtc_create(priv);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	ret = request_irq(priv->vsync_irq, meson_irq, 0, drm->driver->name, drm);
+ 	if (ret)
+-		goto free_drm;
++		goto exit_afbcd;
+ 
+ 	drm_mode_config_reset(drm);
+ 
+@@ -355,6 +355,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
+ 
+ uninstall_irq:
+ 	free_irq(priv->vsync_irq, drm);
++exit_afbcd:
++	if (priv->afbcd.ops)
++		priv->afbcd.ops->exit(priv);
+ free_drm:
+ 	drm_dev_put(drm);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch b/queue-5.16/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch
new file mode 100644
index 00000000000..77cea904867
--- /dev/null
+++ b/queue-5.16/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch
@@ -0,0 +1,144 @@
+From 4bbc13250ee7df3cf6b84946705ec85642d46f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Dec 2021 00:55:14 +0100
+Subject: drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 04b8a5d9cfd171f65df75f444b5617a372649edd ]
+
+Use this to simplify the driver shutdown. It will also come handy when
+fixing the error handling in meson_drv_bind_master().
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Fixes: d1b5e41e13a7e9 ("drm/meson: Add AFBCD module driver")
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211230235515.1627522-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c       |  6 ++--
+ drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++++++++++++++++---------
+ drivers/gpu/drm/meson/meson_osd_afbcd.h |  1 +
+ 3 files changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 7f41a33592c8..923377f856de 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -380,10 +380,8 @@ static void meson_drv_unbind(struct device *dev)
+ 	free_irq(priv->vsync_irq, drm);
+ 	drm_dev_put(drm);
+ 
+-	if (priv->afbcd.ops) {
+-		priv->afbcd.ops->reset(priv);
+-		meson_rdma_free(priv);
+-	}
++	if (priv->afbcd.ops)
++		priv->afbcd.ops->exit(priv);
+ }
+ 
+ static const struct component_master_ops meson_drv_master_ops = {
+diff --git a/drivers/gpu/drm/meson/meson_osd_afbcd.c b/drivers/gpu/drm/meson/meson_osd_afbcd.c
+index ffc6b584dbf8..0cdbe899402f 100644
+--- a/drivers/gpu/drm/meson/meson_osd_afbcd.c
++++ b/drivers/gpu/drm/meson/meson_osd_afbcd.c
+@@ -79,11 +79,6 @@ static bool meson_gxm_afbcd_supported_fmt(u64 modifier, uint32_t format)
+ 	return meson_gxm_afbcd_pixel_fmt(modifier, format) >= 0;
+ }
+ 
+-static int meson_gxm_afbcd_init(struct meson_drm *priv)
+-{
+-	return 0;
+-}
+-
+ static int meson_gxm_afbcd_reset(struct meson_drm *priv)
+ {
+ 	writel_relaxed(VIU_SW_RESET_OSD1_AFBCD,
+@@ -93,6 +88,16 @@ static int meson_gxm_afbcd_reset(struct meson_drm *priv)
+ 	return 0;
+ }
+ 
++static int meson_gxm_afbcd_init(struct meson_drm *priv)
++{
++	return 0;
++}
++
++static void meson_gxm_afbcd_exit(struct meson_drm *priv)
++{
++	meson_gxm_afbcd_reset(priv);
++}
++
+ static int meson_gxm_afbcd_enable(struct meson_drm *priv)
+ {
+ 	writel_relaxed(FIELD_PREP(OSD1_AFBCD_ID_FIFO_THRD, 0x40) |
+@@ -172,6 +177,7 @@ static int meson_gxm_afbcd_setup(struct meson_drm *priv)
+ 
+ struct meson_afbcd_ops meson_afbcd_gxm_ops = {
+ 	.init = meson_gxm_afbcd_init,
++	.exit = meson_gxm_afbcd_exit,
+ 	.reset = meson_gxm_afbcd_reset,
+ 	.enable = meson_gxm_afbcd_enable,
+ 	.disable = meson_gxm_afbcd_disable,
+@@ -269,6 +275,18 @@ static bool meson_g12a_afbcd_supported_fmt(u64 modifier, uint32_t format)
+ 	return meson_g12a_afbcd_pixel_fmt(modifier, format) >= 0;
+ }
+ 
++static int meson_g12a_afbcd_reset(struct meson_drm *priv)
++{
++	meson_rdma_reset(priv);
++
++	meson_rdma_writel_sync(priv, VIU_SW_RESET_G12A_AFBC_ARB |
++			       VIU_SW_RESET_G12A_OSD1_AFBCD,
++			       VIU_SW_RESET);
++	meson_rdma_writel_sync(priv, 0, VIU_SW_RESET);
++
++	return 0;
++}
++
+ static int meson_g12a_afbcd_init(struct meson_drm *priv)
+ {
+ 	int ret;
+@@ -286,16 +304,10 @@ static int meson_g12a_afbcd_init(struct meson_drm *priv)
+ 	return 0;
+ }
+ 
+-static int meson_g12a_afbcd_reset(struct meson_drm *priv)
++static void meson_g12a_afbcd_exit(struct meson_drm *priv)
+ {
+-	meson_rdma_reset(priv);
+-
+-	meson_rdma_writel_sync(priv, VIU_SW_RESET_G12A_AFBC_ARB |
+-			       VIU_SW_RESET_G12A_OSD1_AFBCD,
+-			       VIU_SW_RESET);
+-	meson_rdma_writel_sync(priv, 0, VIU_SW_RESET);
+-
+-	return 0;
++	meson_g12a_afbcd_reset(priv);
++	meson_rdma_free(priv);
+ }
+ 
+ static int meson_g12a_afbcd_enable(struct meson_drm *priv)
+@@ -380,6 +392,7 @@ static int meson_g12a_afbcd_setup(struct meson_drm *priv)
+ 
+ struct meson_afbcd_ops meson_afbcd_g12a_ops = {
+ 	.init = meson_g12a_afbcd_init,
++	.exit = meson_g12a_afbcd_exit,
+ 	.reset = meson_g12a_afbcd_reset,
+ 	.enable = meson_g12a_afbcd_enable,
+ 	.disable = meson_g12a_afbcd_disable,
+diff --git a/drivers/gpu/drm/meson/meson_osd_afbcd.h b/drivers/gpu/drm/meson/meson_osd_afbcd.h
+index 5e5523304f42..e77ddeb6416f 100644
+--- a/drivers/gpu/drm/meson/meson_osd_afbcd.h
++++ b/drivers/gpu/drm/meson/meson_osd_afbcd.h
+@@ -14,6 +14,7 @@
+ 
+ struct meson_afbcd_ops {
+ 	int (*init)(struct meson_drm *priv);
++	void (*exit)(struct meson_drm *priv);
+ 	int (*reset)(struct meson_drm *priv);
+ 	int (*enable)(struct meson_drm *priv);
+ 	int (*disable)(struct meson_drm *priv);
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-meson-split-out-encoder-from-meson_dw_hdmi.patch b/queue-5.16/drm-meson-split-out-encoder-from-meson_dw_hdmi.patch
new file mode 100644
index 00000000000..dd7aa7a2a27
--- /dev/null
+++ b/queue-5.16/drm-meson-split-out-encoder-from-meson_dw_hdmi.patch
@@ -0,0 +1,948 @@
+From 540046a17598b7cb1f15190c4657b70fb353bd9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 14:39:44 +0200
+Subject: drm/meson: split out encoder from meson_dw_hdmi
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit e67f6037ae1be34b2b686bab72caa41d57714534 ]
+
+This moves all the non-DW-HDMI code where it should be:
+an encoder in the drm/meson core driver.
+
+The bridge functions are copied as-is, except:
+- the encoder init uses the simple kms helper
+- the mode_set has been moved to atomic_enable()
+- debug prints are converted to dev_debg()
+
+For now the bridge attach flags is 0, DRM_BRIDGE_ATTACH_NO_CONNECTOR
+will be handled later.
+
+The meson dw-hdmi glue is slightly fixed to live without the
+encoder in the same driver.
+
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+[narmstrong: fixed warning because missing meson_encoder_hdmi.h include]
+Link: https://patchwork.freedesktop.org/patch/msgid/20211020123947.2585572-4-narmstrong@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/Makefile             |   1 +
+ drivers/gpu/drm/meson/meson_drv.c          |   5 +
+ drivers/gpu/drm/meson/meson_dw_hdmi.c      | 341 ++-----------------
+ drivers/gpu/drm/meson/meson_encoder_hdmi.c | 370 +++++++++++++++++++++
+ drivers/gpu/drm/meson/meson_encoder_hdmi.h |  12 +
+ 5 files changed, 407 insertions(+), 322 deletions(-)
+ create mode 100644 drivers/gpu/drm/meson/meson_encoder_hdmi.c
+ create mode 100644 drivers/gpu/drm/meson/meson_encoder_hdmi.h
+
+diff --git a/drivers/gpu/drm/meson/Makefile b/drivers/gpu/drm/meson/Makefile
+index 28a519cdf66b..523fce45f16b 100644
+--- a/drivers/gpu/drm/meson/Makefile
++++ b/drivers/gpu/drm/meson/Makefile
+@@ -2,6 +2,7 @@
+ meson-drm-y := meson_drv.o meson_plane.o meson_crtc.o meson_venc_cvbs.o
+ meson-drm-y += meson_viu.o meson_vpp.o meson_venc.o meson_vclk.o meson_overlay.o
+ meson-drm-y += meson_rdma.o meson_osd_afbcd.o
++meson-drm-y += meson_encoder_hdmi.o
+ 
+ obj-$(CONFIG_DRM_MESON) += meson-drm.o
+ obj-$(CONFIG_DRM_MESON_DW_HDMI) += meson_dw_hdmi.o
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 923377f856de..45bfe9451db8 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -32,6 +32,7 @@
+ #include "meson_osd_afbcd.h"
+ #include "meson_registers.h"
+ #include "meson_venc_cvbs.h"
++#include "meson_encoder_hdmi.h"
+ #include "meson_viu.h"
+ #include "meson_vpp.h"
+ #include "meson_rdma.h"
+@@ -318,6 +319,10 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
+ 		}
+ 	}
+ 
++	ret = meson_encoder_hdmi_init(priv);
++	if (ret)
++		goto free_drm;
++
+ 	ret = meson_plane_create(priv);
+ 	if (ret)
+ 		goto free_drm;
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 0afbd1e70bfc..fb540a503efe 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -22,14 +22,11 @@
+ #include <drm/drm_probe_helper.h>
+ #include <drm/drm_print.h>
+ 
+-#include <linux/media-bus-format.h>
+ #include <linux/videodev2.h>
+ 
+ #include "meson_drv.h"
+ #include "meson_dw_hdmi.h"
+ #include "meson_registers.h"
+-#include "meson_vclk.h"
+-#include "meson_venc.h"
+ 
+ #define DRIVER_NAME "meson-dw-hdmi"
+ #define DRIVER_DESC "Amlogic Meson HDMI-TX DRM driver"
+@@ -135,8 +132,6 @@ struct meson_dw_hdmi_data {
+ };
+ 
+ struct meson_dw_hdmi {
+-	struct drm_encoder encoder;
+-	struct drm_bridge bridge;
+ 	struct dw_hdmi_plat_data dw_plat_data;
+ 	struct meson_drm *priv;
+ 	struct device *dev;
+@@ -148,12 +143,8 @@ struct meson_dw_hdmi {
+ 	struct regulator *hdmi_supply;
+ 	u32 irq_stat;
+ 	struct dw_hdmi *hdmi;
+-	unsigned long output_bus_fmt;
++	struct drm_bridge *bridge;
+ };
+-#define encoder_to_meson_dw_hdmi(x) \
+-	container_of(x, struct meson_dw_hdmi, encoder)
+-#define bridge_to_meson_dw_hdmi(x) \
+-	container_of(x, struct meson_dw_hdmi, bridge)
+ 
+ static inline int dw_hdmi_is_compatible(struct meson_dw_hdmi *dw_hdmi,
+ 					const char *compat)
+@@ -295,14 +286,14 @@ static inline void dw_hdmi_dwc_write_bits(struct meson_dw_hdmi *dw_hdmi,
+ 
+ /* Setup PHY bandwidth modes */
+ static void meson_hdmi_phy_setup_mode(struct meson_dw_hdmi *dw_hdmi,
+-				      const struct drm_display_mode *mode)
++				      const struct drm_display_mode *mode,
++				      bool mode_is_420)
+ {
+ 	struct meson_drm *priv = dw_hdmi->priv;
+ 	unsigned int pixel_clock = mode->clock;
+ 
+ 	/* For 420, pixel clock is half unlike venc clock */
+-	if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
+-		pixel_clock /= 2;
++	if (mode_is_420) pixel_clock /= 2;
+ 
+ 	if (dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxl-dw-hdmi") ||
+ 	    dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxm-dw-hdmi")) {
+@@ -374,68 +365,25 @@ static inline void meson_dw_hdmi_phy_reset(struct meson_dw_hdmi *dw_hdmi)
+ 	mdelay(2);
+ }
+ 
+-static void dw_hdmi_set_vclk(struct meson_dw_hdmi *dw_hdmi,
+-			     const struct drm_display_mode *mode)
+-{
+-	struct meson_drm *priv = dw_hdmi->priv;
+-	int vic = drm_match_cea_mode(mode);
+-	unsigned int phy_freq;
+-	unsigned int vclk_freq;
+-	unsigned int venc_freq;
+-	unsigned int hdmi_freq;
+-
+-	vclk_freq = mode->clock;
+-
+-	/* For 420, pixel clock is half unlike venc clock */
+-	if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
+-		vclk_freq /= 2;
+-
+-	/* TMDS clock is pixel_clock * 10 */
+-	phy_freq = vclk_freq * 10;
+-
+-	if (!vic) {
+-		meson_vclk_setup(priv, MESON_VCLK_TARGET_DMT, phy_freq,
+-				 vclk_freq, vclk_freq, vclk_freq, false);
+-		return;
+-	}
+-
+-	/* 480i/576i needs global pixel doubling */
+-	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+-		vclk_freq *= 2;
+-
+-	venc_freq = vclk_freq;
+-	hdmi_freq = vclk_freq;
+-
+-	/* VENC double pixels for 1080i, 720p and YUV420 modes */
+-	if (meson_venc_hdmi_venc_repeat(vic) ||
+-	    dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
+-		venc_freq *= 2;
+-
+-	vclk_freq = max(venc_freq, hdmi_freq);
+-
+-	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+-		venc_freq /= 2;
+-
+-	DRM_DEBUG_DRIVER("vclk:%d phy=%d venc=%d hdmi=%d enci=%d\n",
+-		phy_freq, vclk_freq, venc_freq, hdmi_freq,
+-		priv->venc.hdmi_use_enci);
+-
+-	meson_vclk_setup(priv, MESON_VCLK_TARGET_HDMI, phy_freq, vclk_freq,
+-			 venc_freq, hdmi_freq, priv->venc.hdmi_use_enci);
+-}
+-
+ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,
+ 			    const struct drm_display_info *display,
+ 			    const struct drm_display_mode *mode)
+ {
+ 	struct meson_dw_hdmi *dw_hdmi = (struct meson_dw_hdmi *)data;
++	bool is_hdmi2_sink = display->hdmi.scdc.supported;
+ 	struct meson_drm *priv = dw_hdmi->priv;
+ 	unsigned int wr_clk =
+ 		readl_relaxed(priv->io_base + _REG(VPU_HDMI_SETTING));
++	bool mode_is_420 = false;
+ 
+ 	DRM_DEBUG_DRIVER("\"%s\" div%d\n", mode->name,
+ 			 mode->clock > 340000 ? 40 : 10);
+ 
++	if (drm_mode_is_420_only(display, mode) ||
++	    (!is_hdmi2_sink &&
++	     drm_mode_is_420_also(display, mode)))
++		mode_is_420 = true;
++
+ 	/* Enable clocks */
+ 	regmap_update_bits(priv->hhi, HHI_HDMI_CLK_CNTL, 0xffff, 0x100);
+ 
+@@ -457,8 +405,7 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,
+ 	dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
+ 
+ 	/* TMDS pattern setup */
+-	if (mode->clock > 340000 &&
+-	    dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_YUV8_1X24) {
++	if (mode->clock > 340000 && !mode_is_420) {
+ 		dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_01,
+ 				  0);
+ 		dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_23,
+@@ -476,7 +423,7 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,
+ 	dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_CNTL, 0x2);
+ 
+ 	/* Setup PHY parameters */
+-	meson_hdmi_phy_setup_mode(dw_hdmi, mode);
++	meson_hdmi_phy_setup_mode(dw_hdmi, mode, mode_is_420);
+ 
+ 	/* Setup PHY */
+ 	regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+@@ -622,214 +569,15 @@ static irqreturn_t dw_hdmi_top_thread_irq(int irq, void *dev_id)
+ 		dw_hdmi_setup_rx_sense(dw_hdmi->hdmi, hpd_connected,
+ 				       hpd_connected);
+ 
+-		drm_helper_hpd_irq_event(dw_hdmi->encoder.dev);
++		drm_helper_hpd_irq_event(dw_hdmi->bridge->dev);
++		drm_bridge_hpd_notify(dw_hdmi->bridge,
++				      hpd_connected ? connector_status_connected
++						    : connector_status_disconnected);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+ }
+ 
+-static enum drm_mode_status
+-dw_hdmi_mode_valid(struct dw_hdmi *hdmi, void *data,
+-		   const struct drm_display_info *display_info,
+-		   const struct drm_display_mode *mode)
+-{
+-	struct meson_dw_hdmi *dw_hdmi = data;
+-	struct meson_drm *priv = dw_hdmi->priv;
+-	bool is_hdmi2_sink = display_info->hdmi.scdc.supported;
+-	unsigned int phy_freq;
+-	unsigned int vclk_freq;
+-	unsigned int venc_freq;
+-	unsigned int hdmi_freq;
+-	int vic = drm_match_cea_mode(mode);
+-	enum drm_mode_status status;
+-
+-	DRM_DEBUG_DRIVER("Modeline " DRM_MODE_FMT "\n", DRM_MODE_ARG(mode));
+-
+-	/* If sink does not support 540MHz, reject the non-420 HDMI2 modes */
+-	if (display_info->max_tmds_clock &&
+-	    mode->clock > display_info->max_tmds_clock &&
+-	    !drm_mode_is_420_only(display_info, mode) &&
+-	    !drm_mode_is_420_also(display_info, mode))
+-		return MODE_BAD;
+-
+-	/* Check against non-VIC supported modes */
+-	if (!vic) {
+-		status = meson_venc_hdmi_supported_mode(mode);
+-		if (status != MODE_OK)
+-			return status;
+-
+-		return meson_vclk_dmt_supported_freq(priv, mode->clock);
+-	/* Check against supported VIC modes */
+-	} else if (!meson_venc_hdmi_supported_vic(vic))
+-		return MODE_BAD;
+-
+-	vclk_freq = mode->clock;
+-
+-	/* For 420, pixel clock is half unlike venc clock */
+-	if (drm_mode_is_420_only(display_info, mode) ||
+-	    (!is_hdmi2_sink &&
+-	     drm_mode_is_420_also(display_info, mode)))
+-		vclk_freq /= 2;
+-
+-	/* TMDS clock is pixel_clock * 10 */
+-	phy_freq = vclk_freq * 10;
+-
+-	/* 480i/576i needs global pixel doubling */
+-	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+-		vclk_freq *= 2;
+-
+-	venc_freq = vclk_freq;
+-	hdmi_freq = vclk_freq;
+-
+-	/* VENC double pixels for 1080i, 720p and YUV420 modes */
+-	if (meson_venc_hdmi_venc_repeat(vic) ||
+-	    drm_mode_is_420_only(display_info, mode) ||
+-	    (!is_hdmi2_sink &&
+-	     drm_mode_is_420_also(display_info, mode)))
+-		venc_freq *= 2;
+-
+-	vclk_freq = max(venc_freq, hdmi_freq);
+-
+-	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+-		venc_freq /= 2;
+-
+-	dev_dbg(dw_hdmi->dev, "%s: vclk:%d phy=%d venc=%d hdmi=%d\n",
+-		__func__, phy_freq, vclk_freq, venc_freq, hdmi_freq);
+-
+-	return meson_vclk_vic_supported_freq(priv, phy_freq, vclk_freq);
+-}
+-
+-/* Encoder */
+-
+-static const u32 meson_dw_hdmi_out_bus_fmts[] = {
+-	MEDIA_BUS_FMT_YUV8_1X24,
+-	MEDIA_BUS_FMT_UYYVYY8_0_5X24,
+-};
+-
+-static void meson_venc_hdmi_encoder_destroy(struct drm_encoder *encoder)
+-{
+-	drm_encoder_cleanup(encoder);
+-}
+-
+-static const struct drm_encoder_funcs meson_venc_hdmi_encoder_funcs = {
+-	.destroy        = meson_venc_hdmi_encoder_destroy,
+-};
+-
+-static u32 *
+-meson_venc_hdmi_encoder_get_inp_bus_fmts(struct drm_bridge *bridge,
+-					struct drm_bridge_state *bridge_state,
+-					struct drm_crtc_state *crtc_state,
+-					struct drm_connector_state *conn_state,
+-					u32 output_fmt,
+-					unsigned int *num_input_fmts)
+-{
+-	u32 *input_fmts = NULL;
+-	int i;
+-
+-	*num_input_fmts = 0;
+-
+-	for (i = 0 ; i < ARRAY_SIZE(meson_dw_hdmi_out_bus_fmts) ; ++i) {
+-		if (output_fmt == meson_dw_hdmi_out_bus_fmts[i]) {
+-			*num_input_fmts = 1;
+-			input_fmts = kcalloc(*num_input_fmts,
+-					     sizeof(*input_fmts),
+-					     GFP_KERNEL);
+-			if (!input_fmts)
+-				return NULL;
+-
+-			input_fmts[0] = output_fmt;
+-
+-			break;
+-		}
+-	}
+-
+-	return input_fmts;
+-}
+-
+-static int meson_venc_hdmi_encoder_atomic_check(struct drm_bridge *bridge,
+-					struct drm_bridge_state *bridge_state,
+-					struct drm_crtc_state *crtc_state,
+-					struct drm_connector_state *conn_state)
+-{
+-	struct meson_dw_hdmi *dw_hdmi = bridge_to_meson_dw_hdmi(bridge);
+-
+-	dw_hdmi->output_bus_fmt = bridge_state->output_bus_cfg.format;
+-
+-	DRM_DEBUG_DRIVER("output_bus_fmt %lx\n", dw_hdmi->output_bus_fmt);
+-
+-	return 0;
+-}
+-
+-static void meson_venc_hdmi_encoder_disable(struct drm_bridge *bridge)
+-{
+-	struct meson_dw_hdmi *dw_hdmi = bridge_to_meson_dw_hdmi(bridge);
+-	struct meson_drm *priv = dw_hdmi->priv;
+-
+-	DRM_DEBUG_DRIVER("\n");
+-
+-	writel_bits_relaxed(0x3, 0,
+-			    priv->io_base + _REG(VPU_HDMI_SETTING));
+-
+-	writel_relaxed(0, priv->io_base + _REG(ENCI_VIDEO_EN));
+-	writel_relaxed(0, priv->io_base + _REG(ENCP_VIDEO_EN));
+-}
+-
+-static void meson_venc_hdmi_encoder_enable(struct drm_bridge *bridge)
+-{
+-	struct meson_dw_hdmi *dw_hdmi = bridge_to_meson_dw_hdmi(bridge);
+-	struct meson_drm *priv = dw_hdmi->priv;
+-
+-	DRM_DEBUG_DRIVER("%s\n", priv->venc.hdmi_use_enci ? "VENCI" : "VENCP");
+-
+-	if (priv->venc.hdmi_use_enci)
+-		writel_relaxed(1, priv->io_base + _REG(ENCI_VIDEO_EN));
+-	else
+-		writel_relaxed(1, priv->io_base + _REG(ENCP_VIDEO_EN));
+-}
+-
+-static void meson_venc_hdmi_encoder_mode_set(struct drm_bridge *bridge,
+-				   const struct drm_display_mode *mode,
+-				   const struct drm_display_mode *adjusted_mode)
+-{
+-	struct meson_dw_hdmi *dw_hdmi = bridge_to_meson_dw_hdmi(bridge);
+-	struct meson_drm *priv = dw_hdmi->priv;
+-	int vic = drm_match_cea_mode(mode);
+-	unsigned int ycrcb_map = VPU_HDMI_OUTPUT_CBYCR;
+-	bool yuv420_mode = false;
+-
+-	DRM_DEBUG_DRIVER("\"%s\" vic %d\n", mode->name, vic);
+-
+-	if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24) {
+-		ycrcb_map = VPU_HDMI_OUTPUT_CRYCB;
+-		yuv420_mode = true;
+-	}
+-
+-	/* VENC + VENC-DVI Mode setup */
+-	meson_venc_hdmi_mode_set(priv, vic, ycrcb_map, yuv420_mode, mode);
+-
+-	/* VCLK Set clock */
+-	dw_hdmi_set_vclk(dw_hdmi, mode);
+-
+-	if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
+-		/* Setup YUV420 to HDMI-TX, no 10bit diphering */
+-		writel_relaxed(2 | (2 << 2),
+-			       priv->io_base + _REG(VPU_HDMI_FMT_CTRL));
+-	else
+-		/* Setup YUV444 to HDMI-TX, no 10bit diphering */
+-		writel_relaxed(0, priv->io_base + _REG(VPU_HDMI_FMT_CTRL));
+-}
+-
+-static const struct drm_bridge_funcs meson_venc_hdmi_encoder_bridge_funcs = {
+-	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+-	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+-	.atomic_get_input_bus_fmts = meson_venc_hdmi_encoder_get_inp_bus_fmts,
+-	.atomic_reset = drm_atomic_helper_bridge_reset,
+-	.atomic_check = meson_venc_hdmi_encoder_atomic_check,
+-	.enable	= meson_venc_hdmi_encoder_enable,
+-	.disable = meson_venc_hdmi_encoder_disable,
+-	.mode_set = meson_venc_hdmi_encoder_mode_set,
+-};
+-
+ /* DW HDMI Regmap */
+ 
+ static int meson_dw_hdmi_reg_read(void *context, unsigned int reg,
+@@ -876,28 +624,6 @@ static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = {
+ 	.dwc_write = dw_hdmi_g12a_dwc_write,
+ };
+ 
+-static bool meson_hdmi_connector_is_available(struct device *dev)
+-{
+-	struct device_node *ep, *remote;
+-
+-	/* HDMI Connector is on the second port, first endpoint */
+-	ep = of_graph_get_endpoint_by_regs(dev->of_node, 1, 0);
+-	if (!ep)
+-		return false;
+-
+-	/* If the endpoint node exists, consider it enabled */
+-	remote = of_graph_get_remote_port(ep);
+-	if (remote) {
+-		of_node_put(ep);
+-		return true;
+-	}
+-
+-	of_node_put(ep);
+-	of_node_put(remote);
+-
+-	return false;
+-}
+-
+ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
+ {
+ 	struct meson_drm *priv = meson_dw_hdmi->priv;
+@@ -976,18 +702,11 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	struct drm_device *drm = data;
+ 	struct meson_drm *priv = drm->dev_private;
+ 	struct dw_hdmi_plat_data *dw_plat_data;
+-	struct drm_bridge *next_bridge;
+-	struct drm_encoder *encoder;
+ 	int irq;
+ 	int ret;
+ 
+ 	DRM_DEBUG_DRIVER("\n");
+ 
+-	if (!meson_hdmi_connector_is_available(dev)) {
+-		dev_info(drm->dev, "HDMI Output connector not available\n");
+-		return -ENODEV;
+-	}
+-
+ 	match = of_device_get_match_data(&pdev->dev);
+ 	if (!match) {
+ 		dev_err(&pdev->dev, "failed to get match data\n");
+@@ -1003,7 +722,6 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	meson_dw_hdmi->dev = dev;
+ 	meson_dw_hdmi->data = match;
+ 	dw_plat_data = &meson_dw_hdmi->dw_plat_data;
+-	encoder = &meson_dw_hdmi->encoder;
+ 
+ 	meson_dw_hdmi->hdmi_supply = devm_regulator_get_optional(dev, "hdmi");
+ 	if (IS_ERR(meson_dw_hdmi->hdmi_supply)) {
+@@ -1074,28 +792,11 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 		return ret;
+ 	}
+ 
+-	/* Encoder */
+-
+-	ret = drm_encoder_init(drm, encoder, &meson_venc_hdmi_encoder_funcs,
+-			       DRM_MODE_ENCODER_TMDS, "meson_hdmi");
+-	if (ret) {
+-		dev_err(priv->dev, "Failed to init HDMI encoder\n");
+-		return ret;
+-	}
+-
+-	meson_dw_hdmi->bridge.funcs = &meson_venc_hdmi_encoder_bridge_funcs;
+-	drm_bridge_attach(encoder, &meson_dw_hdmi->bridge, NULL, 0);
+-
+-	encoder->possible_crtcs = BIT(0);
+-
+ 	meson_dw_hdmi_init(meson_dw_hdmi);
+ 
+-	DRM_DEBUG_DRIVER("encoder initialized\n");
+-
+ 	/* Bridge / Connector */
+ 
+ 	dw_plat_data->priv_data = meson_dw_hdmi;
+-	dw_plat_data->mode_valid = dw_hdmi_mode_valid;
+ 	dw_plat_data->phy_ops = &meson_dw_hdmi_phy_ops;
+ 	dw_plat_data->phy_name = "meson_dw_hdmi_phy";
+ 	dw_plat_data->phy_data = meson_dw_hdmi;
+@@ -1110,15 +811,11 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 
+ 	platform_set_drvdata(pdev, meson_dw_hdmi);
+ 
+-	meson_dw_hdmi->hdmi = dw_hdmi_probe(pdev,
+-					    &meson_dw_hdmi->dw_plat_data);
++	meson_dw_hdmi->hdmi = dw_hdmi_probe(pdev, &meson_dw_hdmi->dw_plat_data);
+ 	if (IS_ERR(meson_dw_hdmi->hdmi))
+ 		return PTR_ERR(meson_dw_hdmi->hdmi);
+ 
+-	next_bridge = of_drm_find_bridge(pdev->dev.of_node);
+-	if (next_bridge)
+-		drm_bridge_attach(encoder, next_bridge,
+-				  &meson_dw_hdmi->bridge, 0);
++	meson_dw_hdmi->bridge = of_drm_find_bridge(pdev->dev.of_node);
+ 
+ 	DRM_DEBUG_DRIVER("HDMI controller initialized\n");
+ 
+diff --git a/drivers/gpu/drm/meson/meson_encoder_hdmi.c b/drivers/gpu/drm/meson/meson_encoder_hdmi.c
+new file mode 100644
+index 000000000000..db332fa4cd54
+--- /dev/null
++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.c
+@@ -0,0 +1,370 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (C) 2016 BayLibre, SAS
++ * Author: Neil Armstrong <narmstrong@baylibre.com>
++ * Copyright (C) 2015 Amlogic, Inc. All rights reserved.
++ */
++
++#include <linux/clk.h>
++#include <linux/component.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of_device.h>
++#include <linux/of_graph.h>
++#include <linux/regulator/consumer.h>
++#include <linux/reset.h>
++
++#include <drm/drm_atomic_helper.h>
++#include <drm/drm_bridge.h>
++#include <drm/drm_device.h>
++#include <drm/drm_edid.h>
++#include <drm/drm_probe_helper.h>
++#include <drm/drm_simple_kms_helper.h>
++
++#include <linux/media-bus-format.h>
++#include <linux/videodev2.h>
++
++#include "meson_drv.h"
++#include "meson_registers.h"
++#include "meson_vclk.h"
++#include "meson_venc.h"
++#include "meson_encoder_hdmi.h"
++
++struct meson_encoder_hdmi {
++	struct drm_encoder encoder;
++	struct drm_bridge bridge;
++	struct drm_bridge *next_bridge;
++	struct meson_drm *priv;
++	unsigned long output_bus_fmt;
++};
++
++#define bridge_to_meson_encoder_hdmi(x) \
++	container_of(x, struct meson_encoder_hdmi, bridge)
++
++static int meson_encoder_hdmi_attach(struct drm_bridge *bridge,
++				     enum drm_bridge_attach_flags flags)
++{
++	struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
++
++	return drm_bridge_attach(bridge->encoder, encoder_hdmi->next_bridge,
++				 &encoder_hdmi->bridge, flags);
++}
++
++static void meson_encoder_hdmi_set_vclk(struct meson_encoder_hdmi *encoder_hdmi,
++					const struct drm_display_mode *mode)
++{
++	struct meson_drm *priv = encoder_hdmi->priv;
++	int vic = drm_match_cea_mode(mode);
++	unsigned int phy_freq;
++	unsigned int vclk_freq;
++	unsigned int venc_freq;
++	unsigned int hdmi_freq;
++
++	vclk_freq = mode->clock;
++
++	/* For 420, pixel clock is half unlike venc clock */
++	if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
++		vclk_freq /= 2;
++
++	/* TMDS clock is pixel_clock * 10 */
++	phy_freq = vclk_freq * 10;
++
++	if (!vic) {
++		meson_vclk_setup(priv, MESON_VCLK_TARGET_DMT, phy_freq,
++				 vclk_freq, vclk_freq, vclk_freq, false);
++		return;
++	}
++
++	/* 480i/576i needs global pixel doubling */
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		vclk_freq *= 2;
++
++	venc_freq = vclk_freq;
++	hdmi_freq = vclk_freq;
++
++	/* VENC double pixels for 1080i, 720p and YUV420 modes */
++	if (meson_venc_hdmi_venc_repeat(vic) ||
++	    encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
++		venc_freq *= 2;
++
++	vclk_freq = max(venc_freq, hdmi_freq);
++
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		venc_freq /= 2;
++
++	dev_dbg(priv->dev, "vclk:%d phy=%d venc=%d hdmi=%d enci=%d\n",
++		phy_freq, vclk_freq, venc_freq, hdmi_freq,
++		priv->venc.hdmi_use_enci);
++
++	meson_vclk_setup(priv, MESON_VCLK_TARGET_HDMI, phy_freq, vclk_freq,
++			 venc_freq, hdmi_freq, priv->venc.hdmi_use_enci);
++}
++
++static enum drm_mode_status meson_encoder_hdmi_mode_valid(struct drm_bridge *bridge,
++					const struct drm_display_info *display_info,
++					const struct drm_display_mode *mode)
++{
++	struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
++	struct meson_drm *priv = encoder_hdmi->priv;
++	bool is_hdmi2_sink = display_info->hdmi.scdc.supported;
++	unsigned int phy_freq;
++	unsigned int vclk_freq;
++	unsigned int venc_freq;
++	unsigned int hdmi_freq;
++	int vic = drm_match_cea_mode(mode);
++	enum drm_mode_status status;
++
++	dev_dbg(priv->dev, "Modeline " DRM_MODE_FMT "\n", DRM_MODE_ARG(mode));
++
++	/* If sink does not support 540MHz, reject the non-420 HDMI2 modes */
++	if (display_info->max_tmds_clock &&
++	    mode->clock > display_info->max_tmds_clock &&
++	    !drm_mode_is_420_only(display_info, mode) &&
++	    !drm_mode_is_420_also(display_info, mode))
++		return MODE_BAD;
++
++	/* Check against non-VIC supported modes */
++	if (!vic) {
++		status = meson_venc_hdmi_supported_mode(mode);
++		if (status != MODE_OK)
++			return status;
++
++		return meson_vclk_dmt_supported_freq(priv, mode->clock);
++	/* Check against supported VIC modes */
++	} else if (!meson_venc_hdmi_supported_vic(vic))
++		return MODE_BAD;
++
++	vclk_freq = mode->clock;
++
++	/* For 420, pixel clock is half unlike venc clock */
++	if (drm_mode_is_420_only(display_info, mode) ||
++	    (!is_hdmi2_sink &&
++	     drm_mode_is_420_also(display_info, mode)))
++		vclk_freq /= 2;
++
++	/* TMDS clock is pixel_clock * 10 */
++	phy_freq = vclk_freq * 10;
++
++	/* 480i/576i needs global pixel doubling */
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		vclk_freq *= 2;
++
++	venc_freq = vclk_freq;
++	hdmi_freq = vclk_freq;
++
++	/* VENC double pixels for 1080i, 720p and YUV420 modes */
++	if (meson_venc_hdmi_venc_repeat(vic) ||
++	    drm_mode_is_420_only(display_info, mode) ||
++	    (!is_hdmi2_sink &&
++	     drm_mode_is_420_also(display_info, mode)))
++		venc_freq *= 2;
++
++	vclk_freq = max(venc_freq, hdmi_freq);
++
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++		venc_freq /= 2;
++
++	dev_dbg(priv->dev, "%s: vclk:%d phy=%d venc=%d hdmi=%d\n",
++		__func__, phy_freq, vclk_freq, venc_freq, hdmi_freq);
++
++	return meson_vclk_vic_supported_freq(priv, phy_freq, vclk_freq);
++}
++
++static void meson_encoder_hdmi_atomic_enable(struct drm_bridge *bridge,
++					     struct drm_bridge_state *bridge_state)
++{
++	struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
++	struct drm_atomic_state *state = bridge_state->base.state;
++	unsigned int ycrcb_map = VPU_HDMI_OUTPUT_CBYCR;
++	struct meson_drm *priv = encoder_hdmi->priv;
++	struct drm_connector_state *conn_state;
++	const struct drm_display_mode *mode;
++	struct drm_crtc_state *crtc_state;
++	struct drm_connector *connector;
++	bool yuv420_mode = false;
++	int vic;
++
++	connector = drm_atomic_get_new_connector_for_encoder(state, bridge->encoder);
++	if (WARN_ON(!connector))
++		return;
++
++	conn_state = drm_atomic_get_new_connector_state(state, connector);
++	if (WARN_ON(!conn_state))
++		return;
++
++	crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
++	if (WARN_ON(!crtc_state))
++		return;
++
++	mode = &crtc_state->adjusted_mode;
++
++	vic = drm_match_cea_mode(mode);
++
++	dev_dbg(priv->dev, "\"%s\" vic %d\n", mode->name, vic);
++
++	if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24) {
++		ycrcb_map = VPU_HDMI_OUTPUT_CRYCB;
++		yuv420_mode = true;
++	}
++
++	/* VENC + VENC-DVI Mode setup */
++	meson_venc_hdmi_mode_set(priv, vic, ycrcb_map, yuv420_mode, mode);
++
++	/* VCLK Set clock */
++	meson_encoder_hdmi_set_vclk(encoder_hdmi, mode);
++
++	if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
++		/* Setup YUV420 to HDMI-TX, no 10bit diphering */
++		writel_relaxed(2 | (2 << 2),
++			       priv->io_base + _REG(VPU_HDMI_FMT_CTRL));
++	else
++		/* Setup YUV444 to HDMI-TX, no 10bit diphering */
++		writel_relaxed(0, priv->io_base + _REG(VPU_HDMI_FMT_CTRL));
++
++	dev_dbg(priv->dev, "%s\n", priv->venc.hdmi_use_enci ? "VENCI" : "VENCP");
++
++	if (priv->venc.hdmi_use_enci)
++		writel_relaxed(1, priv->io_base + _REG(ENCI_VIDEO_EN));
++	else
++		writel_relaxed(1, priv->io_base + _REG(ENCP_VIDEO_EN));
++}
++
++static void meson_encoder_hdmi_atomic_disable(struct drm_bridge *bridge,
++					     struct drm_bridge_state *bridge_state)
++{
++	struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
++	struct meson_drm *priv = encoder_hdmi->priv;
++
++	writel_bits_relaxed(0x3, 0,
++			    priv->io_base + _REG(VPU_HDMI_SETTING));
++
++	writel_relaxed(0, priv->io_base + _REG(ENCI_VIDEO_EN));
++	writel_relaxed(0, priv->io_base + _REG(ENCP_VIDEO_EN));
++}
++
++static const u32 meson_encoder_hdmi_out_bus_fmts[] = {
++	MEDIA_BUS_FMT_YUV8_1X24,
++	MEDIA_BUS_FMT_UYYVYY8_0_5X24,
++};
++
++static u32 *
++meson_encoder_hdmi_get_inp_bus_fmts(struct drm_bridge *bridge,
++					struct drm_bridge_state *bridge_state,
++					struct drm_crtc_state *crtc_state,
++					struct drm_connector_state *conn_state,
++					u32 output_fmt,
++					unsigned int *num_input_fmts)
++{
++	u32 *input_fmts = NULL;
++	int i;
++
++	*num_input_fmts = 0;
++
++	for (i = 0 ; i < ARRAY_SIZE(meson_encoder_hdmi_out_bus_fmts) ; ++i) {
++		if (output_fmt == meson_encoder_hdmi_out_bus_fmts[i]) {
++			*num_input_fmts = 1;
++			input_fmts = kcalloc(*num_input_fmts,
++					     sizeof(*input_fmts),
++					     GFP_KERNEL);
++			if (!input_fmts)
++				return NULL;
++
++			input_fmts[0] = output_fmt;
++
++			break;
++		}
++	}
++
++	return input_fmts;
++}
++
++static int meson_encoder_hdmi_atomic_check(struct drm_bridge *bridge,
++					struct drm_bridge_state *bridge_state,
++					struct drm_crtc_state *crtc_state,
++					struct drm_connector_state *conn_state)
++{
++	struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
++	struct drm_connector_state *old_conn_state =
++		drm_atomic_get_old_connector_state(conn_state->state, conn_state->connector);
++	struct meson_drm *priv = encoder_hdmi->priv;
++
++	encoder_hdmi->output_bus_fmt = bridge_state->output_bus_cfg.format;
++
++	dev_dbg(priv->dev, "output_bus_fmt %lx\n", encoder_hdmi->output_bus_fmt);
++
++	if (!drm_connector_atomic_hdr_metadata_equal(old_conn_state, conn_state))
++		crtc_state->mode_changed = true;
++
++	return 0;
++}
++
++static const struct drm_bridge_funcs meson_encoder_hdmi_bridge_funcs = {
++	.attach = meson_encoder_hdmi_attach,
++	.mode_valid = meson_encoder_hdmi_mode_valid,
++	.atomic_enable = meson_encoder_hdmi_atomic_enable,
++	.atomic_disable = meson_encoder_hdmi_atomic_disable,
++	.atomic_get_input_bus_fmts = meson_encoder_hdmi_get_inp_bus_fmts,
++	.atomic_check = meson_encoder_hdmi_atomic_check,
++	.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
++	.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
++	.atomic_reset = drm_atomic_helper_bridge_reset,
++};
++
++int meson_encoder_hdmi_init(struct meson_drm *priv)
++{
++	struct meson_encoder_hdmi *meson_encoder_hdmi;
++	struct device_node *remote;
++	int ret;
++
++	meson_encoder_hdmi = devm_kzalloc(priv->dev, sizeof(*meson_encoder_hdmi), GFP_KERNEL);
++	if (!meson_encoder_hdmi)
++		return -ENOMEM;
++
++	/* HDMI Transceiver Bridge */
++	remote = of_graph_get_remote_node(priv->dev->of_node, 1, 0);
++	if (!remote) {
++		dev_err(priv->dev, "HDMI transceiver device is disabled");
++		return 0;
++	}
++
++	meson_encoder_hdmi->next_bridge = of_drm_find_bridge(remote);
++	if (!meson_encoder_hdmi->next_bridge) {
++		dev_err(priv->dev, "Failed to find HDMI transceiver bridge\n");
++		return -EPROBE_DEFER;
++	}
++
++	/* HDMI Encoder Bridge */
++	meson_encoder_hdmi->bridge.funcs = &meson_encoder_hdmi_bridge_funcs;
++	meson_encoder_hdmi->bridge.of_node = priv->dev->of_node;
++	meson_encoder_hdmi->bridge.type = DRM_MODE_CONNECTOR_HDMIA;
++
++	drm_bridge_add(&meson_encoder_hdmi->bridge);
++
++	meson_encoder_hdmi->priv = priv;
++
++	/* Encoder */
++	ret = drm_simple_encoder_init(priv->drm, &meson_encoder_hdmi->encoder,
++				      DRM_MODE_ENCODER_TMDS);
++	if (ret) {
++		dev_err(priv->dev, "Failed to init HDMI encoder: %d\n", ret);
++		return ret;
++	}
++
++	meson_encoder_hdmi->encoder.possible_crtcs = BIT(0);
++
++	/* Attach HDMI Encoder Bridge to Encoder */
++	ret = drm_bridge_attach(&meson_encoder_hdmi->encoder, &meson_encoder_hdmi->bridge, NULL, 0);
++	if (ret) {
++		dev_err(priv->dev, "Failed to attach bridge: %d\n", ret);
++		return ret;
++	}
++
++	/*
++	 * We should have now in place:
++	 * encoder->[hdmi encoder bridge]->[dw-hdmi bridge]->[dw-hdmi connector]
++	 */
++
++	dev_dbg(priv->dev, "HDMI encoder initialized\n");
++
++	return 0;
++}
+diff --git a/drivers/gpu/drm/meson/meson_encoder_hdmi.h b/drivers/gpu/drm/meson/meson_encoder_hdmi.h
+new file mode 100644
+index 000000000000..ed19494f0956
+--- /dev/null
++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright (C) 2021 BayLibre, SAS
++ * Author: Neil Armstrong <narmstrong@baylibre.com>
++ */
++
++#ifndef __MESON_ENCODER_HDMI_H
++#define __MESON_ENCODER_HDMI_H
++
++int meson_encoder_hdmi_init(struct meson_drm *priv);
++
++#endif /* __MESON_ENCODER_HDMI_H */
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-a6xx-fix-missing-array_size-check.patch b/queue-5.16/drm-msm-a6xx-fix-missing-array_size-check.patch
new file mode 100644
index 00000000000..1737a30d55c
--- /dev/null
+++ b/queue-5.16/drm-msm-a6xx-fix-missing-array_size-check.patch
@@ -0,0 +1,53 @@
+From 573c07b9e854344ab8f825ac79c0460073e39041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 09:34:03 -0800
+Subject: drm/msm/a6xx: Fix missing ARRAY_SIZE() check
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit cca96584b35765bf9eb5f38ca55a144ea2ba0de4 ]
+
+Fixes: f6d62d091cfd ("drm/msm/a6xx: add support for Adreno 660 GPU")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20220305173405.914989-1-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index a305ff7e8c6f..f880a59a40fc 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -658,19 +658,23 @@ static void a6xx_set_cp_protect(struct msm_gpu *gpu)
+ {
+ 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+ 	const u32 *regs = a6xx_protect;
+-	unsigned i, count = ARRAY_SIZE(a6xx_protect), count_max = 32;
+-
+-	BUILD_BUG_ON(ARRAY_SIZE(a6xx_protect) > 32);
+-	BUILD_BUG_ON(ARRAY_SIZE(a650_protect) > 48);
++	unsigned i, count, count_max;
+ 
+ 	if (adreno_is_a650(adreno_gpu)) {
+ 		regs = a650_protect;
+ 		count = ARRAY_SIZE(a650_protect);
+ 		count_max = 48;
++		BUILD_BUG_ON(ARRAY_SIZE(a650_protect) > 48);
+ 	} else if (adreno_is_a660_family(adreno_gpu)) {
+ 		regs = a660_protect;
+ 		count = ARRAY_SIZE(a660_protect);
+ 		count_max = 48;
++		BUILD_BUG_ON(ARRAY_SIZE(a660_protect) > 48);
++	} else {
++		regs = a6xx_protect;
++		count = ARRAY_SIZE(a6xx_protect);
++		count_max = 32;
++		BUILD_BUG_ON(ARRAY_SIZE(a6xx_protect) > 32);
+ 	}
+ 
+ 	/*
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dp-always-add-fail-safe-mode-into-connector-.patch b/queue-5.16/drm-msm-dp-always-add-fail-safe-mode-into-connector-.patch
new file mode 100644
index 00000000000..57d1c04984e
--- /dev/null
+++ b/queue-5.16/drm-msm-dp-always-add-fail-safe-mode-into-connector-.patch
@@ -0,0 +1,47 @@
+From e218133c0cf79b02d461fe89f6d96c3c5e092fb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 15:17:54 -0800
+Subject: drm/msm/dp: always add fail-safe mode into connector mode list
+
+From: Kuogee Hsieh <quic_khsieh@quicinc.com>
+
+[ Upstream commit d4aca422539c441a7f3fec749287b36de37d9b6b ]
+
+Some of DP link compliant test expects to return fail-safe mode
+if prefer detailed timing mode can not be supported by mainlink's
+lane and rate after link training. Therefore add fail-safe mode
+into connector mode list as backup mode. This patch fixes test
+case 4.2.2.1.
+
+Changes in v2:
+-- add Fixes text string
+
+Fixes: 4b85d405cfe9 ( "drm/msm/dp: reduce link rate if failed at link training 1")
+Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1643066274-25814-1-git-send-email-quic_khsieh@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_panel.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
+index 71db10c0f262..f1418722c549 100644
+--- a/drivers/gpu/drm/msm/dp/dp_panel.c
++++ b/drivers/gpu/drm/msm/dp/dp_panel.c
+@@ -212,6 +212,11 @@ int dp_panel_read_sink_caps(struct dp_panel *dp_panel,
+ 		if (drm_add_modes_noedid(connector, 640, 480))
+ 			drm_set_preferred_mode(connector, 640, 480);
+ 		mutex_unlock(&connector->dev->mode_config.mutex);
++	} else {
++		/* always add fail-safe mode as backup mode */
++		mutex_lock(&connector->dev->mode_config.mutex);
++		drm_add_modes_noedid(connector, 640, 480);
++		mutex_unlock(&connector->dev->mode_config.mutex);
+ 	}
+ 
+ 	if (panel->aux_cfg_update_done) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dp-populate-connector-of-struct-dp_panel.patch b/queue-5.16/drm-msm-dp-populate-connector-of-struct-dp_panel.patch
new file mode 100644
index 00000000000..926c4ac8673
--- /dev/null
+++ b/queue-5.16/drm-msm-dp-populate-connector-of-struct-dp_panel.patch
@@ -0,0 +1,82 @@
+From 6ae4fb95a1ceba9a132cdd08ace3937ef16dfd13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:47:26 -0800
+Subject: drm/msm/dp: populate connector of struct dp_panel
+
+From: Kuogee Hsieh <quic_khsieh@quicinc.com>
+
+[ Upstream commit 5e602f5156910c7b19661699896cb6e3fb94fab9 ]
+
+DP CTS test case 4.2.2.6 has valid edid with bad checksum on purpose
+and expect DP source return correct checksum. During drm edid read,
+correct edid checksum is calculated and stored at
+connector::real_edid_checksum.
+
+The problem is struct dp_panel::connector never be assigned, instead the
+connector is stored in struct msm_dp::connector. When we run compliance
+testing test case 4.2.2.6 dp_panel_handle_sink_request() won't have a valid
+edid set in struct dp_panel::edid so we'll try to use the connectors
+real_edid_checksum and hit a NULL pointer dereference error because the
+connector pointer is never assigned.
+
+Changes in V2:
+-- populate panel connector at msm_dp_modeset_init() instead of at dp_panel_read_sink_caps()
+
+Changes in V3:
+-- remove unhelpful kernel crash trace commit text
+-- remove renaming dp_display parameter to dp
+
+Changes in V4:
+-- add more details to commit text
+
+Changes in v10:
+--  group into one series
+
+Changes in v11:
+-- drop drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read
+
+Fixes: 7948fe12d47 ("drm/msm/dp: return correct edid checksum after corrupted edid checksum read")
+Signee-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1642531648-8448-3-git-send-email-quic_khsieh@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index aba8aa47ed76..98a546a65091 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1455,6 +1455,7 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+ 			struct drm_encoder *encoder)
+ {
+ 	struct msm_drm_private *priv;
++	struct dp_display_private *dp_priv;
+ 	int ret;
+ 
+ 	if (WARN_ON(!encoder) || WARN_ON(!dp_display) || WARN_ON(!dev))
+@@ -1463,6 +1464,8 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+ 	priv = dev->dev_private;
+ 	dp_display->drm_dev = dev;
+ 
++	dp_priv = container_of(dp_display, struct dp_display_private, dp_display);
++
+ 	ret = dp_display_request_irq(dp_display);
+ 	if (ret) {
+ 		DRM_ERROR("request_irq failed, ret=%d\n", ret);
+@@ -1480,6 +1483,8 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+ 		return ret;
+ 	}
+ 
++	dp_priv->panel->connector = dp_display->connector;
++
+ 	priv->connectors[priv->num_connectors++] = dp_display->connector;
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dp-stop-link-training-after-link-training-2-.patch b/queue-5.16/drm-msm-dp-stop-link-training-after-link-training-2-.patch
new file mode 100644
index 00000000000..52dce4bbfc0
--- /dev/null
+++ b/queue-5.16/drm-msm-dp-stop-link-training-after-link-training-2-.patch
@@ -0,0 +1,49 @@
+From 11a473ffadfa097590eca6079b4521b629d4ea20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:47:28 -0800
+Subject: drm/msm/dp: stop link training after link training 2 failed
+
+From: Kuogee Hsieh <quic_khsieh@quicinc.com>
+
+[ Upstream commit 9051d629dbf7a998a40f7eac65a9512b01bc3bb8 ]
+
+Each DP link training contains link training 1 followed by link
+training 2.  There is maximum of 5 retries of DP link training
+before declared link training failed. It is required to stop link
+training at end of link training 2 if it is failed so that next
+link training 1 can start freshly. This patch fixes link compliance
+test  case 4.3.1.13 (Source Device Link Training EQ Fallback Test).
+
+Changes in v10:
+--  group into one series
+
+Changes in v11:
+-- drop drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read
+
+Fixes: 2e0adc765d88 ("drm/msm/dp: do not end dp link training until video is ready")
+Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1642531648-8448-5-git-send-email-quic_khsieh@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 62e75dc8afc6..4af281d97493 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1744,6 +1744,9 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ 				/* end with failure */
+ 				break; /* lane == 1 already */
+ 			}
++
++			/* stop link training before start re training  */
++			dp_ctrl_clear_training_pattern(ctrl);
+ 		}
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dpu-add-dspp-blocks-teardown.patch b/queue-5.16/drm-msm-dpu-add-dspp-blocks-teardown.patch
new file mode 100644
index 00000000000..7417919f446
--- /dev/null
+++ b/queue-5.16/drm-msm-dpu-add-dspp-blocks-teardown.patch
@@ -0,0 +1,45 @@
+From 39e642efe2f5d0ff63cc788dda00ee0bf6f6a595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 00:06:14 +0300
+Subject: drm/msm/dpu: add DSPP blocks teardown
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d5c5e78f217172e87d8fb2c3418dd8b58b4adfcb ]
+
+Add missing calls to dpu_hw_dspp_destroy() to free resources allocated
+for DSPP hardware blocks.
+
+Fixes: e47616df008b ("drm/msm/dpu: add support for color processing blocks in dpu driver")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Link: https://lore.kernel.org/r/20220121210618.3482550-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
+index f9c83d6e427a..24fbaf562d41 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
+@@ -35,6 +35,14 @@ int dpu_rm_destroy(struct dpu_rm *rm)
+ {
+ 	int i;
+ 
++	for (i = 0; i < ARRAY_SIZE(rm->dspp_blks); i++) {
++		struct dpu_hw_dspp *hw;
++
++		if (rm->dspp_blks[i]) {
++			hw = to_dpu_hw_dspp(rm->dspp_blks[i]);
++			dpu_hw_dspp_destroy(hw);
++		}
++	}
+ 	for (i = 0; i < ARRAY_SIZE(rm->pingpong_blks); i++) {
+ 		struct dpu_hw_pingpong *hw;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dpu-fix-dp-audio-condition.patch b/queue-5.16/drm-msm-dpu-fix-dp-audio-condition.patch
new file mode 100644
index 00000000000..f2ca3a2fd03
--- /dev/null
+++ b/queue-5.16/drm-msm-dpu-fix-dp-audio-condition.patch
@@ -0,0 +1,41 @@
+From ff789c7f903b4bb50671b8e7540402975cd1d542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 06:53:52 +0300
+Subject: drm/msm/dpu: fix dp audio condition
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 1e0505a5a7a2fea243f8e6d7e13fcde65f9e41bc ]
+
+DP audio enablement code which is comparing intf_type,
+DRM_MODE_ENCODER_TMDS (= 2) with DRM_MODE_CONNECTOR_DisplayPort (= 10).
+Which would never succeed. Fix it to check for DRM_MODE_ENCODER_TMDS.
+
+Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM")
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20220217035358.465904-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index e7ee4cfb8461..ad27a01c22af 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -1102,7 +1102,7 @@ static void _dpu_encoder_virt_enable_helper(struct drm_encoder *drm_enc)
+ 	}
+ 
+ 
+-	if (dpu_enc->disp_info.intf_type == DRM_MODE_CONNECTOR_DisplayPort &&
++	if (dpu_enc->disp_info.intf_type == DRM_MODE_ENCODER_TMDS &&
+ 		dpu_enc->cur_master->hw_mdptop &&
+ 		dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select)
+ 		dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select(
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dsi-phy-fix-7nm-v4.0-settings-for-c-phy-mode.patch b/queue-5.16/drm-msm-dsi-phy-fix-7nm-v4.0-settings-for-c-phy-mode.patch
new file mode 100644
index 00000000000..61312d80956
--- /dev/null
+++ b/queue-5.16/drm-msm-dsi-phy-fix-7nm-v4.0-settings-for-c-phy-mode.patch
@@ -0,0 +1,67 @@
+From 48dad6d33ccfd8b39353062a98f497c234838174 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 03:08:37 +0300
+Subject: drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit bb07af2ed2a47dc6c4d0681f275bb27d4f845465 ]
+
+The dsi_7nm_phy_enable() disagrees with downstream for
+glbl_str_swi_cal_sel_ctrl and glbl_hstx_str_ctrl_0 values. Update
+programmed settings to match downstream driver. To remove the
+possibility for such errors in future drop less_than_1500_mhz
+assignment and specify settings explicitly.
+
+Fixes: 5ac178381d26 ("drm/msm/dsi: support CPHY mode for 7nm pll/phy")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Link: https://lore.kernel.org/r/20220217000837.435340-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 36eb6109cb88..6e506feb111f 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -864,20 +864,26 @@ static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy,
+ 	/* Alter PHY configurations if data rate less than 1.5GHZ*/
+ 	less_than_1500_mhz = (clk_req->bitclk_rate <= 1500000000);
+ 
+-	/* For C-PHY, no low power settings for lower clk rate */
+-	if (phy->cphy_mode)
+-		less_than_1500_mhz = false;
+-
+ 	if (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_1) {
+ 		vreg_ctrl_0 = less_than_1500_mhz ? 0x53 : 0x52;
+-		glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x00;
+-		glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x39 :  0x3c;
++		if (phy->cphy_mode) {
++			glbl_rescode_top_ctrl = 0x00;
++			glbl_rescode_bot_ctrl = 0x3c;
++		} else {
++			glbl_rescode_top_ctrl = less_than_1500_mhz ? 0x3d :  0x00;
++			glbl_rescode_bot_ctrl = less_than_1500_mhz ? 0x39 :  0x3c;
++		}
+ 		glbl_str_swi_cal_sel_ctrl = 0x00;
+ 		glbl_hstx_str_ctrl_0 = 0x88;
+ 	} else {
+ 		vreg_ctrl_0 = less_than_1500_mhz ? 0x5B : 0x59;
+-		glbl_str_swi_cal_sel_ctrl = less_than_1500_mhz ? 0x03 : 0x00;
+-		glbl_hstx_str_ctrl_0 = less_than_1500_mhz ? 0x66 : 0x88;
++		if (phy->cphy_mode) {
++			glbl_str_swi_cal_sel_ctrl = 0x03;
++			glbl_hstx_str_ctrl_0 = 0x66;
++		} else {
++			glbl_str_swi_cal_sel_ctrl = less_than_1500_mhz ? 0x03 : 0x00;
++			glbl_hstx_str_ctrl_0 = less_than_1500_mhz ? 0x66 : 0x88;
++		}
+ 		glbl_rescode_top_ctrl = 0x03;
+ 		glbl_rescode_bot_ctrl = 0x3c;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-msm-dsi-use-ref-fw-clock-instead-of-global-name-.patch b/queue-5.16/drm-msm-dsi-use-ref-fw-clock-instead-of-global-name-.patch
new file mode 100644
index 00000000000..9ecd7c906f8
--- /dev/null
+++ b/queue-5.16/drm-msm-dsi-use-ref-fw-clock-instead-of-global-name-.patch
@@ -0,0 +1,135 @@
+From fe2e3a5c84bb7923422a1dc2adcac305e8600b81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Sep 2021 15:19:20 +0200
+Subject: drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 3a3ee71bd8e14c5e852c71f317eebfda8f88dff0 ]
+
+All DSI PHY/PLL drivers were referencing their VCO parent clock by a
+global name, most of which don't exist or have been renamed.  These
+clock drivers seem to function fine without that except the 14nm driver
+for sdm6xx [1].
+
+At the same time all DTs provide a "ref" clock as per the requirements
+of dsi-phy-common.yaml, but the clock is never used.  This patchset puts
+that clock to use without relying on a global clock name, so that all
+dependencies are explicitly defined in DT (the firmware) in the end.
+
+Note that this patch intentionally breaks older firmware (DT) that
+relies on the clock to be found globally instead.  The only affected
+platform is msm8974 [2] for whose dsi_phy_28nm a .name="xo" fallback is
+left in place to accommodate a more graceful transition period.  All
+other platforms had the "ref" clock added to their phy node since its
+inception, or in a followup patch some time after.  These patches
+wrongly assumed that the "ref" clock was actively used and have hence
+been listed as "Fixes:" below.
+Furthermore apq8064 was providing the wrong 19.2MHz cxo instead of
+27MHz pxo clock, which has been addressed in [3].
+
+It is expected that both [2] and [3] are applied to the tree well in
+advance of this patch such that any actual breakage is extremely
+unlikely, but might still occur if kernel upgrades are performed without
+the DT to match.  After some time the fallback for msm8974 can be
+removed again as well.
+
+[1]: https://lore.kernel.org/linux-arm-msm/386db1a6-a1cd-3c7d-a88e-dc83f8a1be96@somainline.org/
+[2]: https://lore.kernel.org/linux-arm-msm/20210830175739.143401-1-marijn.suijten@somainline.org/
+[3]: https://lore.kernel.org/linux-arm-msm/20210829203027.276143-2-marijn.suijten@somainline.org/
+
+Fixes: 79e51645a1dd ("arm64: dts: qcom: msm8916: Set 'xo_board' as ref clock of the DSI PHY")
+Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY")
+Fixes: 0c0e72705a33 ("arm64: dts: sdm845: Set 'bi_tcxo' as ref clock of the DSI PHYs")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210911131922.387964-2-marijn.suijten@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c      | 4 +++-
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c      | 4 +++-
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm.c      | 4 +++-
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm_8960.c | 4 +++-
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c       | 4 +++-
+ 5 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
+index d8128f50b0dd..0b782cc18b3f 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
+@@ -562,7 +562,9 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm, struct clk_hw **prov
+ 	char clk_name[32], parent[32], vco_name[32];
+ 	char parent2[32], parent3[32], parent4[32];
+ 	struct clk_init_data vco_init = {
+-		.parent_names = (const char *[]){ "xo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "ref",
++		},
+ 		.num_parents = 1,
+ 		.name = vco_name,
+ 		.flags = CLK_IGNORE_UNUSED,
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+index 7414966f198e..75557ac99adf 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+@@ -802,7 +802,9 @@ static int pll_14nm_register(struct dsi_pll_14nm *pll_14nm, struct clk_hw **prov
+ {
+ 	char clk_name[32], parent[32], vco_name[32];
+ 	struct clk_init_data vco_init = {
+-		.parent_names = (const char *[]){ "xo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "ref",
++		},
+ 		.num_parents = 1,
+ 		.name = vco_name,
+ 		.flags = CLK_IGNORE_UNUSED,
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm.c
+index 2da673a2add6..48eab80b548e 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm.c
+@@ -521,7 +521,9 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm, struct clk_hw **prov
+ {
+ 	char clk_name[32], parent1[32], parent2[32], vco_name[32];
+ 	struct clk_init_data vco_init = {
+-		.parent_names = (const char *[]){ "xo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "ref", .name = "xo",
++		},
+ 		.num_parents = 1,
+ 		.name = vco_name,
+ 		.flags = CLK_IGNORE_UNUSED,
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm_8960.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm_8960.c
+index 71ed4aa0dc67..fc56cdcc9ad6 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm_8960.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_28nm_8960.c
+@@ -385,7 +385,9 @@ static int pll_28nm_register(struct dsi_pll_28nm *pll_28nm, struct clk_hw **prov
+ {
+ 	char *clk_name, *parent_name, *vco_name;
+ 	struct clk_init_data vco_init = {
+-		.parent_names = (const char *[]){ "pxo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "ref",
++		},
+ 		.num_parents = 1,
+ 		.flags = CLK_IGNORE_UNUSED,
+ 		.ops = &clk_ops_dsi_pll_28nm_vco,
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 079613d2aaa9..36eb6109cb88 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -588,7 +588,9 @@ static int pll_7nm_register(struct dsi_pll_7nm *pll_7nm, struct clk_hw **provide
+ 	char clk_name[32], parent[32], vco_name[32];
+ 	char parent2[32], parent3[32], parent4[32];
+ 	struct clk_init_data vco_init = {
+-		.parent_names = (const char *[]){ "bi_tcxo" },
++		.parent_data = &(const struct clk_parent_data) {
++			.fw_name = "ref",
++		},
+ 		.num_parents = 1,
+ 		.name = vco_name,
+ 		.flags = CLK_IGNORE_UNUSED,
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch b/queue-5.16/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch
new file mode 100644
index 00000000000..d54a987f54f
--- /dev/null
+++ b/queue-5.16/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch
@@ -0,0 +1,54 @@
+From ad82178b285480d9ee9cd6856360204da75f4509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 00:58:55 +0800
+Subject: drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl()
+
+From: Zhou Qingyang <zhou1615@umn.edu>
+
+[ Upstream commit 2343bcdb4747d4f418a4daf2e898b94f86c24a59 ]
+
+In nvkm_acr_hsfw_load_bl(), the return value of kmalloc() is directly
+passed to memcpy(), which could lead to undefined behavior on failure
+of kmalloc().
+
+Fix this bug by using kmemdup() instead of kmalloc()+memcpy().
+
+This bug was found by a static analyzer.
+
+Builds with 'make allyesconfig' show no new warnings,
+and our static analyzer no longer warns about this code.
+
+Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
+Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220124165856.57022-1-zhou1615@umn.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c
+index 667fa016496e..a6ea89a5d51a 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c
+@@ -142,11 +142,12 @@ nvkm_acr_hsfw_load_bl(struct nvkm_acr *acr, const char *name, int ver,
+ 
+ 	hsfw->imem_size = desc->code_size;
+ 	hsfw->imem_tag = desc->start_tag;
+-	hsfw->imem = kmalloc(desc->code_size, GFP_KERNEL);
+-	memcpy(hsfw->imem, data + desc->code_off, desc->code_size);
+-
++	hsfw->imem = kmemdup(data + desc->code_off, desc->code_size, GFP_KERNEL);
+ 	nvkm_firmware_put(fw);
+-	return 0;
++	if (!hsfw->imem)
++		return -ENOMEM;
++	else
++		return 0;
+ }
+ 
+ int
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-panfrost-check-for-error-num-after-setting-mask.patch b/queue-5.16/drm-panfrost-check-for-error-num-after-setting-mask.patch
new file mode 100644
index 00000000000..4402df099f1
--- /dev/null
+++ b/queue-5.16/drm-panfrost-check-for-error-num-after-setting-mask.patch
@@ -0,0 +1,45 @@
+From eaba3d6d3aa4f6885be19fe11b9c707f35bea307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jan 2022 11:03:26 +0800
+Subject: drm/panfrost: Check for error num after setting mask
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 44ab30b056149bd59dd7989a593dd25ead6007fd ]
+
+Because of the possible failure of the dma_supported(), the
+dma_set_mask_and_coherent() may return error num.
+Therefore, it should be better to check it and return the error if
+fails.
+
+Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+[Steve: fix Fixes: line]
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220106030326.2620942-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index bbe628b306ee..f8355de6e335 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -360,8 +360,11 @@ int panfrost_gpu_init(struct panfrost_device *pfdev)
+ 
+ 	panfrost_gpu_init_features(pfdev);
+ 
+-	dma_set_mask_and_coherent(pfdev->dev,
++	err = dma_set_mask_and_coherent(pfdev->dev,
+ 		DMA_BIT_MASK(FIELD_GET(0xff00, pfdev->features.mmu_features)));
++	if (err)
++		return err;
++
+ 	dma_set_max_seg_size(pfdev->dev, UINT_MAX);
+ 
+ 	irq = platform_get_irq_byname(to_platform_device(pfdev->dev), "gpu");
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-selftests-test-drm_dp_mst_helper-fix-memory-leak.patch b/queue-5.16/drm-selftests-test-drm_dp_mst_helper-fix-memory-leak.patch
new file mode 100644
index 00000000000..07b62bd6b50
--- /dev/null
+++ b/queue-5.16/drm-selftests-test-drm_dp_mst_helper-fix-memory-leak.patch
@@ -0,0 +1,45 @@
+From 69a57ac28b7c4132e22e4f0f5126580049127cd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 17:58:12 +0100
+Subject: drm/selftests/test-drm_dp_mst_helper: Fix memory leak in
+ sideband_msg_req_encode_decode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit ba3a5ddcf1e5df31f2291006d5297ca62035584f ]
+
+Avoid leaking the "out" variable if it is not possible to allocate
+the "txmsg" variable.
+
+Fixes: 09234b88ef55 ("drm/selftests/test-drm_dp_mst_helper: Move 'sideband_msg_req_encode_decode' onto the heap")
+Addresses-Coverity-ID: 1475685 ("Resource leak")
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220108165812.46797-1-jose.exposito89@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
+index 6b4759ed6bfd..c491429f1a02 100644
+--- a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
++++ b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
+@@ -131,8 +131,10 @@ sideband_msg_req_encode_decode(struct drm_dp_sideband_msg_req_body *in)
+ 		return false;
+ 
+ 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+-	if (!txmsg)
++	if (!txmsg) {
++		kfree(out);
+ 		return false;
++	}
+ 
+ 	drm_dp_encode_sideband_req(in, txmsg);
+ 	ret = drm_dp_decode_sideband_req(txmsg, out);
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch b/queue-5.16/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
new file mode 100644
index 00000000000..0207cf8a416
--- /dev/null
+++ b/queue-5.16/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
@@ -0,0 +1,39 @@
+From 0fdde132bd6cef1180bde2b4bf7fe11e6ca164cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 06:53:16 +0000
+Subject: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 221e3638feb8bc42143833c9a704fa89b6c366bb ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore. Add put_device() call to fix this.
+
+Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index f46d377f0c30..de1333dc0d86 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1538,8 +1538,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
+ 		dsi->slave = platform_get_drvdata(gangster);
+ 		of_node_put(np);
+ 
+-		if (!dsi->slave)
++		if (!dsi->slave) {
++			put_device(&gangster->dev);
+ 			return -EPROBE_DEFER;
++		}
+ 
+ 		dsi->slave->master = dsi;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/drm-v3d-v3d_drv-check-for-error-num-after-setting-ma.patch b/queue-5.16/drm-v3d-v3d_drv-check-for-error-num-after-setting-ma.patch
new file mode 100644
index 00000000000..36f581d9aa4
--- /dev/null
+++ b/queue-5.16/drm-v3d-v3d_drv-check-for-error-num-after-setting-ma.patch
@@ -0,0 +1,55 @@
+From f922512ac57f99ef93298b535d2e1cfc88037ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 09:38:07 +0800
+Subject: drm/v3d/v3d_drv: Check for error num after setting mask
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 4a39156166b90465da0f9a33b3442d63b5651bec ]
+
+Because of the possible failure of the dma_supported(), the
+dma_set_mask_and_coherent() may return error num.
+Therefore, it should be better to check it and return the error if
+fails.
+Also, we can create a variable for the mask to solve the
+alignment issue.
+
+Fixes: 334dd38a3878 ("drm/v3d: Set dma_mask as well as coherent_dma_mask")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220110013807.4105270-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index bd46396a1ae0..1afcd54fbbd5 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -219,6 +219,7 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ 	int ret;
+ 	u32 mmu_debug;
+ 	u32 ident1;
++	u64 mask;
+ 
+ 	v3d = devm_drm_dev_alloc(dev, &v3d_drm_driver, struct v3d_dev, drm);
+ 	if (IS_ERR(v3d))
+@@ -237,8 +238,11 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	mmu_debug = V3D_READ(V3D_MMU_DEBUG_INFO);
+-	dma_set_mask_and_coherent(dev,
+-		DMA_BIT_MASK(30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_PA_WIDTH)));
++	mask = DMA_BIT_MASK(30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_PA_WIDTH));
++	ret = dma_set_mask_and_coherent(dev, mask);
++	if (ret)
++		return ret;
++
+ 	v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
+ 
+ 	ident1 = V3D_READ(V3D_HUB_IDENT1);
+-- 
+2.34.1
+
diff --git a/queue-5.16/evm-fix-the-evm-__setup-handler-return-value.patch b/queue-5.16/evm-fix-the-evm-__setup-handler-return-value.patch
new file mode 100644
index 00000000000..8fdbdac6e75
--- /dev/null
+++ b/queue-5.16/evm-fix-the-evm-__setup-handler-return-value.patch
@@ -0,0 +1,58 @@
+From 0fca827dc8b17674291a0bd19bd514b699e78fcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 13:45:18 -0800
+Subject: EVM: fix the evm= __setup handler return value
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f2544f5e6c691679d56bb38637d2f347075b36fa ]
+
+__setup() handlers should return 1 if the parameter is handled.
+Returning 0 causes the entire string to be added to init's
+environment strings (limited to 32 strings), unnecessarily polluting it.
+
+Using the documented string "evm=fix" causes an Unknown parameter message:
+  Unknown kernel command line parameters
+  "BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix", will be passed to user space.
+
+and that string is added to init's environment string space:
+  Run /sbin/init as init process
+    with arguments:
+     /sbin/init
+    with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     evm=fix
+
+With this change, using "evm=fix" acts as expected and an invalid
+option ("evm=evm") causes a warning to be printed:
+  evm: invalid "evm" mode
+but init's environment is not polluted with this string, as expected.
+
+Fixes: 7102ebcd65c1 ("evm: permit only valid security.evm xattrs to be updated")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 08f907382c61..7d87772f0ce6 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -86,7 +86,7 @@ static int __init evm_set_fixmode(char *str)
+ 	else
+ 		pr_err("invalid \"%s\" mode", str);
+ 
+-	return 0;
++	return 1;
+ }
+ __setup("evm=", evm_set_fixmode);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ext2-correct-max-file-size-computing.patch b/queue-5.16/ext2-correct-max-file-size-computing.patch
new file mode 100644
index 00000000000..3ad827a66f2
--- /dev/null
+++ b/queue-5.16/ext2-correct-max-file-size-computing.patch
@@ -0,0 +1,58 @@
+From f07fe97baa9d9e86d2deb2b5956245e2031e022f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 13:05:32 +0800
+Subject: ext2: correct max file size computing
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 50b3a818991074177a56c87124c7a7bdf5fa4f67 ]
+
+We need to calculate the max file size accurately if the total blocks
+that can address by block tree exceed the upper_limit. But this check is
+not correct now, it only compute the total data blocks but missing
+metadata blocks are needed. So in the case of "data blocks < upper_limit
+&& total blocks > upper_limit", we will get wrong result. Fortunately,
+this case could not happen in reality, but it's confused and better to
+correct the computing.
+
+  bits   data blocks   metadatablocks   upper_limit
+  10        16843020            66051    2147483647
+  11       134480396           263171    1073741823
+  12      1074791436          1050627     536870911 (*)
+  13      8594130956          4198403     268435455 (*)
+  14     68736258060         16785411     134217727 (*)
+  15    549822930956         67125251      67108863 (*)
+  16   4398314962956        268468227      33554431 (*)
+
+  [*] Need to calculate in depth.
+
+Fixes: 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()")
+Link: https://lore.kernel.org/r/20220212050532.179055-1-yi.zhang@huawei.com
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index d8d580b609ba..3d21279fe2cb 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -753,8 +753,12 @@ static loff_t ext2_max_size(int bits)
+ 	res += 1LL << (bits-2);
+ 	res += 1LL << (2*(bits-2));
+ 	res += 1LL << (3*(bits-2));
++	/* Compute how many metadata blocks are needed */
++	meta_blocks = 1;
++	meta_blocks += 1 + ppb;
++	meta_blocks += 1 + ppb + ppb * ppb;
+ 	/* Does block tree limit file size? */
+-	if (res < upper_limit)
++	if (res + meta_blocks <= upper_limit)
+ 		goto check_lfs;
+ 
+ 	res = upper_limit;
+-- 
+2.34.1
+
diff --git a/queue-5.16/ext4-correct-cluster-len-and-clusters-changed-accoun.patch b/queue-5.16/ext4-correct-cluster-len-and-clusters-changed-accoun.patch
new file mode 100644
index 00000000000..5bb3b08fc8b
--- /dev/null
+++ b/queue-5.16/ext4-correct-cluster-len-and-clusters-changed-accoun.patch
@@ -0,0 +1,82 @@
+From bfde1817c98d3849c22ffc3861d9553f9a30831f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 12:32:43 +0530
+Subject: ext4: correct cluster len and clusters changed accounting in
+ ext4_mb_mark_bb
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit a5c0e2fdf7cea535ba03259894dc184e5a4c2800 ]
+
+ext4_mb_mark_bb() currently wrongly calculates cluster len (clen) and
+flex_group->free_clusters. This patch fixes that.
+
+Identified based on code review of ext4_mb_mark_bb() function.
+
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/a0b035d536bafa88110b74456853774b64c8ac40.1644992609.git.riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index e872ea582555..c0868b82a62f 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3899,10 +3899,11 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	ext4_group_t group;
+ 	ext4_grpblk_t blkoff;
+-	int i, clen, err;
++	int i, err;
+ 	int already;
++	unsigned int clen, clen_changed;
+ 
+-	clen = EXT4_B2C(sbi, len);
++	clen = EXT4_NUM_B2C(sbi, len);
+ 
+ 	ext4_get_group_no_and_offset(sb, block, &group, &blkoff);
+ 	bitmap_bh = ext4_read_block_bitmap(sb, group);
+@@ -3923,6 +3924,7 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
+ 		if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)
+ 			already++;
+ 
++	clen_changed = clen - already;
+ 	if (state)
+ 		ext4_set_bits(bitmap_bh->b_data, blkoff, clen);
+ 	else
+@@ -3935,9 +3937,9 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
+ 						group, gdp));
+ 	}
+ 	if (state)
+-		clen = ext4_free_group_clusters(sb, gdp) - clen + already;
++		clen = ext4_free_group_clusters(sb, gdp) - clen_changed;
+ 	else
+-		clen = ext4_free_group_clusters(sb, gdp) + clen - already;
++		clen = ext4_free_group_clusters(sb, gdp) + clen_changed;
+ 
+ 	ext4_free_group_clusters_set(sb, gdp, clen);
+ 	ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh);
+@@ -3947,10 +3949,13 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
+ 
+ 	if (sbi->s_log_groups_per_flex) {
+ 		ext4_group_t flex_group = ext4_flex_group(sbi, group);
++		struct flex_groups *fg = sbi_array_rcu_deref(sbi,
++					   s_flex_groups, flex_group);
+ 
+-		atomic64_sub(len,
+-			     &sbi_array_rcu_deref(sbi, s_flex_groups,
+-						  flex_group)->free_clusters);
++		if (state)
++			atomic64_sub(clen_changed, &fg->free_clusters);
++		else
++			atomic64_add(clen_changed, &fg->free_clusters);
+ 	}
+ 
+ 	err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch b/queue-5.16/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
new file mode 100644
index 00000000000..63da635b4c3
--- /dev/null
+++ b/queue-5.16/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
@@ -0,0 +1,84 @@
+From 5aab62639a7eb76ec6ca15d18f9df017ba535eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 09:38:47 -0500
+Subject: ext4: don't BUG if someone dirty pages without asking ext4 first
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ]
+
+[un]pin_user_pages_remote is dirtying pages without properly warning
+the file system in advance.  A related race was noted by Jan Kara in
+2018[1]; however, more recently instead of it being a very hard-to-hit
+race, it could be reliably triggered by process_vm_writev(2) which was
+discovered by Syzbot[2].
+
+This is technically a bug in mm/gup.c, but arguably ext4 is fragile in
+that if some other kernel subsystem dirty pages without properly
+notifying the file system using page_mkwrite(), ext4 will BUG, while
+other file systems will not BUG (although data will still be lost).
+
+So instead of crashing with a BUG, issue a warning (since there may be
+potential data loss) and just mark the page as clean to avoid
+unprivileged denial of service attacks until the problem can be
+properly fixed.  More discussion and background can be found in the
+thread starting at [2].
+
+[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
+[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com
+
+Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db@syzkaller.appspotmail.com
+Reported-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 2f5686dfa30d..a61d1e4e1026 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1992,6 +1992,15 @@ static int ext4_writepage(struct page *page,
+ 	else
+ 		len = PAGE_SIZE;
+ 
++	/* Should never happen but for bugs in other kernel subsystems */
++	if (!page_has_buffers(page)) {
++		ext4_warning_inode(inode,
++		   "page %lu does not have buffers attached", page->index);
++		ClearPageDirty(page);
++		unlock_page(page);
++		return 0;
++	}
++
+ 	page_bufs = page_buffers(page);
+ 	/*
+ 	 * We cannot do block allocation or other extent handling in this
+@@ -2595,6 +2604,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
+ 			wait_on_page_writeback(page);
+ 			BUG_ON(PageWriteback(page));
+ 
++			/*
++			 * Should never happen but for buggy code in
++			 * other subsystems that call
++			 * set_page_dirty() without properly warning
++			 * the file system first.  See [1] for more
++			 * information.
++			 *
++			 * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
++			 */
++			if (!page_has_buffers(page)) {
++				ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index);
++				ClearPageDirty(page);
++				unlock_page(page);
++				continue;
++			}
++
+ 			if (mpd->map.m_len == 0)
+ 				mpd->first_page = page->index;
+ 			mpd->next_page = page->index + 1;
+-- 
+2.34.1
+
diff --git a/queue-5.16/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch b/queue-5.16/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch
new file mode 100644
index 00000000000..5e7a37ac072
--- /dev/null
+++ b/queue-5.16/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch
@@ -0,0 +1,224 @@
+From 26623ce6cb46800d7b25fba7a3b1e727c398034a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 12:32:44 +0530
+Subject: ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit bfdc502a4a4c058bf4cbb1df0c297761d528f54d ]
+
+In case of flex_bg feature (which is by default enabled), extents for
+any given inode might span across blocks from two different block group.
+ext4_mb_mark_bb() only reads the buffer_head of block bitmap once for the
+starting block group, but it fails to read it again when the extent length
+boundary overflows to another block group. Then in this below loop it
+accesses memory beyond the block group bitmap buffer_head and results
+into a data abort.
+
+	for (i = 0; i < clen; i++)
+		if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)
+			already++;
+
+This patch adds this functionality for checking block group boundary in
+ext4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different
+block group.
+
+w/o this patch, I was easily able to hit a data access abort using Power platform.
+
+<...>
+[   74.327662] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters
+[   74.533214] EXT4-fs (loop3): shut down requested (2)
+[   74.536705] Aborting journal on device loop3-8.
+[   74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000
+[   74.703727] Faulting instruction address: 0xc0000000007bffb8
+cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060]
+    pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0
+    lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0
+    sp: c000000015db7300
+   msr: 800000000280b033
+   dar: c00000005e980000
+ dsisr: 40000000
+  current = 0xc000000027af6880
+  paca    = 0xc00000003ffd5200   irqmask: 0x03   irq_happened: 0x01
+    pid   = 5167, comm = mount
+<...>
+enter ? for help
+[c000000015db7380] c000000000782708 ext4_ext_clear_bb+0x378/0x410
+[c000000015db7400] c000000000813f14 ext4_fc_replay+0x1794/0x2000
+[c000000015db7580] c000000000833f7c do_one_pass+0xe9c/0x12a0
+[c000000015db7710] c000000000834504 jbd2_journal_recover+0x184/0x2d0
+[c000000015db77c0] c000000000841398 jbd2_journal_load+0x188/0x4a0
+[c000000015db7880] c000000000804de8 ext4_fill_super+0x2638/0x3e10
+[c000000015db7a40] c0000000005f8404 get_tree_bdev+0x2b4/0x350
+[c000000015db7ae0] c0000000007ef058 ext4_get_tree+0x28/0x40
+[c000000015db7b00] c0000000005f6344 vfs_get_tree+0x44/0x100
+[c000000015db7b70] c00000000063c408 path_mount+0xdd8/0xe70
+[c000000015db7c40] c00000000063c8f0 sys_mount+0x450/0x550
+[c000000015db7d50] c000000000035770 system_call_exception+0x4a0/0x4e0
+[c000000015db7e10] c00000000000c74c system_call_common+0xec/0x250
+
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/2609bc8f66fc15870616ee416a18a3d392a209c4.1644992609.git.riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 131 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 76 insertions(+), 55 deletions(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index c0868b82a62f..b53c07c5c760 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3901,72 +3901,93 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
+ 	ext4_grpblk_t blkoff;
+ 	int i, err;
+ 	int already;
+-	unsigned int clen, clen_changed;
++	unsigned int clen, clen_changed, thisgrp_len;
+ 
+-	clen = EXT4_NUM_B2C(sbi, len);
+-
+-	ext4_get_group_no_and_offset(sb, block, &group, &blkoff);
+-	bitmap_bh = ext4_read_block_bitmap(sb, group);
+-	if (IS_ERR(bitmap_bh)) {
+-		err = PTR_ERR(bitmap_bh);
+-		bitmap_bh = NULL;
+-		goto out_err;
+-	}
+-
+-	err = -EIO;
+-	gdp = ext4_get_group_desc(sb, group, &gdp_bh);
+-	if (!gdp)
+-		goto out_err;
++	while (len > 0) {
++		ext4_get_group_no_and_offset(sb, block, &group, &blkoff);
+ 
+-	ext4_lock_group(sb, group);
+-	already = 0;
+-	for (i = 0; i < clen; i++)
+-		if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)
+-			already++;
+-
+-	clen_changed = clen - already;
+-	if (state)
+-		ext4_set_bits(bitmap_bh->b_data, blkoff, clen);
+-	else
+-		mb_test_and_clear_bits(bitmap_bh->b_data, blkoff, clen);
+-	if (ext4_has_group_desc_csum(sb) &&
+-	    (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
+-		gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
+-		ext4_free_group_clusters_set(sb, gdp,
+-					     ext4_free_clusters_after_init(sb,
+-						group, gdp));
+-	}
+-	if (state)
+-		clen = ext4_free_group_clusters(sb, gdp) - clen_changed;
+-	else
+-		clen = ext4_free_group_clusters(sb, gdp) + clen_changed;
++		/*
++		 * Check to see if we are freeing blocks across a group
++		 * boundary.
++		 * In case of flex_bg, this can happen that (block, len) may
++		 * span across more than one group. In that case we need to
++		 * get the corresponding group metadata to work with.
++		 * For this we have goto again loop.
++		 */
++		thisgrp_len = min_t(unsigned int, (unsigned int)len,
++			EXT4_BLOCKS_PER_GROUP(sb) - EXT4_C2B(sbi, blkoff));
++		clen = EXT4_NUM_B2C(sbi, thisgrp_len);
+ 
+-	ext4_free_group_clusters_set(sb, gdp, clen);
+-	ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh);
+-	ext4_group_desc_csum_set(sb, group, gdp);
++		bitmap_bh = ext4_read_block_bitmap(sb, group);
++		if (IS_ERR(bitmap_bh)) {
++			err = PTR_ERR(bitmap_bh);
++			bitmap_bh = NULL;
++			break;
++		}
+ 
+-	ext4_unlock_group(sb, group);
++		err = -EIO;
++		gdp = ext4_get_group_desc(sb, group, &gdp_bh);
++		if (!gdp)
++			break;
+ 
+-	if (sbi->s_log_groups_per_flex) {
+-		ext4_group_t flex_group = ext4_flex_group(sbi, group);
+-		struct flex_groups *fg = sbi_array_rcu_deref(sbi,
+-					   s_flex_groups, flex_group);
++		ext4_lock_group(sb, group);
++		already = 0;
++		for (i = 0; i < clen; i++)
++			if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) ==
++					 !state)
++				already++;
+ 
++		clen_changed = clen - already;
+ 		if (state)
+-			atomic64_sub(clen_changed, &fg->free_clusters);
++			ext4_set_bits(bitmap_bh->b_data, blkoff, clen);
+ 		else
+-			atomic64_add(clen_changed, &fg->free_clusters);
++			mb_test_and_clear_bits(bitmap_bh->b_data, blkoff, clen);
++		if (ext4_has_group_desc_csum(sb) &&
++		    (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
++			gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
++			ext4_free_group_clusters_set(sb, gdp,
++			     ext4_free_clusters_after_init(sb, group, gdp));
++		}
++		if (state)
++			clen = ext4_free_group_clusters(sb, gdp) - clen_changed;
++		else
++			clen = ext4_free_group_clusters(sb, gdp) + clen_changed;
++
++		ext4_free_group_clusters_set(sb, gdp, clen);
++		ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh);
++		ext4_group_desc_csum_set(sb, group, gdp);
++
++		ext4_unlock_group(sb, group);
++
++		if (sbi->s_log_groups_per_flex) {
++			ext4_group_t flex_group = ext4_flex_group(sbi, group);
++			struct flex_groups *fg = sbi_array_rcu_deref(sbi,
++						   s_flex_groups, flex_group);
++
++			if (state)
++				atomic64_sub(clen_changed, &fg->free_clusters);
++			else
++				atomic64_add(clen_changed, &fg->free_clusters);
++
++		}
++
++		err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh);
++		if (err)
++			break;
++		sync_dirty_buffer(bitmap_bh);
++		err = ext4_handle_dirty_metadata(NULL, NULL, gdp_bh);
++		sync_dirty_buffer(gdp_bh);
++		if (err)
++			break;
++
++		block += thisgrp_len;
++		len -= thisgrp_len;
++		brelse(bitmap_bh);
++		BUG_ON(len < 0);
+ 	}
+ 
+-	err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh);
+ 	if (err)
+-		goto out_err;
+-	sync_dirty_buffer(bitmap_bh);
+-	err = ext4_handle_dirty_metadata(NULL, NULL, gdp_bh);
+-	sync_dirty_buffer(gdp_bh);
+-
+-out_err:
+-	brelse(bitmap_bh);
++		brelse(bitmap_bh);
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch b/queue-5.16/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch
new file mode 100644
index 00000000000..b4ad9d282de
--- /dev/null
+++ b/queue-5.16/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch
@@ -0,0 +1,41 @@
+From 1688e316de6743f2e85ff8d0af83c3856b69551f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 18:20:00 +0800
+Subject: f2fs: compress: fix to print raw data size in error path of lz4
+ decompression
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit d284af43f703760e261b1601378a0c13a19d5f1f ]
+
+In lz4_decompress_pages(), if size of decompressed data is not equal to
+expected one, we should print the size rather than size of target buffer
+for decompressed data, fix it.
+
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 190a3c4d4c91..ced0fd54658c 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -313,10 +313,9 @@ static int lz4_decompress_pages(struct decompress_io_ctx *dic)
+ 	}
+ 
+ 	if (ret != PAGE_SIZE << dic->log_cluster_size) {
+-		printk_ratelimited("%sF2FS-fs (%s): lz4 invalid rlen:%zu, "
++		printk_ratelimited("%sF2FS-fs (%s): lz4 invalid ret:%d, "
+ 					"expected:%lu\n", KERN_ERR,
+-					F2FS_I_SB(dic->inode)->sb->s_id,
+-					dic->rlen,
++					F2FS_I_SB(dic->inode)->sb->s_id, ret,
+ 					PAGE_SIZE << dic->log_cluster_size);
+ 		return -EIO;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-don-t-get-freeze-lock-in-f2fs_evict_inode-in-fr.patch b/queue-5.16/f2fs-don-t-get-freeze-lock-in-f2fs_evict_inode-in-fr.patch
new file mode 100644
index 00000000000..9d0ecfb4c38
--- /dev/null
+++ b/queue-5.16/f2fs-don-t-get-freeze-lock-in-f2fs_evict_inode-in-fr.patch
@@ -0,0 +1,118 @@
+From 43021fb0ee489de747af830aa95714f612363d6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 09:40:05 -0800
+Subject: f2fs: don't get FREEZE lock in f2fs_evict_inode in frozen fs
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit ba900534f807f0b327c92d5141c85d2313e2d55c ]
+
+Let's purge inode cache in order to avoid the below deadlock.
+
+[freeze test]                         shrinkder
+freeze_super
+ - pwercpu_down_write(SB_FREEZE_FS)
+                                       - super_cache_scan
+                                         - down_read(&sb->s_umount)
+                                           - prune_icache_sb
+                                            - dispose_list
+                                             - evict
+                                              - f2fs_evict_inode
+thaw_super
+ - down_write(&sb->s_umount);
+                                              - __percpu_down_read(SB_FREEZE_FS)
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-fs-f2fs | 1 +
+ fs/f2fs/debug.c                         | 1 +
+ fs/f2fs/f2fs.h                          | 1 +
+ fs/f2fs/inode.c                         | 6 ++++--
+ fs/f2fs/super.c                         | 4 ++++
+ 5 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs
+index b268e3e18b4a..91e2b549f817 100644
+--- a/Documentation/ABI/testing/sysfs-fs-f2fs
++++ b/Documentation/ABI/testing/sysfs-fs-f2fs
+@@ -425,6 +425,7 @@ Description:	Show status of f2fs superblock in real time.
+ 		0x800  SBI_QUOTA_SKIP_FLUSH  skip flushing quota in current CP
+ 		0x1000 SBI_QUOTA_NEED_REPAIR quota file may be corrupted
+ 		0x2000 SBI_IS_RESIZEFS       resizefs is in process
++		0x4000 SBI_IS_FREEZING       freefs is in process
+ 		====== ===================== =================================
+ 
+ What:		/sys/fs/f2fs/<disk>/ckpt_thread_ioprio
+diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
+index 8c50518475a9..07ad0d81f0c5 100644
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -338,6 +338,7 @@ static char *s_flag[] = {
+ 	[SBI_QUOTA_SKIP_FLUSH]	= " quota_skip_flush",
+ 	[SBI_QUOTA_NEED_REPAIR]	= " quota_need_repair",
+ 	[SBI_IS_RESIZEFS]	= " resizefs",
++	[SBI_IS_FREEZING]	= " freezefs",
+ };
+ 
+ static int stat_show(struct seq_file *s, void *v)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index d753094a4919..980c0c2b6350 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1259,6 +1259,7 @@ enum {
+ 	SBI_QUOTA_SKIP_FLUSH,			/* skip flushing quota in current CP */
+ 	SBI_QUOTA_NEED_REPAIR,			/* quota file may be corrupted */
+ 	SBI_IS_RESIZEFS,			/* resizefs is in process */
++	SBI_IS_FREEZING,			/* freezefs is in process */
+ };
+ 
+ enum {
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 5a10f98dbbc3..a40e52ba5ec8 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -769,7 +769,8 @@ void f2fs_evict_inode(struct inode *inode)
+ 	f2fs_remove_ino_entry(sbi, inode->i_ino, UPDATE_INO);
+ 	f2fs_remove_ino_entry(sbi, inode->i_ino, FLUSH_INO);
+ 
+-	sb_start_intwrite(inode->i_sb);
++	if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING))
++		sb_start_intwrite(inode->i_sb);
+ 	set_inode_flag(inode, FI_NO_ALLOC);
+ 	i_size_write(inode, 0);
+ retry:
+@@ -800,7 +801,8 @@ void f2fs_evict_inode(struct inode *inode)
+ 		if (dquot_initialize_needed(inode))
+ 			set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+ 	}
+-	sb_end_intwrite(inode->i_sb);
++	if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING))
++		sb_end_intwrite(inode->i_sb);
+ no_delete:
+ 	dquot_drop(inode);
+ 
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 45106b426e8d..9402d5b2c7fd 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1668,11 +1668,15 @@ static int f2fs_freeze(struct super_block *sb)
+ 	/* ensure no checkpoint required */
+ 	if (!llist_empty(&F2FS_SB(sb)->cprc_info.issue_list))
+ 		return -EINVAL;
++
++	/* to avoid deadlock on f2fs_evict_inode->SB_FREEZE_FS */
++	set_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING);
+ 	return 0;
+ }
+ 
+ static int f2fs_unfreeze(struct super_block *sb)
+ {
++	clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING);
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch b/queue-5.16/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch
new file mode 100644
index 00000000000..95fea764d40
--- /dev/null
+++ b/queue-5.16/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch
@@ -0,0 +1,79 @@
+From 080b71df352c8b6f090813b0655c78d1eb8beb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 09:23:04 +0800
+Subject: f2fs: fix compressed file start atomic write may cause data
+ corruption
+
+From: Fengnan Chang <changfengnan@vivo.com>
+
+[ Upstream commit 9b56adcf525522e9ffa52471260298d91fc1d395 ]
+
+When compressed file has blocks, f2fs_ioc_start_atomic_write will succeed,
+but compressed flag will be remained in inode. If write partial compreseed
+cluster and commit atomic write will cause data corruption.
+
+This is the reproduction process:
+Step 1:
+create a compressed file ,write 64K data , call fsync(), then the blocks
+are write as compressed cluster.
+Step2:
+iotcl(F2FS_IOC_START_ATOMIC_WRITE)  --- this should be fail, but not.
+write page 0 and page 3.
+iotcl(F2FS_IOC_COMMIT_ATOMIC_WRITE)  -- page 0 and 3 write as normal file,
+Step3:
+drop cache.
+read page 0-4   -- Since page 0 has a valid block address, read as
+non-compressed cluster, page 1 and 2 will be filled with compressed data
+or zero.
+
+The root cause is, after commit 7eab7a696827 ("f2fs: compress: remove
+unneeded read when rewrite whole cluster"), in step 2, f2fs_write_begin()
+only set target page dirty, and in f2fs_commit_inmem_pages(), we will write
+partial raw pages into compressed cluster, result in corrupting compressed
+cluster layout.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Fixes: 7eab7a696827 ("f2fs: compress: remove unneeded read when rewrite whole cluster")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Fengnan Chang <changfengnan@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ fs/f2fs/file.c | 5 ++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 04e82dedb4df..5b4b26130844 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -3463,7 +3463,7 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping,
+ 
+ 		*fsdata = NULL;
+ 
+-		if (len == PAGE_SIZE)
++		if (len == PAGE_SIZE && !(f2fs_is_atomic_file(inode)))
+ 			goto repeat;
+ 
+ 		ret = f2fs_prepare_compress_overwrite(inode, pagep,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index b752d1a6e6ff..21dde125ff77 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2002,7 +2002,10 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ 
+ 	inode_lock(inode);
+ 
+-	f2fs_disable_compressed_file(inode);
++	if (!f2fs_disable_compressed_file(inode)) {
++		ret = -EINVAL;
++		goto out;
++	}
+ 
+ 	if (f2fs_is_atomic_file(inode)) {
+ 		if (is_inode_flag_set(inode, FI_ATOMIC_REVOKE_REQUEST))
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch b/queue-5.16/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
new file mode 100644
index 00000000000..e7801fb706b
--- /dev/null
+++ b/queue-5.16/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
@@ -0,0 +1,109 @@
+From 86eb467220f89d25f92bfb7195552315da0ad464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 18:56:46 -0800
+Subject: f2fs: fix missing free nid in f2fs_handle_failed_inode
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 2fef99b8372c1ae3d8445ab570e888b5a358dbe9 ]
+
+This patch fixes xfstests/generic/475 failure.
+
+[  293.680694] F2FS-fs (dm-1): May loss orphan inode, run fsck to fix.
+[  293.685358] Buffer I/O error on dev dm-1, logical block 8388592, async page read
+[  293.691527] Buffer I/O error on dev dm-1, logical block 8388592, async page read
+[  293.691764] sh (7615): drop_caches: 3
+[  293.691819] sh (7616): drop_caches: 3
+[  293.694017] Buffer I/O error on dev dm-1, logical block 1, async page read
+[  293.695659] sh (7618): drop_caches: 3
+[  293.696979] sh (7617): drop_caches: 3
+[  293.700290] sh (7623): drop_caches: 3
+[  293.708621] sh (7626): drop_caches: 3
+[  293.711386] sh (7628): drop_caches: 3
+[  293.711825] sh (7627): drop_caches: 3
+[  293.716738] sh (7630): drop_caches: 3
+[  293.719613] sh (7632): drop_caches: 3
+[  293.720971] sh (7633): drop_caches: 3
+[  293.727741] sh (7634): drop_caches: 3
+[  293.730783] sh (7636): drop_caches: 3
+[  293.732681] sh (7635): drop_caches: 3
+[  293.732988] sh (7637): drop_caches: 3
+[  293.738836] sh (7639): drop_caches: 3
+[  293.740568] sh (7641): drop_caches: 3
+[  293.743053] sh (7640): drop_caches: 3
+[  293.821889] ------------[ cut here ]------------
+[  293.824654] kernel BUG at fs/f2fs/node.c:3334!
+[  293.826226] invalid opcode: 0000 [#1] PREEMPT SMP PTI
+[  293.828713] CPU: 0 PID: 7653 Comm: umount Tainted: G           OE     5.17.0-rc1-custom #1
+[  293.830946] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+[  293.832526] RIP: 0010:f2fs_destroy_node_manager+0x33f/0x350 [f2fs]
+[  293.833905] Code: e8 d6 3d f9 f9 48 8b 45 d0 65 48 2b 04 25 28 00 00 00 75 1a 48 81 c4 28 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b
+[  293.837783] RSP: 0018:ffffb04ec31e7a20 EFLAGS: 00010202
+[  293.839062] RAX: 0000000000000001 RBX: ffff9df947db2eb8 RCX: 0000000080aa0072
+[  293.840666] RDX: 0000000000000000 RSI: ffffe86c0432a140 RDI: ffffffffc0b72a21
+[  293.842261] RBP: ffffb04ec31e7d70 R08: ffff9df94ca85780 R09: 0000000080aa0072
+[  293.843909] R10: ffff9df94ca85700 R11: ffff9df94e1ccf58 R12: ffff9df947db2e00
+[  293.845594] R13: ffff9df947db2ed0 R14: ffff9df947db2eb8 R15: ffff9df947db2eb8
+[  293.847855] FS:  00007f5a97379800(0000) GS:ffff9dfa77c00000(0000) knlGS:0000000000000000
+[  293.850647] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  293.852940] CR2: 00007f5a97528730 CR3: 000000010bc76005 CR4: 0000000000370ef0
+[  293.854680] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  293.856423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  293.858380] Call Trace:
+[  293.859302]  <TASK>
+[  293.860311]  ? ttwu_do_wakeup+0x1c/0x170
+[  293.861800]  ? ttwu_do_activate+0x6d/0xb0
+[  293.863057]  ? _raw_spin_unlock_irqrestore+0x29/0x40
+[  293.864411]  ? try_to_wake_up+0x9d/0x5e0
+[  293.865618]  ? debug_smp_processor_id+0x17/0x20
+[  293.866934]  ? debug_smp_processor_id+0x17/0x20
+[  293.868223]  ? free_unref_page+0xbf/0x120
+[  293.869470]  ? __free_slab+0xcb/0x1c0
+[  293.870614]  ? preempt_count_add+0x7a/0xc0
+[  293.871811]  ? __slab_free+0xa0/0x2d0
+[  293.872918]  ? __wake_up_common_lock+0x8a/0xc0
+[  293.874186]  ? __slab_free+0xa0/0x2d0
+[  293.875305]  ? free_inode_nonrcu+0x20/0x20
+[  293.876466]  ? free_inode_nonrcu+0x20/0x20
+[  293.877650]  ? debug_smp_processor_id+0x17/0x20
+[  293.878949]  ? call_rcu+0x11a/0x240
+[  293.880060]  ? f2fs_destroy_stats+0x59/0x60 [f2fs]
+[  293.881437]  ? kfree+0x1fe/0x230
+[  293.882674]  f2fs_put_super+0x160/0x390 [f2fs]
+[  293.883978]  generic_shutdown_super+0x7a/0x120
+[  293.885274]  kill_block_super+0x27/0x50
+[  293.886496]  kill_f2fs_super+0x7f/0x100 [f2fs]
+[  293.887806]  deactivate_locked_super+0x35/0xa0
+[  293.889271]  deactivate_super+0x40/0x50
+[  293.890513]  cleanup_mnt+0x139/0x190
+[  293.891689]  __cleanup_mnt+0x12/0x20
+[  293.892850]  task_work_run+0x64/0xa0
+[  293.894035]  exit_to_user_mode_prepare+0x1b7/0x1c0
+[  293.895409]  syscall_exit_to_user_mode+0x27/0x50
+[  293.896872]  do_syscall_64+0x48/0xc0
+[  293.898090]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+[  293.899517] RIP: 0033:0x7f5a975cd25b
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 1db7823d5a13..5a10f98dbbc3 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -876,6 +876,7 @@ void f2fs_handle_failed_inode(struct inode *inode)
+ 	err = f2fs_get_node_info(sbi, inode->i_ino, &ni);
+ 	if (err) {
+ 		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		set_inode_flag(inode, FI_FREE_NID);
+ 		f2fs_warn(sbi, "May loss orphan inode, run fsck to fix.");
+ 		goto out;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-fix-to-avoid-potential-deadlock.patch b/queue-5.16/f2fs-fix-to-avoid-potential-deadlock.patch
new file mode 100644
index 00000000000..8479f47c0c3
--- /dev/null
+++ b/queue-5.16/f2fs-fix-to-avoid-potential-deadlock.patch
@@ -0,0 +1,88 @@
+From 485bcc6c98221938cdb1f4c7dc13eb2da17d594e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 13:44:49 +0800
+Subject: f2fs: fix to avoid potential deadlock
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 344150999b7fc88502a65bbb147a47503eca2033 ]
+
+Quoted from Jing Xia's report, there is a potential deadlock may happen
+between kworker and checkpoint as below:
+
+[T:writeback]				[T:checkpoint]
+- wb_writeback
+ - blk_start_plug
+bio contains NodeA was plugged in writeback threads
+					- do_writepages  -- sync write inodeB, inc wb_sync_req[DATA]
+					 - f2fs_write_data_pages
+					  - f2fs_write_single_data_page -- write last dirty page
+					   - f2fs_do_write_data_page
+					    - set_page_writeback  -- clear page dirty flag and
+					    PAGECACHE_TAG_DIRTY tag in radix tree
+					    - f2fs_outplace_write_data
+					     - f2fs_update_data_blkaddr
+					      - f2fs_wait_on_page_writeback -- wait NodeA to writeback here
+					   - inode_dec_dirty_pages
+ - writeback_sb_inodes
+  - writeback_single_inode
+   - do_writepages
+    - f2fs_write_data_pages -- skip writepages due to wb_sync_req[DATA]
+     - wbc->pages_skipped += get_dirty_pages() -- PAGECACHE_TAG_DIRTY is not set but get_dirty_pages() returns one
+  - requeue_inode -- requeue inode to wb->b_dirty queue due to non-zero.pages_skipped
+ - blk_finish_plug
+
+Let's try to avoid deadlock condition by forcing unplugging previous bio via
+blk_finish_plug(current->plug) once we'v skipped writeback in writepages()
+due to valid sbi->wb_sync_req[DATA/NODE].
+
+Fixes: 687de7f1010c ("f2fs: avoid IO split due to mixed WB_SYNC_ALL and WB_SYNC_NONE")
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Jing Xia <jing.xia@unisoc.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 6 +++++-
+ fs/f2fs/node.c | 6 +++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 3ba75587a2cd..04e82dedb4df 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -3267,8 +3267,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping,
+ 	/* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */
+ 	if (wbc->sync_mode == WB_SYNC_ALL)
+ 		atomic_inc(&sbi->wb_sync_req[DATA]);
+-	else if (atomic_read(&sbi->wb_sync_req[DATA]))
++	else if (atomic_read(&sbi->wb_sync_req[DATA])) {
++		/* to avoid potential deadlock */
++		if (current->plug)
++			blk_finish_plug(current->plug);
+ 		goto skip_write;
++	}
+ 
+ 	if (__should_serialize_io(inode, wbc)) {
+ 		mutex_lock(&sbi->writepages);
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 556fcd8457f3..69c6bcaf5aae 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2106,8 +2106,12 @@ static int f2fs_write_node_pages(struct address_space *mapping,
+ 
+ 	if (wbc->sync_mode == WB_SYNC_ALL)
+ 		atomic_inc(&sbi->wb_sync_req[NODE]);
+-	else if (atomic_read(&sbi->wb_sync_req[NODE]))
++	else if (atomic_read(&sbi->wb_sync_req[NODE])) {
++		/* to avoid potential deadlock */
++		if (current->plug)
++			blk_finish_plug(current->plug);
+ 		goto skip_write;
++	}
+ 
+ 	trace_f2fs_writepages(mapping->host, wbc, NODE);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch b/queue-5.16/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch
new file mode 100644
index 00000000000..c1bb4c0f934
--- /dev/null
+++ b/queue-5.16/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch
@@ -0,0 +1,86 @@
+From c4400ac1a3dc270ba6d7426ad1077a4a1b9ab992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 09:49:13 +0800
+Subject: f2fs: fix to do sanity check on curseg->alloc_type
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit f41ee8b91c00770d718be2ff4852a80017ae9ab3 ]
+
+As Wenqing Liu reported in bugzilla:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=215657
+
+- Overview
+UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image
+
+- Reproduce
+tested on kernel 5.17-rc4, 5.17-rc6
+
+1. mkdir test_crash
+2. cd test_crash
+3. unzip tmp2.zip
+4. mkdir mnt
+5. ./single_test.sh f2fs 2
+
+- Kernel dump
+[   46.434454] loop0: detected capacity change from 0 to 131072
+[   46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9
+[   46.738319] ================================================================================
+[   46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2
+[   46.738475] index 231 is out of range for type 'unsigned int [2]'
+[   46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1
+[   46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
+[   46.738551] Call Trace:
+[   46.738556]  <TASK>
+[   46.738563]  dump_stack_lvl+0x47/0x5c
+[   46.738581]  ubsan_epilogue+0x5/0x50
+[   46.738592]  __ubsan_handle_out_of_bounds+0x68/0x80
+[   46.738604]  f2fs_allocate_data_block+0xdff/0xe60 [f2fs]
+[   46.738819]  do_write_page+0xef/0x210 [f2fs]
+[   46.738934]  f2fs_do_write_node_page+0x3f/0x80 [f2fs]
+[   46.739038]  __write_node_page+0x2b7/0x920 [f2fs]
+[   46.739162]  f2fs_sync_node_pages+0x943/0xb00 [f2fs]
+[   46.739293]  f2fs_write_checkpoint+0x7bb/0x1030 [f2fs]
+[   46.739405]  kill_f2fs_super+0x125/0x150 [f2fs]
+[   46.739507]  deactivate_locked_super+0x60/0xc0
+[   46.739517]  deactivate_super+0x70/0xb0
+[   46.739524]  cleanup_mnt+0x11a/0x200
+[   46.739532]  __cleanup_mnt+0x16/0x20
+[   46.739538]  task_work_run+0x67/0xa0
+[   46.739547]  exit_to_user_mode_prepare+0x18c/0x1a0
+[   46.739559]  syscall_exit_to_user_mode+0x26/0x40
+[   46.739568]  do_syscall_64+0x46/0xb0
+[   46.739584]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+The root cause is we missed to do sanity check on curseg->alloc_type,
+result in out-of-bound accessing on sbi->block_count[] array, fix it.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index df9ed75f0b7a..5fd33aabd0fc 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4792,6 +4792,13 @@ static int sanity_check_curseg(struct f2fs_sb_info *sbi)
+ 
+ 		sanity_check_seg_type(sbi, curseg->seg_type);
+ 
++		if (curseg->alloc_type != LFS && curseg->alloc_type != SSR) {
++			f2fs_err(sbi,
++				 "Current segment has invalid alloc_type:%d",
++				 curseg->alloc_type);
++			return -EFSCORRUPTED;
++		}
++
+ 		if (f2fs_test_bit(blkofs, se->cur_valid_map))
+ 			goto out;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch b/queue-5.16/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch
new file mode 100644
index 00000000000..181b77e1b4d
--- /dev/null
+++ b/queue-5.16/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch
@@ -0,0 +1,38 @@
+From 903c8b30498f0b51d2987cc4e33717bf2b9f3d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 11:48:02 +0800
+Subject: f2fs: fix to enable ATGC correctly via gc_idle sysfs interface
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 7d19e3dab0002e527052b0aaf986e8c32e5537bf ]
+
+It needs to assign sbi->gc_mode with GC_IDLE_AT rather than GC_AT when
+user tries to enable ATGC via gc_idle sysfs interface, fix it.
+
+Fixes: 093749e296e2 ("f2fs: support age threshold based garbage collection")
+Cc: Zhipeng Tan <tanzhipeng@hust.edu.cn>
+Signed-off-by: Jicheng Shao <shaojicheng@hust.edu.cn>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 8cdeac090f81..8885c7383472 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -473,7 +473,7 @@ static ssize_t __sbi_store(struct f2fs_attr *a,
+ 		} else if (t == GC_IDLE_AT) {
+ 			if (!sbi->am.atgc_enabled)
+ 				return -EINVAL;
+-			sbi->gc_mode = GC_AT;
++			sbi->gc_mode = GC_IDLE_AT;
+ 		} else {
+ 			sbi->gc_mode = GC_NORMAL;
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/f2fs-use-spin_lock-to-avoid-hang.patch b/queue-5.16/f2fs-use-spin_lock-to-avoid-hang.patch
new file mode 100644
index 00000000000..7f80314e97e
--- /dev/null
+++ b/queue-5.16/f2fs-use-spin_lock-to-avoid-hang.patch
@@ -0,0 +1,141 @@
+From 933d3144aad2a14d34846ce27c1ceb519febcf96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 17:27:46 -0800
+Subject: f2fs: use spin_lock to avoid hang
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 98237fcda4a24e67b0a4498c17d5aa4ad4537bc7 ]
+
+[14696.634553] task:cat             state:D stack:    0 pid:1613738 ppid:1613735 flags:0x00000004
+[14696.638285] Call Trace:
+[14696.639038]  <TASK>
+[14696.640032]  __schedule+0x302/0x930
+[14696.640969]  schedule+0x58/0xd0
+[14696.641799]  schedule_preempt_disabled+0x18/0x30
+[14696.642890]  __mutex_lock.constprop.0+0x2fb/0x4f0
+[14696.644035]  ? mod_objcg_state+0x10c/0x310
+[14696.645040]  ? obj_cgroup_charge+0xe1/0x170
+[14696.646067]  __mutex_lock_slowpath+0x13/0x20
+[14696.647126]  mutex_lock+0x34/0x40
+[14696.648070]  stat_show+0x25/0x17c0 [f2fs]
+[14696.649218]  seq_read_iter+0x120/0x4b0
+[14696.650289]  ? aa_file_perm+0x12a/0x500
+[14696.651357]  ? lru_cache_add+0x1c/0x20
+[14696.652470]  seq_read+0xfd/0x140
+[14696.653445]  full_proxy_read+0x5c/0x80
+[14696.654535]  vfs_read+0xa0/0x1a0
+[14696.655497]  ksys_read+0x67/0xe0
+[14696.656502]  __x64_sys_read+0x1a/0x20
+[14696.657580]  do_syscall_64+0x3b/0xc0
+[14696.658671]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+[14696.660068] RIP: 0033:0x7efe39df1cb2
+[14696.661133] RSP: 002b:00007ffc8badd948 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[14696.662958] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007efe39df1cb2
+[14696.664757] RDX: 0000000000020000 RSI: 00007efe399df000 RDI: 0000000000000003
+[14696.666542] RBP: 00007efe399df000 R08: 00007efe399de010 R09: 00007efe399de010
+[14696.668363] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000000
+[14696.670155] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
+[14696.671965]  </TASK>
+[14696.672826] task:umount          state:D stack:    0 pid:1614985 ppid:1614984 flags:0x00004000
+[14696.674930] Call Trace:
+[14696.675903]  <TASK>
+[14696.676780]  __schedule+0x302/0x930
+[14696.677927]  schedule+0x58/0xd0
+[14696.679019]  schedule_preempt_disabled+0x18/0x30
+[14696.680412]  __mutex_lock.constprop.0+0x2fb/0x4f0
+[14696.681783]  ? destroy_inode+0x65/0x80
+[14696.683006]  __mutex_lock_slowpath+0x13/0x20
+[14696.684305]  mutex_lock+0x34/0x40
+[14696.685442]  f2fs_destroy_stats+0x1e/0x60 [f2fs]
+[14696.686803]  f2fs_put_super+0x158/0x390 [f2fs]
+[14696.688238]  generic_shutdown_super+0x7a/0x120
+[14696.689621]  kill_block_super+0x27/0x50
+[14696.690894]  kill_f2fs_super+0x7f/0x100 [f2fs]
+[14696.692311]  deactivate_locked_super+0x35/0xa0
+[14696.693698]  deactivate_super+0x40/0x50
+[14696.694985]  cleanup_mnt+0x139/0x190
+[14696.696209]  __cleanup_mnt+0x12/0x20
+[14696.697390]  task_work_run+0x64/0xa0
+[14696.698587]  exit_to_user_mode_prepare+0x1b7/0x1c0
+[14696.700053]  syscall_exit_to_user_mode+0x27/0x50
+[14696.701418]  do_syscall_64+0x48/0xc0
+[14696.702630]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/debug.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
+index 07ad0d81f0c5..b449c7a372a4 100644
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -21,7 +21,7 @@
+ #include "gc.h"
+ 
+ static LIST_HEAD(f2fs_stat_list);
+-static DEFINE_MUTEX(f2fs_stat_mutex);
++static DEFINE_RAW_SPINLOCK(f2fs_stat_lock);
+ #ifdef CONFIG_DEBUG_FS
+ static struct dentry *f2fs_debugfs_root;
+ #endif
+@@ -345,8 +345,9 @@ static int stat_show(struct seq_file *s, void *v)
+ {
+ 	struct f2fs_stat_info *si;
+ 	int i = 0, j = 0;
++	unsigned long flags;
+ 
+-	mutex_lock(&f2fs_stat_mutex);
++	raw_spin_lock_irqsave(&f2fs_stat_lock, flags);
+ 	list_for_each_entry(si, &f2fs_stat_list, stat_list) {
+ 		update_general_status(si->sbi);
+ 
+@@ -574,7 +575,7 @@ static int stat_show(struct seq_file *s, void *v)
+ 		seq_printf(s, "  - paged : %llu KB\n",
+ 				si->page_mem >> 10);
+ 	}
+-	mutex_unlock(&f2fs_stat_mutex);
++	raw_spin_unlock_irqrestore(&f2fs_stat_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -585,6 +586,7 @@ int f2fs_build_stats(struct f2fs_sb_info *sbi)
+ {
+ 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+ 	struct f2fs_stat_info *si;
++	unsigned long flags;
+ 	int i;
+ 
+ 	si = f2fs_kzalloc(sbi, sizeof(struct f2fs_stat_info), GFP_KERNEL);
+@@ -620,9 +622,9 @@ int f2fs_build_stats(struct f2fs_sb_info *sbi)
+ 	atomic_set(&sbi->max_aw_cnt, 0);
+ 	atomic_set(&sbi->max_vw_cnt, 0);
+ 
+-	mutex_lock(&f2fs_stat_mutex);
++	raw_spin_lock_irqsave(&f2fs_stat_lock, flags);
+ 	list_add_tail(&si->stat_list, &f2fs_stat_list);
+-	mutex_unlock(&f2fs_stat_mutex);
++	raw_spin_unlock_irqrestore(&f2fs_stat_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -630,10 +632,11 @@ int f2fs_build_stats(struct f2fs_sb_info *sbi)
+ void f2fs_destroy_stats(struct f2fs_sb_info *sbi)
+ {
+ 	struct f2fs_stat_info *si = F2FS_STAT(sbi);
++	unsigned long flags;
+ 
+-	mutex_lock(&f2fs_stat_mutex);
++	raw_spin_lock_irqsave(&f2fs_stat_lock, flags);
+ 	list_del(&si->stat_list);
+-	mutex_unlock(&f2fs_stat_mutex);
++	raw_spin_unlock_irqrestore(&f2fs_stat_lock, flags);
+ 
+ 	kfree(si);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/firmware-google-properly-state-iomem-dependency.patch b/queue-5.16/firmware-google-properly-state-iomem-dependency.patch
new file mode 100644
index 00000000000..65188728a64
--- /dev/null
+++ b/queue-5.16/firmware-google-properly-state-iomem-dependency.patch
@@ -0,0 +1,58 @@
+From 81336b00214b5c6e697d839893b7f953fdb61fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 12:15:02 +0800
+Subject: firmware: google: Properly state IOMEM dependency
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 37fd83916da2e4cae03d350015c82a67b1b334c4 ]
+
+The Google Coreboot implementation requires IOMEM functions
+(memmremap, memunmap, devm_memremap), but does not specify this is its
+Kconfig. This results in build errors when HAS_IOMEM is not set, such as
+on some UML configurations:
+
+/usr/bin/ld: drivers/firmware/google/coreboot_table.o: in function `coreboot_table_probe':
+coreboot_table.c:(.text+0x311): undefined reference to `memremap'
+/usr/bin/ld: coreboot_table.c:(.text+0x34e): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/memconsole-coreboot.o: in function `memconsole_probe':
+memconsole-coreboot.c:(.text+0x12d): undefined reference to `memremap'
+/usr/bin/ld: memconsole-coreboot.c:(.text+0x17e): undefined reference to `devm_memremap'
+/usr/bin/ld: memconsole-coreboot.c:(.text+0x191): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_destroy.isra.0':
+vpd.c:(.text+0x300): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_init':
+vpd.c:(.text+0x382): undefined reference to `memremap'
+/usr/bin/ld: vpd.c:(.text+0x459): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_probe':
+vpd.c:(.text+0x59d): undefined reference to `memremap'
+/usr/bin/ld: vpd.c:(.text+0x5d3): undefined reference to `memunmap'
+collect2: error: ld returned 1 exit status
+
+Fixes: a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core")
+Acked-By: anton ivanov <anton.ivanov@cambridgegreys.com>
+Acked-By: Julius Werner <jwerner@chromium.org>
+Signed-off-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/r/20220225041502.1901806-1-davidgow@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/google/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig
+index 931544c9f63d..983e07dc022e 100644
+--- a/drivers/firmware/google/Kconfig
++++ b/drivers/firmware/google/Kconfig
+@@ -21,7 +21,7 @@ config GOOGLE_SMI
+ 
+ config GOOGLE_COREBOOT_TABLE
+ 	tristate "Coreboot Table Access"
+-	depends on ACPI || OF
++	depends on HAS_IOMEM && (ACPI || OF)
+ 	help
+ 	  This option enables the coreboot_table module, which provides other
+ 	  firmware modules access to the coreboot table. The coreboot table
+-- 
+2.34.1
+
diff --git a/queue-5.16/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch b/queue-5.16/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch
new file mode 100644
index 00000000000..443422922f0
--- /dev/null
+++ b/queue-5.16/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch
@@ -0,0 +1,47 @@
+From dd11cb38bfc529d8103c1f4ca36836fed460899e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 09:34:21 +0100
+Subject: firmware: qcom: scm: Remove reassignment to desc following
+ initializer
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 7823e5aa5d1dd9ed5849923c165eb8f29ad23c54 ]
+
+Member assignments to qcom_scm_desc were moved into struct initializers
+in 57d3b816718c ("firmware: qcom_scm: Remove thin wrappers") including
+the case in qcom_scm_iommu_secure_ptbl_init, except that the - now
+duplicate - assignment to desc was left in place. While not harmful,
+remove this unnecessary extra reassignment.
+
+Fixes: 57d3b816718c ("firmware: qcom_scm: Remove thin wrappers")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Reviewed-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211208083423.22037-2-marijn.suijten@somainline.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 7db8066b19fd..3f67bf774821 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -749,12 +749,6 @@ int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare)
+ 	};
+ 	int ret;
+ 
+-	desc.args[0] = addr;
+-	desc.args[1] = size;
+-	desc.args[2] = spare;
+-	desc.arginfo = QCOM_SCM_ARGS(3, QCOM_SCM_RW, QCOM_SCM_VAL,
+-				     QCOM_SCM_VAL);
+-
+ 	ret = qcom_scm_call(__scm->dev, &desc, NULL);
+ 
+ 	/* the pg table has been initialized already, ignore the error */
+-- 
+2.34.1
+
diff --git a/queue-5.16/firmware-ti_sci-fix-compilation-failure-when-config_.patch b/queue-5.16/firmware-ti_sci-fix-compilation-failure-when-config_.patch
new file mode 100644
index 00000000000..d0610246f41
--- /dev/null
+++ b/queue-5.16/firmware-ti_sci-fix-compilation-failure-when-config_.patch
@@ -0,0 +1,37 @@
+From ec0511f59698d0c0ea3005f15b34b93d2b3cbcfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 17:23:00 +0100
+Subject: firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL
+ is not defined
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 043cfff99a18933fda2fb2e163daee73cc07910b ]
+
+Remove an extra ";" which breaks compilation.
+
+Fixes: 53bf2b0e4e4c ("firmware: ti_sci: Add support for getting resource with subtype")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/e6c3cb793e1a6a2a0ae2528d5a5650dfe6a4b6ff.1640276505.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/soc/ti/ti_sci_protocol.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/soc/ti/ti_sci_protocol.h b/include/linux/soc/ti/ti_sci_protocol.h
+index 0aad7009b50e..bd0d11af76c5 100644
+--- a/include/linux/soc/ti/ti_sci_protocol.h
++++ b/include/linux/soc/ti/ti_sci_protocol.h
+@@ -645,7 +645,7 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle *handle,
+ 
+ static inline struct ti_sci_resource *
+ devm_ti_sci_get_resource(const struct ti_sci_handle *handle, struct device *dev,
+-			 u32 dev_id, u32 sub_type);
++			 u32 dev_id, u32 sub_type)
+ {
+ 	return ERR_PTR(-EINVAL);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch b/queue-5.16/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
new file mode 100644
index 00000000000..689e5baad52
--- /dev/null
+++ b/queue-5.16/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
@@ -0,0 +1,35 @@
+From e677f4054ac9d09007a3bb5966e49bcf64bb8a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 15:45:32 -0800
+Subject: Fix incorrect type in assignment of ipv6 port for audit
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit a5cd1ab7ab679d252a6d2f483eee7d45ebf2040c ]
+
+Remove inappropriate use of ntohs() and assign the
+port value directly.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack_lsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index efd35b07c7f8..95a15b77f42f 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2511,7 +2511,7 @@ static int smk_ipv6_check(struct smack_known *subject,
+ #ifdef CONFIG_AUDIT
+ 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ 	ad.a.u.net->family = PF_INET6;
+-	ad.a.u.net->dport = ntohs(address->sin6_port);
++	ad.a.u.net->dport = address->sin6_port;
+ 	if (act == SMK_RECEIVING)
+ 		ad.a.u.net->v6info.saddr = address->sin6_addr;
+ 	else
+-- 
+2.34.1
+
diff --git a/queue-5.16/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch b/queue-5.16/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch
new file mode 100644
index 00000000000..5f6252c89f1
--- /dev/null
+++ b/queue-5.16/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch
@@ -0,0 +1,119 @@
+From f3dc887c84e33cdd4a415e729593c96e20536709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 21:40:16 +0900
+Subject: fs/binfmt_elf: Fix AT_PHDR for unusual ELF files
+
+From: Akira Kawata <akirakawata1@gmail.com>
+
+[ Upstream commit 0da1d5002745cdc721bc018b582a8a9704d56c42 ]
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197921
+
+As pointed out in the discussion of buglink, we cannot calculate AT_PHDR
+as the sum of load_addr and exec->e_phoff.
+
+: The AT_PHDR of ELF auxiliary vectors should point to the memory address
+: of program header. But binfmt_elf.c calculates this address as follows:
+:
+: NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
+:
+: which is wrong since e_phoff is the file offset of program header and
+: load_addr is the memory base address from PT_LOAD entry.
+:
+: The ld.so uses AT_PHDR as the memory address of program header. In normal
+: case, since the e_phoff is usually 64 and in the first PT_LOAD region, it
+: is the correct program header address.
+:
+: But if the address of program header isn't equal to the first PT_LOAD
+: address + e_phoff (e.g.  Put the program header in other non-consecutive
+: PT_LOAD region), ld.so will try to read program header from wrong address
+: then crash or use incorrect program header.
+
+This is because exec->e_phoff
+is the offset of PHDRs in the file and the address of PHDRs in the
+memory may differ from it. This patch fixes the bug by calculating the
+address of program headers from PT_LOADs directly.
+
+Signed-off-by: Akira Kawata <akirakawata1@gmail.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20220127124014.338760-2-akirakawata1@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index d19762dc90fe..c4de845f86c8 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -170,8 +170,8 @@ static int padzero(unsigned long elf_bss)
+ 
+ static int
+ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
+-		unsigned long load_addr, unsigned long interp_load_addr,
+-		unsigned long e_entry)
++		unsigned long interp_load_addr,
++		unsigned long e_entry, unsigned long phdr_addr)
+ {
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long p = bprm->p;
+@@ -257,7 +257,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
+ 	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
+ 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
+ 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
+-	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
++	NEW_AUX_ENT(AT_PHDR, phdr_addr);
+ 	NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
+ 	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
+ 	NEW_AUX_ENT(AT_BASE, interp_load_addr);
+@@ -823,7 +823,7 @@ static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr,
+ static int load_elf_binary(struct linux_binprm *bprm)
+ {
+ 	struct file *interpreter = NULL; /* to shut gcc up */
+- 	unsigned long load_addr = 0, load_bias = 0;
++	unsigned long load_addr, load_bias = 0, phdr_addr = 0;
+ 	int load_addr_set = 0;
+ 	unsigned long error;
+ 	struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL;
+@@ -1180,6 +1180,17 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ 				reloc_func_desc = load_bias;
+ 			}
+ 		}
++
++		/*
++		 * Figure out which segment in the file contains the Program
++		 * Header table, and map to the associated memory address.
++		 */
++		if (elf_ppnt->p_offset <= elf_ex->e_phoff &&
++		    elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) {
++			phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset +
++				    elf_ppnt->p_vaddr;
++		}
++
+ 		k = elf_ppnt->p_vaddr;
+ 		if ((elf_ppnt->p_flags & PF_X) && k < start_code)
+ 			start_code = k;
+@@ -1215,6 +1226,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ 	}
+ 
+ 	e_entry = elf_ex->e_entry + load_bias;
++	phdr_addr += load_bias;
+ 	elf_bss += load_bias;
+ 	elf_brk += load_bias;
+ 	start_code += load_bias;
+@@ -1278,8 +1290,8 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ 		goto out;
+ #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
+ 
+-	retval = create_elf_tables(bprm, elf_ex,
+-			  load_addr, interp_load_addr, e_entry);
++	retval = create_elf_tables(bprm, elf_ex, interp_load_addr,
++				   e_entry, phdr_addr);
+ 	if (retval < 0)
+ 		goto out;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch b/queue-5.16/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch
new file mode 100644
index 00000000000..8f3d087fd9c
--- /dev/null
+++ b/queue-5.16/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch
@@ -0,0 +1,128 @@
+From a10637e57ea02798d11e3f8b31767c6ea7aa066f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 15:06:39 -0700
+Subject: fs: fd tables have to be multiples of BITS_PER_LONG
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 1c24a186398f59c80adb9a967486b65c1423a59d ]
+
+This has always been the rule: fdtables have several bitmaps in them,
+and as a result they have to be sized properly for bitmaps.  We walk
+those bitmaps in chunks of 'unsigned long' in serveral cases, but even
+when we don't, we use the regular kernel bitops that are defined to work
+on arrays of 'unsigned long', not on some byte array.
+
+Now, the distinction between arrays of bytes and 'unsigned long'
+normally only really ends up being noticeable on big-endian systems, but
+Fedor Pchelkin and Alexey Khoroshilov reported that copy_fd_bitmaps()
+could be called with an argument that wasn't even a multiple of
+BITS_PER_BYTE.  And then it fails to do the proper copy even on
+little-endian machines.
+
+The bug wasn't in copy_fd_bitmap(), but in sane_fdtable_size(), which
+didn't actually sanitize the fdtable size sufficiently, and never made
+sure it had the proper BITS_PER_LONG alignment.
+
+That's partly because the alignment historically came not from having to
+explicitly align things, but simply from previous fdtable sizes, and
+from count_open_files(), which counts the file descriptors by walking
+them one 'unsigned long' word at a time and thus naturally ends up doing
+sizing in the proper 'chunks of unsigned long'.
+
+But with the introduction of close_range(), we now have an external
+source of "this is how many files we want to have", and so
+sane_fdtable_size() needs to do a better job.
+
+This also adds that explicit alignment to alloc_fdtable(), although
+there it is mainly just for documentation at a source code level.  The
+arithmetic we do there to pick a reasonable fdtable size already aligns
+the result sufficiently.
+
+In fact,clang notices that the added ALIGN() in that function doesn't
+actually do anything, and does not generate any extra code for it.
+
+It turns out that gcc ends up confusing itself by combining a previous
+constant-sized shift operation with the variable-sized shift operations
+in roundup_pow_of_two().  And probably due to that doesn't notice that
+the ALIGN() is a no-op.  But that's a (tiny) gcc misfeature that doesn't
+matter.  Having the explicit alignment makes sense, and would actually
+matter on a 128-bit architecture if we ever go there.
+
+This also adds big comments above both functions about how fdtable sizes
+have to have that BITS_PER_LONG alignment.
+
+Fixes: 60997c3d45d9 ("close_range: add CLOSE_RANGE_UNSHARE")
+Reported-by: Fedor Pchelkin <aissur0002@gmail.com>
+Reported-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Link: https://lore.kernel.org/all/20220326114009.1690-1-aissur0002@gmail.com/
+Tested-and-acked-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/fs/file.c b/fs/file.c
+index 97d212a9b814..c01c29417ae6 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -87,6 +87,21 @@ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
+ 	copy_fd_bitmaps(nfdt, ofdt, ofdt->max_fds);
+ }
+ 
++/*
++ * Note how the fdtable bitmap allocations very much have to be a multiple of
++ * BITS_PER_LONG. This is not only because we walk those things in chunks of
++ * 'unsigned long' in some places, but simply because that is how the Linux
++ * kernel bitmaps are defined to work: they are not "bits in an array of bytes",
++ * they are very much "bits in an array of unsigned long".
++ *
++ * The ALIGN(nr, BITS_PER_LONG) here is for clarity: since we just multiplied
++ * by that "1024/sizeof(ptr)" before, we already know there are sufficient
++ * clear low bits. Clang seems to realize that, gcc ends up being confused.
++ *
++ * On a 128-bit machine, the ALIGN() would actually matter. In the meantime,
++ * let's consider it documentation (and maybe a test-case for gcc to improve
++ * its code generation ;)
++ */
+ static struct fdtable * alloc_fdtable(unsigned int nr)
+ {
+ 	struct fdtable *fdt;
+@@ -102,6 +117,7 @@ static struct fdtable * alloc_fdtable(unsigned int nr)
+ 	nr /= (1024 / sizeof(struct file *));
+ 	nr = roundup_pow_of_two(nr + 1);
+ 	nr *= (1024 / sizeof(struct file *));
++	nr = ALIGN(nr, BITS_PER_LONG);
+ 	/*
+ 	 * Note that this can drive nr *below* what we had passed if sysctl_nr_open
+ 	 * had been set lower between the check in expand_files() and here.  Deal
+@@ -269,11 +285,25 @@ static unsigned int count_open_files(struct fdtable *fdt)
+ 	return i;
+ }
+ 
++/*
++ * Note that a sane fdtable size always has to be a multiple of
++ * BITS_PER_LONG, since we have bitmaps that are sized by this.
++ *
++ * 'max_fds' will normally already be properly aligned, but it
++ * turns out that in the close_range() -> __close_range() ->
++ * unshare_fd() -> dup_fd() -> sane_fdtable_size() we can end
++ * up having a 'max_fds' value that isn't already aligned.
++ *
++ * Rather than make close_range() have to worry about this,
++ * just make that BITS_PER_LONG alignment be part of a sane
++ * fdtable size. Becuase that's really what it is.
++ */
+ static unsigned int sane_fdtable_size(struct fdtable *fdt, unsigned int max_fds)
+ {
+ 	unsigned int count;
+ 
+ 	count = count_open_files(fdt);
++	max_fds = ALIGN(max_fds, BITS_PER_LONG);
+ 	if (max_fds < NR_OPEN_DEFAULT)
+ 		max_fds = NR_OPEN_DEFAULT;
+ 	return min(count, max_fds);
+-- 
+2.34.1
+
diff --git a/queue-5.16/fs-fix-fd-table-size-alignment-properly.patch b/queue-5.16/fs-fix-fd-table-size-alignment-properly.patch
new file mode 100644
index 00000000000..88cb784e6ab
--- /dev/null
+++ b/queue-5.16/fs-fix-fd-table-size-alignment-properly.patch
@@ -0,0 +1,55 @@
+From 258b4028a1411b2b3b91914c9a02e58d7284e46e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 23:29:18 -0700
+Subject: fs: fix fd table size alignment properly
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit d888c83fcec75194a8a48ccd283953bdba7b2550 ]
+
+Jason Donenfeld reports that my commit 1c24a186398f ("fs: fd tables have
+to be multiples of BITS_PER_LONG") doesn't work, and the reason is an
+embarrassing brown-paper-bag bug.
+
+Yes, we want to align the number of fds to BITS_PER_LONG, and yes, the
+reason they might not be aligned is because the incoming 'max_fd'
+argument might not be aligned.
+
+But aligining the argument - while simple - will cause a "infinitely
+big" maxfd (eg NR_OPEN_MAX) to just overflow to zero.  Which most
+definitely isn't what we want either.
+
+The obvious fix was always just to do the alignment last, but I had
+moved it earlier just to make the patch smaller and the code look
+simpler.  Duh.  It certainly made _me_ look simple.
+
+Fixes: 1c24a186398f ("fs: fd tables have to be multiples of BITS_PER_LONG")
+Reported-and-tested-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Fedor Pchelkin <aissur0002@gmail.com>
+Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Cc: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/file.c b/fs/file.c
+index c01c29417ae6..ee9317346702 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -303,10 +303,9 @@ static unsigned int sane_fdtable_size(struct fdtable *fdt, unsigned int max_fds)
+ 	unsigned int count;
+ 
+ 	count = count_open_files(fdt);
+-	max_fds = ALIGN(max_fds, BITS_PER_LONG);
+ 	if (max_fds < NR_OPEN_DEFAULT)
+ 		max_fds = NR_OPEN_DEFAULT;
+-	return min(count, max_fds);
++	return ALIGN(min(count, max_fds), BITS_PER_LONG);
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.16/fsi-aspeed-fix-a-potential-double-free.patch b/queue-5.16/fsi-aspeed-fix-a-potential-double-free.patch
new file mode 100644
index 00000000000..b820b5b6820
--- /dev/null
+++ b/queue-5.16/fsi-aspeed-fix-a-potential-double-free.patch
@@ -0,0 +1,95 @@
+From 40f78485a33b9f490ca48dd05f2adeda5c2d8402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jan 2022 22:56:10 +0100
+Subject: fsi: Aspeed: Fix a potential double free
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 83ba7e895debc529803a7a258653f2fe9bf3bf40 ]
+
+A struct device can never be devm_alloc()'ed.
+Here, it is embedded in "struct fsi_master", and "struct fsi_master" is
+embedded in "struct fsi_master_aspeed".
+
+Since "struct device" is embedded, the data structure embedding it must be
+released with the release function, as is already done here.
+
+So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and
+update all error handling branches accordingly.
+
+This prevent a potential double free().
+
+This also fix another issue if opb_readl() fails. Instead of a direct
+return, it now jumps in the error handling path.
+
+Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
+Suggested-by: Greg KH <gregkh@linuxfoundation.org>
+Suggested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/2c123f8b0a40dc1a061fae982169fe030b4f47e6.1641765339.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-master-aspeed.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
+index 8606e55c1721..0bed2fab8055 100644
+--- a/drivers/fsi/fsi-master-aspeed.c
++++ b/drivers/fsi/fsi-master-aspeed.c
+@@ -542,25 +542,28 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
+ 		return rc;
+ 	}
+ 
+-	aspeed = devm_kzalloc(&pdev->dev, sizeof(*aspeed), GFP_KERNEL);
++	aspeed = kzalloc(sizeof(*aspeed), GFP_KERNEL);
+ 	if (!aspeed)
+ 		return -ENOMEM;
+ 
+ 	aspeed->dev = &pdev->dev;
+ 
+ 	aspeed->base = devm_platform_ioremap_resource(pdev, 0);
+-	if (IS_ERR(aspeed->base))
+-		return PTR_ERR(aspeed->base);
++	if (IS_ERR(aspeed->base)) {
++		rc = PTR_ERR(aspeed->base);
++		goto err_free_aspeed;
++	}
+ 
+ 	aspeed->clk = devm_clk_get(aspeed->dev, NULL);
+ 	if (IS_ERR(aspeed->clk)) {
+ 		dev_err(aspeed->dev, "couldn't get clock\n");
+-		return PTR_ERR(aspeed->clk);
++		rc = PTR_ERR(aspeed->clk);
++		goto err_free_aspeed;
+ 	}
+ 	rc = clk_prepare_enable(aspeed->clk);
+ 	if (rc) {
+ 		dev_err(aspeed->dev, "couldn't enable clock\n");
+-		return rc;
++		goto err_free_aspeed;
+ 	}
+ 
+ 	rc = setup_cfam_reset(aspeed);
+@@ -595,7 +598,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
+ 	rc = opb_readl(aspeed, ctrl_base + FSI_MVER, &raw);
+ 	if (rc) {
+ 		dev_err(&pdev->dev, "failed to read hub version\n");
+-		return rc;
++		goto err_release;
+ 	}
+ 
+ 	reg = be32_to_cpu(raw);
+@@ -634,6 +637,8 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
+ 
+ err_release:
+ 	clk_disable_unprepare(aspeed->clk);
++err_free_aspeed:
++	kfree(aspeed);
+ 	return rc;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/fsi-scom-fix-error-handling.patch b/queue-5.16/fsi-scom-fix-error-handling.patch
new file mode 100644
index 00000000000..ef76c5e554a
--- /dev/null
+++ b/queue-5.16/fsi-scom-fix-error-handling.patch
@@ -0,0 +1,70 @@
+From 4e1781149a002b4f59d3feab2e324d5784374995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Dec 2021 14:08:10 +1030
+Subject: fsi: scom: Fix error handling
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit d46fddd52d11eb6a3a7ed836f9f273e9cf8cd01c ]
+
+SCOM error handling is made complex by trying to pass around two bits of
+information: the function return code, and a status parameter that
+represents the CFAM error status register.
+
+The commit f72ddbe1d7b7 ("fsi: scom: Remove retries") removed the
+"hidden" retries in the SCOM driver, in preference of allowing the
+calling code (userspace or driver) to decide how to handle a failed
+SCOM. However it introduced a bug by attempting to be smart about the
+return codes that were "errors" and which were ok to fall through to the
+status register parsing.
+
+We get the following errors:
+
+ - EINVAL or ENXIO, for indirect scoms where the value is invalid
+ - EINVAL, where the size or address is incorrect
+ - EIO or ETIMEOUT, where FSI write failed (aspeed master)
+ - EAGAIN, where the master detected a crc error (GPIO master only)
+ - EBUSY, where the bus is disabled (GPIO master in external mode)
+
+In all of these cases we should fail the SCOM read/write and return the
+error.
+
+Thanks to Dan Carpenter for the detailed bug report.
+
+Fixes: f72ddbe1d7b7 ("fsi: scom: Remove retries")
+Link: https://lists.ozlabs.org/pipermail/linux-fsi/2021-November/000235.html
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20211207033811.518981-2-joel@jms.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-scom.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
+index da1486bb6a14..3b427f7e9027 100644
+--- a/drivers/fsi/fsi-scom.c
++++ b/drivers/fsi/fsi-scom.c
+@@ -289,7 +289,7 @@ static int put_scom(struct scom_device *scom, uint64_t value,
+ 	int rc;
+ 
+ 	rc = raw_put_scom(scom, value, addr, &status);
+-	if (rc == -ENODEV)
++	if (rc)
+ 		return rc;
+ 
+ 	rc = handle_fsi2pib_status(scom, status);
+@@ -308,7 +308,7 @@ static int get_scom(struct scom_device *scom, uint64_t *value,
+ 	int rc;
+ 
+ 	rc = raw_get_scom(scom, value, addr, &status);
+-	if (rc == -ENODEV)
++	if (rc)
+ 		return rc;
+ 
+ 	rc = handle_fsi2pib_status(scom, status);
+-- 
+2.34.1
+
diff --git a/queue-5.16/fsi-scom-remove-retries-in-indirect-scoms.patch b/queue-5.16/fsi-scom-remove-retries-in-indirect-scoms.patch
new file mode 100644
index 00000000000..3fa9d4f8337
--- /dev/null
+++ b/queue-5.16/fsi-scom-remove-retries-in-indirect-scoms.patch
@@ -0,0 +1,114 @@
+From e968ad7e89629a6fbd25b649cb1970d8f805a825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Dec 2021 14:08:11 +1030
+Subject: fsi: scom: Remove retries in indirect scoms
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit ab1b79159ad5a6dc4e4994b49737f7feb13b7155 ]
+
+In commit f72ddbe1d7b7 ("fsi: scom: Remove retries") the retries were
+removed from get and put scoms. That patch missed the retires in get and
+put indirect scom.
+
+For the same reason, remove them from the scom driver to allow the
+caller to decide to retry.
+
+This removes the following special case which would have caused the
+retry code to return early:
+
+ -       if ((ind_data & XSCOM_DATA_IND_COMPLETE) || (err != SCOM_PIB_BLOCKED))
+ -               return 0;
+
+I believe this case is handled.
+
+Fixes: f72ddbe1d7b7 ("fsi: scom: Remove retries")
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20211207033811.518981-3-joel@jms.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-scom.c | 41 +++++++++++++++--------------------------
+ 1 file changed, 15 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
+index 3b427f7e9027..bcb756dc9866 100644
+--- a/drivers/fsi/fsi-scom.c
++++ b/drivers/fsi/fsi-scom.c
+@@ -145,7 +145,7 @@ static int put_indirect_scom_form0(struct scom_device *scom, uint64_t value,
+ 				   uint64_t addr, uint32_t *status)
+ {
+ 	uint64_t ind_data, ind_addr;
+-	int rc, retries, err = 0;
++	int rc, err;
+ 
+ 	if (value & ~XSCOM_DATA_IND_DATA)
+ 		return -EINVAL;
+@@ -156,19 +156,14 @@ static int put_indirect_scom_form0(struct scom_device *scom, uint64_t value,
+ 	if (rc || (*status & SCOM_STATUS_ANY_ERR))
+ 		return rc;
+ 
+-	for (retries = 0; retries < SCOM_MAX_IND_RETRIES; retries++) {
+-		rc = __get_scom(scom, &ind_data, addr, status);
+-		if (rc || (*status & SCOM_STATUS_ANY_ERR))
+-			return rc;
++	rc = __get_scom(scom, &ind_data, addr, status);
++	if (rc || (*status & SCOM_STATUS_ANY_ERR))
++		return rc;
+ 
+-		err = (ind_data & XSCOM_DATA_IND_ERR_MASK) >> XSCOM_DATA_IND_ERR_SHIFT;
+-		*status = err << SCOM_STATUS_PIB_RESP_SHIFT;
+-		if ((ind_data & XSCOM_DATA_IND_COMPLETE) || (err != SCOM_PIB_BLOCKED))
+-			return 0;
++	err = (ind_data & XSCOM_DATA_IND_ERR_MASK) >> XSCOM_DATA_IND_ERR_SHIFT;
++	*status = err << SCOM_STATUS_PIB_RESP_SHIFT;
+ 
+-		msleep(1);
+-	}
+-	return rc;
++	return 0;
+ }
+ 
+ static int put_indirect_scom_form1(struct scom_device *scom, uint64_t value,
+@@ -188,7 +183,7 @@ static int get_indirect_scom_form0(struct scom_device *scom, uint64_t *value,
+ 				   uint64_t addr, uint32_t *status)
+ {
+ 	uint64_t ind_data, ind_addr;
+-	int rc, retries, err = 0;
++	int rc, err;
+ 
+ 	ind_addr = addr & XSCOM_ADDR_DIRECT_PART;
+ 	ind_data = (addr & XSCOM_ADDR_INDIRECT_PART) | XSCOM_DATA_IND_READ;
+@@ -196,21 +191,15 @@ static int get_indirect_scom_form0(struct scom_device *scom, uint64_t *value,
+ 	if (rc || (*status & SCOM_STATUS_ANY_ERR))
+ 		return rc;
+ 
+-	for (retries = 0; retries < SCOM_MAX_IND_RETRIES; retries++) {
+-		rc = __get_scom(scom, &ind_data, addr, status);
+-		if (rc || (*status & SCOM_STATUS_ANY_ERR))
+-			return rc;
+-
+-		err = (ind_data & XSCOM_DATA_IND_ERR_MASK) >> XSCOM_DATA_IND_ERR_SHIFT;
+-		*status = err << SCOM_STATUS_PIB_RESP_SHIFT;
+-		*value = ind_data & XSCOM_DATA_IND_DATA;
++	rc = __get_scom(scom, &ind_data, addr, status);
++	if (rc || (*status & SCOM_STATUS_ANY_ERR))
++		return rc;
+ 
+-		if ((ind_data & XSCOM_DATA_IND_COMPLETE) || (err != SCOM_PIB_BLOCKED))
+-			return 0;
++	err = (ind_data & XSCOM_DATA_IND_ERR_MASK) >> XSCOM_DATA_IND_ERR_SHIFT;
++	*status = err << SCOM_STATUS_PIB_RESP_SHIFT;
++	*value = ind_data & XSCOM_DATA_IND_DATA;
+ 
+-		msleep(1);
+-	}
+-	return rc;
++	return 0;
+ }
+ 
+ static int raw_put_scom(struct scom_device *scom, uint64_t value,
+-- 
+2.34.1
+
diff --git a/queue-5.16/gcc-plugins-stackleak-exactly-match-strings-instead-.patch b/queue-5.16/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
new file mode 100644
index 00000000000..5c512cf378b
--- /dev/null
+++ b/queue-5.16/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
@@ -0,0 +1,70 @@
+From 0aee5c83a25b245fb4dbd7efcb42af8a3fdca162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 09:08:20 -0800
+Subject: gcc-plugins/stackleak: Exactly match strings instead of prefixes
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 27e9faf415dbf94af19b9c827842435edbc1fbbc ]
+
+Since STRING_CST may not be NUL terminated, strncmp() was used for check
+for equality. However, this may lead to mismatches for longer section
+names where the start matches the tested-for string. Test for exact
+equality by checking for the presences of NUL termination.
+
+Cc: Alexander Popov <alex.popov@linux.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gcc-plugins/stackleak_plugin.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
+index e9db7dcb3e5f..b04aa8e91a41 100644
+--- a/scripts/gcc-plugins/stackleak_plugin.c
++++ b/scripts/gcc-plugins/stackleak_plugin.c
+@@ -429,6 +429,23 @@ static unsigned int stackleak_cleanup_execute(void)
+ 	return 0;
+ }
+ 
++/*
++ * STRING_CST may or may not be NUL terminated:
++ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html
++ */
++static inline bool string_equal(tree node, const char *string, int length)
++{
++	if (TREE_STRING_LENGTH(node) < length)
++		return false;
++	if (TREE_STRING_LENGTH(node) > length + 1)
++		return false;
++	if (TREE_STRING_LENGTH(node) == length + 1 &&
++	    TREE_STRING_POINTER(node)[length] != '\0')
++		return false;
++	return !memcmp(TREE_STRING_POINTER(node), string, length);
++}
++#define STRING_EQUAL(node, str)	string_equal(node, str, strlen(str))
++
+ static bool stackleak_gate(void)
+ {
+ 	tree section;
+@@ -438,13 +455,13 @@ static bool stackleak_gate(void)
+ 	if (section && TREE_VALUE(section)) {
+ 		section = TREE_VALUE(TREE_VALUE(section));
+ 
+-		if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
++		if (STRING_EQUAL(section, ".init.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
++		if (STRING_EQUAL(section, ".devinit.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
++		if (STRING_EQUAL(section, ".cpuinit.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
++		if (STRING_EQUAL(section, ".meminit.text"))
+ 			return false;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch b/queue-5.16/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch
new file mode 100644
index 00000000000..46b7283d97e
--- /dev/null
+++ b/queue-5.16/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch
@@ -0,0 +1,35 @@
+From 3a8f403147511b7b3f6532b228050f9e535516d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Nov 2021 22:16:36 +0100
+Subject: gpu: host1x: Fix a memory leak in 'host1x_remove()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 025c6643a81564f066d8381b9e2f4603e0f8438f ]
+
+Add a missing 'host1x_channel_list_free()' call in the remove function,
+as already done in the error handling path of the probe function.
+
+Fixes: 8474b02531c4 ("gpu: host1x: Refactor channel allocation code")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
+index 3872e4cd2698..fc9f54282f7d 100644
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -526,6 +526,7 @@ static int host1x_remove(struct platform_device *pdev)
+ 	host1x_syncpt_deinit(host);
+ 	reset_control_assert(host->rst);
+ 	clk_disable_unprepare(host->clk);
++	host1x_channel_list_free(&host->channel_list);
+ 	host1x_iommu_exit(host);
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/habanalabs-add-check-for-pci_enable_device.patch b/queue-5.16/habanalabs-add-check-for-pci_enable_device.patch
new file mode 100644
index 00000000000..1bfd0062e23
--- /dev/null
+++ b/queue-5.16/habanalabs-add-check-for-pci_enable_device.patch
@@ -0,0 +1,38 @@
+From 6e07cba086bff091e8d284b3737e3ad9d5e98980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 14:58:05 +0800
+Subject: habanalabs: Add check for pci_enable_device
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 9c27896ac1bb83ea5c461ce6f7089d02102a2b21 ]
+
+As the potential failure of the pci_enable_device(),
+it should be better to check the return value and return
+error if fails.
+
+Fixes: 70b2f993ea4a ("habanalabs: create common folder")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/common/debugfs.c b/drivers/misc/habanalabs/common/debugfs.c
+index 1f2a3dc6c4e2..78a6789ef7cc 100644
+--- a/drivers/misc/habanalabs/common/debugfs.c
++++ b/drivers/misc/habanalabs/common/debugfs.c
+@@ -856,6 +856,8 @@ static ssize_t hl_set_power_state(struct file *f, const char __user *buf,
+ 		pci_set_power_state(hdev->pdev, PCI_D0);
+ 		pci_restore_state(hdev->pdev);
+ 		rc = pci_enable_device(hdev->pdev);
++		if (rc < 0)
++			return rc;
+ 	} else if (value == 2) {
+ 		pci_save_state(hdev->pdev);
+ 		pci_disable_device(hdev->pdev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch b/queue-5.16/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
new file mode 100644
index 00000000000..ceaf2b7817c
--- /dev/null
+++ b/queue-5.16/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
@@ -0,0 +1,91 @@
+From ae37d8ff8744df1b9e85bc0ada847d660fd4b0a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jan 2022 23:26:18 -0800
+Subject: HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit a5e5e03e94764148a01757b2fa4737d3445c13a6 ]
+
+Internally kernel prepends all report buffers, for both numbered and
+unnumbered reports, with report ID, therefore to properly handle unnumbered
+reports we should prepend it ourselves.
+
+For the same reason we should skip the first byte of the buffer when
+calling i2c_hid_set_or_send_report() which then will take care of properly
+formatting the transfer buffer based on its separate report ID argument
+along with report payload.
+
+[jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin]
+Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 4804d71e5293..65c1f20ec420 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -615,6 +615,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ 	if (report_type == HID_OUTPUT_REPORT)
+ 		return -EINVAL;
+ 
++	/*
++	 * In case of unnumbered reports the response from the device will
++	 * not have the report ID that the upper layers expect, so we need
++	 * to stash it the buffer ourselves and adjust the data size.
++	 */
++	if (!report_number) {
++		buf[0] = 0;
++		buf++;
++		count--;
++	}
++
+ 	/* +2 bytes to include the size of the reply in the query buffer */
+ 	ask_count = min(count + 2, (size_t)ihid->bufsize);
+ 
+@@ -636,6 +647,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ 	count = min(count, ret_count - 2);
+ 	memcpy(buf, ihid->rawbuf + 2, count);
+ 
++	if (!report_number)
++		count++;
++
+ 	return count;
+ }
+ 
+@@ -652,17 +666,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
+ 
+ 	mutex_lock(&ihid->reset_lock);
+ 
+-	if (report_id) {
+-		buf++;
+-		count--;
+-	}
+-
++	/*
++	 * Note that both numbered and unnumbered reports passed here
++	 * are supposed to have report ID stored in the 1st byte of the
++	 * buffer, so we strip it off unconditionally before passing payload
++	 * to i2c_hid_set_or_send_report which takes care of encoding
++	 * everything properly.
++	 */
+ 	ret = i2c_hid_set_or_send_report(client,
+ 				report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
+-				report_id, buf, count, use_data);
++				report_id, buf + 1, count - 1, use_data);
+ 
+-	if (report_id && ret >= 0)
+-		ret++; /* add report_id to the number of transfered bytes */
++	if (ret >= 0)
++		ret++; /* add report_id to the number of transferred bytes */
+ 
+ 	mutex_unlock(&ihid->reset_lock);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/hv_balloon-rate-limit-unhandled-message-warning.patch b/queue-5.16/hv_balloon-rate-limit-unhandled-message-warning.patch
new file mode 100644
index 00000000000..d2f4a23507b
--- /dev/null
+++ b/queue-5.16/hv_balloon-rate-limit-unhandled-message-warning.patch
@@ -0,0 +1,51 @@
+From e973a9bcc7fc05a30ad3ec3746ead2cff6aa1c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 16:14:00 +0200
+Subject: hv_balloon: rate-limit "Unhandled message" warning
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+[ Upstream commit 1d7286729aa616772be334eb908e11f527e1e291 ]
+
+For a couple of times I have encountered a situation where
+
+  hv_balloon: Unhandled message: type: 12447
+
+is being flooded over 1 million times per second with various values,
+filling the log and consuming cycles, making debugging difficult.
+
+Add rate limiting to the message.
+
+Most other Hyper-V drivers already have similar rate limiting in their
+message callbacks.
+
+The cause of the floods in my case was probably fixed by 96d9d1fa5cd5
+("Drivers: hv: balloon: account for vmbus packet header in
+max_pkt_size").
+
+Fixes: 9aa8b50b2b3d ("Drivers: hv: Add Hyper-V balloon driver")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20220222141400.98160-1-anssi.hannula@bitwise.fi
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv_balloon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index f2d05bff4245..439f99b8b5de 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1563,7 +1563,7 @@ static void balloon_onchannelcallback(void *context)
+ 			break;
+ 
+ 		default:
+-			pr_warn("Unhandled message: type: %d\n", dm_hdr->type);
++			pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type);
+ 
+ 		}
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwmon-pmbus-add-mutex-to-regulator-ops.patch b/queue-5.16/hwmon-pmbus-add-mutex-to-regulator-ops.patch
new file mode 100644
index 00000000000..b77991a2423
--- /dev/null
+++ b/queue-5.16/hwmon-pmbus-add-mutex-to-regulator-ops.patch
@@ -0,0 +1,71 @@
+From d9b820ddbc32ece1c2010117b6efba10a581c5a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 17:06:09 +0100
+Subject: hwmon: (pmbus) Add mutex to regulator ops
+
+From: Patrick Rudolph <patrick.rudolph@9elements.com>
+
+[ Upstream commit 686d303ee6301261b422ea51e64833d7909a2c36 ]
+
+On PMBUS devices with multiple pages, the regulator ops need to be
+protected with the update mutex. This prevents accidentally changing
+the page in a separate thread while operating on the PMBUS_OPERATION
+register.
+
+Tested on Infineon xdpe11280 while a separate thread polls for sensor
+data.
+
+Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
+Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io>
+Link: https://lore.kernel.org/r/b991506bcbf665f7af185945f70bf9d5cf04637c.1645804976.git.sylv@sylv.io
+Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support")
+Cc: Alan Tull <atull@opensource.altera.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index ac2fbee1ba9c..b1386a4df4cc 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2391,10 +2391,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev)
+ {
+ 	struct device *dev = rdev_get_dev(rdev);
+ 	struct i2c_client *client = to_i2c_client(dev->parent);
++	struct pmbus_data *data = i2c_get_clientdata(client);
+ 	u8 page = rdev_get_id(rdev);
+ 	int ret;
+ 
++	mutex_lock(&data->update_lock);
+ 	ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
++	mutex_unlock(&data->update_lock);
++
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -2405,11 +2409,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable)
+ {
+ 	struct device *dev = rdev_get_dev(rdev);
+ 	struct i2c_client *client = to_i2c_client(dev->parent);
++	struct pmbus_data *data = i2c_get_clientdata(client);
+ 	u8 page = rdev_get_id(rdev);
++	int ret;
+ 
+-	return pmbus_update_byte_data(client, page, PMBUS_OPERATION,
+-				      PB_OPERATION_CONTROL_ON,
+-				      enable ? PB_OPERATION_CONTROL_ON : 0);
++	mutex_lock(&data->update_lock);
++	ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION,
++				     PB_OPERATION_CONTROL_ON,
++				     enable ? PB_OPERATION_CONTROL_ON : 0);
++	mutex_unlock(&data->update_lock);
++
++	return ret;
+ }
+ 
+ static int pmbus_regulator_enable(struct regulator_dev *rdev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwmon-pmbus-add-vin-unit-off-handling.patch b/queue-5.16/hwmon-pmbus-add-vin-unit-off-handling.patch
new file mode 100644
index 00000000000..e6825a594c7
--- /dev/null
+++ b/queue-5.16/hwmon-pmbus-add-vin-unit-off-handling.patch
@@ -0,0 +1,61 @@
+From bb8641b218f86281afe17e76cad9d031787f9385 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 23:21:23 +0000
+Subject: hwmon: (pmbus) Add Vin unit off handling
+
+From: Brandon Wyman <bjwyman@gmail.com>
+
+[ Upstream commit a5436af598779219b375c1977555c82def1c35d0 ]
+
+If there is an input undervoltage fault, reported in STATUS_INPUT
+command response, there is quite likely a "Unit Off For Insufficient
+Input Voltage" condition as well.
+
+Add a constant for bit 3 of STATUS_INPUT. Update the Vin limit
+attributes to include both bits in the mask for clearing faults.
+
+If an input undervoltage fault occurs, causing a unit off for
+insufficient input voltage, but the unit is off bit is not cleared, the
+STATUS_WORD will not be updated to clear the input fault condition.
+Including the unit is off bit (bit 3) allows for the input fault
+condition to completely clear.
+
+Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
+Link: https://lore.kernel.org/r/20220317232123.2103592-1-bjwyman@gmail.com
+Fixes: b4ce237b7f7d3 ("hwmon: (pmbus) Introduce infrastructure to detect sensors and limit registers")
+[groeck: Dropped unnecessary ()]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus.h      | 1 +
+ drivers/hwmon/pmbus/pmbus_core.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
+index e0aa8aa46d8c..ef3a8ecde4df 100644
+--- a/drivers/hwmon/pmbus/pmbus.h
++++ b/drivers/hwmon/pmbus/pmbus.h
+@@ -319,6 +319,7 @@ enum pmbus_fan_mode { percent = 0, rpm };
+ /*
+  * STATUS_VOUT, STATUS_INPUT
+  */
++#define PB_VOLTAGE_VIN_OFF		BIT(3)
+ #define PB_VOLTAGE_UV_FAULT		BIT(4)
+ #define PB_VOLTAGE_UV_WARNING		BIT(5)
+ #define PB_VOLTAGE_OV_WARNING		BIT(6)
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index b1386a4df4cc..ca0bfaf2f691 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1373,7 +1373,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = {
+ 		.reg = PMBUS_VIN_UV_FAULT_LIMIT,
+ 		.attr = "lcrit",
+ 		.alarm = "lcrit_alarm",
+-		.sbit = PB_VOLTAGE_UV_FAULT,
++		.sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF,
+ 	}, {
+ 		.reg = PMBUS_VIN_OV_WARN_LIMIT,
+ 		.attr = "max",
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch b/queue-5.16/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
new file mode 100644
index 00000000000..16dbe2106df
--- /dev/null
+++ b/queue-5.16/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
@@ -0,0 +1,45 @@
+From e2568de82d4a559c681b2d6e918fbc9a2055e867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 22:19:35 +0100
+Subject: hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 647d6f09bea7dacf4cdb6d4ea7e3051883955297 ]
+
+If the watchdog was already enabled by the BIOS after booting, the
+watchdog infrastructure needs to regularly send keepalives to
+prevent a unexpected reset.
+WDOG_ACTIVE only serves as an status indicator for userspace,
+we want to use WDOG_HW_RUNNING instead.
+
+Since my Fujitsu Esprimo P720 does not support the watchdog,
+this change is compile-tested only.
+
+Suggested-by: Guenter Roeck <linux@roeck-us.net>
+Fixes: fb551405c0f8 (watchdog: sch56xx: Use watchdog core)
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20220131211935.3656-5-W_Armin@gmx.de
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch56xx-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c
+index 40cdadad35e5..f85eede6d766 100644
+--- a/drivers/hwmon/sch56xx-common.c
++++ b/drivers/hwmon/sch56xx-common.c
+@@ -422,7 +422,7 @@ void sch56xx_watchdog_register(struct device *parent, u16 addr, u32 revision,
+ 	data->wddev.max_timeout = 255 * 60;
+ 	watchdog_set_nowayout(&data->wddev, nowayout);
+ 	if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE)
+-		set_bit(WDOG_ACTIVE, &data->wddev.status);
++		set_bit(WDOG_HW_RUNNING, &data->wddev.status);
+ 
+ 	/* Since the watchdog uses a downcounter there is no register to read
+ 	   the BIOS set timeout from (if any was set at all) ->
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwrng-atmel-disable-trng-on-failure-path.patch b/queue-5.16/hwrng-atmel-disable-trng-on-failure-path.patch
new file mode 100644
index 00000000000..59825121d51
--- /dev/null
+++ b/queue-5.16/hwrng-atmel-disable-trng-on-failure-path.patch
@@ -0,0 +1,34 @@
+From 2196886b10c52b15a8b6ccc55d5e5b6c2ba99f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 09:59:23 +0200
+Subject: hwrng: atmel - disable trng on failure path
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit a223ea9f89ab960eb254ba78429efd42eaf845eb ]
+
+Call atmel_trng_disable() on failure path of probe.
+
+Fixes: a1fa98d8116f ("hwrng: atmel - disable TRNG during suspend")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/atmel-rng.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c
+index ecb71c4317a5..8cf0ef501341 100644
+--- a/drivers/char/hw_random/atmel-rng.c
++++ b/drivers/char/hw_random/atmel-rng.c
+@@ -114,6 +114,7 @@ static int atmel_trng_probe(struct platform_device *pdev)
+ 
+ err_register:
+ 	clk_disable_unprepare(trng->clk);
++	atmel_trng_disable(trng);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwrng-cavium-check-health-status-while-reading-rando.patch b/queue-5.16/hwrng-cavium-check-health-status-while-reading-rando.patch
new file mode 100644
index 00000000000..701963e93dd
--- /dev/null
+++ b/queue-5.16/hwrng-cavium-check-health-status-while-reading-rando.patch
@@ -0,0 +1,339 @@
+From e70de2fdb44cc5baefe8855ac3bbbfb96e93b4dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Oct 2021 22:49:59 +0530
+Subject: hwrng: cavium - Check health status while reading random data
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+[ Upstream commit 680efb33546be8960ccbb2f4e0e43034d9c93b30 ]
+
+This RNG device is present on Marvell OcteonTx2 silicons as well and
+also provides entropy health status.
+
+HW continuously checks health condition of entropy and reports
+faults. Fault is in terms of co-processor cycles since last fault
+detected. This doesn't get cleared and only updated when new fault
+is detected. Also there are chances of detecting false positives.
+So to detect a entropy failure SW has to check if failures are
+persistent ie cycles elapsed is frequently updated by HW.
+
+This patch adds support to detect health failures using below algo.
+1. Consider any fault detected before 10ms as a false positive and ignore.
+   10ms is chosen randomly, no significance.
+2. Upon first failure detection make a note of cycles elapsed and when this
+   error happened in realtime (cntvct).
+3. Upon subsequent failure, check if this is new or a old one by comparing
+   current cycles with the ones since last failure. cycles or time since
+   last failure is calculated using cycles and time info captured at (2).
+
+HEALTH_CHECK status register is not available to VF, hence had to map
+PF registers. Also since cycles are in terms of co-processor cycles,
+had to retrieve co-processor clock rate from RST device.
+
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig         |   2 +-
+ drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++++++++++--
+ drivers/char/hw_random/cavium-rng.c    |  11 +-
+ 3 files changed, 190 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index 814b3d0ca7b7..1da64771ee2e 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -414,7 +414,7 @@ config HW_RANDOM_MESON
+ 
+ config HW_RANDOM_CAVIUM
+ 	tristate "Cavium ThunderX Random Number Generator support"
+-	depends on HW_RANDOM && PCI && (ARM64 || (COMPILE_TEST && 64BIT))
++	depends on HW_RANDOM && PCI && ARM64
+ 	default HW_RANDOM
+ 	help
+ 	  This driver provides kernel-side support for the Random Number
+diff --git a/drivers/char/hw_random/cavium-rng-vf.c b/drivers/char/hw_random/cavium-rng-vf.c
+index 3de4a6a443ef..6f66919652bf 100644
+--- a/drivers/char/hw_random/cavium-rng-vf.c
++++ b/drivers/char/hw_random/cavium-rng-vf.c
+@@ -1,10 +1,7 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+- * Hardware Random Number Generator support for Cavium, Inc.
+- * Thunder processor family.
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License.  See the file "COPYING" in the main directory of this archive
+- * for more details.
++ * Hardware Random Number Generator support.
++ * Cavium Thunder, Marvell OcteonTx/Tx2 processor families.
+  *
+  * Copyright (C) 2016 Cavium, Inc.
+  */
+@@ -15,16 +12,146 @@
+ #include <linux/pci.h>
+ #include <linux/pci_ids.h>
+ 
++#include <asm/arch_timer.h>
++
++/* PCI device IDs */
++#define	PCI_DEVID_CAVIUM_RNG_PF		0xA018
++#define	PCI_DEVID_CAVIUM_RNG_VF		0xA033
++
++#define HEALTH_STATUS_REG		0x38
++
++/* RST device info */
++#define PCI_DEVICE_ID_RST_OTX2		0xA085
++#define RST_BOOT_REG			0x1600ULL
++#define CLOCK_BASE_RATE			50000000ULL
++#define MSEC_TO_NSEC(x)			(x * 1000000)
++
+ struct cavium_rng {
+ 	struct hwrng ops;
+ 	void __iomem *result;
++	void __iomem *pf_regbase;
++	struct pci_dev *pdev;
++	u64  clock_rate;
++	u64  prev_error;
++	u64  prev_time;
+ };
+ 
++static inline bool is_octeontx(struct pci_dev *pdev)
++{
++	if (midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_83XX,
++				    MIDR_CPU_VAR_REV(0, 0),
++				    MIDR_CPU_VAR_REV(3, 0)) ||
++	    midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_81XX,
++				    MIDR_CPU_VAR_REV(0, 0),
++				    MIDR_CPU_VAR_REV(3, 0)) ||
++	    midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX,
++				    MIDR_CPU_VAR_REV(0, 0),
++				    MIDR_CPU_VAR_REV(3, 0)))
++		return true;
++
++	return false;
++}
++
++static u64 rng_get_coprocessor_clkrate(void)
++{
++	u64 ret = CLOCK_BASE_RATE * 16; /* Assume 800Mhz as default */
++	struct pci_dev *pdev;
++	void __iomem *base;
++
++	pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
++			      PCI_DEVICE_ID_RST_OTX2, NULL);
++	if (!pdev)
++		goto error;
++
++	base = pci_ioremap_bar(pdev, 0);
++	if (!base)
++		goto error_put_pdev;
++
++	/* RST: PNR_MUL * 50Mhz gives clockrate */
++	ret = CLOCK_BASE_RATE * ((readq(base + RST_BOOT_REG) >> 33) & 0x3F);
++
++	iounmap(base);
++
++error_put_pdev:
++	pci_dev_put(pdev);
++
++error:
++	return ret;
++}
++
++static int check_rng_health(struct cavium_rng *rng)
++{
++	u64 cur_err, cur_time;
++	u64 status, cycles;
++	u64 time_elapsed;
++
++
++	/* Skip checking health for OcteonTx */
++	if (!rng->pf_regbase)
++		return 0;
++
++	status = readq(rng->pf_regbase + HEALTH_STATUS_REG);
++	if (status & BIT_ULL(0)) {
++		dev_err(&rng->pdev->dev, "HWRNG: Startup health test failed\n");
++		return -EIO;
++	}
++
++	cycles = status >> 1;
++	if (!cycles)
++		return 0;
++
++	cur_time = arch_timer_read_counter();
++
++	/* RNM_HEALTH_STATUS[CYCLES_SINCE_HEALTH_FAILURE]
++	 * Number of coprocessor cycles times 2 since the last failure.
++	 * This field doesn't get cleared/updated until another failure.
++	 */
++	cycles = cycles / 2;
++	cur_err = (cycles * 1000000000) / rng->clock_rate; /* In nanosec */
++
++	/* Ignore errors that happenned a long time ago, these
++	 * are most likely false positive errors.
++	 */
++	if (cur_err > MSEC_TO_NSEC(10)) {
++		rng->prev_error = 0;
++		rng->prev_time = 0;
++		return 0;
++	}
++
++	if (rng->prev_error) {
++		/* Calculate time elapsed since last error
++		 * '1' tick of CNTVCT is 10ns, since it runs at 100Mhz.
++		 */
++		time_elapsed = (cur_time - rng->prev_time) * 10;
++		time_elapsed += rng->prev_error;
++
++		/* Check if current error is a new one or the old one itself.
++		 * If error is a new one then consider there is a persistent
++		 * issue with entropy, declare hardware failure.
++		 */
++		if (cur_err < time_elapsed) {
++			dev_err(&rng->pdev->dev, "HWRNG failure detected\n");
++			rng->prev_error = cur_err;
++			rng->prev_time = cur_time;
++			return -EIO;
++		}
++	}
++
++	rng->prev_error = cur_err;
++	rng->prev_time = cur_time;
++	return 0;
++}
++
+ /* Read data from the RNG unit */
+ static int cavium_rng_read(struct hwrng *rng, void *dat, size_t max, bool wait)
+ {
+ 	struct cavium_rng *p = container_of(rng, struct cavium_rng, ops);
+ 	unsigned int size = max;
++	int err = 0;
++
++	err = check_rng_health(p);
++	if (err)
++		return err;
+ 
+ 	while (size >= 8) {
+ 		*((u64 *)dat) = readq(p->result);
+@@ -39,6 +166,39 @@ static int cavium_rng_read(struct hwrng *rng, void *dat, size_t max, bool wait)
+ 	return max;
+ }
+ 
++static int cavium_map_pf_regs(struct cavium_rng *rng)
++{
++	struct pci_dev *pdev;
++
++	/* Health status is not supported on 83xx, skip mapping PF CSRs */
++	if (is_octeontx(rng->pdev)) {
++		rng->pf_regbase = NULL;
++		return 0;
++	}
++
++	pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
++			      PCI_DEVID_CAVIUM_RNG_PF, NULL);
++	if (!pdev) {
++		dev_err(&pdev->dev, "Cannot find RNG PF device\n");
++		return -EIO;
++	}
++
++	rng->pf_regbase = ioremap(pci_resource_start(pdev, 0),
++				  pci_resource_len(pdev, 0));
++	if (!rng->pf_regbase) {
++		dev_err(&pdev->dev, "Failed to map PF CSR region\n");
++		pci_dev_put(pdev);
++		return -ENOMEM;
++	}
++
++	pci_dev_put(pdev);
++
++	/* Get co-processor clock rate */
++	rng->clock_rate = rng_get_coprocessor_clkrate();
++
++	return 0;
++}
++
+ /* Map Cavium RNG to an HWRNG object */
+ static int cavium_rng_probe_vf(struct	pci_dev		*pdev,
+ 			 const struct	pci_device_id	*id)
+@@ -50,6 +210,8 @@ static int cavium_rng_probe_vf(struct	pci_dev		*pdev,
+ 	if (!rng)
+ 		return -ENOMEM;
+ 
++	rng->pdev = pdev;
++
+ 	/* Map the RNG result */
+ 	rng->result = pcim_iomap(pdev, 0, 0);
+ 	if (!rng->result) {
+@@ -67,6 +229,11 @@ static int cavium_rng_probe_vf(struct	pci_dev		*pdev,
+ 
+ 	pci_set_drvdata(pdev, rng);
+ 
++	/* Health status is available only at PF, hence map PF registers. */
++	ret = cavium_map_pf_regs(rng);
++	if (ret)
++		return ret;
++
+ 	ret = devm_hwrng_register(&pdev->dev, &rng->ops);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Error registering device as HWRNG.\n");
+@@ -76,10 +243,18 @@ static int cavium_rng_probe_vf(struct	pci_dev		*pdev,
+ 	return 0;
+ }
+ 
++/* Remove the VF */
++static void cavium_rng_remove_vf(struct pci_dev *pdev)
++{
++	struct cavium_rng *rng;
++
++	rng = pci_get_drvdata(pdev);
++	iounmap(rng->pf_regbase);
++}
+ 
+ static const struct pci_device_id cavium_rng_vf_id_table[] = {
+-	{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, 0xa033), 0, 0, 0},
+-	{0,},
++	{ PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CAVIUM_RNG_VF) },
++	{ 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, cavium_rng_vf_id_table);
+ 
+@@ -87,8 +262,9 @@ static struct pci_driver cavium_rng_vf_driver = {
+ 	.name		= "cavium_rng_vf",
+ 	.id_table	= cavium_rng_vf_id_table,
+ 	.probe		= cavium_rng_probe_vf,
++	.remove		= cavium_rng_remove_vf,
+ };
+ module_pci_driver(cavium_rng_vf_driver);
+ 
+ MODULE_AUTHOR("Omer Khaliq <okhaliq@caviumnetworks.com>");
+-MODULE_LICENSE("GPL");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/char/hw_random/cavium-rng.c b/drivers/char/hw_random/cavium-rng.c
+index 63d6e68c24d2..b96579222408 100644
+--- a/drivers/char/hw_random/cavium-rng.c
++++ b/drivers/char/hw_random/cavium-rng.c
+@@ -1,10 +1,7 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+- * Hardware Random Number Generator support for Cavium Inc.
+- * Thunder processor family.
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License.  See the file "COPYING" in the main directory of this archive
+- * for more details.
++ * Hardware Random Number Generator support.
++ * Cavium Thunder, Marvell OcteonTx/Tx2 processor families.
+  *
+  * Copyright (C) 2016 Cavium, Inc.
+  */
+@@ -91,4 +88,4 @@ static struct pci_driver cavium_rng_pf_driver = {
+ 
+ module_pci_driver(cavium_rng_pf_driver);
+ MODULE_AUTHOR("Omer Khaliq <okhaliq@caviumnetworks.com>");
+-MODULE_LICENSE("GPL");
++MODULE_LICENSE("GPL v2");
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch b/queue-5.16/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch
new file mode 100644
index 00000000000..b1fb9698af9
--- /dev/null
+++ b/queue-5.16/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch
@@ -0,0 +1,38 @@
+From 150b0a07ca7ae98c38cf1939f2e135558426a370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 15:05:03 +0100
+Subject: hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit ab7d88549e2f7ae116afd303f32e1950cb790a1d ]
+
+The Cavium ThunderX Random Number Generator is only present on Cavium
+ThunderX SoCs, and not available as an independent PCIe endpoint.  Hence
+add a dependency on ARCH_THUNDER, to prevent asking the user about this
+driver when configuring a kernel without Cavium Thunder SoC  support.
+
+Fixes: cc2f1908c6b8f625 ("hwrng: cavium - Add Cavium HWRNG driver for ThunderX SoC.")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index 1da64771ee2e..372859b43f89 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -414,7 +414,7 @@ config HW_RANDOM_MESON
+ 
+ config HW_RANDOM_CAVIUM
+ 	tristate "Cavium ThunderX Random Number Generator support"
+-	depends on HW_RANDOM && PCI && ARM64
++	depends on HW_RANDOM && PCI && ARCH_THUNDER
+ 	default HW_RANDOM
+ 	help
+ 	  This driver provides kernel-side support for the Random Number
+-- 
+2.34.1
+
diff --git a/queue-5.16/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch b/queue-5.16/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch
new file mode 100644
index 00000000000..24a5a3eee69
--- /dev/null
+++ b/queue-5.16/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch
@@ -0,0 +1,47 @@
+From 2f893f31e5b462b7f0696260942a642836366594 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 11:07:24 +0000
+Subject: hwrng: nomadik - Change clk_disable to clk_disable_unprepare
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 7f0f1f3ef62ed7a40e30aff28115bd94c4211d1d ]
+
+The corresponding API for clk_prepare_enable is clk_disable_unprepare,
+other than clk_disable_unprepare.
+
+Fix this by changing clk_disable to clk_disable_unprepare.
+
+Fixes: beca35d05cc2 ("hwrng: nomadik - use clk_prepare_enable()")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/nomadik-rng.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/hw_random/nomadik-rng.c b/drivers/char/hw_random/nomadik-rng.c
+index 67947a19aa22..e8f9621e7954 100644
+--- a/drivers/char/hw_random/nomadik-rng.c
++++ b/drivers/char/hw_random/nomadik-rng.c
+@@ -65,14 +65,14 @@ static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id)
+ out_release:
+ 	amba_release_regions(dev);
+ out_clk:
+-	clk_disable(rng_clk);
++	clk_disable_unprepare(rng_clk);
+ 	return ret;
+ }
+ 
+ static void nmk_rng_remove(struct amba_device *dev)
+ {
+ 	amba_release_regions(dev);
+-	clk_disable(rng_clk);
++	clk_disable_unprepare(rng_clk);
+ }
+ 
+ static const struct amba_id nmk_rng_ids[] = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-bcm2835-fix-the-error-handling-in-bcm2835_i2c_pr.patch b/queue-5.16/i2c-bcm2835-fix-the-error-handling-in-bcm2835_i2c_pr.patch
new file mode 100644
index 00000000000..5f4a313466c
--- /dev/null
+++ b/queue-5.16/i2c-bcm2835-fix-the-error-handling-in-bcm2835_i2c_pr.patch
@@ -0,0 +1,77 @@
+From 73d380d803328c34d6221599988afbb64d968add Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 20:43:33 +0200
+Subject: i2c: bcm2835: Fix the error handling in 'bcm2835_i2c_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b205f5850263632b6897d8f0bfaeeea4955f8663 ]
+
+Some resource should be released if an error occurs in
+'bcm2835_i2c_probe()'.
+Add an error handling path and the needed 'clk_disable_unprepare()' and
+'clk_rate_exclusive_put()' calls.
+
+While at it, rework the bottom of the function to use this newly added
+error handling path and have an explicit and more standard "return 0;" at
+the end of the normal path.
+
+Fixes: bebff81fb8b9 ("i2c: bcm2835: Model Divider in CCF")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[wsa: rebased]
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index 5149454eef4a..f72c6576d8a3 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -454,18 +454,20 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
+ 	ret = clk_prepare_enable(i2c_dev->bus_clk);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Couldn't prepare clock");
+-		return ret;
++		goto err_put_exclusive_rate;
+ 	}
+ 
+ 	i2c_dev->irq = platform_get_irq(pdev, 0);
+-	if (i2c_dev->irq < 0)
+-		return i2c_dev->irq;
++	if (i2c_dev->irq < 0) {
++		ret = i2c_dev->irq;
++		goto err_disable_unprepare_clk;
++	}
+ 
+ 	ret = request_irq(i2c_dev->irq, bcm2835_i2c_isr, IRQF_SHARED,
+ 			  dev_name(&pdev->dev), i2c_dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Could not request IRQ\n");
+-		return -ENODEV;
++		goto err_disable_unprepare_clk;
+ 	}
+ 
+ 	adap = &i2c_dev->adapter;
+@@ -489,7 +491,16 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
+ 
+ 	ret = i2c_add_adapter(adap);
+ 	if (ret)
+-		free_irq(i2c_dev->irq, i2c_dev);
++		goto err_free_irq;
++
++	return 0;
++
++err_free_irq:
++	free_irq(i2c_dev->irq, i2c_dev);
++err_disable_unprepare_clk:
++	clk_disable_unprepare(i2c_dev->bus_clk);
++err_put_exclusive_rate:
++	clk_rate_exclusive_put(i2c_dev->bus_clk);
+ 
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-bcm2835-use-platform_get_irq-to-get-the-interrup.patch b/queue-5.16/i2c-bcm2835-use-platform_get_irq-to-get-the-interrup.patch
new file mode 100644
index 00000000000..fcd23222f76
--- /dev/null
+++ b/queue-5.16/i2c-bcm2835-use-platform_get_irq-to-get-the-interrup.patch
@@ -0,0 +1,58 @@
+From f1a62b2e77f58881ff3e50a9d9892310c51bfaeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Dec 2021 17:53:20 +0000
+Subject: i2c: bcm2835: Use platform_get_irq() to get the interrupt
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit c3b2f911ac11892b672df7829becf28d3a830073 ]
+
+platform_get_resource(pdev, IORESOURCE_IRQ, ..) relies on static
+allocation of IRQ resources in DT core code, this causes an issue
+when using hierarchical interrupt domains using "interrupts" property
+in the node as this bypasses the hierarchical setup and messes up the
+irq chaining.
+
+In preparation for removal of static setup of IRQ resource from DT core
+code use platform_get_irq().
+
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index ad3b124a2e37..5149454eef4a 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -407,7 +407,7 @@ static const struct i2c_adapter_quirks bcm2835_i2c_quirks = {
+ static int bcm2835_i2c_probe(struct platform_device *pdev)
+ {
+ 	struct bcm2835_i2c_dev *i2c_dev;
+-	struct resource *mem, *irq;
++	struct resource *mem;
+ 	int ret;
+ 	struct i2c_adapter *adap;
+ 	struct clk *mclk;
+@@ -457,12 +457,9 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!irq) {
+-		dev_err(&pdev->dev, "No IRQ resource\n");
+-		return -ENODEV;
+-	}
+-	i2c_dev->irq = irq->start;
++	i2c_dev->irq = platform_get_irq(pdev, 0);
++	if (i2c_dev->irq < 0)
++		return i2c_dev->irq;
+ 
+ 	ret = request_irq(i2c_dev->irq, bcm2835_i2c_isr, IRQF_SHARED,
+ 			  dev_name(&pdev->dev), i2c_dev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-meson-fix-wrong-speed-use-from-probe.patch b/queue-5.16/i2c-meson-fix-wrong-speed-use-from-probe.patch
new file mode 100644
index 00000000000..6fed433dd7d
--- /dev/null
+++ b/queue-5.16/i2c-meson-fix-wrong-speed-use-from-probe.patch
@@ -0,0 +1,59 @@
+From fd701de75c8f694e5cb852672feab624cf0f0569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 07:26:00 +0000
+Subject: i2c: meson: Fix wrong speed use from probe
+
+From: Lucas Tanure <tanure@linux.com>
+
+[ Upstream commit cb13aa16f34f794a9cee2626862af8a95f0f0ee9 ]
+
+Having meson_i2c_set_clk_div after i2c_add_adapter
+causes issues for client drivers that try to use
+the bus before the requested speed is applied.
+
+The bus can be used just after i2c_add_adapter, so
+move i2c_add_adapter to the final step as
+meson_i2c_set_clk_div needs to be called before
+the bus is used.
+
+Fixes: 09af1c2fa490 ("i2c: meson: set clock divider in probe instead of setting it for each transfer")
+Signed-off-by: Lucas Tanure <tanure@linux.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-meson.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
+index ef73a42577cc..07eb819072c4 100644
+--- a/drivers/i2c/busses/i2c-meson.c
++++ b/drivers/i2c/busses/i2c-meson.c
+@@ -465,18 +465,18 @@ static int meson_i2c_probe(struct platform_device *pdev)
+ 	 */
+ 	meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_START, 0);
+ 
+-	ret = i2c_add_adapter(&i2c->adap);
+-	if (ret < 0) {
+-		clk_disable_unprepare(i2c->clk);
+-		return ret;
+-	}
+-
+ 	/* Disable filtering */
+ 	meson_i2c_set_mask(i2c, REG_SLAVE_ADDR,
+ 			   REG_SLV_SDA_FILTER | REG_SLV_SCL_FILTER, 0);
+ 
+ 	meson_i2c_set_clk_div(i2c, timings.bus_freq_hz);
+ 
++	ret = i2c_add_adapter(&i2c->adap);
++	if (ret < 0) {
++		clk_disable_unprepare(i2c->clk);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch b/queue-5.16/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
new file mode 100644
index 00000000000..ad232243723
--- /dev/null
+++ b/queue-5.16/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
@@ -0,0 +1,53 @@
+From f2c3513fcecf0d1c5398d46507f547bd94b98027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 12:22:35 +0100
+Subject: i2c: mux: demux-pinctrl: do not deactivate a master that is not
+ active
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 1a22aabf20adf89cb216f566913196128766f25b ]
+
+Attempting to rollback the activation of the current master when
+the current master has not been activated is bad. priv->cur_chan
+and priv->cur_adap are both still zeroed out and the rollback
+may result in attempts to revert an of changeset that has not been
+applied and do result in calls to both del and put the zeroed out
+i2c_adapter. Maybe it crashes, or whatever, but it's bad in any
+case.
+
+Fixes: e9d1a0a41d44 ("i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 5365199a31f4..f7a7405d4350 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 
+ 	err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ 	if (err)
+-		goto err_rollback;
++		goto err_rollback_activation;
+ 
+ 	err = device_create_file(&pdev->dev, &dev_attr_current_master);
+ 	if (err)
+@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 
+ err_rollback_available:
+ 	device_remove_file(&pdev->dev, &dev_attr_available_masters);
+-err_rollback:
++err_rollback_activation:
+ 	i2c_demux_deactivate_master(priv);
++err_rollback:
+ 	for (j = 0; j < i; j++) {
+ 		of_node_put(priv->chan[j].parent_np);
+ 		of_changeset_destroy(&priv->chan[j].chgset);
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-pasemi-drop-i2c-classes-from-platform-driver-var.patch b/queue-5.16/i2c-pasemi-drop-i2c-classes-from-platform-driver-var.patch
new file mode 100644
index 00000000000..acafa6ea85d
--- /dev/null
+++ b/queue-5.16/i2c-pasemi-drop-i2c-classes-from-platform-driver-var.patch
@@ -0,0 +1,55 @@
+From 2ae037dfc06b1528716a564cf1f78f89e0ee2d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Feb 2022 10:59:14 +0100
+Subject: i2c: pasemi: Drop I2C classes from platform driver variant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Povišer <povik+lin@cutebit.org>
+
+[ Upstream commit 19e138e43a0820bb4dbf8fb5c7691f82e9221f2b ]
+
+Drop I2C device-probing classes from platform variant of the PASemi
+controller as it is only used on platforms where I2C devices should
+be instantiated in devicetree. (The I2C_CLASS_DEPRECATED flag is not
+raised as up to this point no devices relied on the old behavior.)
+
+Fixes: d88ae2932df0 ("i2c: pasemi: Add Apple platform driver")
+Signed-off-by: Martin Povišer <povik+lin@cutebit.org>
+Reviewed-by: Sven Peter <sven@svenpeter.dev>
+Acked-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-pasemi-core.c | 1 -
+ drivers/i2c/busses/i2c-pasemi-pci.c  | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-pasemi-core.c b/drivers/i2c/busses/i2c-pasemi-core.c
+index 4e161a4089d8..7728c8460dc0 100644
+--- a/drivers/i2c/busses/i2c-pasemi-core.c
++++ b/drivers/i2c/busses/i2c-pasemi-core.c
+@@ -333,7 +333,6 @@ int pasemi_i2c_common_probe(struct pasemi_smbus *smbus)
+ 	smbus->adapter.owner = THIS_MODULE;
+ 	snprintf(smbus->adapter.name, sizeof(smbus->adapter.name),
+ 		 "PA Semi SMBus adapter (%s)", dev_name(smbus->dev));
+-	smbus->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ 	smbus->adapter.algo = &smbus_algorithm;
+ 	smbus->adapter.algo_data = smbus;
+ 
+diff --git a/drivers/i2c/busses/i2c-pasemi-pci.c b/drivers/i2c/busses/i2c-pasemi-pci.c
+index 1ab1f28744fb..cfc89e04eb94 100644
+--- a/drivers/i2c/busses/i2c-pasemi-pci.c
++++ b/drivers/i2c/busses/i2c-pasemi-pci.c
+@@ -56,6 +56,7 @@ static int pasemi_smb_pci_probe(struct pci_dev *dev,
+ 	if (!smbus->ioaddr)
+ 		return -EBUSY;
+ 
++	smbus->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ 	error = pasemi_i2c_common_probe(smbus);
+ 	if (error)
+ 		return error;
+-- 
+2.34.1
+
diff --git a/queue-5.16/i2c-xiic-make-bus-names-unique.patch b/queue-5.16/i2c-xiic-make-bus-names-unique.patch
new file mode 100644
index 00000000000..beb869d9543
--- /dev/null
+++ b/queue-5.16/i2c-xiic-make-bus-names-unique.patch
@@ -0,0 +1,49 @@
+From 2aa1436ec582fda6e2ede4bd39165dc1bac55239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 11:50:13 -0600
+Subject: i2c: xiic: Make bus names unique
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 1d366c2f9df8279df2adbb60471f86fc40a1c39e ]
+
+This driver is for an FPGA logic core, so there can be arbitrarily many
+instances of the bus on a given system. Previously all of the I2C bus
+names were "xiic-i2c" which caused issues with lm_sensors when trying to
+map human-readable names to sensor inputs because it could not properly
+distinguish the busses, for example. Append the platform device name to
+the I2C bus name so it is unique between different instances.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Tested-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index eb789cfb9973..ffefe3c482e9 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -734,7 +734,6 @@ static const struct i2c_adapter_quirks xiic_quirks = {
+ 
+ static const struct i2c_adapter xiic_adapter = {
+ 	.owner = THIS_MODULE,
+-	.name = DRIVER_NAME,
+ 	.class = I2C_CLASS_DEPRECATED,
+ 	.algo = &xiic_algorithm,
+ 	.quirks = &xiic_quirks,
+@@ -771,6 +770,8 @@ static int xiic_i2c_probe(struct platform_device *pdev)
+ 	i2c_set_adapdata(&i2c->adap, i2c);
+ 	i2c->adap.dev.parent = &pdev->dev;
+ 	i2c->adap.dev.of_node = pdev->dev.of_node;
++	snprintf(i2c->adap.name, sizeof(i2c->adap.name),
++		 DRIVER_NAME " %s", pdev->name);
+ 
+ 	mutex_init(&i2c->lock);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch b/queue-5.16/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
new file mode 100644
index 00000000000..440a147f293
--- /dev/null
+++ b/queue-5.16/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
@@ -0,0 +1,53 @@
+From d94cd1c1dac0b9deb4adc36a3926c66f54a18624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:54 +0100
+Subject: i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit bc97f9c6f988b31b728eb47a94ca825401dbeffe ]
+
+{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD
++ NET_IP_ALIGN for any skb.
+OTOH, i40e_construct_skb_zc() currently allocates and reserves
+additional `xdp->data - xdp->data_hard_start`, which is
+XDP_PACKET_HEADROOM for XSK frames.
+There's no need for that at all as the frame is post-XDP and will
+go only to the networking stack core.
+Pass the size of the actual data only to __napi_alloc_skb() and
+don't reserve anything. This will give enough headroom for stack
+processing.
+
+Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index ea06e957393e..dff7c7fcc329 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -246,13 +246,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring,
+ 	struct sk_buff *skb;
+ 
+ 	/* allocate a skb to store the frags */
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
+-			       xdp->data_end - xdp->data_hard_start,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		goto out;
+ 
+-	skb_reserve(skb, xdp->data - xdp->data_hard_start);
+ 	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+-- 
+2.34.1
+
diff --git a/queue-5.16/i40e-remove-dead-stores-on-xsk-hotpath.patch b/queue-5.16/i40e-remove-dead-stores-on-xsk-hotpath.patch
new file mode 100644
index 00000000000..3bd2b75a010
--- /dev/null
+++ b/queue-5.16/i40e-remove-dead-stores-on-xsk-hotpath.patch
@@ -0,0 +1,59 @@
+From 72a411ad80629eb30bdacc73b64af93228b2c8bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 13:50:33 -0800
+Subject: i40e: remove dead stores on XSK hotpath
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 7e1b54d07751edcbf23c7211508abf5667b490ee ]
+
+The 'if (ntu == rx_ring->count)' block in i40e_alloc_rx_buffers_zc()
+was previously residing in the loop, but after introducing the
+batched interface it is used only to wrap-around the NTU descriptor,
+thus no more need to assign 'xdp'.
+
+'cleaned_count' in i40e_clean_rx_irq_zc() was previously being
+incremented in the loop, but after commit f12738b6ec06
+("i40e: remove unnecessary cleaned_count updates") it gets
+assigned only once after it, so the initialization can be dropped.
+
+Fixes: 6aab0bb0c5cd ("i40e: Use the xsk batched rx allocation interface")
+Fixes: f12738b6ec06 ("i40e: remove unnecessary cleaned_count updates")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index 2553b130108d..0e8cf275e084 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -218,7 +218,6 @@ bool i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count)
+ 	ntu += nb_buffs;
+ 	if (ntu == rx_ring->count) {
+ 		rx_desc = I40E_RX_DESC(rx_ring, 0);
+-		xdp = i40e_rx_bi(rx_ring, 0);
+ 		ntu = 0;
+ 	}
+ 
+@@ -328,11 +327,11 @@ static void i40e_handle_xdp_result_zc(struct i40e_ring *rx_ring,
+ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget)
+ {
+ 	unsigned int total_rx_bytes = 0, total_rx_packets = 0;
+-	u16 cleaned_count = I40E_DESC_UNUSED(rx_ring);
+ 	u16 next_to_clean = rx_ring->next_to_clean;
+ 	u16 count_mask = rx_ring->count - 1;
+ 	unsigned int xdp_res, xdp_xmit = 0;
+ 	bool failure = false;
++	u16 cleaned_count;
+ 
+ 	while (likely(total_rx_packets < (unsigned int)budget)) {
+ 		union i40e_rx_desc *rx_desc;
+-- 
+2.34.1
+
diff --git a/queue-5.16/i40e-respect-metadata-on-xsk-rx-to-skb.patch b/queue-5.16/i40e-respect-metadata-on-xsk-rx-to-skb.patch
new file mode 100644
index 00000000000..af0f1d811d0
--- /dev/null
+++ b/queue-5.16/i40e-respect-metadata-on-xsk-rx-to-skb.patch
@@ -0,0 +1,68 @@
+From 2882e4009b4fdc1b4c8e4b5620b098ca7354c192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:55 +0100
+Subject: i40e: respect metadata on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 6dba29537c0f639b482bd8f8bbd50ab4ae74b48d ]
+
+For now, if the XDP prog returns XDP_PASS on XSK, the metadata will
+be lost as it doesn't get copied to the skb.
+
+Copy it along with the frame headers. Account its size on skb
+allocation, and when copying just treat it as a part of the frame
+and do a pull after to "move" it to the "reserved" zone.
+
+net_prefetch() xdp->data_meta and align the copy size to speed-up
+memcpy() a little and better match i40e_construct_skb().
+
+Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support")
+Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index dff7c7fcc329..2553b130108d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -241,19 +241,25 @@ bool i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count)
+ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring,
+ 					     struct xdp_buff *xdp)
+ {
++	unsigned int totalsize = xdp->data_end - xdp->data_meta;
+ 	unsigned int metasize = xdp->data - xdp->data_meta;
+-	unsigned int datasize = xdp->data_end - xdp->data;
+ 	struct sk_buff *skb;
+ 
++	net_prefetch(xdp->data_meta);
++
+ 	/* allocate a skb to store the frags */
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, totalsize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		goto out;
+ 
+-	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+-	if (metasize)
++	memcpy(__skb_put(skb, totalsize), xdp->data_meta,
++	       ALIGN(totalsize, sizeof(long)));
++
++	if (metasize) {
+ 		skb_metadata_set(skb, metasize);
++		__skb_pull(skb, metasize);
++	}
+ 
+ out:
+ 	xsk_buff_free(xdp);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch b/queue-5.16/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
new file mode 100644
index 00000000000..36852b174ec
--- /dev/null
+++ b/queue-5.16/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
@@ -0,0 +1,41 @@
+From 9ded86e85d7f1f34bfb05adb0d136f7f8c1a3073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 16:39:35 +0100
+Subject: IB/cma: Allow XRC INI QPs to set their local ACK timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 748663c8ccf6b2e5a800de19127c2cc1c4423fd2 ]
+
+XRC INI QPs should be able to adjust their local ACK timeout.
+
+Fixes: 2c1619edef61 ("IB/cma: Define option to set ack timeout and pack tos_set")
+Link: https://lore.kernel.org/r/1644421175-31943-1-git-send-email-haakon.bugge@oracle.com
+Signed-off-by: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+Suggested-by: Avneesh Pant <avneesh.pant@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 41ec05c4b0d0..80a8e31e5b38 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2642,7 +2642,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout)
+ {
+ 	struct rdma_id_private *id_priv;
+ 
+-	if (id->qp_type != IB_QPT_RC)
++	if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI)
+ 		return -EINVAL;
+ 
+ 	id_priv = container_of(id, struct rdma_id_private, id);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ib-hfi1-allow-larger-mtu-without-aip.patch b/queue-5.16/ib-hfi1-allow-larger-mtu-without-aip.patch
new file mode 100644
index 00000000000..1aed9584b76
--- /dev/null
+++ b/queue-5.16/ib-hfi1-allow-larger-mtu-without-aip.patch
@@ -0,0 +1,46 @@
+From 43ab21e1e488fff52435861233f56097e1b215a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 14:25:09 -0500
+Subject: IB/hfi1: Allow larger MTU without AIP
+
+From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+
+[ Upstream commit b135e324d7a2e7fa0a7ef925076136e799b79f44 ]
+
+The AIP code signals the phys_mtu in the following query_port()
+fragment:
+
+	props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu :
+				ib_mtu_enum_to_int(props->max_mtu);
+
+Using the largest MTU possible should not depend on AIP.
+
+Fix by unconditionally using the hfi1_max_mtu value.
+
+Fixes: 6d72344cf6c4 ("IB/ipoib: Increase ipoib Datagram mode MTU's upper limit")
+Link: https://lore.kernel.org/r/1644348309-174874-1-git-send-email-mike.marciniszyn@cornelisnetworks.com
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/verbs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index dc9211f3a009..99d0743133ca 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1397,8 +1397,7 @@ static int query_port(struct rvt_dev_info *rdi, u32 port_num,
+ 				      4096 : hfi1_max_mtu), IB_MTU_4096);
+ 	props->active_mtu = !valid_ib_mtu(ppd->ibmtu) ? props->max_mtu :
+ 		mtu_to_enum(ppd->ibmtu, IB_MTU_4096);
+-	props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu :
+-				ib_mtu_enum_to_int(props->max_mtu);
++	props->phys_mtu = hfi1_max_mtu;
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/ibmvnic-fix-race-between-xmit-and-reset.patch b/queue-5.16/ibmvnic-fix-race-between-xmit-and-reset.patch
new file mode 100644
index 00000000000..35fc4f3db52
--- /dev/null
+++ b/queue-5.16/ibmvnic-fix-race-between-xmit-and-reset.patch
@@ -0,0 +1,275 @@
+From f19169a58d10a07a815b94b48842f406dd27acf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 18:12:31 -0700
+Subject: ibmvnic: fix race between xmit and reset
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit 4219196d1f662cb10a462eb9e076633a3fc31a15 ]
+
+There is a race between reset and the transmit paths that can lead to
+ibmvnic_xmit() accessing an scrq after it has been freed in the reset
+path. It can result in a crash like:
+
+	Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
+	BUG: Kernel NULL pointer dereference on read at 0x00000000
+	Faulting instruction address: 0xc0080000016189f8
+	Oops: Kernel access of bad area, sig: 11 [#1]
+	...
+	NIP [c0080000016189f8] ibmvnic_xmit+0x60/0xb60 [ibmvnic]
+	LR [c000000000c0046c] dev_hard_start_xmit+0x11c/0x280
+	Call Trace:
+	[c008000001618f08] ibmvnic_xmit+0x570/0xb60 [ibmvnic] (unreliable)
+	[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280
+	[c000000000c9cfcc] sch_direct_xmit+0xec/0x330
+	[c000000000bfe640] __dev_xmit_skb+0x3a0/0x9d0
+	[c000000000c00ad4] __dev_queue_xmit+0x394/0x730
+	[c008000002db813c] __bond_start_xmit+0x254/0x450 [bonding]
+	[c008000002db8378] bond_start_xmit+0x40/0xc0 [bonding]
+	[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280
+	[c000000000c00ca4] __dev_queue_xmit+0x564/0x730
+	[c000000000cf97e0] neigh_hh_output+0xd0/0x180
+	[c000000000cfa69c] ip_finish_output2+0x31c/0x5c0
+	[c000000000cfd244] __ip_queue_xmit+0x194/0x4f0
+	[c000000000d2a3c4] __tcp_transmit_skb+0x434/0x9b0
+	[c000000000d2d1e0] __tcp_retransmit_skb+0x1d0/0x6a0
+	[c000000000d2d984] tcp_retransmit_skb+0x34/0x130
+	[c000000000d310e8] tcp_retransmit_timer+0x388/0x6d0
+	[c000000000d315ec] tcp_write_timer_handler+0x1bc/0x330
+	[c000000000d317bc] tcp_write_timer+0x5c/0x200
+	[c000000000243270] call_timer_fn+0x50/0x1c0
+	[c000000000243704] __run_timers.part.0+0x324/0x460
+	[c000000000243894] run_timer_softirq+0x54/0xa0
+	[c000000000ea713c] __do_softirq+0x15c/0x3e0
+	[c000000000166258] __irq_exit_rcu+0x158/0x190
+	[c000000000166420] irq_exit+0x20/0x40
+	[c00000000002853c] timer_interrupt+0x14c/0x2b0
+	[c000000000009a00] decrementer_common_virt+0x210/0x220
+	--- interrupt: 900 at plpar_hcall_norets_notrace+0x18/0x2c
+
+The immediate cause of the crash is the access of tx_scrq in the following
+snippet during a reset, where the tx_scrq can be either NULL or an address
+that will soon be invalid:
+
+	ibmvnic_xmit()
+	{
+		...
+		tx_scrq = adapter->tx_scrq[queue_num];
+		txq = netdev_get_tx_queue(netdev, queue_num);
+		ind_bufp = &tx_scrq->ind_buf;
+
+		if (test_bit(0, &adapter->resetting)) {
+		...
+	}
+
+But beyond that, the call to ibmvnic_xmit() itself is not safe during a
+reset and the reset path attempts to avoid this by stopping the queue in
+ibmvnic_cleanup(). However just after the queue was stopped, an in-flight
+ibmvnic_complete_tx() could have restarted the queue even as the reset is
+progressing.
+
+Since the queue was restarted we could get a call to ibmvnic_xmit() which
+can then access the bad tx_scrq (or other fields).
+
+We cannot however simply have ibmvnic_complete_tx() check the ->resetting
+bit and skip starting the queue. This can race at the "back-end" of a good
+reset which just restarted the queue but has not cleared the ->resetting
+bit yet. If we skip restarting the queue due to ->resetting being true,
+the queue would remain stopped indefinitely potentially leading to transmit
+timeouts.
+
+IOW ->resetting is too broad for this purpose. Instead use a new flag
+that indicates whether or not the queues are active. Only the open/
+reset paths control when the queues are active. ibmvnic_complete_tx()
+and others wake up the queue only if the queue is marked active.
+
+So we will have:
+	A. reset/open thread in ibmvnic_cleanup() and __ibmvnic_open()
+
+		->resetting = true
+		->tx_queues_active = false
+		disable tx queues
+		...
+		->tx_queues_active = true
+		start tx queues
+
+	B. Tx interrupt in ibmvnic_complete_tx():
+
+		if (->tx_queues_active)
+			netif_wake_subqueue();
+
+To ensure that ->tx_queues_active and state of the queues are consistent,
+we need a lock which:
+
+	- must also be taken in the interrupt path (ibmvnic_complete_tx())
+	- shared across the multiple queues in the adapter (so they don't
+	  become serialized)
+
+Use rcu_read_lock() and have the reset thread synchronize_rcu() after
+updating the ->tx_queues_active state.
+
+While here, consolidate a few boolean fields in ibmvnic_adapter for
+better alignment.
+
+Based on discussions with Brian King and Dany Madden.
+
+Fixes: 7ed5b31f4a66 ("net/ibmvnic: prevent more than one thread from running in reset")
+Reported-by: Vaishnavi Bhat <vaish123@in.ibm.com>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 63 ++++++++++++++++++++++++------
+ drivers/net/ethernet/ibm/ibmvnic.h |  7 +++-
+ 2 files changed, 55 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index a8b65c072f64..82f47bf4d67c 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1429,6 +1429,15 @@ static int __ibmvnic_open(struct net_device *netdev)
+ 		return rc;
+ 	}
+ 
++	adapter->tx_queues_active = true;
++
++	/* Since queues were stopped until now, there shouldn't be any
++	 * one in ibmvnic_complete_tx() or ibmvnic_xmit() so maybe we
++	 * don't need the synchronize_rcu()? Leaving it for consistency
++	 * with setting ->tx_queues_active = false.
++	 */
++	synchronize_rcu();
++
+ 	netif_tx_start_all_queues(netdev);
+ 
+ 	if (prev_state == VNIC_CLOSED) {
+@@ -1603,6 +1612,14 @@ static void ibmvnic_cleanup(struct net_device *netdev)
+ 	struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+ 
+ 	/* ensure that transmissions are stopped if called by do_reset */
++
++	adapter->tx_queues_active = false;
++
++	/* Ensure complete_tx() and ibmvnic_xmit() see ->tx_queues_active
++	 * update so they don't restart a queue after we stop it below.
++	 */
++	synchronize_rcu();
++
+ 	if (test_bit(0, &adapter->resetting))
+ 		netif_tx_disable(netdev);
+ 	else
+@@ -1842,14 +1859,21 @@ static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter,
+ 		tx_buff->skb = NULL;
+ 		adapter->netdev->stats.tx_dropped++;
+ 	}
++
+ 	ind_bufp->index = 0;
++
+ 	if (atomic_sub_return(entries, &tx_scrq->used) <=
+ 	    (adapter->req_tx_entries_per_subcrq / 2) &&
+-	    __netif_subqueue_stopped(adapter->netdev, queue_num) &&
+-	    !test_bit(0, &adapter->resetting)) {
+-		netif_wake_subqueue(adapter->netdev, queue_num);
+-		netdev_dbg(adapter->netdev, "Started queue %d\n",
+-			   queue_num);
++	    __netif_subqueue_stopped(adapter->netdev, queue_num)) {
++		rcu_read_lock();
++
++		if (adapter->tx_queues_active) {
++			netif_wake_subqueue(adapter->netdev, queue_num);
++			netdev_dbg(adapter->netdev, "Started queue %d\n",
++				   queue_num);
++		}
++
++		rcu_read_unlock();
+ 	}
+ }
+ 
+@@ -1904,11 +1928,12 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 	int index = 0;
+ 	u8 proto = 0;
+ 
+-	tx_scrq = adapter->tx_scrq[queue_num];
+-	txq = netdev_get_tx_queue(netdev, queue_num);
+-	ind_bufp = &tx_scrq->ind_buf;
+-
+-	if (test_bit(0, &adapter->resetting)) {
++	/* If a reset is in progress, drop the packet since
++	 * the scrqs may get torn down. Otherwise use the
++	 * rcu to ensure reset waits for us to complete.
++	 */
++	rcu_read_lock();
++	if (!adapter->tx_queues_active) {
+ 		dev_kfree_skb_any(skb);
+ 
+ 		tx_send_failed++;
+@@ -1917,6 +1942,10 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 		goto out;
+ 	}
+ 
++	tx_scrq = adapter->tx_scrq[queue_num];
++	txq = netdev_get_tx_queue(netdev, queue_num);
++	ind_bufp = &tx_scrq->ind_buf;
++
+ 	if (ibmvnic_xmit_workarounds(skb, netdev)) {
+ 		tx_dropped++;
+ 		tx_send_failed++;
+@@ -1924,6 +1953,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 		ibmvnic_tx_scrq_flush(adapter, tx_scrq);
+ 		goto out;
+ 	}
++
+ 	if (skb_is_gso(skb))
+ 		tx_pool = &adapter->tso_pool[queue_num];
+ 	else
+@@ -2078,6 +2108,7 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 		netif_carrier_off(netdev);
+ 	}
+ out:
++	rcu_read_unlock();
+ 	netdev->stats.tx_dropped += tx_dropped;
+ 	netdev->stats.tx_bytes += tx_bytes;
+ 	netdev->stats.tx_packets += tx_packets;
+@@ -3728,9 +3759,15 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter,
+ 		    (adapter->req_tx_entries_per_subcrq / 2) &&
+ 		    __netif_subqueue_stopped(adapter->netdev,
+ 					     scrq->pool_index)) {
+-			netif_wake_subqueue(adapter->netdev, scrq->pool_index);
+-			netdev_dbg(adapter->netdev, "Started queue %d\n",
+-				   scrq->pool_index);
++			rcu_read_lock();
++			if (adapter->tx_queues_active) {
++				netif_wake_subqueue(adapter->netdev,
++						    scrq->pool_index);
++				netdev_dbg(adapter->netdev,
++					   "Started queue %d\n",
++					   scrq->pool_index);
++			}
++			rcu_read_unlock();
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 549a9b7b1a70..1b2bdb85ad67 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1009,11 +1009,14 @@ struct ibmvnic_adapter {
+ 	struct work_struct ibmvnic_reset;
+ 	struct delayed_work ibmvnic_delayed_reset;
+ 	unsigned long resetting;
+-	bool napi_enabled, from_passive_init;
+-	bool login_pending;
+ 	/* last device reset time */
+ 	unsigned long last_reset_time;
+ 
++	bool napi_enabled;
++	bool from_passive_init;
++	bool login_pending;
++	/* protected by rcu */
++	bool tx_queues_active;
+ 	bool failover_pending;
+ 	bool force_reset_recovery;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ice-don-t-allow-to-run-ice_send_event_to_aux-in-atom.patch b/queue-5.16/ice-don-t-allow-to-run-ice_send_event_to_aux-in-atom.patch
new file mode 100644
index 00000000000..1a8d9817dc6
--- /dev/null
+++ b/queue-5.16/ice-don-t-allow-to-run-ice_send_event_to_aux-in-atom.patch
@@ -0,0 +1,47 @@
+From 4805c3ce903d4dce6d86c687562c1857e28d2898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 13:43:53 +0100
+Subject: ice: don't allow to run ice_send_event_to_aux() in atomic ctx
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 5a3156932da06f09953764de113419f254086faf ]
+
+ice_send_event_to_aux() eventually descends to mutex_lock()
+(-> might_sched()), so it must not be called under non-task
+context. However, at least two fixes have happened already for the
+bug splats occurred due to this function being called from atomic
+context.
+To make the emergency landings softer, bail out early when executed
+in non-task context emitting a warn splat only once. This way we
+trade some events being potentially lost for system stability and
+avoid any related hangs and crashes.
+
+Fixes: 348048e724a0e ("ice: Implement iidc operations")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Tested-by: Michal Kubiak <michal.kubiak@intel.com>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_idc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c b/drivers/net/ethernet/intel/ice/ice_idc.c
+index adcc9a251595..a2714988dd96 100644
+--- a/drivers/net/ethernet/intel/ice/ice_idc.c
++++ b/drivers/net/ethernet/intel/ice/ice_idc.c
+@@ -34,6 +34,9 @@ void ice_send_event_to_aux(struct ice_pf *pf, struct iidc_event *event)
+ {
+ 	struct iidc_auxiliary_drv *iadrv;
+ 
++	if (WARN_ON_ONCE(!in_task()))
++		return;
++
+ 	if (!pf->adev)
+ 		return;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ice-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch b/queue-5.16/ice-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
new file mode 100644
index 00000000000..3f7119d7e55
--- /dev/null
+++ b/queue-5.16/ice-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
@@ -0,0 +1,56 @@
+From 7147115d9e5b465fdeb44625980e58e350d11791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:57 +0100
+Subject: ice: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit dc44572d195e10ec41a03e09b3b5addab4af5cea ]
+
+{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD
++ NET_IP_ALIGN for any skb.
+OTOH, ice_construct_skb_zc() currently allocates and reserves
+additional `xdp->data - xdp->data_hard_start`, which is
+XDP_PACKET_HEADROOM for XSK frames.
+There's no need for that at all as the frame is post-XDP and will
+go only to the networking stack core.
+Pass the size of the actual data only to __napi_alloc_skb() and
+don't reserve anything. This will give enough headroom for stack
+processing.
+
+Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_xsk.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
+index c895351b25e0..a2c79431afd8 100644
+--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
+@@ -428,17 +428,15 @@ static void ice_bump_ntc(struct ice_rx_ring *rx_ring)
+ static struct sk_buff *
+ ice_construct_skb_zc(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp)
+ {
+-	unsigned int datasize_hard = xdp->data_end - xdp->data_hard_start;
+ 	unsigned int metasize = xdp->data - xdp->data_meta;
+ 	unsigned int datasize = xdp->data_end - xdp->data;
+ 	struct sk_buff *skb;
+ 
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize_hard,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, xdp->data - xdp->data_hard_start);
+ 	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ice-fix-scheduling-while-atomic-on-aux-critical-err-.patch b/queue-5.16/ice-fix-scheduling-while-atomic-on-aux-critical-err-.patch
new file mode 100644
index 00000000000..9e4da97f615
--- /dev/null
+++ b/queue-5.16/ice-fix-scheduling-while-atomic-on-aux-critical-err-.patch
@@ -0,0 +1,132 @@
+From 544f7336e66cd68fb84e5f27cdd559ae6da8b126 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 13:43:52 +0100
+Subject: ice: fix 'scheduling while atomic' on aux critical err interrupt
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 32d53c0aa3a7b727243473949bad2a830b908edc ]
+
+There's a kernel BUG splat on processing aux critical error
+interrupts in ice_misc_intr():
+
+[ 2100.917085] BUG: scheduling while atomic: swapper/15/0/0x00010000
+...
+[ 2101.060770] Call Trace:
+[ 2101.063229]  <IRQ>
+[ 2101.065252]  dump_stack+0x41/0x60
+[ 2101.068587]  __schedule_bug.cold.100+0x4c/0x58
+[ 2101.073060]  __schedule+0x6a4/0x830
+[ 2101.076570]  schedule+0x35/0xa0
+[ 2101.079727]  schedule_preempt_disabled+0xa/0x10
+[ 2101.084284]  __mutex_lock.isra.7+0x310/0x420
+[ 2101.088580]  ? ice_misc_intr+0x201/0x2e0 [ice]
+[ 2101.093078]  ice_send_event_to_aux+0x25/0x70 [ice]
+[ 2101.097921]  ice_misc_intr+0x220/0x2e0 [ice]
+[ 2101.102232]  __handle_irq_event_percpu+0x40/0x180
+[ 2101.106965]  handle_irq_event_percpu+0x30/0x80
+[ 2101.111434]  handle_irq_event+0x36/0x53
+[ 2101.115292]  handle_edge_irq+0x82/0x190
+[ 2101.119148]  handle_irq+0x1c/0x30
+[ 2101.122480]  do_IRQ+0x49/0xd0
+[ 2101.125465]  common_interrupt+0xf/0xf
+[ 2101.129146]  </IRQ>
+...
+
+As Andrew correctly mentioned previously[0], the following call
+ladder happens:
+
+ice_misc_intr() <- hardirq
+  ice_send_event_to_aux()
+    device_lock()
+      mutex_lock()
+        might_sleep()
+          might_resched() <- oops
+
+Add a new PF state bit which indicates that an aux critical error
+occurred and serve it in ice_service_task() in process context.
+The new ice_pf::oicr_err_reg is read-write in both hardirq and
+process contexts, but only 3 bits of non-critical data probably
+aren't worth explicit synchronizing (and they're even in the same
+byte [31:24]).
+
+[0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch
+
+Fixes: 348048e724a0e ("ice: Implement iidc operations")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Tested-by: Michal Kubiak <michal.kubiak@intel.com>
+Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h      |  2 ++
+ drivers/net/ethernet/intel/ice/ice_main.c | 25 ++++++++++++++---------
+ 2 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index 8093346f163b..240b4c461d9c 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -290,6 +290,7 @@ enum ice_pf_state {
+ 	ICE_LINK_DEFAULT_OVERRIDE_PENDING,
+ 	ICE_PHY_INIT_COMPLETE,
+ 	ICE_FD_VF_FLUSH_CTX,		/* set at FD Rx IRQ or timeout */
++	ICE_AUX_ERR_PENDING,
+ 	ICE_STATE_NBITS		/* must be last */
+ };
+ 
+@@ -557,6 +558,7 @@ struct ice_pf {
+ 	wait_queue_head_t reset_wait_queue;
+ 
+ 	u32 hw_csum_rx_error;
++	u32 oicr_err_reg;
+ 	u16 oicr_idx;		/* Other interrupt cause MSIX vector index */
+ 	u16 num_avail_sw_msix;	/* remaining MSIX SW vectors left unclaimed */
+ 	u16 max_pf_txqs;	/* Total Tx queues PF wide */
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index b449b3408a1c..523877c2f8b6 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -2237,6 +2237,19 @@ static void ice_service_task(struct work_struct *work)
+ 		return;
+ 	}
+ 
++	if (test_and_clear_bit(ICE_AUX_ERR_PENDING, pf->state)) {
++		struct iidc_event *event;
++
++		event = kzalloc(sizeof(*event), GFP_KERNEL);
++		if (event) {
++			set_bit(IIDC_EVENT_CRIT_ERR, event->type);
++			/* report the entire OICR value to AUX driver */
++			swap(event->reg, pf->oicr_err_reg);
++			ice_send_event_to_aux(pf, event);
++			kfree(event);
++		}
++	}
++
+ 	if (test_bit(ICE_FLAG_PLUG_AUX_DEV, pf->flags)) {
+ 		/* Plug aux device per request */
+ 		ice_plug_aux_dev(pf);
+@@ -3023,17 +3036,9 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+ 
+ #define ICE_AUX_CRIT_ERR (PFINT_OICR_PE_CRITERR_M | PFINT_OICR_HMC_ERR_M | PFINT_OICR_PE_PUSH_M)
+ 	if (oicr & ICE_AUX_CRIT_ERR) {
+-		struct iidc_event *event;
+-
++		pf->oicr_err_reg |= oicr;
++		set_bit(ICE_AUX_ERR_PENDING, pf->state);
+ 		ena_mask &= ~ICE_AUX_CRIT_ERR;
+-		event = kzalloc(sizeof(*event), GFP_ATOMIC);
+-		if (event) {
+-			set_bit(IIDC_EVENT_CRIT_ERR, event->type);
+-			/* report the entire OICR value to AUX driver */
+-			event->reg = oicr;
+-			ice_send_event_to_aux(pf, event);
+-			kfree(event);
+-		}
+ 	}
+ 
+ 	/* Report any remaining unexpected interrupts */
+-- 
+2.34.1
+
diff --git a/queue-5.16/ice-respect-metadata-on-xsk-rx-to-skb.patch b/queue-5.16/ice-respect-metadata-on-xsk-rx-to-skb.patch
new file mode 100644
index 00000000000..5fa1da9b0f3
--- /dev/null
+++ b/queue-5.16/ice-respect-metadata-on-xsk-rx-to-skb.patch
@@ -0,0 +1,67 @@
+From 9b21844053c99a4c4a92d886e1d7f3fb9d7b2d5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:58 +0100
+Subject: ice: respect metadata on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 45a34ca68070e34e09d5bf4309f7f1f286a27fc7 ]
+
+For now, if the XDP prog returns XDP_PASS on XSK, the metadata will
+be lost as it doesn't get copied to the skb.
+
+Copy it along with the frame headers. Account its size on skb
+allocation, and when copying just treat it as a part of the frame
+and do a pull after to "move" it to the "reserved" zone.
+
+net_prefetch() xdp->data_meta and align the copy size to speed-up
+memcpy() a little and better match ice_construct_skb().
+
+Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
+Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_xsk.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
+index a2c79431afd8..ac97cf3c5804 100644
+--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
+@@ -428,18 +428,24 @@ static void ice_bump_ntc(struct ice_rx_ring *rx_ring)
+ static struct sk_buff *
+ ice_construct_skb_zc(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp)
+ {
++	unsigned int totalsize = xdp->data_end - xdp->data_meta;
+ 	unsigned int metasize = xdp->data - xdp->data_meta;
+-	unsigned int datasize = xdp->data_end - xdp->data;
+ 	struct sk_buff *skb;
+ 
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
++	net_prefetch(xdp->data_meta);
++
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, totalsize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+-	if (metasize)
++	memcpy(__skb_put(skb, totalsize), xdp->data_meta,
++	       ALIGN(totalsize, sizeof(long)));
++
++	if (metasize) {
+ 		skb_metadata_set(skb, metasize);
++		__skb_pull(skb, metasize);
++	}
+ 
+ 	xsk_buff_free(xdp);
+ 	return skb;
+-- 
+2.34.1
+
diff --git a/queue-5.16/igb-refactor-xdp-registration.patch b/queue-5.16/igb-refactor-xdp-registration.patch
new file mode 100644
index 00000000000..8a11f5f0a75
--- /dev/null
+++ b/queue-5.16/igb-refactor-xdp-registration.patch
@@ -0,0 +1,85 @@
+From 12e73d81b7f877e6dec1a9d34ef194fd6ccf422e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 15:52:59 +0100
+Subject: igb: refactor XDP registration
+
+From: Corinna Vinschen <vinschen@redhat.com>
+
+[ Upstream commit e62ad74aa534404b3ee7e250b114a3536ac56987 ]
+
+On changing the RX ring parameters igb uses a hack to avoid a warning
+when calling xdp_rxq_info_reg via igb_setup_rx_resources.  It just
+clears the struct xdp_rxq_info content.
+
+Instead, change this to unregister if we're already registered.  Align
+code to the igc code.
+
+Fixes: 9cbc948b5a20c ("igb: add XDP support")
+Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_ethtool.c |  4 ----
+ drivers/net/ethernet/intel/igb/igb_main.c    | 19 +++++++++++++------
+ 2 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index fb1029352c3e..3cbb5a89b336 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -961,10 +961,6 @@ static int igb_set_ringparam(struct net_device *netdev,
+ 			memcpy(&temp_ring[i], adapter->rx_ring[i],
+ 			       sizeof(struct igb_ring));
+ 
+-			/* Clear copied XDP RX-queue info */
+-			memset(&temp_ring[i].xdp_rxq, 0,
+-			       sizeof(temp_ring[i].xdp_rxq));
+-
+ 			temp_ring[i].count = new_rx_count;
+ 			err = igb_setup_rx_resources(&temp_ring[i]);
+ 			if (err) {
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 446894dde182..5034ebb57b65 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -4352,7 +4352,18 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
+ {
+ 	struct igb_adapter *adapter = netdev_priv(rx_ring->netdev);
+ 	struct device *dev = rx_ring->dev;
+-	int size;
++	int size, res;
++
++	/* XDP RX-queue info */
++	if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
++		xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
++	res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,
++			       rx_ring->queue_index, 0);
++	if (res < 0) {
++		dev_err(dev, "Failed to register xdp_rxq index %u\n",
++			rx_ring->queue_index);
++		return res;
++	}
+ 
+ 	size = sizeof(struct igb_rx_buffer) * rx_ring->count;
+ 
+@@ -4375,14 +4386,10 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
+ 
+ 	rx_ring->xdp_prog = adapter->xdp_prog;
+ 
+-	/* XDP RX-queue info */
+-	if (xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,
+-			     rx_ring->queue_index, 0) < 0)
+-		goto err;
+-
+ 	return 0;
+ 
+ err:
++	xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
+ 	vfree(rx_ring->rx_buffer_info);
+ 	rx_ring->rx_buffer_info = NULL;
+ 	dev_err(dev, "Unable to allocate memory for the Rx descriptor ring\n");
+-- 
+2.34.1
+
diff --git a/queue-5.16/igc-avoid-kernel-warning-when-changing-rx-ring-param.patch b/queue-5.16/igc-avoid-kernel-warning-when-changing-rx-ring-param.patch
new file mode 100644
index 00000000000..5ae47eb31a9
--- /dev/null
+++ b/queue-5.16/igc-avoid-kernel-warning-when-changing-rx-ring-param.patch
@@ -0,0 +1,77 @@
+From 1e470bf64f622eeb03ee64eebe2ad960a755ca80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 15:52:58 +0100
+Subject: igc: avoid kernel warning when changing RX ring parameters
+
+From: Corinna Vinschen <vinschen@redhat.com>
+
+[ Upstream commit 453307b569a0d41bddd07f26bf41b784cd82a4c9 ]
+
+Calling ethtool changing the RX ring parameters like this:
+
+  $ ethtool -G eth0 rx 1024
+
+on igc triggers kernel warnings like this:
+
+[  225.198467] ------------[ cut here ]------------
+[  225.198473] Missing unregister, handled but fix driver
+[  225.198485] WARNING: CPU: 7 PID: 959 at net/core/xdp.c:168
+xdp_rxq_info_reg+0x79/0xd0
+[...]
+[  225.198601] Call Trace:
+[  225.198604]  <TASK>
+[  225.198609]  igc_setup_rx_resources+0x3f/0xe0 [igc]
+[  225.198617]  igc_ethtool_set_ringparam+0x30e/0x450 [igc]
+[  225.198626]  ethnl_set_rings+0x18a/0x250
+[  225.198631]  genl_family_rcv_msg_doit+0xca/0x110
+[  225.198637]  genl_rcv_msg+0xce/0x1c0
+[  225.198640]  ? rings_prepare_data+0x60/0x60
+[  225.198644]  ? genl_get_cmd+0xd0/0xd0
+[  225.198647]  netlink_rcv_skb+0x4e/0xf0
+[  225.198652]  genl_rcv+0x24/0x40
+[  225.198655]  netlink_unicast+0x20e/0x330
+[  225.198659]  netlink_sendmsg+0x23f/0x480
+[  225.198663]  sock_sendmsg+0x5b/0x60
+[  225.198667]  __sys_sendto+0xf0/0x160
+[  225.198671]  ? handle_mm_fault+0xb2/0x280
+[  225.198676]  ? do_user_addr_fault+0x1eb/0x690
+[  225.198680]  __x64_sys_sendto+0x20/0x30
+[  225.198683]  do_syscall_64+0x38/0x90
+[  225.198687]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+[  225.198693] RIP: 0033:0x7f7ae38ac3aa
+
+igc_ethtool_set_ringparam() copies the igc_ring structure but neglects to
+reset the xdp_rxq_info member before calling igc_setup_rx_resources().
+This in turn calls xdp_rxq_info_reg() with an already registered xdp_rxq_info.
+
+Make sure to unregister the xdp_rxq_info structure first in
+igc_setup_rx_resources.
+
+Fixes: 73f1071c1d29 ("igc: Add support for XDP_TX action")
+Reported-by: Lennert Buytenhek <buytenh@arista.com>
+Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index a156738dc9b6..0000eae0d729 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -505,6 +505,9 @@ int igc_setup_rx_resources(struct igc_ring *rx_ring)
+ 	u8 index = rx_ring->queue_index;
+ 	int size, desc_len, res;
+ 
++	/* XDP RX-queue info */
++	if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
++		xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
+ 	res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, ndev, index,
+ 			       rx_ring->q_vector->napi.napi_id);
+ 	if (res < 0) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/igc-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch b/queue-5.16/igc-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
new file mode 100644
index 00000000000..3beed280b7a
--- /dev/null
+++ b/queue-5.16/igc-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
@@ -0,0 +1,66 @@
+From 9bc530d464a2419c0108ab50be46861107b22e28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:59 +0100
+Subject: igc: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit f9e61d365bafdee40fe2586fc6be490c3e824dad ]
+
+{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD
++ NET_IP_ALIGN for any skb.
+OTOH, igc_construct_skb_zc() currently allocates and reserves
+additional `xdp->data_meta - xdp->data_hard_start`, which is about
+XDP_PACKET_HEADROOM for XSK frames.
+There's no need for that at all as the frame is post-XDP and will
+go only to the networking stack core.
+Pass the size of the actual data only (+ meta) to
+__napi_alloc_skb() and don't reserve anything. This will give
+enough headroom for stack processing.
+Also, net_prefetch() xdp->data_meta and align the copy size to
+speed-up memcpy() a little and better match igc_construct_skb().
+
+Fixes: fc9df2a0b520 ("igc: Enable RX via AF_XDP zero-copy")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index d83e665b3a4f..a156738dc9b6 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -2435,19 +2435,20 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
+ static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
+ 					    struct xdp_buff *xdp)
+ {
++	unsigned int totalsize = xdp->data_end - xdp->data_meta;
+ 	unsigned int metasize = xdp->data - xdp->data_meta;
+-	unsigned int datasize = xdp->data_end - xdp->data;
+-	unsigned int totalsize = metasize + datasize;
+ 	struct sk_buff *skb;
+ 
+-	skb = __napi_alloc_skb(&ring->q_vector->napi,
+-			       xdp->data_end - xdp->data_hard_start,
++	net_prefetch(xdp->data_meta);
++
++	skb = __napi_alloc_skb(&ring->q_vector->napi, totalsize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, xdp->data_meta - xdp->data_hard_start);
+-	memcpy(__skb_put(skb, totalsize), xdp->data_meta, totalsize);
++	memcpy(__skb_put(skb, totalsize), xdp->data_meta,
++	       ALIGN(totalsize, sizeof(long)));
++
+ 	if (metasize) {
+ 		skb_metadata_set(skb, metasize);
+ 		__skb_pull(skb, metasize);
+-- 
+2.34.1
+
diff --git a/queue-5.16/iio-adc-add-check-for-devm_request_threaded_irq.patch b/queue-5.16/iio-adc-add-check-for-devm_request_threaded_irq.patch
new file mode 100644
index 00000000000..62227f73122
--- /dev/null
+++ b/queue-5.16/iio-adc-add-check-for-devm_request_threaded_irq.patch
@@ -0,0 +1,38 @@
+From a14610c72412fe954d6d7c0b86ba131d88262e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 14:28:49 +0800
+Subject: iio: adc: Add check for devm_request_threaded_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b30537a4cedcacf0ade2f33ebb7610178ed1e7d7 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value and return
+error if fails.
+
+Fixes: fa659a40b80b ("iio: adc: twl6030-gpadc: Use devm_* API family")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220224062849.3280966-1-jiasheng@iscas.ac.cn
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/twl6030-gpadc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
+index afdb59e0b526..d0223e39d59a 100644
+--- a/drivers/iio/adc/twl6030-gpadc.c
++++ b/drivers/iio/adc/twl6030-gpadc.c
+@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev)
+ 	ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				twl6030_gpadc_irq_handler,
+ 				IRQF_ONESHOT, "twl6030_gpadc", indio_dev);
++	if (ret)
++		return ret;
+ 
+ 	ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK);
+ 	if (ret < 0) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch b/queue-5.16/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch
new file mode 100644
index 00000000000..daa546a7ac3
--- /dev/null
+++ b/queue-5.16/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch
@@ -0,0 +1,143 @@
+From 1beb22050b08251c246a05af6ae2e30c4ba4514d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 13:43:35 +0100
+Subject: iio: mma8452: Fix probe failing when an i2c_device_id is used
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a47ac019e7e8129b93a0b991e04b2a59872e053d ]
+
+The mma8452_driver declares both of_match_table and i2c_driver.id_table
+match-tables, but its probe() function only checked for of matches.
+
+Add support for i2c_device_id matches. This fixes the driver not loading
+on some x86 tablets (e.g. the Nextbook Ares 8) where the i2c_client is
+instantiated by platform code using an i2c_device_id.
+
+Drop of_match_ptr() protection to avoid unused warning.
+
+Fixes: c3cdd6e48e35 ("iio: mma8452: refactor for seperating chip specific data")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220208124336.511884-1-hdegoede@redhat.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/mma8452.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index 09c7f10fefb6..21a99467f364 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -176,6 +176,7 @@ static const struct mma8452_event_regs trans_ev_regs = {
+  * @enabled_events:		event flags enabled and handled by this driver
+  */
+ struct mma_chip_info {
++	const char *name;
+ 	u8 chip_id;
+ 	const struct iio_chan_spec *channels;
+ 	int num_channels;
+@@ -1301,6 +1302,7 @@ enum {
+ 
+ static const struct mma_chip_info mma_chip_info_table[] = {
+ 	[mma8451] = {
++		.name = "mma8451",
+ 		.chip_id = MMA8451_DEVICE_ID,
+ 		.channels = mma8451_channels,
+ 		.num_channels = ARRAY_SIZE(mma8451_channels),
+@@ -1325,6 +1327,7 @@ static const struct mma_chip_info mma_chip_info_table[] = {
+ 					MMA8452_INT_FF_MT,
+ 	},
+ 	[mma8452] = {
++		.name = "mma8452",
+ 		.chip_id = MMA8452_DEVICE_ID,
+ 		.channels = mma8452_channels,
+ 		.num_channels = ARRAY_SIZE(mma8452_channels),
+@@ -1341,6 +1344,7 @@ static const struct mma_chip_info mma_chip_info_table[] = {
+ 					MMA8452_INT_FF_MT,
+ 	},
+ 	[mma8453] = {
++		.name = "mma8453",
+ 		.chip_id = MMA8453_DEVICE_ID,
+ 		.channels = mma8453_channels,
+ 		.num_channels = ARRAY_SIZE(mma8453_channels),
+@@ -1357,6 +1361,7 @@ static const struct mma_chip_info mma_chip_info_table[] = {
+ 					MMA8452_INT_FF_MT,
+ 	},
+ 	[mma8652] = {
++		.name = "mma8652",
+ 		.chip_id = MMA8652_DEVICE_ID,
+ 		.channels = mma8652_channels,
+ 		.num_channels = ARRAY_SIZE(mma8652_channels),
+@@ -1366,6 +1371,7 @@ static const struct mma_chip_info mma_chip_info_table[] = {
+ 		.enabled_events = MMA8452_INT_FF_MT,
+ 	},
+ 	[mma8653] = {
++		.name = "mma8653",
+ 		.chip_id = MMA8653_DEVICE_ID,
+ 		.channels = mma8653_channels,
+ 		.num_channels = ARRAY_SIZE(mma8653_channels),
+@@ -1380,6 +1386,7 @@ static const struct mma_chip_info mma_chip_info_table[] = {
+ 		.enabled_events = MMA8452_INT_FF_MT,
+ 	},
+ 	[fxls8471] = {
++		.name = "fxls8471",
+ 		.chip_id = FXLS8471_DEVICE_ID,
+ 		.channels = mma8451_channels,
+ 		.num_channels = ARRAY_SIZE(mma8451_channels),
+@@ -1522,13 +1529,6 @@ static int mma8452_probe(struct i2c_client *client,
+ 	struct mma8452_data *data;
+ 	struct iio_dev *indio_dev;
+ 	int ret;
+-	const struct of_device_id *match;
+-
+-	match = of_match_device(mma8452_dt_ids, &client->dev);
+-	if (!match) {
+-		dev_err(&client->dev, "unknown device model\n");
+-		return -ENODEV;
+-	}
+ 
+ 	indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
+ 	if (!indio_dev)
+@@ -1537,7 +1537,14 @@ static int mma8452_probe(struct i2c_client *client,
+ 	data = iio_priv(indio_dev);
+ 	data->client = client;
+ 	mutex_init(&data->lock);
+-	data->chip_info = match->data;
++
++	data->chip_info = device_get_match_data(&client->dev);
++	if (!data->chip_info && id) {
++		data->chip_info = &mma_chip_info_table[id->driver_data];
++	} else {
++		dev_err(&client->dev, "unknown device model\n");
++		return -ENODEV;
++	}
+ 
+ 	data->vdd_reg = devm_regulator_get(&client->dev, "vdd");
+ 	if (IS_ERR(data->vdd_reg))
+@@ -1581,11 +1588,11 @@ static int mma8452_probe(struct i2c_client *client,
+ 	}
+ 
+ 	dev_info(&client->dev, "registering %s accelerometer; ID 0x%x\n",
+-		 match->compatible, data->chip_info->chip_id);
++		 data->chip_info->name, data->chip_info->chip_id);
+ 
+ 	i2c_set_clientdata(client, indio_dev);
+ 	indio_dev->info = &mma8452_info;
+-	indio_dev->name = id->name;
++	indio_dev->name = data->chip_info->name;
+ 	indio_dev->modes = INDIO_DIRECT_MODE;
+ 	indio_dev->channels = data->chip_info->channels;
+ 	indio_dev->num_channels = data->chip_info->num_channels;
+@@ -1810,7 +1817,7 @@ MODULE_DEVICE_TABLE(i2c, mma8452_id);
+ static struct i2c_driver mma8452_driver = {
+ 	.driver = {
+ 		.name	= "mma8452",
+-		.of_match_table = of_match_ptr(mma8452_dt_ids),
++		.of_match_table = mma8452_dt_ids,
+ 		.pm	= &mma8452_pm_ops,
+ 	},
+ 	.probe = mma8452_probe,
+-- 
+2.34.1
+
diff --git a/queue-5.16/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch b/queue-5.16/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
new file mode 100644
index 00000000000..f6605cf5154
--- /dev/null
+++ b/queue-5.16/io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
@@ -0,0 +1,42 @@
+From 965055ae5f98b9661367e8445d1834ff6405bfb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Mar 2022 17:26:19 -0600
+Subject: io_uring: don't check unrelated req->open.how in accept request
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit adf3a9e9f556613197583a1884f0de40a8bb6fb9 ]
+
+Looks like a victim of too much copy/paste, we should not be looking
+at req->open.how in accept. The point is to check CLOEXEC and error
+out, which we don't invalid direct descriptors on exec. Hence any
+attempt to get a direct descriptor with CLOEXEC is invalid.
+
+No harm is done here, as req->open.how.flags overlaps with
+req->accept.flags, but it's very confusing and might change if either of
+those command structs are modified.
+
+Fixes: aaa4db12ef7b ("io_uring: accept directly into fixed file table")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 783d7380331b..974f6fb327e7 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -5178,8 +5178,7 @@ static int io_accept_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
+ 	accept->nofile = rlimit(RLIMIT_NOFILE);
+ 
+ 	accept->file_slot = READ_ONCE(sqe->file_index);
+-	if (accept->file_slot && ((req->open.how.flags & O_CLOEXEC) ||
+-				  (accept->flags & SOCK_CLOEXEC)))
++	if (accept->file_slot && (accept->flags & SOCK_CLOEXEC))
+ 		return -EINVAL;
+ 	if (accept->flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
+ 		return -EINVAL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/io_uring-terminate-manual-loop-iterator-loop-correct.patch b/queue-5.16/io_uring-terminate-manual-loop-iterator-loop-correct.patch
new file mode 100644
index 00000000000..b2dcc4ad1b6
--- /dev/null
+++ b/queue-5.16/io_uring-terminate-manual-loop-iterator-loop-correct.patch
@@ -0,0 +1,48 @@
+From 2572bf40f65d7fa879d412a65b832f2f0e042ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 11:28:13 -0600
+Subject: io_uring: terminate manual loop iterator loop correctly for non-vecs
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 5e929367468c8f97cd1ffb0417316cecfebef94b ]
+
+The fix for not advancing the iterator if we're using fixed buffers is
+broken in that it can hit a condition where we don't terminate the loop.
+This results in io-wq looping forever, asking to read (or write) 0 bytes
+for every subsequent loop.
+
+Reported-by: Joel Jaeschke <joel.jaeschke@gmail.com>
+Link: https://github.com/axboe/liburing/issues/549
+Fixes: 16c8d2df7ec0 ("io_uring: ensure symmetry in handling iter types in loop_rw_iter()")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 974f6fb327e7..2d25c51b8a5d 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3350,13 +3350,15 @@ static ssize_t loop_rw_iter(int rw, struct io_kiocb *req, struct iov_iter *iter)
+ 				ret = nr;
+ 			break;
+ 		}
++		ret += nr;
+ 		if (!iov_iter_is_bvec(iter)) {
+ 			iov_iter_advance(iter, nr);
+ 		} else {
+-			req->rw.len -= nr;
+ 			req->rw.addr += nr;
++			req->rw.len -= nr;
++			if (!req->rw.len)
++				break;
+ 		}
+-		ret += nr;
+ 		if (nr != iovec.iov_len)
+ 			break;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch b/queue-5.16/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
new file mode 100644
index 00000000000..7334cb71e38
--- /dev/null
+++ b/queue-5.16/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
@@ -0,0 +1,42 @@
+From 51a12feb89972398db13b1824cc213e3b6230b0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jan 2022 10:43:02 +0800
+Subject: iommu/ipmmu-vmsa: Check for error num after setting mask
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 1fdbbfd5099f797a4dac05e7ef0192ba4a9c39b4 ]
+
+Because of the possible failure of the dma_supported(), the
+dma_set_mask_and_coherent() may return error num.
+Therefore, it should be better to check it and return the error if
+fails.
+
+Fixes: 1c894225bf5b ("iommu/ipmmu-vmsa: IPMMU device is 40-bit bus master")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Link: https://lore.kernel.org/r/20220106024302.2574180-1-jiasheng@iscas.ac.cn
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/ipmmu-vmsa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index ca752bdc710f..61bd9a3004ed 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -1006,7 +1006,9 @@ static int ipmmu_probe(struct platform_device *pdev)
+ 	bitmap_zero(mmu->ctx, IPMMU_CTX_MAX);
+ 	mmu->features = of_device_get_match_data(&pdev->dev);
+ 	memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs);
+-	dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
++	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
++	if (ret)
++		return ret;
+ 
+ 	/* Map I/O memory and request IRQ. */
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ionic-correctly-print-aq-errors-if-completions-aren-.patch b/queue-5.16/ionic-correctly-print-aq-errors-if-completions-aren-.patch
new file mode 100644
index 00000000000..bd46f7b3226
--- /dev/null
+++ b/queue-5.16/ionic-correctly-print-aq-errors-if-completions-aren-.patch
@@ -0,0 +1,57 @@
+From a9226a494229d8856029f620767a8de0196b7586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:53:04 -0800
+Subject: ionic: Correctly print AQ errors if completions aren't received
+
+From: Brett Creeley <brett@pensando.io>
+
+[ Upstream commit bc43ed4f35abfdb1d52311110d49b545fccce975 ]
+
+Recent changes went into the driver to allow flexibility when
+printing error messages. Unfortunately this had the unexpected
+consequence of printing confusing messages like the following:
+
+IONIC_CMD_RX_FILTER_ADD (31) failed: IONIC_RC_SUCCESS (-6)
+
+In cases like this the completion of the admin queue command never
+completes, so the completion status is 0, hence IONIC_RC_SUCCESS
+is printed even though the command clearly failed. For example,
+this could happen when the driver tries to add a filter and at
+the same time the FW goes through a reset, so the AQ command
+never completes.
+
+Fix this by forcing the FW completion status to IONIC_RC_ERROR
+in cases where we never get the completion.
+
+Fixes: 8c9d956ab6fb ("ionic: allow adminq requests to override default error message")
+Signed-off-by: Brett Creeley <brett@pensando.io>
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 2e4294a4fa83..a0f9136b2d89 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -322,6 +322,7 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx,
+ 		if (do_msg && !test_bit(IONIC_LIF_F_FW_RESET, lif->state))
+ 			netdev_err(netdev, "Posting of %s (%d) failed: %d\n",
+ 				   name, ctx->cmd.cmd.opcode, err);
++		ctx->comp.comp.status = IONIC_RC_ERROR;
+ 		return err;
+ 	}
+ 
+@@ -340,6 +341,7 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx,
+ 			if (do_msg)
+ 				netdev_err(netdev, "%s (%d) interrupted, FW in reset\n",
+ 					   name, ctx->cmd.cmd.opcode);
++			ctx->comp.comp.status = IONIC_RC_ERROR;
+ 			return -ENXIO;
+ 		}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ionic-don-t-send-reset-commands-if-fw-isn-t-running.patch b/queue-5.16/ionic-don-t-send-reset-commands-if-fw-isn-t-running.patch
new file mode 100644
index 00000000000..99a0eeed832
--- /dev/null
+++ b/queue-5.16/ionic-don-t-send-reset-commands-if-fw-isn-t-running.patch
@@ -0,0 +1,131 @@
+From e63f60954aa3adfb4f47f474665fbc5c097b5c93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:53:00 -0800
+Subject: ionic: Don't send reset commands if FW isn't running
+
+From: Brett Creeley <brett@pensando.io>
+
+[ Upstream commit b8fd0271dad00b953caaabe73474788d3d19e252 ]
+
+It's possible the FW is already shutting down while the driver is being
+removed and/or when the driver is going through reset. This can cause
+unexpected/unnecessary errors to be printed:
+
+eth0: DEV_CMD IONIC_CMD_PORT_RESET (12) error, IONIC_RC_ERROR (29) failed
+eth1: DEV_CMD IONIC_CMD_RESET (3) error, IONIC_RC_ERROR (29) failed
+
+Fix this by checking the FW status register before issuing the reset
+commands.
+
+Also, since err may not be assigned in ionic_port_reset(), assign it a
+default value of 0, and remove an unnecessary log message.
+
+Fixes: fbfb8031533c ("ionic: Add hardware init and device commands")
+Signed-off-by: Brett Creeley <brett@pensando.io>
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_dev.c    | 17 ++++++++++++-----
+ .../net/ethernet/pensando/ionic/ionic_dev.h    |  1 +
+ .../net/ethernet/pensando/ionic/ionic_main.c   | 18 ++++++++++--------
+ 3 files changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+index 4044c630f8b4..2c7ce820a1fa 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+@@ -129,6 +129,16 @@ int ionic_dev_setup(struct ionic *ionic)
+ }
+ 
+ /* Devcmd Interface */
++bool ionic_is_fw_running(struct ionic_dev *idev)
++{
++	u8 fw_status = ioread8(&idev->dev_info_regs->fw_status);
++
++	/* firmware is useful only if the running bit is set and
++	 * fw_status != 0xff (bad PCI read)
++	 */
++	return (fw_status != 0xff) && (fw_status & IONIC_FW_STS_F_RUNNING);
++}
++
+ int ionic_heartbeat_check(struct ionic *ionic)
+ {
+ 	struct ionic_dev *idev = &ionic->idev;
+@@ -152,13 +162,10 @@ int ionic_heartbeat_check(struct ionic *ionic)
+ 		goto do_check_time;
+ 	}
+ 
+-	/* firmware is useful only if the running bit is set and
+-	 * fw_status != 0xff (bad PCI read)
+-	 * If fw_status is not ready don't bother with the generation.
+-	 */
+ 	fw_status = ioread8(&idev->dev_info_regs->fw_status);
+ 
+-	if (fw_status == 0xff || !(fw_status & IONIC_FW_STS_F_RUNNING)) {
++	/* If fw_status is not ready don't bother with the generation */
++	if (!ionic_is_fw_running(idev)) {
+ 		fw_status_ready = false;
+ 	} else {
+ 		fw_generation = fw_status & IONIC_FW_STS_F_GENERATION;
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+index e5acf3bd62b2..73b950ac1272 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+@@ -353,5 +353,6 @@ void ionic_q_rewind(struct ionic_queue *q, struct ionic_desc_info *start);
+ void ionic_q_service(struct ionic_queue *q, struct ionic_cq_info *cq_info,
+ 		     unsigned int stop_index);
+ int ionic_heartbeat_check(struct ionic *ionic);
++bool ionic_is_fw_running(struct ionic_dev *idev);
+ 
+ #endif /* _IONIC_DEV_H_ */
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index a89ad768e4a0..a548f2a01806 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -540,6 +540,9 @@ int ionic_reset(struct ionic *ionic)
+ 	struct ionic_dev *idev = &ionic->idev;
+ 	int err;
+ 
++	if (!ionic_is_fw_running(idev))
++		return 0;
++
+ 	mutex_lock(&ionic->dev_cmd_lock);
+ 	ionic_dev_cmd_reset(idev);
+ 	err = ionic_dev_cmd_wait(ionic, DEVCMD_TIMEOUT);
+@@ -612,15 +615,17 @@ int ionic_port_init(struct ionic *ionic)
+ int ionic_port_reset(struct ionic *ionic)
+ {
+ 	struct ionic_dev *idev = &ionic->idev;
+-	int err;
++	int err = 0;
+ 
+ 	if (!idev->port_info)
+ 		return 0;
+ 
+-	mutex_lock(&ionic->dev_cmd_lock);
+-	ionic_dev_cmd_port_reset(idev);
+-	err = ionic_dev_cmd_wait(ionic, DEVCMD_TIMEOUT);
+-	mutex_unlock(&ionic->dev_cmd_lock);
++	if (ionic_is_fw_running(idev)) {
++		mutex_lock(&ionic->dev_cmd_lock);
++		ionic_dev_cmd_port_reset(idev);
++		err = ionic_dev_cmd_wait(ionic, DEVCMD_TIMEOUT);
++		mutex_unlock(&ionic->dev_cmd_lock);
++	}
+ 
+ 	dma_free_coherent(ionic->dev, idev->port_info_sz,
+ 			  idev->port_info, idev->port_info_pa);
+@@ -628,9 +633,6 @@ int ionic_port_reset(struct ionic *ionic)
+ 	idev->port_info = NULL;
+ 	idev->port_info_pa = 0;
+ 
+-	if (err)
+-		dev_err(ionic->dev, "Failed to reset port\n");
+-
+ 	return err;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch b/queue-5.16/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch
new file mode 100644
index 00000000000..3d3dd2d7547
--- /dev/null
+++ b/queue-5.16/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch
@@ -0,0 +1,51 @@
+From 9e3e2a3b7a881e7960a304a3f57298423a23cca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:52:57 -0800
+Subject: ionic: fix type complaint in ionic_dev_cmd_clean()
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit bc0bf9de6f48268f4ee59e57fb42ac751be3ecda ]
+
+Sparse seems to have gotten a little more picky lately and
+we need to revisit this bit of code to make sparse happy.
+
+warning: incorrect type in initializer (different address spaces)
+   expected union ionic_dev_cmd_regs *regs
+   got union ionic_dev_cmd_regs [noderef] __iomem *dev_cmd_regs
+warning: incorrect type in argument 2 (different address spaces)
+   expected void [noderef] __iomem *
+   got unsigned int *
+warning: incorrect type in argument 1 (different address spaces)
+   expected void volatile [noderef] __iomem *
+   got union ionic_dev_cmd *
+
+Fixes: d701ec326a31 ("ionic: clean up sparse complaints")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 875f4ec42efe..a89ad768e4a0 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -370,10 +370,10 @@ int ionic_adminq_post_wait_nomsg(struct ionic_lif *lif, struct ionic_admin_ctx *
+ 
+ static void ionic_dev_cmd_clean(struct ionic *ionic)
+ {
+-	union __iomem ionic_dev_cmd_regs *regs = ionic->idev.dev_cmd_regs;
++	struct ionic_dev *idev = &ionic->idev;
+ 
+-	iowrite32(0, &regs->doorbell);
+-	memset_io(&regs->cmd, 0, sizeof(regs->cmd));
++	iowrite32(0, &idev->dev_cmd_regs->doorbell);
++	memset_io(&idev->dev_cmd_regs->cmd, 0, sizeof(idev->dev_cmd_regs->cmd));
+ }
+ 
+ int ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds)
+-- 
+2.34.1
+
diff --git a/queue-5.16/ionic-fix-up-printing-of-timeout-error.patch b/queue-5.16/ionic-fix-up-printing-of-timeout-error.patch
new file mode 100644
index 00000000000..ff9af526800
--- /dev/null
+++ b/queue-5.16/ionic-fix-up-printing-of-timeout-error.patch
@@ -0,0 +1,43 @@
+From 76099a80f810cb353dd26ed5bba7afe1bff1d81f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:53:03 -0800
+Subject: ionic: fix up printing of timeout error
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 4cc787bd88be6974f3362fa49fd8c5609bd039b8 ]
+
+Make sure we print the TIMEOUT string if we had a timeout
+error, rather than printing the wrong status.
+
+Fixes: 8c9d956ab6fb ("ionic: allow adminq requests to override default error message")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_main.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index a548f2a01806..2e4294a4fa83 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -215,9 +215,13 @@ static void ionic_adminq_flush(struct ionic_lif *lif)
+ void ionic_adminq_netdev_err_print(struct ionic_lif *lif, u8 opcode,
+ 				   u8 status, int err)
+ {
++	const char *stat_str;
++
++	stat_str = (err == -ETIMEDOUT) ? "TIMEOUT" :
++					 ionic_error_to_str(status);
++
+ 	netdev_err(lif->netdev, "%s (%d) failed: %s (%d)\n",
+-		   ionic_opcode_to_str(opcode), opcode,
+-		   ionic_error_to_str(status), err);
++		   ionic_opcode_to_str(opcode), opcode, stat_str, err);
+ }
+ 
+ static int ionic_adminq_check_err(struct ionic_lif *lif,
+-- 
+2.34.1
+
diff --git a/queue-5.16/ionic-start-watchdog-after-all-is-setup.patch b/queue-5.16/ionic-start-watchdog-after-all-is-setup.patch
new file mode 100644
index 00000000000..893cebe370a
--- /dev/null
+++ b/queue-5.16/ionic-start-watchdog-after-all-is-setup.patch
@@ -0,0 +1,62 @@
+From 94cfdef9b401d3c9f6b45b10e74ebfb64a2c6b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:52:58 -0800
+Subject: ionic: start watchdog after all is setup
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 9ad2939a1525962a79a2fd974ec7e3a71455b964 ]
+
+The watchdog expects the lif to fully exist when it goes off,
+so lets not start the watchdog until all is ready in case there
+is some quirky time dialation that makes probe take multiple
+seconds.
+
+Fixes: 089406bc5ad6 ("ionic: add a watchdog timer to monitor heartbeat")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 4 +++-
+ drivers/net/ethernet/pensando/ionic/ionic_dev.c     | 3 ---
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+index 7e296fa71b36..40fa5bce2ac2 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+@@ -331,6 +331,9 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		goto err_out_deregister_lifs;
+ 	}
+ 
++	mod_timer(&ionic->watchdog_timer,
++		  round_jiffies(jiffies + ionic->watchdog_period));
++
+ 	return 0;
+ 
+ err_out_deregister_lifs:
+@@ -348,7 +351,6 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_out_reset:
+ 	ionic_reset(ionic);
+ err_out_teardown:
+-	del_timer_sync(&ionic->watchdog_timer);
+ 	pci_clear_master(pdev);
+ 	/* Don't fail the probe for these errors, keep
+ 	 * the hw interface around for inspection
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+index d57e80d44c9d..4044c630f8b4 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+@@ -122,9 +122,6 @@ int ionic_dev_setup(struct ionic *ionic)
+ 	idev->fw_generation = IONIC_FW_STS_F_GENERATION &
+ 			      ioread8(&idev->dev_info_regs->fw_status);
+ 
+-	mod_timer(&ionic->watchdog_timer,
+-		  round_jiffies(jiffies + ionic->watchdog_period));
+-
+ 	idev->db_pages = bar->vaddr;
+ 	idev->phy_db_pages = bar->bus_addr;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch b/queue-5.16/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch
new file mode 100644
index 00000000000..4009c73b804
--- /dev/null
+++ b/queue-5.16/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch
@@ -0,0 +1,115 @@
+From 02fc6e3612dd0a89f8beea984b3104053a648aea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 13:45:09 +0100
+Subject: ipv4: Fix route lookups when handling ICMP redirects and PMTU updates
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 544b4dd568e3b09c1ab38a759d3187e7abda11a0 ]
+
+The PMTU update and ICMP redirect helper functions initialise their fl4
+variable with either __build_flow_key() or build_sk_flow_key(). These
+initialisation functions always set ->flowi4_scope with
+RT_SCOPE_UNIVERSE and might set the ECN bits of ->flowi4_tos. This is
+not a problem when the route lookup is later done via
+ip_route_output_key_hash(), which properly clears the ECN bits from
+->flowi4_tos and initialises ->flowi4_scope based on the RTO_ONLINK
+flag. However, some helpers call fib_lookup() directly, without
+sanitising the tos and scope fields, so the route lookup can fail and,
+as a result, the ICMP redirect or PMTU update aren't taken into
+account.
+
+Fix this by extracting the ->flowi4_tos and ->flowi4_scope sanitisation
+code into ip_rt_fix_tos(), then use this function in handlers that call
+fib_lookup() directly.
+
+Note 1: We can't sanitise ->flowi4_tos and ->flowi4_scope in a central
+place (like __build_flow_key() or flowi4_init_output()), because
+ip_route_output_key_hash() expects non-sanitised values. When called
+with sanitised values, it can erroneously overwrite RT_SCOPE_LINK with
+RT_SCOPE_UNIVERSE in ->flowi4_scope. Therefore we have to be careful to
+sanitise the values only for those paths that don't call
+ip_route_output_key_hash().
+
+Note 2: The problem is mostly about sanitising ->flowi4_tos. Having
+->flowi4_scope initialised with RT_SCOPE_UNIVERSE instead of
+RT_SCOPE_LINK probably wasn't really a problem: sockets with the
+SOCK_LOCALROUTE flag set (those that'd result in RTO_ONLINK being set)
+normally shouldn't receive ICMP redirects or PMTU updates.
+
+Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 2c30c599cc16..750e229b7c49 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -498,6 +498,15 @@ void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
+ }
+ EXPORT_SYMBOL(__ip_select_ident);
+ 
++static void ip_rt_fix_tos(struct flowi4 *fl4)
++{
++	__u8 tos = RT_FL_TOS(fl4);
++
++	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
++	fl4->flowi4_scope = tos & RTO_ONLINK ?
++			    RT_SCOPE_LINK : RT_SCOPE_UNIVERSE;
++}
++
+ static void __build_flow_key(const struct net *net, struct flowi4 *fl4,
+ 			     const struct sock *sk,
+ 			     const struct iphdr *iph,
+@@ -823,6 +832,7 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf
+ 	rt = (struct rtable *) dst;
+ 
+ 	__build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
++	ip_rt_fix_tos(&fl4);
+ 	__ip_do_redirect(rt, skb, &fl4, true);
+ }
+ 
+@@ -1047,6 +1057,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+ 	struct flowi4 fl4;
+ 
+ 	ip_rt_build_flow_key(&fl4, sk, skb);
++	ip_rt_fix_tos(&fl4);
+ 
+ 	/* Don't make lookup fail for bridged encapsulations */
+ 	if (skb && netif_is_any_bridge_port(skb->dev))
+@@ -1121,6 +1132,8 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
+ 			goto out;
+ 
+ 		new = true;
++	} else {
++		ip_rt_fix_tos(&fl4);
+ 	}
+ 
+ 	__ip_rt_update_pmtu((struct rtable *)xfrm_dst_path(&rt->dst), &fl4, mtu);
+@@ -2601,7 +2614,6 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
+ struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
+ 					const struct sk_buff *skb)
+ {
+-	__u8 tos = RT_FL_TOS(fl4);
+ 	struct fib_result res = {
+ 		.type		= RTN_UNSPEC,
+ 		.fi		= NULL,
+@@ -2611,9 +2623,7 @@ struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
+ 	struct rtable *rth;
+ 
+ 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
+-	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
+-	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
+-			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
++	ip_rt_fix_tos(fl4);
+ 
+ 	rcu_read_lock();
+ 	rth = ip_route_output_key_hash_rcu(net, fl4, &res, skb);
+-- 
+2.34.1
+
diff --git a/queue-5.16/irqchip-nvic-release-nvic_base-upon-failure.patch b/queue-5.16/irqchip-nvic-release-nvic_base-upon-failure.patch
new file mode 100644
index 00000000000..cbbbd6be9f8
--- /dev/null
+++ b/queue-5.16/irqchip-nvic-release-nvic_base-upon-failure.patch
@@ -0,0 +1,50 @@
+From 13c14092b7b06dc3da0a0f72fed53563bb285bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 22:03:03 +0530
+Subject: irqchip/nvic: Release nvic_base upon failure
+
+From: Souptick Joarder (HPE) <jrdr.linux@gmail.com>
+
+[ Upstream commit e414c25e3399b2b3d7337dc47abccab5c71b7c8f ]
+
+smatch warning was reported as below ->
+
+smatch warnings:
+drivers/irqchip/irq-nvic.c:131 nvic_of_init()
+warn: 'nvic_base' not released on lines: 97.
+
+Release nvic_base upon failure.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Souptick Joarder (HPE) <jrdr.linux@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220218163303.33344-1-jrdr.linux@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-nvic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c
+index ba4759b3e269..94230306e0ee 100644
+--- a/drivers/irqchip/irq-nvic.c
++++ b/drivers/irqchip/irq-nvic.c
+@@ -107,6 +107,7 @@ static int __init nvic_of_init(struct device_node *node,
+ 
+ 	if (!nvic_irq_domain) {
+ 		pr_warn("Failed to allocate irq domain\n");
++		iounmap(nvic_base);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -116,6 +117,7 @@ static int __init nvic_of_init(struct device_node *node,
+ 	if (ret) {
+ 		pr_warn("Failed to allocate irq chips\n");
+ 		irq_domain_remove(nvic_irq_domain);
++		iounmap(nvic_base);
+ 		return ret;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/irqchip-qcom-pdc-fix-broken-locking.patch b/queue-5.16/irqchip-qcom-pdc-fix-broken-locking.patch
new file mode 100644
index 00000000000..f5189698189
--- /dev/null
+++ b/queue-5.16/irqchip-qcom-pdc-fix-broken-locking.patch
@@ -0,0 +1,56 @@
+From 60dbf3d1cfab79e823782d6a6a6ed5866cf69b43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:12:25 +0000
+Subject: irqchip/qcom-pdc: Fix broken locking
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit a6aca2f460e203781dc41391913cc5b54f4bc0ce ]
+
+pdc_enable_intr() serves as a primitive to qcom_pdc_gic_{en,dis}able,
+and has a raw spinlock for mutual exclusion, which is uses with
+interruptible primitives.
+
+This means that this critical section can itself be interrupted.
+Should the interrupt also be a PDC interrupt, and the endpoint driver
+perform an irq_disable() on that interrupt, we end-up in a deadlock.
+
+Fix this by using the irqsave/irqrestore variants of the locking
+primitives.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Maulik Shah <quic_mkshah@quicinc.com>
+Link: https://lore.kernel.org/r/20220224101226.88373-5-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/qcom-pdc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index 173e6520e06e..c0b457f26ec4 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -56,17 +56,18 @@ static u32 pdc_reg_read(int reg, u32 i)
+ static void pdc_enable_intr(struct irq_data *d, bool on)
+ {
+ 	int pin_out = d->hwirq;
++	unsigned long flags;
+ 	u32 index, mask;
+ 	u32 enable;
+ 
+ 	index = pin_out / 32;
+ 	mask = pin_out % 32;
+ 
+-	raw_spin_lock(&pdc_lock);
++	raw_spin_lock_irqsave(&pdc_lock, flags);
+ 	enable = pdc_reg_read(IRQ_ENABLE_BANK, index);
+ 	enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask);
+ 	pdc_reg_write(IRQ_ENABLE_BANK, index, enable);
+-	raw_spin_unlock(&pdc_lock);
++	raw_spin_unlock_irqrestore(&pdc_lock, flags);
+ }
+ 
+ static void qcom_pdc_gic_disable(struct irq_data *d)
+-- 
+2.34.1
+
diff --git a/queue-5.16/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch b/queue-5.16/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
new file mode 100644
index 00000000000..d96d9192d28
--- /dev/null
+++ b/queue-5.16/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
@@ -0,0 +1,123 @@
+From 4b085c298ae1c3085e9efbfcaeb7a44cb4e7e457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Mar 2022 12:29:11 +0100
+Subject: ivtv: fix incorrect device_caps for ivtvfb
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 25e94139218c0293b4375233c14f2256d7dcfaa8 ]
+
+The VIDIOC_G_FBUF and related overlay ioctls no longer worked (-ENOTTY was
+returned).
+
+The root cause was the introduction of the caps field in ivtv-driver.h.
+While loading the ivtvfb module would update the video_device device_caps
+field with V4L2_CAP_VIDEO_OUTPUT_OVERLAY it would not update that caps
+field, and that's what the overlay ioctls would look at.
+
+It's a bad idea to keep information in two places, so drop the caps field
+and only use vdev.device_caps.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Martin Dauskardt <martin.dauskardt@gmx.de>
+Fixes: 2161536516ed (media: media/pci: set device_caps in struct video_device)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-driver.h  |  1 -
+ drivers/media/pci/ivtv/ivtv-ioctl.c   | 10 +++++-----
+ drivers/media/pci/ivtv/ivtv-streams.c | 11 ++++-------
+ 3 files changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index 4cf92dee6527..ce3a7ca51736 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -330,7 +330,6 @@ struct ivtv_stream {
+ 	struct ivtv *itv;		/* for ease of use */
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+-	u32 caps;			/* V4L2 capabilities */
+ 
+ 	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
+ 	spinlock_t qlock;		/* locks access to the queues */
+diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c
+index 0cdf6b3210c2..fee460e2ca86 100644
+--- a/drivers/media/pci/ivtv/ivtv-ioctl.c
++++ b/drivers/media/pci/ivtv/ivtv-ioctl.c
+@@ -438,7 +438,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 	struct v4l2_window *winfmt = &fmt->fmt.win;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -EINVAL;
+ 	if (!itv->osd_video_pbase)
+ 		return -EINVAL;
+@@ -549,7 +549,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2
+ 	u32 chromakey = fmt->fmt.win.chromakey;
+ 	u8 global_alpha = fmt->fmt.win.global_alpha;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -EINVAL;
+ 	if (!itv->osd_video_pbase)
+ 		return -EINVAL;
+@@ -1383,7 +1383,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb)
+ 		0,
+ 	};
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+@@ -1450,7 +1450,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 	struct yuv_playback_info *yi = &itv->yuv_info;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+@@ -1470,7 +1470,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on)
+ 	struct ivtv *itv = id->itv;
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c
+index 6e455948cc77..13d7d55e6594 100644
+--- a/drivers/media/pci/ivtv/ivtv-streams.c
++++ b/drivers/media/pci/ivtv/ivtv-streams.c
+@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type)
+ 	s->itv = itv;
+ 	s->type = type;
+ 	s->name = ivtv_stream_info[type].name;
+-	s->caps = ivtv_stream_info[type].v4l2_caps;
++	s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps;
+ 
+ 	if (ivtv_stream_info[type].pio)
+ 		s->dma = DMA_NONE;
+@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type)
+ 		if (s_mpg->vdev.v4l2_dev)
+ 			num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset;
+ 	}
+-	s->vdev.device_caps = s->caps;
+-	if (itv->osd_video_pbase) {
+-		itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |=
+-			V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+-		itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |=
+-			V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
++	if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV ||
++				     type == IVTV_DEC_STREAM_TYPE_MPG)) {
++		s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+ 		itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+ 	}
+ 	video_set_drvdata(&s->vdev, s);
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-fix-eio-error-code-that-is-never-returned.patch b/queue-5.16/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
new file mode 100644
index 00000000000..7a65cb49af3
--- /dev/null
+++ b/queue-5.16/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
@@ -0,0 +1,39 @@
+From 1010d645b9a35458331c509623551a2c0572338f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 11:46:58 +0100
+Subject: iwlwifi: Fix -EIO error code that is never returned
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c305c94bdc18e45b5ad1db54da4269f8cbfdff6b ]
+
+Currently the error -EIO is being assinged to variable ret when
+the READY_BIT is not set but the function iwlagn_mac_start returns
+0 rather than ret. Fix this by returning ret instead of 0.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 7335613ae27a ("iwlwifi: move all mac80211 related functions to one place")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210907104658.14706-1-colin.king@canonical.com
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+index 754876cd27ce..e8bd4f0e3d2d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -299,7 +299,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw)
+ 
+ 	priv->is_open = 1;
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+-	return 0;
++	return ret;
+ }
+ 
+ static void iwlagn_mac_stop(struct ieee80211_hw *hw)
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-mvm-align-locking-in-d3-test-debugfs.patch b/queue-5.16/iwlwifi-mvm-align-locking-in-d3-test-debugfs.patch
new file mode 100644
index 00000000000..dc351606eff
--- /dev/null
+++ b/queue-5.16/iwlwifi-mvm-align-locking-in-d3-test-debugfs.patch
@@ -0,0 +1,53 @@
+From b6916dc1c317f5ece0c5abbe31680f353f4b8d80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 13:16:16 +0200
+Subject: iwlwifi: mvm: align locking in D3 test debugfs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 59e1221f470c2e5d2f2d4c95153edd577a7071c5 ]
+
+Since commit a05829a7222e ("cfg80211: avoid holding the RTNL when
+calling the driver") we're not only holding the RTNL when going
+in and out of suspend, but also the wiphy->mtx. Add that to the
+D3 test debugfs in iwlwifi since it's required for various calls
+to mac80211.
+
+Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220129105618.fcec0204e162.Ib73bf787ab4d83581de20eb89b1f8dbfcaaad0e3@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index a19f646a324f..75e9776001b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -2566,7 +2566,9 @@ static int iwl_mvm_d3_test_open(struct inode *inode, struct file *file)
+ 
+ 	/* start pseudo D3 */
+ 	rtnl_lock();
++	wiphy_lock(mvm->hw->wiphy);
+ 	err = __iwl_mvm_suspend(mvm->hw, mvm->hw->wiphy->wowlan_config, true);
++	wiphy_unlock(mvm->hw->wiphy);
+ 	rtnl_unlock();
+ 	if (err > 0)
+ 		err = -EINVAL;
+@@ -2622,7 +2624,9 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
+ 	iwl_fw_dbg_read_d3_debug_data(&mvm->fwrt);
+ 
+ 	rtnl_lock();
++	wiphy_lock(mvm->hw->wiphy);
+ 	__iwl_mvm_resume(mvm, true);
++	wiphy_unlock(mvm->hw->wiphy);
+ 	rtnl_unlock();
+ 
+ 	iwl_mvm_resume_tcm(mvm);
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch b/queue-5.16/iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch
new file mode 100644
index 00000000000..d97bdf1ef5d
--- /dev/null
+++ b/queue-5.16/iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch
@@ -0,0 +1,52 @@
+From c217d83b9b5fa22f47d04558f514c26ab9936b8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jan 2022 12:40:24 +0100
+Subject: iwlwifi: mvm: Don't call iwl_mvm_sta_from_mac80211() with NULL sta
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 30d17c12b0895e15ce22ebc1f52a4ff02df6dbc6 ]
+
+The recent fix for NULL sta in iwl_mvm_get_tx_rate() still has a call
+of iwl_mvm_sta_from_mac80211() that may be called with NULL sta.
+Although this practically only points to the address and the actual
+access doesn't happen due to the conditional evaluation at a later
+point, it looks a bit flaky.
+
+This patch drops the temporary variable above and evaluates
+iwm_mvm_sta_from_mac80211() directly for avoiding confusions.
+
+Fixes: d599f714b73e ("iwlwifi: mvm: don't crash on invalid rate w/o STA")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20220121114024.10454-1-tiwai@suse.de
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 0f96d422d6e0..bbd394a7b531 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -272,15 +272,14 @@ static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm,
+ 
+ 	/* info->control is only relevant for non HW rate control */
+ 	if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) {
+-		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+-
+ 		/* HT rate doesn't make sense for a non data frame */
+ 		WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS &&
+ 			  !ieee80211_is_data(fc),
+ 			  "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n",
+ 			  info->control.rates[0].flags,
+ 			  info->control.rates[0].idx,
+-			  le16_to_cpu(fc), sta ? mvmsta->sta_state : -1);
++			  le16_to_cpu(fc),
++			  sta ? iwl_mvm_sta_from_mac80211(sta)->sta_state : -1);
+ 
+ 		rate_idx = info->control.rates[0].idx;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-mvm-don-t-iterate-unadded-vifs-when-handling.patch b/queue-5.16/iwlwifi-mvm-don-t-iterate-unadded-vifs-when-handling.patch
new file mode 100644
index 00000000000..5fb7b25548a
--- /dev/null
+++ b/queue-5.16/iwlwifi-mvm-don-t-iterate-unadded-vifs-when-handling.patch
@@ -0,0 +1,42 @@
+From d8fca83fff4fabeff6bf33b6c06f10387c6d2bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 13:16:15 +0200
+Subject: iwlwifi: mvm: don't iterate unadded vifs when handling FW SMPS req
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 8a265d1a619c16400406c9d598411850ee104aed ]
+
+We may not have all the interfaces added to the driver when we get the
+THERMAL_DUAL_CHAIN_REQUEST notification from the FW, so instead of
+iterating all vifs to update SMPS, iterate only the ones that are
+already assigned.  The interfaces that were not assigned yet, will be
+updated accordingly when we start using them.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220129105618.9416aade2ba0.I0b71142f89e3f158aa058a1dfb2517c8c1fa3726@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 364f6aefae81..5b7d89e33431 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -237,7 +237,8 @@ static void iwl_mvm_rx_thermal_dual_chain_req(struct iwl_mvm *mvm,
+ 	 */
+ 	mvm->fw_static_smps_request =
+ 		req->event == cpu_to_le32(THERMAL_DUAL_CHAIN_REQ_DISABLE);
+-	ieee80211_iterate_interfaces(mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
++	ieee80211_iterate_interfaces(mvm->hw,
++				     IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER,
+ 				     iwl_mvm_intf_dual_chain_req, NULL);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch b/queue-5.16/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
new file mode 100644
index 00000000000..58c5c8669ea
--- /dev/null
+++ b/queue-5.16/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
@@ -0,0 +1,39 @@
+From caf8eae749b784118351e73c5431be51bb8707f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:39:30 +0300
+Subject: iwlwifi: mvm: Fix an error code in iwl_mvm_up()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 583d18336abdfb1b355270289ff8f6a2608ba905 ]
+
+Return -ENODEV instead of success on this error path.
+
+Fixes: dd36a507c806 ("iwlwifi: mvm: look for the first supported channel when add/remove phy ctxt")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210816183930.GA2068@kili
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 58d5395acf73..6d17d7a71182 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1553,8 +1553,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ 	while (!sband && i < NUM_NL80211_BANDS)
+ 		sband = mvm->hw->wiphy->bands[i++];
+ 
+-	if (WARN_ON_ONCE(!sband))
++	if (WARN_ON_ONCE(!sband)) {
++		ret = -ENODEV;
+ 		goto error;
++	}
+ 
+ 	chan = &sband->channels[0];
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-pcie-fix-sw-error-msi-x-mapping.patch b/queue-5.16/iwlwifi-pcie-fix-sw-error-msi-x-mapping.patch
new file mode 100644
index 00000000000..6d1f60b16c8
--- /dev/null
+++ b/queue-5.16/iwlwifi-pcie-fix-sw-error-msi-x-mapping.patch
@@ -0,0 +1,38 @@
+From 7540daf3c5b53b2f26b5874957d63f029b9cca09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 13:21:24 +0200
+Subject: iwlwifi: pcie: fix SW error MSI-X mapping
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 7b9f485091a5755f6e0a7dd3725f3b312768ecd0 ]
+
+We need to also update the IVAR location, since we've shifted
+the bit.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: 571836a02c7b ("iwlwifi: pcie: update sw error interrupt for BZ family")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220304131517.bcfb28484e50.I921df6b5134785d7eeb0c934e4a43157c582fa79@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 3b38c426575b..39cd7dfea78f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1084,7 +1084,7 @@ static const struct iwl_causes_list causes_list_pre_bz[] = {
+ };
+ 
+ static const struct iwl_causes_list causes_list_bz[] = {
+-	{MSIX_HW_INT_CAUSES_REG_SW_ERR_BZ,	CSR_MSIX_HW_INT_MASK_AD, 0x29},
++	{MSIX_HW_INT_CAUSES_REG_SW_ERR_BZ,	CSR_MSIX_HW_INT_MASK_AD, 0x15},
+ };
+ 
+ static void iwl_pcie_map_list(struct iwl_trans *trans,
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-yoyo-avoid-using-dram-data-if-allocation-fai.patch b/queue-5.16/iwlwifi-yoyo-avoid-using-dram-data-if-allocation-fai.patch
new file mode 100644
index 00000000000..9add6714adc
--- /dev/null
+++ b/queue-5.16/iwlwifi-yoyo-avoid-using-dram-data-if-allocation-fai.patch
@@ -0,0 +1,53 @@
+From ceb2fe7de7296388afe49501c48668627d78ad42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Feb 2022 12:25:01 +0200
+Subject: iwlwifi: yoyo: Avoid using dram data if allocation failed
+
+From: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
+
+[ Upstream commit e2d53d10ef666859517360e711fd7761e7e984ce ]
+
+The config set TLV setting depend on dram allocation
+and if allocation failed the data used in config set tlv
+should not set this.
+Adding the check if dram fragment is available or not.
+
+Signed-off-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
+Fixes: 1a5daead217c ("iwlwifi: yoyo: support for ROM usniffer")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220204122220.44835d181528.I3e78ba29c13bbeada017fcb2a620f3552c1dfa30@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 7ab98b419cc1..d412b6d0b28e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -849,11 +849,18 @@ static void iwl_dbg_tlv_apply_config(struct iwl_fw_runtime *fwrt,
+ 		case IWL_FW_INI_CONFIG_SET_TYPE_DBGC_DRAM_ADDR: {
+ 			struct iwl_dbgc1_info dram_info = {};
+ 			struct iwl_dram_data *frags = &fwrt->trans->dbg.fw_mon_ini[1].frags[0];
+-			__le64 dram_base_addr = cpu_to_le64(frags->physical);
+-			__le32 dram_size = cpu_to_le32(frags->size);
+-			u64  dram_addr = le64_to_cpu(dram_base_addr);
++			__le64 dram_base_addr;
++			__le32 dram_size;
++			u64 dram_addr;
+ 			u32 ret;
+ 
++			if (!frags)
++				break;
++
++			dram_base_addr = cpu_to_le64(frags->physical);
++			dram_size = cpu_to_le32(frags->size);
++			dram_addr = le64_to_cpu(dram_base_addr);
++
+ 			IWL_DEBUG_FW(fwrt, "WRT: dram_base_addr 0x%016llx, dram_size 0x%x\n",
+ 				     dram_base_addr, dram_size);
+ 			IWL_DEBUG_FW(fwrt, "WRT: config_list->addr_offset: %u\n",
+-- 
+2.34.1
+
diff --git a/queue-5.16/iwlwifi-yoyo-remove-dbgi_sram-address-reset-writing.patch b/queue-5.16/iwlwifi-yoyo-remove-dbgi_sram-address-reset-writing.patch
new file mode 100644
index 00000000000..912b6801355
--- /dev/null
+++ b/queue-5.16/iwlwifi-yoyo-remove-dbgi_sram-address-reset-writing.patch
@@ -0,0 +1,55 @@
+From af612d7050abee681812f33783b786a99487afe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 13:16:21 +0200
+Subject: iwlwifi: yoyo: remove DBGI_SRAM address reset writing
+
+From: Rotem Saado <rotem.saado@intel.com>
+
+[ Upstream commit ce014c9861544bb4e789323d0d8956a5ad262e25 ]
+
+Due to preg protection we cannot write to this register
+while FW is running (when FW in Halt it is ok).
+since we have some cases that we need to dump this
+region while FW is running remove this writing from DRV.
+FW will do this writing.
+
+Signed-off-by: Rotem Saado <rotem.saado@intel.com>
+Fixes: 89639e06d0f3 ("iwlwifi: yoyo: support for new DBGI_SRAM region")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220129105618.209f3078bc74.I463530bd2f40daedb39f6d9df987bb7cee209033@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c   | 2 --
+ drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index a39013c401c9..e2001e88a4b4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -1562,8 +1562,6 @@ iwl_dump_ini_dbgi_sram_iter(struct iwl_fw_runtime *fwrt,
+ 		return -EBUSY;
+ 
+ 	range->range_data_size = reg->dev_addr.size;
+-	iwl_write_prph_no_grab(fwrt->trans, DBGI_SRAM_TARGET_ACCESS_CFG,
+-			       DBGI_SRAM_TARGET_ACCESS_CFG_RESET_ADDRESS_MSK);
+ 	for (i = 0; i < (le32_to_cpu(reg->dev_addr.size) / 4); i++) {
+ 		prph_data = iwl_read_prph(fwrt->trans, (i % 2) ?
+ 					  DBGI_SRAM_TARGET_ACCESS_RDATA_MSB :
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index a84ab02cf9d7..7d3fedfdb348 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -356,8 +356,6 @@
+ #define WFPM_GP2			0xA030B4
+ 
+ /* DBGI SRAM Register details */
+-#define DBGI_SRAM_TARGET_ACCESS_CFG			0x00A2E14C
+-#define DBGI_SRAM_TARGET_ACCESS_CFG_RESET_ADDRESS_MSK	0x10000
+ #define DBGI_SRAM_TARGET_ACCESS_RDATA_LSB		0x00A2E154
+ #define DBGI_SRAM_TARGET_ACCESS_RDATA_MSB		0x00A2E158
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ixgbe-don-t-reserve-excessive-xdp_packet_headroom-on.patch b/queue-5.16/ixgbe-don-t-reserve-excessive-xdp_packet_headroom-on.patch
new file mode 100644
index 00000000000..216d932fd51
--- /dev/null
+++ b/queue-5.16/ixgbe-don-t-reserve-excessive-xdp_packet_headroom-on.patch
@@ -0,0 +1,52 @@
+From 8cc99c1a4095384d92faf8e6ca7ed0e45fa62dfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:07:01 +0100
+Subject: ixgbe: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 8f405221a73a53234486c185d8ef647377a53cc6 ]
+
+{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD
++ NET_IP_ALIGN for any skb.
+OTOH, ixgbe_construct_skb_zc() currently allocates and reserves
+additional `xdp->data - xdp->data_hard_start`, which is
+XDP_PACKET_HEADROOM for XSK frames.
+There's no need for that at all as the frame is post-XDP and will
+go only to the networking stack core.
+Pass the size of the actual data only to __napi_alloc_skb() and
+don't reserve anything. This will give enough headroom for stack
+processing.
+
+Fixes: d0bcacd0a130 ("ixgbe: add AF_XDP zero-copy Rx support")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index ab96d7ce1aa0..920c556c75dd 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -214,13 +214,11 @@ static struct sk_buff *ixgbe_construct_skb_zc(struct ixgbe_ring *rx_ring,
+ 	struct sk_buff *skb;
+ 
+ 	/* allocate a skb to store the frags */
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
+-			       xdp->data_end - xdp->data_hard_start,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, xdp->data - xdp->data_hard_start);
+ 	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+-- 
+2.34.1
+
diff --git a/queue-5.16/ixgbe-pass-bi-xdp-to-ixgbe_construct_skb_zc-directly.patch b/queue-5.16/ixgbe-pass-bi-xdp-to-ixgbe_construct_skb_zc-directly.patch
new file mode 100644
index 00000000000..4a8c9ee88e3
--- /dev/null
+++ b/queue-5.16/ixgbe-pass-bi-xdp-to-ixgbe_construct_skb_zc-directly.patch
@@ -0,0 +1,80 @@
+From ad1c08c3929df0112ab29f2b1e0e24f9cb3d9083 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:07:00 +0100
+Subject: ixgbe: pass bi->xdp to ixgbe_construct_skb_zc() directly
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit 1fbdaa13386804a31eefd3db3c5fe00e80ce9bc3 ]
+
+To not dereference bi->xdp each time in ixgbe_construct_skb_zc(),
+pass bi->xdp as an argument instead of bi. We can also call
+xsk_buff_free() outside of the function as well as assign bi->xdp
+to NULL, which seems to make it closer to its name.
+
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index 666ff2c07ab9..ab96d7ce1aa0 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -207,26 +207,24 @@ bool ixgbe_alloc_rx_buffers_zc(struct ixgbe_ring *rx_ring, u16 count)
+ }
+ 
+ static struct sk_buff *ixgbe_construct_skb_zc(struct ixgbe_ring *rx_ring,
+-					      struct ixgbe_rx_buffer *bi)
++					      const struct xdp_buff *xdp)
+ {
+-	unsigned int metasize = bi->xdp->data - bi->xdp->data_meta;
+-	unsigned int datasize = bi->xdp->data_end - bi->xdp->data;
++	unsigned int metasize = xdp->data - xdp->data_meta;
++	unsigned int datasize = xdp->data_end - xdp->data;
+ 	struct sk_buff *skb;
+ 
+ 	/* allocate a skb to store the frags */
+ 	skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
+-			       bi->xdp->data_end - bi->xdp->data_hard_start,
++			       xdp->data_end - xdp->data_hard_start,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, bi->xdp->data - bi->xdp->data_hard_start);
+-	memcpy(__skb_put(skb, datasize), bi->xdp->data, datasize);
++	skb_reserve(skb, xdp->data - xdp->data_hard_start);
++	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+ 
+-	xsk_buff_free(bi->xdp);
+-	bi->xdp = NULL;
+ 	return skb;
+ }
+ 
+@@ -317,12 +315,15 @@ int ixgbe_clean_rx_irq_zc(struct ixgbe_q_vector *q_vector,
+ 		}
+ 
+ 		/* XDP_PASS path */
+-		skb = ixgbe_construct_skb_zc(rx_ring, bi);
++		skb = ixgbe_construct_skb_zc(rx_ring, bi->xdp);
+ 		if (!skb) {
+ 			rx_ring->rx_stats.alloc_rx_buff_failed++;
+ 			break;
+ 		}
+ 
++		xsk_buff_free(bi->xdp);
++		bi->xdp = NULL;
++
+ 		cleaned_count++;
+ 		ixgbe_inc_ntc(rx_ring);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ixgbe-respect-metadata-on-xsk-rx-to-skb.patch b/queue-5.16/ixgbe-respect-metadata-on-xsk-rx-to-skb.patch
new file mode 100644
index 00000000000..9854f4d0883
--- /dev/null
+++ b/queue-5.16/ixgbe-respect-metadata-on-xsk-rx-to-skb.patch
@@ -0,0 +1,68 @@
+From 0e9bbbd4020efaaca8a2e6425819ecf31865378b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:07:02 +0100
+Subject: ixgbe: respect metadata on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit f322a620be69e95594eda89502b478aa7dbf6ec2 ]
+
+For now, if the XDP prog returns XDP_PASS on XSK, the metadata
+will be lost as it doesn't get copied to the skb.
+
+Copy it along with the frame headers. Account its size on skb
+allocation, and when copying just treat it as a part of the frame
+and do a pull after to "move" it to the "reserved" zone.
+
+net_prefetch() xdp->data_meta and align the copy size to speed-up
+memcpy() a little and better match ixgbe_construct_skb().
+
+Fixes: d0bcacd0a130 ("ixgbe: add AF_XDP zero-copy Rx support")
+Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index 920c556c75dd..92a5080f8201 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -209,19 +209,25 @@ bool ixgbe_alloc_rx_buffers_zc(struct ixgbe_ring *rx_ring, u16 count)
+ static struct sk_buff *ixgbe_construct_skb_zc(struct ixgbe_ring *rx_ring,
+ 					      const struct xdp_buff *xdp)
+ {
++	unsigned int totalsize = xdp->data_end - xdp->data_meta;
+ 	unsigned int metasize = xdp->data - xdp->data_meta;
+-	unsigned int datasize = xdp->data_end - xdp->data;
+ 	struct sk_buff *skb;
+ 
++	net_prefetch(xdp->data_meta);
++
+ 	/* allocate a skb to store the frags */
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, totalsize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+-	if (metasize)
++	memcpy(__skb_put(skb, totalsize), xdp->data_meta,
++	       ALIGN(totalsize, sizeof(long)));
++
++	if (metasize) {
+ 		skb_metadata_set(skb, metasize);
++		__skb_pull(skb, metasize);
++	}
+ 
+ 	return skb;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/jfs-fix-divide-error-in-dbnextag.patch b/queue-5.16/jfs-fix-divide-error-in-dbnextag.patch
new file mode 100644
index 00000000000..32582421250
--- /dev/null
+++ b/queue-5.16/jfs-fix-divide-error-in-dbnextag.patch
@@ -0,0 +1,56 @@
+From 24a3ae1d77b5731d0af8f25264c0c074738e87e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Mar 2022 22:30:00 +0300
+Subject: jfs: fix divide error in dbNextAG
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]
+
+Syzbot reported divide error in dbNextAG(). The problem was in missing
+validation check for malicious image.
+
+Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
+validation checks, but dbNextAG() blindly use bmp->db_numag in divide
+expression
+
+Fix it by validating bmp->db_numag in dbMount() and return an error if
+image is malicious
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 91f4ec93dab1..d8502f4989d9 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -148,6 +148,7 @@ static const s8 budtab[256] = {
+  *	0	- success
+  *	-ENOMEM	- insufficient memory
+  *	-EIO	- i/o error
++ *	-EINVAL - wrong bmap data
+  */
+ int dbMount(struct inode *ipbmap)
+ {
+@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap)
+ 	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
+ 	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
+ 	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
++	if (!bmp->db_numag) {
++		release_metapage(mp);
++		kfree(bmp);
++		return -EINVAL;
++	}
++
+ 	bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
+ 	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
+ 	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
+-- 
+2.34.1
+
diff --git a/queue-5.16/kdb-fix-the-putarea-helper-function.patch b/queue-5.16/kdb-fix-the-putarea-helper-function.patch
new file mode 100644
index 00000000000..e070c29a316
--- /dev/null
+++ b/queue-5.16/kdb-fix-the-putarea-helper-function.patch
@@ -0,0 +1,47 @@
+From 5596e89c5af5d12d33dcaf35d3abaade056b6cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 14:40:55 +0000
+Subject: kdb: Fix the putarea helper function
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit c1cb81429df462eca1b6ba615cddd21dd3103c46 ]
+
+Currently kdb_putarea_size() uses copy_from_kernel_nofault() to write *to*
+arbitrary kernel memory. This is obviously wrong and means the memory
+modify ('mm') command is a serious risk to debugger stability: if we poke
+to a bad address we'll double-fault and lose our debug session.
+
+Fix this the (very) obvious way.
+
+Note that there are two Fixes: tags because the API was renamed and this
+patch will only trivially backport as far as the rename (and this is
+probably enough). Nevertheless Christoph's rename did not introduce this
+problem so I wanted to record that!
+
+Fixes: fe557319aa06 ("maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault")
+Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20220128144055.207267-1-daniel.thompson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_support.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index df2bface866e..85cb51c4a17e 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -291,7 +291,7 @@ int kdb_getarea_size(void *res, unsigned long addr, size_t size)
+  */
+ int kdb_putarea_size(unsigned long addr, void *res, size_t size)
+ {
+-	int ret = copy_from_kernel_nofault((char *)addr, (char *)res, size);
++	int ret = copy_to_kernel_nofault((char *)addr, (char *)res, size);
+ 	if (ret) {
+ 		if (!KDB_STATE(SUPPRESS)) {
+ 			kdb_func_printf("Bad address 0x%lx\n", addr);
+-- 
+2.34.1
+
diff --git a/queue-5.16/kernel-resource-fix-kfree-of-bootmem-memory-again.patch b/queue-5.16/kernel-resource-fix-kfree-of-bootmem-memory-again.patch
new file mode 100644
index 00000000000..fe0d0867ce3
--- /dev/null
+++ b/queue-5.16/kernel-resource-fix-kfree-of-bootmem-memory-again.patch
@@ -0,0 +1,96 @@
+From 1f3513b164367c4dbde4b00ec91da9ce9970508d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 16:07:18 -0700
+Subject: kernel/resource: fix kfree() of bootmem memory again
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit 0cbcc92917c5de80f15c24d033566539ad696892 ]
+
+Since commit ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem
+memory"), we could get a resource allocated during boot via
+alloc_resource().  And it's required to release the resource using
+free_resource().  Howerver, many people use kfree directly which will
+result in kernel BUG.  In order to fix this without fixing every call
+site, just leak a couple of bytes in such corner case.
+
+Link: https://lkml.kernel.org/r/20220217083619.19305-1-linmiaohe@huawei.com
+Fixes: ebff7d8f270d ("mem hotunplug: fix kfree() of bootmem memory")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Suggested-by: David Hildenbrand <david@redhat.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Alistair Popple <apopple@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/resource.c | 41 ++++++++---------------------------------
+ 1 file changed, 8 insertions(+), 33 deletions(-)
+
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 5ad3eba619ba..092a6154371b 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -56,14 +56,6 @@ struct resource_constraint {
+ 
+ static DEFINE_RWLOCK(resource_lock);
+ 
+-/*
+- * For memory hotplug, there is no way to free resource entries allocated
+- * by boot mem after the system is up. So for reusing the resource entry
+- * we need to remember the resource.
+- */
+-static struct resource *bootmem_resource_free;
+-static DEFINE_SPINLOCK(bootmem_resource_lock);
+-
+ static struct resource *next_resource(struct resource *p)
+ {
+ 	if (p->child)
+@@ -160,36 +152,19 @@ __initcall(ioresources_init);
+ 
+ static void free_resource(struct resource *res)
+ {
+-	if (!res)
+-		return;
+-
+-	if (!PageSlab(virt_to_head_page(res))) {
+-		spin_lock(&bootmem_resource_lock);
+-		res->sibling = bootmem_resource_free;
+-		bootmem_resource_free = res;
+-		spin_unlock(&bootmem_resource_lock);
+-	} else {
++	/**
++	 * If the resource was allocated using memblock early during boot
++	 * we'll leak it here: we can only return full pages back to the
++	 * buddy and trying to be smart and reusing them eventually in
++	 * alloc_resource() overcomplicates resource handling.
++	 */
++	if (res && PageSlab(virt_to_head_page(res)))
+ 		kfree(res);
+-	}
+ }
+ 
+ static struct resource *alloc_resource(gfp_t flags)
+ {
+-	struct resource *res = NULL;
+-
+-	spin_lock(&bootmem_resource_lock);
+-	if (bootmem_resource_free) {
+-		res = bootmem_resource_free;
+-		bootmem_resource_free = res->sibling;
+-	}
+-	spin_unlock(&bootmem_resource_lock);
+-
+-	if (res)
+-		memset(res, 0, sizeof(struct resource));
+-	else
+-		res = kzalloc(sizeof(struct resource), flags);
+-
+-	return res;
++	return kzalloc(sizeof(struct resource), flags);
+ }
+ 
+ /* Return the conflict entry if you can't request it */
+-- 
+2.34.1
+
diff --git a/queue-5.16/keys-trusted-avoid-calling-null-function-trusted_key.patch b/queue-5.16/keys-trusted-avoid-calling-null-function-trusted_key.patch
new file mode 100644
index 00000000000..0b57e55c483
--- /dev/null
+++ b/queue-5.16/keys-trusted-avoid-calling-null-function-trusted_key.patch
@@ -0,0 +1,47 @@
+From 27c1fd7c8103a97ad44a746d20bc515fe5d355d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jan 2022 14:32:43 -0600
+Subject: KEYS: trusted: Avoid calling null function trusted_key_exit
+
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+
+[ Upstream commit c5d1ed846e15090bc90dfdaafc07eac066e070bb ]
+
+If one loads and unloads the trusted module, trusted_key_exit can be
+NULL. Call it through static_call_cond() to avoid a kernel trap.
+
+Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Cc: James Bottomley <jejb@linux.ibm.com>
+Cc: Jarkko Sakkinen <jarkko@kernel.org>
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Cc: linux-integrity@vger.kernel.org
+Cc: keyrings@vger.kernel.org
+Cc: linux-security-module@vger.kernel.org
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/trusted-keys/trusted_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
+index 5b35f1b87644..9b9d3ef79cbe 100644
+--- a/security/keys/trusted-keys/trusted_core.c
++++ b/security/keys/trusted-keys/trusted_core.c
+@@ -351,7 +351,7 @@ static int __init init_trusted(void)
+ 
+ static void __exit cleanup_trusted(void)
+ {
+-	static_call(trusted_key_exit)();
++	static_call_cond(trusted_key_exit)();
+ }
+ 
+ late_initcall(init_trusted);
+-- 
+2.34.1
+
diff --git a/queue-5.16/keys-trusted-fix-trusted-key-backends-when-building-.patch b/queue-5.16/keys-trusted-fix-trusted-key-backends-when-building-.patch
new file mode 100644
index 00000000000..74dcbce77a6
--- /dev/null
+++ b/queue-5.16/keys-trusted-fix-trusted-key-backends-when-building-.patch
@@ -0,0 +1,54 @@
+From 23caacdf27d171c4035e13c3d065f3688eb7e347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Dec 2021 10:59:00 +0100
+Subject: KEYS: trusted: Fix trusted key backends when building as module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andreas Rammhold <andreas@rammhold.de>
+
+[ Upstream commit 969a26446bcd142faedfe8c6f41cd7668596c1fa ]
+
+Before this commit the kernel could end up with no trusted key sources
+even though both of the currently supported backends (TPM and TEE) were
+compiled as modules. This manifested in the trusted key type not being
+registered at all.
+
+When checking if a CONFIG_… preprocessor variable is defined we only
+test for the builtin (=y) case and not the module (=m) case. By using
+the IS_REACHABLE() macro we do test for both cases.
+
+Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Andreas Rammhold <andreas@rammhold.de>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/trusted-keys/trusted_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
+index d5c891d8d353..5b35f1b87644 100644
+--- a/security/keys/trusted-keys/trusted_core.c
++++ b/security/keys/trusted-keys/trusted_core.c
+@@ -27,10 +27,10 @@ module_param_named(source, trusted_key_source, charp, 0);
+ MODULE_PARM_DESC(source, "Select trusted keys source (tpm or tee)");
+ 
+ static const struct trusted_key_source trusted_key_sources[] = {
+-#if defined(CONFIG_TCG_TPM)
++#if IS_REACHABLE(CONFIG_TCG_TPM)
+ 	{ "tpm", &trusted_key_tpm_ops },
+ #endif
+-#if defined(CONFIG_TEE)
++#if IS_REACHABLE(CONFIG_TEE)
+ 	{ "tee", &trusted_key_tee_ops },
+ #endif
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/kgdboc-fix-return-value-of-__setup-handler.patch b/queue-5.16/kgdboc-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..c0ec0b9eaa4
--- /dev/null
+++ b/queue-5.16/kgdboc-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,76 @@
+From e5e9aac850e76f4f6179662432fff2c03db5eef7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 19:30:18 -0800
+Subject: kgdboc: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ab818c7aa7544bf8d2dd4bdf68878b17a02eb332 ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) environment strings.
+So return 1 from kgdboc_option_setup().
+
+Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7
+  kgdboc=kbd kgdbts=", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc7
+     kgdboc=kbd
+     kgdbts=
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 1bd54d851f50 ("kgdboc: Passing ekgdboc to command line causes panic")
+Fixes: f2d937f3bf00 ("consoles: polling support, kgdboc")
+Cc: He Zhe <zhe.he@windriver.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: kgdb-bugreport@lists.sourceforge.net
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: linux-serial@vger.kernel.org
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220309033018.17936-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/kgdboc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index 49d0c7f2b29b..79b7db8580e0 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -403,16 +403,16 @@ static int kgdboc_option_setup(char *opt)
+ {
+ 	if (!opt) {
+ 		pr_err("config string not provided\n");
+-		return -EINVAL;
++		return 1;
+ 	}
+ 
+ 	if (strlen(opt) >= MAX_CONFIG_LEN) {
+ 		pr_err("config string too long\n");
+-		return -ENOSPC;
++		return 1;
+ 	}
+ 	strcpy(config, opt);
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kgdboc=", kgdboc_option_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.16/kgdbts-fix-return-value-of-__setup-handler.patch b/queue-5.16/kgdbts-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..41f328bb6ea
--- /dev/null
+++ b/queue-5.16/kgdbts-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,65 @@
+From 1ff448c149205843d8c3fd0fd60379609445cc5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 19:32:55 -0800
+Subject: kgdbts: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 96c9e802c64014a7716865332d732cc9c7f24593 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled. A return of 0 causes the boot option/value to be
+listed as an Unknown kernel parameter and added to init's (limited)
+environment strings. So return 1 from kgdbts_option_setup().
+
+Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7
+  kgdboc=kbd kgdbts=", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc7
+     kgdboc=kbd
+     kgdbts=
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: e8d31c204e36 ("kgdb: add kgdb internal test suite")
+Cc: kgdb-bugreport@lists.sourceforge.net
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220308033255.22118-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 67c5b452dd35..88b91ad8e541 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -1070,10 +1070,10 @@ static int kgdbts_option_setup(char *opt)
+ {
+ 	if (strlen(opt) >= MAX_CONFIG_LEN) {
+ 		printk(KERN_ERR "kgdbts: config string too long\n");
+-		return -ENOSPC;
++		return 1;
+ 	}
+ 	strcpy(config, opt);
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kgdbts=", kgdbts_option_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.16/kunit-make-kunit_test_timeout-compatible-with-commen.patch b/queue-5.16/kunit-make-kunit_test_timeout-compatible-with-commen.patch
new file mode 100644
index 00000000000..fa056937cd5
--- /dev/null
+++ b/queue-5.16/kunit-make-kunit_test_timeout-compatible-with-commen.patch
@@ -0,0 +1,48 @@
+From 45669f3a2fa0f804a2f5f2cb788dc28939a68e3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:48:19 -0700
+Subject: kunit: make kunit_test_timeout compatible with comment
+
+From: Peng Liu <liupeng256@huawei.com>
+
+[ Upstream commit bdd015f7b71b92c2e4ecabac689642cc72553e04 ]
+
+In function kunit_test_timeout, it is declared "300 * MSEC_PER_SEC"
+represent 5min.  However, it is wrong when dealing with arm64 whose
+default HZ = 250, or some other situations.  Use msecs_to_jiffies to fix
+this, and kunit_test_timeout will work as desired.
+
+Link: https://lkml.kernel.org/r/20220309083753.1561921-3-liupeng256@huawei.com
+Fixes: 5f3e06208920 ("kunit: test: add support for test abort")
+Signed-off-by: Peng Liu <liupeng256@huawei.com>
+Reviewed-by: Marco Elver <elver@google.com>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Reviewed-by: Brendan Higgins <brendanhiggins@google.com>
+Tested-by: Brendan Higgins <brendanhiggins@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Wang Kefeng <wangkefeng.wang@huawei.com>
+Cc: David Gow <davidgow@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/try-catch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
+index 0dd434e40487..71e5c5853099 100644
+--- a/lib/kunit/try-catch.c
++++ b/lib/kunit/try-catch.c
+@@ -52,7 +52,7 @@ static unsigned long kunit_test_timeout(void)
+ 	 * If tests timeout due to exceeding sysctl_hung_task_timeout_secs,
+ 	 * the task will be killed and an oops generated.
+ 	 */
+-	return 300 * MSEC_PER_SEC; /* 5 min */
++	return 300 * msecs_to_jiffies(MSEC_PER_SEC); /* 5 min */
+ }
+ 
+ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-arm64-enable-cortex-a510-erratum-2077057-by-defa.patch b/queue-5.16/kvm-arm64-enable-cortex-a510-erratum-2077057-by-defa.patch
new file mode 100644
index 00000000000..6a46f6a85a6
--- /dev/null
+++ b/queue-5.16/kvm-arm64-enable-cortex-a510-erratum-2077057-by-defa.patch
@@ -0,0 +1,39 @@
+From e9e2510d041511572fe0e90045fded1a3d3820e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 18:46:58 +0000
+Subject: KVM: arm64: Enable Cortex-A510 erratum 2077057 by default
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 4c11113c1a3d10f5b617e5d2b9acd8d1d715450f ]
+
+The recently added configuration option for Cortex A510 erratum 2077057 does
+not have a "default y" unlike other errata fixes. This appears to simply be
+an oversight since the help text suggests enabling the option if unsure and
+there's nothing in the commit log to suggest it is intentional.
+
+Fixes: 1dd498e5e26ad ("KVM: arm64: Workaround Cortex-A510's single-step and PAC trap errata")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220225184658.172527-1-broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index d05d94d2b28b..0a83e1728f7e 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -683,6 +683,7 @@ config ARM64_ERRATUM_2051678
+ 
+ config ARM64_ERRATUM_2077057
+ 	bool "Cortex-A510: 2077057: workaround software-step corrupting SPSR_EL2"
++	default y
+ 	help
+ 	  This option adds the workaround for ARM Cortex-A510 erratum 2077057.
+ 	  Affected Cortex-A510 may corrupt SPSR_EL2 when the a step exception is
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch b/queue-5.16/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch
new file mode 100644
index 00000000000..af6fc18fad3
--- /dev/null
+++ b/queue-5.16/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch
@@ -0,0 +1,42 @@
+From 48abc0067d4244ff0c22a7b4cb15b316e15b95fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 12:57:32 -0300
+Subject: KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init
+
+From: Fabiano Rosas <farosas@linux.ibm.com>
+
+[ Upstream commit 69ab6ac380a00244575de02c406dcb9491bf3368 ]
+
+The return of the function is being shadowed by the call to
+kvmppc_uvmem_init.
+
+Fixes: ca9f4942670c ("KVM: PPC: Book3S HV: Support for running secure guests")
+Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220125155735.1018683-2-farosas@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index a2fd1db29f7e..7fa685711669 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -6101,8 +6101,11 @@ static int kvmppc_book3s_init_hv(void)
+ 	if (r)
+ 		return r;
+ 
+-	if (kvmppc_radix_possible())
++	if (kvmppc_radix_possible()) {
+ 		r = kvmppc_radix_init();
++		if (r)
++			return r;
++	}
+ 
+ 	r = kvmppc_uvmem_init();
+ 	if (r < 0)
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch b/queue-5.16/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
new file mode 100644
index 00000000000..5167c6367f3
--- /dev/null
+++ b/queue-5.16/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
@@ -0,0 +1,48 @@
+From 3f615b24e9e9f8191e7ac9990f5ce438f96e8c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 18:56:52 -0300
+Subject: KVM: PPC: Fix vmx/vsx mixup in mmio emulation
+
+From: Fabiano Rosas <farosas@linux.ibm.com>
+
+[ Upstream commit b99234b918c6e36b9aa0a5b2981e86b6bd11f8e2 ]
+
+The MMIO emulation code for vector instructions is duplicated between
+VSX and VMX. When emulating VMX we should check the VMX copy size
+instead of the VSX one.
+
+Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction ...")
+Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220125215655.1026224-3-farosas@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/powerpc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index a72920f4f221..8d91a50a84a8 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1507,7 +1507,7 @@ int kvmppc_handle_vmx_load(struct kvm_vcpu *vcpu,
+ {
+ 	enum emulation_result emulated = EMULATE_DONE;
+ 
+-	if (vcpu->arch.mmio_vsx_copy_nums > 2)
++	if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ 		return EMULATE_FAIL;
+ 
+ 	while (vcpu->arch.mmio_vmx_copy_nums) {
+@@ -1604,7 +1604,7 @@ int kvmppc_handle_vmx_store(struct kvm_vcpu *vcpu,
+ 	unsigned int index = rs & KVM_MMIO_REG_MASK;
+ 	enum emulation_result emulated = EMULATE_DONE;
+ 
+-	if (vcpu->arch.mmio_vsx_copy_nums > 2)
++	if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ 		return EMULATE_FAIL;
+ 
+ 	vcpu->arch.io_gpr = rs;
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-svm-exit-to-userspace-on-enomem-efault-ghcb-erro.patch b/queue-5.16/kvm-svm-exit-to-userspace-on-enomem-efault-ghcb-erro.patch
new file mode 100644
index 00000000000..9ca7b68b013
--- /dev/null
+++ b/queue-5.16/kvm-svm-exit-to-userspace-on-enomem-efault-ghcb-erro.patch
@@ -0,0 +1,191 @@
+From 154786fcb57a33ac2728523312fb8e962c887bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 20:52:09 +0000
+Subject: KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit aa9f58415a8e45598bf44befa90b9d5babe09601 ]
+
+Exit to userspace if setup_vmgexit_scratch() fails due to OOM or because
+copying data from guest (userspace) memory failed/faulted.  The OOM
+scenario is clearcut, it's userspace's decision as to whether it should
+terminate the guest, free memory, etc...
+
+As for -EFAULT, arguably, any guest issue is a violation of the guest's
+contract with userspace, and thus userspace needs to decide how to
+proceed.  E.g. userspace defines what is RAM vs. MMIO and communicates
+that directly to the guest, KVM is not involved in deciding what is/isn't
+RAM nor in communicating that information to the guest.  If the scratch
+GPA doesn't resolve to a memslot, then the guest is not honoring the
+memory configuration as defined by userspace.
+
+And if userspace unmaps an hva for whatever reason, then exiting to
+userspace with -EFAULT is absolutely the right thing to do.  KVM's ABI
+currently sucks and doesn't provide enough information to act on the
+-EFAULT, but that will hopefully be remedied in the future as there are
+multiple use cases, e.g. uffd and virtiofs truncation, that shouldn't
+require any work in KVM beyond returning -EFAULT with a small amount of
+metadata.
+
+KVM could define its ABI such that failure to access the scratch area is
+reflected into the guest, i.e. establish a contract with userspace, but
+that's undesirable as it limits KVM's options in the future, e.g. in the
+potential uffd case any failure on a uaccess needs to kick out to
+userspace.  KVM does have several cases where it reflects these errors
+into the guest, e.g. kvm_pv_clock_pairing() and Hyper-V emulation, but
+KVM would preferably "fix" those instead of propagating the falsehood
+that any memory failure is the guest's fault.
+
+Lastly, returning a boolean as an "error" for that a helper that isn't
+named accordingly never works out well.
+
+Fixes: ad5b353240c8 ("KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure")
+Cc: Alper Gun <alpergun@google.com>
+Cc: Peter Gonda <pgonda@google.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20220225205209.3881130-1-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/sev.c | 36 +++++++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
+index be2883141220..20a5d3abaeda 100644
+--- a/arch/x86/kvm/svm/sev.c
++++ b/arch/x86/kvm/svm/sev.c
+@@ -2352,7 +2352,7 @@ static void sev_es_sync_from_ghcb(struct vcpu_svm *svm)
+ 	memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap));
+ }
+ 
+-static bool sev_es_validate_vmgexit(struct vcpu_svm *svm)
++static int sev_es_validate_vmgexit(struct vcpu_svm *svm)
+ {
+ 	struct kvm_vcpu *vcpu;
+ 	struct ghcb *ghcb;
+@@ -2457,7 +2457,7 @@ static bool sev_es_validate_vmgexit(struct vcpu_svm *svm)
+ 		goto vmgexit_err;
+ 	}
+ 
+-	return true;
++	return 0;
+ 
+ vmgexit_err:
+ 	vcpu = &svm->vcpu;
+@@ -2480,7 +2480,8 @@ static bool sev_es_validate_vmgexit(struct vcpu_svm *svm)
+ 	ghcb_set_sw_exit_info_1(ghcb, 2);
+ 	ghcb_set_sw_exit_info_2(ghcb, reason);
+ 
+-	return false;
++	/* Resume the guest to "return" the error code. */
++	return 1;
+ }
+ 
+ void sev_es_unmap_ghcb(struct vcpu_svm *svm)
+@@ -2539,7 +2540,7 @@ void pre_sev_run(struct vcpu_svm *svm, int cpu)
+ }
+ 
+ #define GHCB_SCRATCH_AREA_LIMIT		(16ULL * PAGE_SIZE)
+-static bool setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
++static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
+ {
+ 	struct vmcb_control_area *control = &svm->vmcb->control;
+ 	struct ghcb *ghcb = svm->sev_es.ghcb;
+@@ -2592,14 +2593,14 @@ static bool setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
+ 		}
+ 		scratch_va = kvzalloc(len, GFP_KERNEL_ACCOUNT);
+ 		if (!scratch_va)
+-			goto e_scratch;
++			return -ENOMEM;
+ 
+ 		if (kvm_read_guest(svm->vcpu.kvm, scratch_gpa_beg, scratch_va, len)) {
+ 			/* Unable to copy scratch area from guest */
+ 			pr_err("vmgexit: kvm_read_guest for scratch area failed\n");
+ 
+ 			kvfree(scratch_va);
+-			goto e_scratch;
++			return -EFAULT;
+ 		}
+ 
+ 		/*
+@@ -2615,13 +2616,13 @@ static bool setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 len)
+ 	svm->sev_es.ghcb_sa = scratch_va;
+ 	svm->sev_es.ghcb_sa_len = len;
+ 
+-	return true;
++	return 0;
+ 
+ e_scratch:
+ 	ghcb_set_sw_exit_info_1(ghcb, 2);
+ 	ghcb_set_sw_exit_info_2(ghcb, GHCB_ERR_INVALID_SCRATCH_AREA);
+ 
+-	return false;
++	return 1;
+ }
+ 
+ static void set_ghcb_msr_bits(struct vcpu_svm *svm, u64 value, u64 mask,
+@@ -2759,17 +2760,18 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
+ 
+ 	exit_code = ghcb_get_sw_exit_code(ghcb);
+ 
+-	if (!sev_es_validate_vmgexit(svm))
+-		return 1;
++	ret = sev_es_validate_vmgexit(svm);
++	if (ret)
++		return ret;
+ 
+ 	sev_es_sync_from_ghcb(svm);
+ 	ghcb_set_sw_exit_info_1(ghcb, 0);
+ 	ghcb_set_sw_exit_info_2(ghcb, 0);
+ 
+-	ret = 1;
+ 	switch (exit_code) {
+ 	case SVM_VMGEXIT_MMIO_READ:
+-		if (!setup_vmgexit_scratch(svm, true, control->exit_info_2))
++		ret = setup_vmgexit_scratch(svm, true, control->exit_info_2);
++		if (ret)
+ 			break;
+ 
+ 		ret = kvm_sev_es_mmio_read(vcpu,
+@@ -2778,7 +2780,8 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
+ 					   svm->sev_es.ghcb_sa);
+ 		break;
+ 	case SVM_VMGEXIT_MMIO_WRITE:
+-		if (!setup_vmgexit_scratch(svm, false, control->exit_info_2))
++		ret = setup_vmgexit_scratch(svm, false, control->exit_info_2);
++		if (ret)
+ 			break;
+ 
+ 		ret = kvm_sev_es_mmio_write(vcpu,
+@@ -2811,6 +2814,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu)
+ 			ghcb_set_sw_exit_info_2(ghcb, GHCB_ERR_INVALID_INPUT);
+ 		}
+ 
++		ret = 1;
+ 		break;
+ 	}
+ 	case SVM_VMGEXIT_UNSUPPORTED_EVENT:
+@@ -2830,6 +2834,7 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
+ {
+ 	int count;
+ 	int bytes;
++	int r;
+ 
+ 	if (svm->vmcb->control.exit_info_2 > INT_MAX)
+ 		return -EINVAL;
+@@ -2838,8 +2843,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in)
+ 	if (unlikely(check_mul_overflow(count, size, &bytes)))
+ 		return -EINVAL;
+ 
+-	if (!setup_vmgexit_scratch(svm, in, bytes))
+-		return 1;
++	r = setup_vmgexit_scratch(svm, in, bytes);
++	if (r)
++		return r;
+ 
+ 	return kvm_sev_es_string_io(&svm->vcpu, size, port, svm->sev_es.ghcb_sa,
+ 				    count, in);
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-x86-emulator-defer-not-present-segment-check-in-.patch b/queue-5.16/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
new file mode 100644
index 00000000000..3b3d3756ef0
--- /dev/null
+++ b/queue-5.16/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
@@ -0,0 +1,69 @@
+From ef562e79be48051ac9ee7b3fe1439a970bee91e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 17:34:03 +0800
+Subject: KVM: x86/emulator: Defer not-present segment check in
+ __load_segment_descriptor()
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit ca85f002258fdac3762c57d12d5e6e401b6a41af ]
+
+Per Intel's SDM on the "Instruction Set Reference", when
+loading segment descriptor, not-present segment check should
+be after all type and privilege checks. But the emulator checks
+it first, then #NP is triggered instead of #GP if privilege fails
+and segment is not present. Put not-present segment check after
+type and privilege checks in __load_segment_descriptor().
+
+Fixes: 38ba30ba51a00 (KVM: x86 emulator: Emulate task switch in emulator.c)
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Message-Id: <52573c01d369f506cadcf7233812427cf7db81a7.1644292363.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/emulate.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 28b1a4e57827..5705446c1213 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1614,11 +1614,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 		goto exception;
+ 	}
+ 
+-	if (!seg_desc.p) {
+-		err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
+-		goto exception;
+-	}
+-
+ 	dpl = seg_desc.dpl;
+ 
+ 	switch (seg) {
+@@ -1658,6 +1653,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 	case VCPU_SREG_TR:
+ 		if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
+ 			goto exception;
++		if (!seg_desc.p) {
++			err_vec = NP_VECTOR;
++			goto exception;
++		}
+ 		old_desc = seg_desc;
+ 		seg_desc.type |= 2; /* busy */
+ 		ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
+@@ -1682,6 +1681,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 		break;
+ 	}
+ 
++	if (!seg_desc.p) {
++		err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
++		goto exception;
++	}
++
+ 	if (seg_desc.s) {
+ 		/* mark segment as accessed */
+ 		if (!(seg_desc.type & 1)) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/kvm-x86-fix-emulation-in-writing-cr8.patch b/queue-5.16/kvm-x86-fix-emulation-in-writing-cr8.patch
new file mode 100644
index 00000000000..50e6d1743e3
--- /dev/null
+++ b/queue-5.16/kvm-x86-fix-emulation-in-writing-cr8.patch
@@ -0,0 +1,65 @@
+From 74f260821be9eebfdb2e6a4cfb3f0aefe3d11338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 17:45:06 +0800
+Subject: KVM: x86: Fix emulation in writing cr8
+
+From: Zhenzhong Duan <zhenzhong.duan@intel.com>
+
+[ Upstream commit f66af9f222f08d5b11ea41c1bd6c07a0f12daa07 ]
+
+In emulation of writing to cr8, one of the lowest four bits in TPR[3:0]
+is kept.
+
+According to Intel SDM 10.8.6.1(baremetal scenario):
+"APIC.TPR[bits 7:4] = CR8[bits 3:0], APIC.TPR[bits 3:0] = 0";
+
+and SDM 28.3(use TPR shadow):
+"MOV to CR8. The instruction stores bits 3:0 of its source operand into
+bits 7:4 of VTPR; the remainder of VTPR (bits 3:0 and bits 31:8) are
+cleared.";
+
+and AMD's APM 16.6.4:
+"Task Priority Sub-class (TPS)-Bits 3 : 0. The TPS field indicates the
+current sub-priority to be used when arbitrating lowest-priority messages.
+This field is written with zero when TPR is written using the architectural
+CR8 register.";
+
+so in KVM emulated scenario, clear TPR[3:0] to make a consistent behavior
+as in other scenarios.
+
+This doesn't impact evaluation and delivery of pending virtual interrupts
+because processor does not use the processor-priority sub-class to
+determine which interrupts to delivery and which to inhibit.
+
+Sub-class is used by hardware to arbitrate lowest priority interrupts,
+but KVM just does a round-robin style delivery.
+
+Fixes: b93463aa59d6 ("KVM: Accelerated apic support")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20220210094506.20181-1-zhenzhong.duan@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/lapic.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index e8e383fbe886..6c87032c928c 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2242,10 +2242,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
+ 
+ void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8)
+ {
+-	struct kvm_lapic *apic = vcpu->arch.apic;
+-
+-	apic_set_tpr(apic, ((cr8 & 0x0f) << 4)
+-		     | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4));
++	apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4);
+ }
+ 
+ u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu)
+-- 
+2.34.1
+
diff --git a/queue-5.16/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch b/queue-5.16/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
new file mode 100644
index 00000000000..30be38ed5f4
--- /dev/null
+++ b/queue-5.16/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
@@ -0,0 +1,85 @@
+From b3778ce4fc62a4e5d93cadf6980c3a96655091c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 16:21:48 +0100
+Subject: lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit 633174a7046ec3b4572bec24ef98e6ee89bce14b ]
+
+Buidling raid6test on Ubuntu 21.10 (ppc64le) with GNU Make 4.3 shows the
+errors below:
+
+    $ cd lib/raid6/test/
+    $ make
+    <stdin>:1:1: error: stray ‘\’ in program
+    <stdin>:1:2: error: stray ‘#’ in program
+    <stdin>:1:11: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ \
+        before ‘<’ token
+
+    [...]
+
+The errors come from the HAS_ALTIVEC test, which fails, and the POWER
+optimized versions are not built. That’s also reason nobody noticed on the
+other architectures.
+
+GNU Make 4.3 does not remove the backslash anymore. From the 4.3 release
+announcment:
+
+> * WARNING: Backward-incompatibility!
+>   Number signs (#) appearing inside a macro reference or function invocation
+>   no longer introduce comments and should not be escaped with backslashes:
+>   thus a call such as:
+>     foo := $(shell echo '#')
+>   is legal.  Previously the number sign needed to be escaped, for example:
+>     foo := $(shell echo '\#')
+>   Now this latter will resolve to "\#".  If you want to write makefiles
+>   portable to both versions, assign the number sign to a variable:
+>     H := \#
+>     foo := $(shell echo '$H')
+>   This was claimed to be fixed in 3.81, but wasn't, for some reason.
+>   To detect this change search for 'nocomment' in the .FEATURES variable.
+
+So, do the same as commit 9564a8cf422d ("Kbuild: fix # escaping in .cmd
+files for future Make") and commit 929bef467771 ("bpf: Use $(pound) instead
+of \# in Makefiles") and define and use a $(pound) variable.
+
+Reference for the change in make:
+https://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b57
+
+Cc: Matt Brown <matthew.brown.dev@gmail.com>
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/test/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index a4c7cd74cff5..4fb7700a741b 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -4,6 +4,8 @@
+ # from userspace.
+ #
+ 
++pound := \#
++
+ CC	 = gcc
+ OPTFLAGS = -O2			# Adjust as desired
+ CFLAGS	 = -I.. -I ../../../include -g $(OPTFLAGS)
+@@ -42,7 +44,7 @@ else ifeq ($(HAS_NEON),yes)
+         OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+         CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+-        HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
++        HAS_ALTIVEC := $(shell printf '$(pound)include <altivec.h>\nvector int a;\n' |\
+                          gcc -c -x c - >/dev/null && rm ./-.o && echo yes)
+         ifeq ($(HAS_ALTIVEC),yes)
+                 CFLAGS += -I../../../arch/powerpc/include
+-- 
+2.34.1
+
diff --git a/queue-5.16/lib-test-use-after-free-in-register_test_dev_kmod.patch b/queue-5.16/lib-test-use-after-free-in-register_test_dev_kmod.patch
new file mode 100644
index 00000000000..b391da0d0ae
--- /dev/null
+++ b/queue-5.16/lib-test-use-after-free-in-register_test_dev_kmod.patch
@@ -0,0 +1,34 @@
+From 856a7ab0bedf03eb2adf7b3390bfaa2226c02477 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 08:52:07 +0300
+Subject: lib/test: use after free in register_test_dev_kmod()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dc0ce6cc4b133f5f2beb8b47dacae13a7d283c2c ]
+
+The "test_dev" pointer is freed but then returned to the caller.
+
+Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kmod.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index ce1589391413..cb800b1d0d99 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -1149,6 +1149,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
+ 	if (ret) {
+ 		pr_err("could not register misc device: %d\n", ret);
+ 		free_test_dev_kmod(test_dev);
++		test_dev = NULL;
+ 		goto out;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch b/queue-5.16/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch
new file mode 100644
index 00000000000..6cd76f7b768
--- /dev/null
+++ b/queue-5.16/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch
@@ -0,0 +1,48 @@
+From 0b87f8e1f4657662f4c8dac08e5eb81d87a2c1d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 13:48:06 +0100
+Subject: lib/test_lockup: fix kernel pointer check for separate address spaces
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5a06fcb15b43d1f7bf740c672950122331cb5655 ]
+
+test_kernel_ptr() uses access_ok() to figure out if a given address
+points to user space instead of kernel space. However on architectures
+that set CONFIG_ALTERNATE_USER_ADDRESS_SPACE, a pointer can be valid
+for both, and the check always fails because access_ok() returns true.
+
+Make the check for user space pointers conditional on the type of
+address space layout.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_lockup.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/test_lockup.c b/lib/test_lockup.c
+index 6a0f329a794a..c3fd87d6c2dd 100644
+--- a/lib/test_lockup.c
++++ b/lib/test_lockup.c
+@@ -417,9 +417,14 @@ static bool test_kernel_ptr(unsigned long addr, int size)
+ 		return false;
+ 
+ 	/* should be at least readable kernel address */
+-	if (access_ok((void __user *)ptr, 1) ||
+-	    access_ok((void __user *)ptr + size - 1, 1) ||
+-	    get_kernel_nofault(buf, ptr) ||
++	if (!IS_ENABLED(CONFIG_ALTERNATE_USER_ADDRESS_SPACE) &&
++	    (access_ok((void __user *)ptr, 1) ||
++	     access_ok((void __user *)ptr + size - 1, 1))) {
++		pr_err("user space ptr invalid in kernel: %#lx\n", addr);
++		return true;
++	}
++
++	if (get_kernel_nofault(buf, ptr) ||
+ 	    get_kernel_nofault(buf, ptr + size - 1)) {
+ 		pr_err("invalid kernel ptr: %#lx\n", addr);
+ 		return true;
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-fix-compilation-warning-due-to-mismatched-pri.patch b/queue-5.16/libbpf-fix-compilation-warning-due-to-mismatched-pri.patch
new file mode 100644
index 00000000000..aa890bb0bab
--- /dev/null
+++ b/queue-5.16/libbpf-fix-compilation-warning-due-to-mismatched-pri.patch
@@ -0,0 +1,38 @@
+From 18e65c1b98bfe8ad72c6249414ac0cd61f67ffc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 22:39:09 -0800
+Subject: libbpf: Fix compilation warning due to mismatched printf format
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit dc37dc617fabfb1c3a16d49f5d8cc20e9e3608ca ]
+
+On ppc64le architecture __s64 is long int and requires %ld. Cast to
+ssize_t and use %zd to avoid architecture-specific specifiers.
+
+Fixes: 4172843ed4a3 ("libbpf: Fix signedness bug in btf_dump_array_data()")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220209063909.1268319-1-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index 700dfd362c4a..f2ab392a0e34 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -1847,7 +1847,8 @@ static int btf_dump_array_data(struct btf_dump *d,
+ 	elem_type = skip_mods_and_typedefs(d->btf, elem_type_id, NULL);
+ 	elem_size = btf__resolve_size(d->btf, elem_type_id);
+ 	if (elem_size <= 0) {
+-		pr_warn("unexpected elem size %lld for array type [%u]\n", elem_size, id);
++		pr_warn("unexpected elem size %zd for array type [%u]\n",
++			(ssize_t)elem_size, id);
+ 		return -EINVAL;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-fix-memleak-in-libbpf_netlink_recv.patch b/queue-5.16/libbpf-fix-memleak-in-libbpf_netlink_recv.patch
new file mode 100644
index 00000000000..eafea078988
--- /dev/null
+++ b/queue-5.16/libbpf-fix-memleak-in-libbpf_netlink_recv.patch
@@ -0,0 +1,55 @@
+From 1bebd9ee281d5efcb8b10f3bf53cac8f4b0cffb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 23:39:58 -0800
+Subject: libbpf: Fix memleak in libbpf_netlink_recv()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 1b8c924a05934d2e758ec7da7bd217ef8ebd80ce ]
+
+Ensure that libbpf_netlink_recv() frees dynamically allocated buffer in
+all code paths.
+
+Fixes: 9c3de619e13e ("libbpf: Use dynamically allocated buffer when receiving netlink messages")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/bpf/20220217073958.276959-1-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/netlink.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index 69b353d55dbf..fadde7d80a51 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -176,7 +176,8 @@ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq,
+ 				libbpf_nla_dump_errormsg(nh);
+ 				goto done;
+ 			case NLMSG_DONE:
+-				return 0;
++				ret = 0;
++				goto done;
+ 			default:
+ 				break;
+ 			}
+@@ -188,9 +189,10 @@ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq,
+ 				case NL_NEXT:
+ 					goto start;
+ 				case NL_DONE:
+-					return 0;
++					ret = 0;
++					goto done;
+ 				default:
+-					return ret;
++					goto done;
+ 				}
+ 			}
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-fix-possible-null-pointer-dereference-when-de.patch b/queue-5.16/libbpf-fix-possible-null-pointer-dereference-when-de.patch
new file mode 100644
index 00000000000..926f2873d0c
--- /dev/null
+++ b/queue-5.16/libbpf-fix-possible-null-pointer-dereference-when-de.patch
@@ -0,0 +1,59 @@
+From 7efd373ee7df24f7862f1b3e4c9b0a8059be22d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 13:47:39 +0000
+Subject: libbpf: Fix possible NULL pointer dereference when destroying
+ skeleton
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit a32ea51a3f17ce6524c9fc19d311e708331c8b5f ]
+
+When I checked the code in skeleton header file generated with my own
+bpf prog, I found there may be possible NULL pointer dereference when
+destroying skeleton. Then I checked the in-tree bpf progs, finding that is
+a common issue. Let's take the generated samples/bpf/xdp_redirect_cpu.skel.h
+for example. Below is the generated code in
+xdp_redirect_cpu__create_skeleton():
+
+	xdp_redirect_cpu__create_skeleton
+		struct bpf_object_skeleton *s;
+		s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
+		if (!s)
+			goto error;
+		...
+	error:
+		bpf_object__destroy_skeleton(s);
+		return  -ENOMEM;
+
+After goto error, the NULL 's' will be deferenced in
+bpf_object__destroy_skeleton().
+
+We can simply fix this issue by just adding a NULL check in
+bpf_object__destroy_skeleton().
+
+Fixes: d66562fba1ce ("libbpf: Add BPF object skeleton support")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220108134739.32541-1-laoar.shao@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index c7ba5e6ed9cf..23edb41637d4 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -11497,6 +11497,9 @@ void bpf_object__detach_skeleton(struct bpf_object_skeleton *s)
+ 
+ void bpf_object__destroy_skeleton(struct bpf_object_skeleton *s)
+ {
++	if (!s)
++		return;
++
+ 	if (s->progs)
+ 		bpf_object__detach_skeleton(s);
+ 	if (s->obj)
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-fix-signedness-bug-in-btf_dump_array_data.patch b/queue-5.16/libbpf-fix-signedness-bug-in-btf_dump_array_data.patch
new file mode 100644
index 00000000000..da16ad0b475
--- /dev/null
+++ b/queue-5.16/libbpf-fix-signedness-bug-in-btf_dump_array_data.patch
@@ -0,0 +1,47 @@
+From 8f4b336fd5d2f8940706fd454a2a83139dcf6b6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 10:15:52 +0300
+Subject: libbpf: Fix signedness bug in btf_dump_array_data()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4172843ed4a38f97084032f74f07b2037b5da3a6 ]
+
+The btf__resolve_size() function returns negative error codes so
+"elem_size" must be signed for the error handling to work.
+
+Fixes: 920d16af9b42 ("libbpf: BTF dumper support for typed data")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20220208071552.GB10495@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index 5cae71600631..700dfd362c4a 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -1839,14 +1839,15 @@ static int btf_dump_array_data(struct btf_dump *d,
+ {
+ 	const struct btf_array *array = btf_array(t);
+ 	const struct btf_type *elem_type;
+-	__u32 i, elem_size = 0, elem_type_id;
++	__u32 i, elem_type_id;
++	__s64 elem_size;
+ 	bool is_array_member;
+ 
+ 	elem_type_id = array->type;
+ 	elem_type = skip_mods_and_typedefs(d->btf, elem_type_id, NULL);
+ 	elem_size = btf__resolve_size(d->btf, elem_type_id);
+ 	if (elem_size <= 0) {
+-		pr_warn("unexpected elem size %d for array type [%u]\n", elem_size, id);
++		pr_warn("unexpected elem size %lld for array type [%u]\n", elem_size, id);
+ 		return -EINVAL;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-skip-forward-declaration-when-counting-duplic.patch b/queue-5.16/libbpf-skip-forward-declaration-when-counting-duplic.patch
new file mode 100644
index 00000000000..3de6358e18a
--- /dev/null
+++ b/queue-5.16/libbpf-skip-forward-declaration-when-counting-duplic.patch
@@ -0,0 +1,54 @@
+From eb3b8320d961752f8021528b02f27a77d55fe1c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 00:32:49 -0500
+Subject: libbpf: Skip forward declaration when counting duplicated type names
+
+From: Xu Kuohai <xukuohai@huawei.com>
+
+[ Upstream commit 4226961b0019b2e1612029e8950a9e911affc995 ]
+
+Currently if a declaration appears in the BTF before the definition, the
+definition is dumped as a conflicting name, e.g.:
+
+    $ bpftool btf dump file vmlinux format raw | grep "'unix_sock'"
+    [81287] FWD 'unix_sock' fwd_kind=struct
+    [89336] STRUCT 'unix_sock' size=1024 vlen=14
+
+    $ bpftool btf dump file vmlinux format c | grep "struct unix_sock"
+    struct unix_sock;
+    struct unix_sock___2 {	<--- conflict, the "___2" is unexpected
+		    struct unix_sock___2 *unix_sk;
+
+This causes a compilation error if the dump output is used as a header file.
+
+Fix it by skipping declaration when counting duplicated type names.
+
+Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion")
+Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20220301053250.1464204-2-xukuohai@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index f2ab392a0e34..96af8c4ecf78 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -1483,6 +1483,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id,
+ 	if (s->name_resolved)
+ 		return *cached_name ? *cached_name : orig_name;
+ 
++	if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) {
++		s->name_resolved = 1;
++		return orig_name;
++	}
++
+ 	dup_cnt = btf_dump_name_dups(d, name_map, orig_name);
+ 	if (dup_cnt > 1) {
+ 		const size_t max_len = 256;
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-unmap-rings-when-umem-deleted.patch b/queue-5.16/libbpf-unmap-rings-when-umem-deleted.patch
new file mode 100644
index 00000000000..b91cafeb9a3
--- /dev/null
+++ b/queue-5.16/libbpf-unmap-rings-when-umem-deleted.patch
@@ -0,0 +1,60 @@
+From 93f858479cdd8ce2fbb21aa7ca12d04e32093d7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 13:26:23 +0000
+Subject: libbpf: Unmap rings when umem deleted
+
+From: lic121 <lic121@chinatelecom.cn>
+
+[ Upstream commit 9c6e6a80ee741adf6cb3cfd8eef7d1554f91fceb ]
+
+xsk_umem__create() does mmap for fill/comp rings, but xsk_umem__delete()
+doesn't do the unmap. This works fine for regular cases, because
+xsk_socket__delete() does unmap for the rings. But for the case that
+xsk_socket__create_shared() fails, umem rings are not unmapped.
+
+fill_save/comp_save are checked to determine if rings have already be
+unmapped by xsk. If fill_save and comp_save are NULL, it means that the
+rings have already been used by xsk. Then they are supposed to be
+unmapped by xsk_socket__delete(). Otherwise, xsk_umem__delete() does the
+unmap.
+
+Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices")
+Signed-off-by: Cheng Li <lic121@chinatelecom.cn>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220301132623.GA19995@vscode.7~
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index 81f8fbc85e70..c43b4d94346d 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -1210,12 +1210,23 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname,
+ 
+ int xsk_umem__delete(struct xsk_umem *umem)
+ {
++	struct xdp_mmap_offsets off;
++	int err;
++
+ 	if (!umem)
+ 		return 0;
+ 
+ 	if (umem->refcount)
+ 		return -EBUSY;
+ 
++	err = xsk_get_mmap_offsets(umem->fd, &off);
++	if (!err && umem->fill_save && umem->comp_save) {
++		munmap(umem->fill_save->ring - off.fr.desc,
++		       off.fr.desc + umem->config.fill_size * sizeof(__u64));
++		munmap(umem->comp_save->ring - off.cr.desc,
++		       off.cr.desc + umem->config.comp_size * sizeof(__u64));
++	}
++
+ 	close(umem->fd);
+ 	free(umem);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/libbpf-use-dynamically-allocated-buffer-when-receivi.patch b/queue-5.16/libbpf-use-dynamically-allocated-buffer-when-receivi.patch
new file mode 100644
index 00000000000..164b73e7630
--- /dev/null
+++ b/queue-5.16/libbpf-use-dynamically-allocated-buffer-when-receivi.patch
@@ -0,0 +1,135 @@
+From 2eaf12a625e30f19ad8de9fc01704d4165cce982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 00:48:19 +0100
+Subject: libbpf: Use dynamically allocated buffer when receiving netlink
+ messages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 9c3de619e13ee6693ec5ac74f50b7aa89056a70e ]
+
+When receiving netlink messages, libbpf was using a statically allocated
+stack buffer of 4k bytes. This happened to work fine on systems with a 4k
+page size, but on systems with larger page sizes it can lead to truncated
+messages. The user-visible impact of this was that libbpf would insist no
+XDP program was attached to some interfaces because that bit of the netlink
+message got chopped off.
+
+Fix this by switching to a dynamically allocated buffer; we borrow the
+approach from iproute2 of using recvmsg() with MSG_PEEK|MSG_TRUNC to get
+the actual size of the pending message before receiving it, adjusting the
+buffer as necessary. While we're at it, also add retries on interrupted
+system calls around the recvmsg() call.
+
+v2:
+  - Move peek logic to libbpf_netlink_recv(), don't double free on ENOMEM.
+
+Fixes: 8bbb77b7c7a2 ("libbpf: Add various netlink helpers")
+Reported-by: Zhiqian Guan <zhguan@redhat.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/bpf/20220211234819.612288-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/netlink.c | 55 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 51 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index 39f25e09b51e..69b353d55dbf 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -87,29 +87,75 @@ enum {
+ 	NL_DONE,
+ };
+ 
++static int netlink_recvmsg(int sock, struct msghdr *mhdr, int flags)
++{
++	int len;
++
++	do {
++		len = recvmsg(sock, mhdr, flags);
++	} while (len < 0 && (errno == EINTR || errno == EAGAIN));
++
++	if (len < 0)
++		return -errno;
++	return len;
++}
++
++static int alloc_iov(struct iovec *iov, int len)
++{
++	void *nbuf;
++
++	nbuf = realloc(iov->iov_base, len);
++	if (!nbuf)
++		return -ENOMEM;
++
++	iov->iov_base = nbuf;
++	iov->iov_len = len;
++	return 0;
++}
++
+ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq,
+ 			       __dump_nlmsg_t _fn, libbpf_dump_nlmsg_t fn,
+ 			       void *cookie)
+ {
++	struct iovec iov = {};
++	struct msghdr mhdr = {
++		.msg_iov = &iov,
++		.msg_iovlen = 1,
++	};
+ 	bool multipart = true;
+ 	struct nlmsgerr *err;
+ 	struct nlmsghdr *nh;
+-	char buf[4096];
+ 	int len, ret;
+ 
++	ret = alloc_iov(&iov, 4096);
++	if (ret)
++		goto done;
++
+ 	while (multipart) {
+ start:
+ 		multipart = false;
+-		len = recv(sock, buf, sizeof(buf), 0);
++		len = netlink_recvmsg(sock, &mhdr, MSG_PEEK | MSG_TRUNC);
++		if (len < 0) {
++			ret = len;
++			goto done;
++		}
++
++		if (len > iov.iov_len) {
++			ret = alloc_iov(&iov, len);
++			if (ret)
++				goto done;
++		}
++
++		len = netlink_recvmsg(sock, &mhdr, 0);
+ 		if (len < 0) {
+-			ret = -errno;
++			ret = len;
+ 			goto done;
+ 		}
+ 
+ 		if (len == 0)
+ 			break;
+ 
+-		for (nh = (struct nlmsghdr *)buf; NLMSG_OK(nh, len);
++		for (nh = (struct nlmsghdr *)iov.iov_base; NLMSG_OK(nh, len);
+ 		     nh = NLMSG_NEXT(nh, len)) {
+ 			if (nh->nlmsg_pid != nl_pid) {
+ 				ret = -LIBBPF_ERRNO__WRNGPID;
+@@ -151,6 +197,7 @@ static int libbpf_netlink_recv(int sock, __u32 nl_pid, int seq,
+ 	}
+ 	ret = 0;
+ done:
++	free(iov.iov_base);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/livepatch-fix-build-failure-on-32-bits-processors.patch b/queue-5.16/livepatch-fix-build-failure-on-32-bits-processors.patch
new file mode 100644
index 00000000000..53252b44dad
--- /dev/null
+++ b/queue-5.16/livepatch-fix-build-failure-on-32-bits-processors.patch
@@ -0,0 +1,67 @@
+From 5cc90d79d590f89fed79812314cad9c9b74bdb7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Dec 2021 16:38:02 +0000
+Subject: livepatch: Fix build failure on 32 bits processors
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 2f293651eca3eacaeb56747dede31edace7329d2 ]
+
+Trying to build livepatch on powerpc/32 results in:
+
+	kernel/livepatch/core.c: In function 'klp_resolve_symbols':
+	kernel/livepatch/core.c:221:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+	  221 |                 sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
+	      |                       ^
+	kernel/livepatch/core.c:221:21: error: assignment to 'Elf32_Sym *' {aka 'struct elf32_sym *'} from incompatible pointer type 'Elf64_Sym *' {aka 'struct elf64_sym *'} [-Werror=incompatible-pointer-types]
+	  221 |                 sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
+	      |                     ^
+	kernel/livepatch/core.c: In function 'klp_apply_section_relocs':
+	kernel/livepatch/core.c:312:35: error: passing argument 1 of 'klp_resolve_symbols' from incompatible pointer type [-Werror=incompatible-pointer-types]
+	  312 |         ret = klp_resolve_symbols(sechdrs, strtab, symndx, sec, sec_objname);
+	      |                                   ^~~~~~~
+	      |                                   |
+	      |                                   Elf32_Shdr * {aka struct elf32_shdr *}
+	kernel/livepatch/core.c:193:44: note: expected 'Elf64_Shdr *' {aka 'struct elf64_shdr *'} but argument is of type 'Elf32_Shdr *' {aka 'struct elf32_shdr *'}
+	  193 | static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
+	      |                                ~~~~~~~~~~~~^~~~~~~
+
+Fix it by using the right types instead of forcing 64 bits types.
+
+Fixes: 7c8e2bdd5f0d ("livepatch: Apply vmlinux-specific KLP relocations early")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/5288e11b018a762ea3351cc8fb2d4f15093a4457.1640017960.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/livepatch/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index 335d988bd811..c0789383807b 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -190,7 +190,7 @@ static int klp_find_object_symbol(const char *objname, const char *name,
+ 	return -EINVAL;
+ }
+ 
+-static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
++static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab,
+ 			       unsigned int symndx, Elf_Shdr *relasec,
+ 			       const char *sec_objname)
+ {
+@@ -218,7 +218,7 @@ static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
+ 	relas = (Elf_Rela *) relasec->sh_addr;
+ 	/* For each rela in this klp relocation section */
+ 	for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) {
+-		sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
++		sym = (Elf_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
+ 		if (sym->st_shndx != SHN_LIVEPATCH) {
+ 			pr_err("symbol %s is not marked as a livepatch symbol\n",
+ 			       strtab + sym->st_name);
+-- 
+2.34.1
+
diff --git a/queue-5.16/locking-lockdep-iterate-lock_classes-directly-when-r.patch b/queue-5.16/locking-lockdep-iterate-lock_classes-directly-when-r.patch
new file mode 100644
index 00000000000..69443da335d
--- /dev/null
+++ b/queue-5.16/locking-lockdep-iterate-lock_classes-directly-when-r.patch
@@ -0,0 +1,255 @@
+From 61239243b17a179d38ef4bdbb8050e8ab8a12232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 22:55:26 -0500
+Subject: locking/lockdep: Iterate lock_classes directly when reading lockdep
+ files
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit fb7275acd6fb988313dddd8d3d19efa70d9015ad ]
+
+When dumping lock_classes information via /proc/lockdep, we can't take
+the lockdep lock as the lock hold time is indeterminate. Iterating
+over all_lock_classes without holding lock can be dangerous as there
+is a slight chance that it may branch off to other lists leading to
+infinite loop or even access invalid memory if changes are made to
+all_lock_classes list in parallel.
+
+To avoid this problem, iteration of lock classes is now done directly
+on the lock_classes array itself. The lock_classes_in_use bitmap is
+checked to see if the lock class is being used. To avoid iterating
+the full array all the times, a new max_lock_class_idx value is added
+to track the maximum lock_class index that is currently being used.
+
+We can theoretically take the lockdep lock for iterating all_lock_classes
+when other lockdep files (lockdep_stats and lock_stat) are accessed as
+the lock hold time will be shorter for them. For consistency, they are
+also modified to iterate the lock_classes array directly.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20220211035526.1329503-2-longman@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/lockdep.c           | 14 +++++---
+ kernel/locking/lockdep_internals.h |  6 ++--
+ kernel/locking/lockdep_proc.c      | 51 +++++++++++++++++++++++++-----
+ 3 files changed, 56 insertions(+), 15 deletions(-)
+
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 220913a84494..55570f52de5a 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -183,11 +183,9 @@ static DECLARE_BITMAP(list_entries_in_use, MAX_LOCKDEP_ENTRIES);
+ static struct hlist_head lock_keys_hash[KEYHASH_SIZE];
+ unsigned long nr_lock_classes;
+ unsigned long nr_zapped_classes;
+-#ifndef CONFIG_DEBUG_LOCKDEP
+-static
+-#endif
++unsigned long max_lock_class_idx;
+ struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
+-static DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS);
++DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS);
+ 
+ static inline struct lock_class *hlock_class(struct held_lock *hlock)
+ {
+@@ -338,7 +336,7 @@ static inline void lock_release_holdtime(struct held_lock *hlock)
+  * elements. These elements are linked together by the lock_entry member in
+  * struct lock_class.
+  */
+-LIST_HEAD(all_lock_classes);
++static LIST_HEAD(all_lock_classes);
+ static LIST_HEAD(free_lock_classes);
+ 
+ /**
+@@ -1252,6 +1250,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
+ 	struct lockdep_subclass_key *key;
+ 	struct hlist_head *hash_head;
+ 	struct lock_class *class;
++	int idx;
+ 
+ 	DEBUG_LOCKS_WARN_ON(!irqs_disabled());
+ 
+@@ -1317,6 +1316,9 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
+ 	 * of classes.
+ 	 */
+ 	list_move_tail(&class->lock_entry, &all_lock_classes);
++	idx = class - lock_classes;
++	if (idx > max_lock_class_idx)
++		max_lock_class_idx = idx;
+ 
+ 	if (verbose(class)) {
+ 		graph_unlock();
+@@ -5998,6 +6000,8 @@ static void zap_class(struct pending_free *pf, struct lock_class *class)
+ 		WRITE_ONCE(class->name, NULL);
+ 		nr_lock_classes--;
+ 		__clear_bit(class - lock_classes, lock_classes_in_use);
++		if (class - lock_classes == max_lock_class_idx)
++			max_lock_class_idx--;
+ 	} else {
+ 		WARN_ONCE(true, "%s() failed for class %s\n", __func__,
+ 			  class->name);
+diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h
+index ecb8662e7a4e..bbe9000260d0 100644
+--- a/kernel/locking/lockdep_internals.h
++++ b/kernel/locking/lockdep_internals.h
+@@ -121,7 +121,6 @@ static const unsigned long LOCKF_USED_IN_IRQ_READ =
+ 
+ #define MAX_LOCKDEP_CHAIN_HLOCKS (MAX_LOCKDEP_CHAINS*5)
+ 
+-extern struct list_head all_lock_classes;
+ extern struct lock_chain lock_chains[];
+ 
+ #define LOCK_USAGE_CHARS (2*XXX_LOCK_USAGE_STATES + 1)
+@@ -151,6 +150,10 @@ extern unsigned int nr_large_chain_blocks;
+ 
+ extern unsigned int max_lockdep_depth;
+ extern unsigned int max_bfs_queue_depth;
++extern unsigned long max_lock_class_idx;
++
++extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
++extern unsigned long lock_classes_in_use[];
+ 
+ #ifdef CONFIG_PROVE_LOCKING
+ extern unsigned long lockdep_count_forward_deps(struct lock_class *);
+@@ -205,7 +208,6 @@ struct lockdep_stats {
+ };
+ 
+ DECLARE_PER_CPU(struct lockdep_stats, lockdep_stats);
+-extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
+ 
+ #define __debug_atomic_inc(ptr)					\
+ 	this_cpu_inc(lockdep_stats.ptr);
+diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
+index b8d9a050c337..15fdc7fa5c68 100644
+--- a/kernel/locking/lockdep_proc.c
++++ b/kernel/locking/lockdep_proc.c
+@@ -24,14 +24,33 @@
+ 
+ #include "lockdep_internals.h"
+ 
++/*
++ * Since iteration of lock_classes is done without holding the lockdep lock,
++ * it is not safe to iterate all_lock_classes list directly as the iteration
++ * may branch off to free_lock_classes or the zapped list. Iteration is done
++ * directly on the lock_classes array by checking the lock_classes_in_use
++ * bitmap and max_lock_class_idx.
++ */
++#define iterate_lock_classes(idx, class)				\
++	for (idx = 0, class = lock_classes; idx <= max_lock_class_idx;	\
++	     idx++, class++)
++
+ static void *l_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+-	return seq_list_next(v, &all_lock_classes, pos);
++	struct lock_class *class = v;
++
++	++class;
++	*pos = class - lock_classes;
++	return (*pos > max_lock_class_idx) ? NULL : class;
+ }
+ 
+ static void *l_start(struct seq_file *m, loff_t *pos)
+ {
+-	return seq_list_start_head(&all_lock_classes, *pos);
++	unsigned long idx = *pos;
++
++	if (idx > max_lock_class_idx)
++		return NULL;
++	return lock_classes + idx;
+ }
+ 
+ static void l_stop(struct seq_file *m, void *v)
+@@ -57,14 +76,16 @@ static void print_name(struct seq_file *m, struct lock_class *class)
+ 
+ static int l_show(struct seq_file *m, void *v)
+ {
+-	struct lock_class *class = list_entry(v, struct lock_class, lock_entry);
++	struct lock_class *class = v;
+ 	struct lock_list *entry;
+ 	char usage[LOCK_USAGE_CHARS];
++	int idx = class - lock_classes;
+ 
+-	if (v == &all_lock_classes) {
++	if (v == lock_classes)
+ 		seq_printf(m, "all lock classes:\n");
++
++	if (!test_bit(idx, lock_classes_in_use))
+ 		return 0;
+-	}
+ 
+ 	seq_printf(m, "%p", class->key);
+ #ifdef CONFIG_DEBUG_LOCKDEP
+@@ -220,8 +241,11 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ 
+ #ifdef CONFIG_PROVE_LOCKING
+ 	struct lock_class *class;
++	unsigned long idx;
+ 
+-	list_for_each_entry(class, &all_lock_classes, lock_entry) {
++	iterate_lock_classes(idx, class) {
++		if (!test_bit(idx, lock_classes_in_use))
++			continue;
+ 
+ 		if (class->usage_mask == 0)
+ 			nr_unused++;
+@@ -254,6 +278,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ 
+ 		sum_forward_deps += lockdep_count_forward_deps(class);
+ 	}
++
+ #ifdef CONFIG_DEBUG_LOCKDEP
+ 	DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
+ #endif
+@@ -345,6 +370,8 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ 	seq_printf(m, " max bfs queue depth:           %11u\n",
+ 			max_bfs_queue_depth);
+ #endif
++	seq_printf(m, " max lock class index:          %11lu\n",
++			max_lock_class_idx);
+ 	lockdep_stats_debug_show(m);
+ 	seq_printf(m, " debug_locks:                   %11u\n",
+ 			debug_locks);
+@@ -622,12 +649,16 @@ static int lock_stat_open(struct inode *inode, struct file *file)
+ 	if (!res) {
+ 		struct lock_stat_data *iter = data->stats;
+ 		struct seq_file *m = file->private_data;
++		unsigned long idx;
+ 
+-		list_for_each_entry(class, &all_lock_classes, lock_entry) {
++		iterate_lock_classes(idx, class) {
++			if (!test_bit(idx, lock_classes_in_use))
++				continue;
+ 			iter->class = class;
+ 			iter->stats = lock_stats(class);
+ 			iter++;
+ 		}
++
+ 		data->iter_end = iter;
+ 
+ 		sort(data->stats, data->iter_end - data->stats,
+@@ -645,6 +676,7 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf,
+ 			       size_t count, loff_t *ppos)
+ {
+ 	struct lock_class *class;
++	unsigned long idx;
+ 	char c;
+ 
+ 	if (count) {
+@@ -654,8 +686,11 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf,
+ 		if (c != '0')
+ 			return count;
+ 
+-		list_for_each_entry(class, &all_lock_classes, lock_entry)
++		iterate_lock_classes(idx, class) {
++			if (!test_bit(idx, lock_classes_in_use))
++				continue;
+ 			clear_lock_stats(class);
++		}
+ 	}
+ 	return count;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch b/queue-5.16/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
new file mode 100644
index 00000000000..e7d1929b4fe
--- /dev/null
+++ b/queue-5.16/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
@@ -0,0 +1,73 @@
+From d98ab1ded9e5975433e7026f3549164965a898de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 13:33:07 -0800
+Subject: loop: use sysfs_emit() in the sysfs xxx show()
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit b27824d31f09ea7b4a6ba2c1b18bd328df3e8bed ]
+
+sprintf does not know the PAGE_SIZE maximum of the temporary buffer
+used for outputting sysfs content and it's possible to overrun the
+PAGE_SIZE buffer length.
+
+Use a generic sysfs_emit function that knows the size of the
+temporary buffer and ensures that no overrun is done for offset
+attribute in
+loop_attr_[offset|sizelimit|autoclear|partscan|dio]_show() callbacks.
+
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Link: https://lore.kernel.org/r/20220215213310.7264-2-kch@nvidia.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index fdb4798cb006..1422967bf5c1 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -681,33 +681,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
+ 
+ static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf)
+ {
+-	return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset);
++	return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset);
+ }
+ 
+ static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf)
+ {
+-	return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
++	return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
+ }
+ 
+ static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf)
+ {
+ 	int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR);
+ 
+-	return sprintf(buf, "%s\n", autoclear ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0");
+ }
+ 
+ static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf)
+ {
+ 	int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN);
+ 
+-	return sprintf(buf, "%s\n", partscan ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", partscan ? "1" : "0");
+ }
+ 
+ static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf)
+ {
+ 	int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO);
+ 
+-	return sprintf(buf, "%s\n", dio ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", dio ? "1" : "0");
+ }
+ 
+ LOOP_ATTR_RO(backing_file);
+-- 
+2.34.1
+
diff --git a/queue-5.16/lsm-general-protection-fault-in-legacy_parse_param.patch b/queue-5.16/lsm-general-protection-fault-in-legacy_parse_param.patch
new file mode 100644
index 00000000000..a0721db3bf9
--- /dev/null
+++ b/queue-5.16/lsm-general-protection-fault-in-legacy_parse_param.patch
@@ -0,0 +1,79 @@
+From f24765972470dd5c55c68ed8bf7f8e7b4ddec3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 04:51:00 +0000
+Subject: LSM: general protection fault in legacy_parse_param
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ]
+
+The usual LSM hook "bail on fail" scheme doesn't work for cases where
+a security module may return an error code indicating that it does not
+recognize an input.  In this particular case Smack sees a mount option
+that it recognizes, and returns 0. A call to a BPF hook follows, which
+returns -ENOPARAM, which confuses the caller because Smack has processed
+its data.
+
+The SELinux hook incorrectly returns 1 on success. There was a time
+when this was correct, however the current expectation is that it
+return 0 on success. This is repaired.
+
+Reported-by: syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Acked-by: James Morris <jamorris@linux.microsoft.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/security.c      | 17 +++++++++++++++--
+ security/selinux/hooks.c |  5 ++---
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/security/security.c b/security/security.c
+index cf6615b5e820..745a8bf66d91 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -884,9 +884,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
+ 	return call_int_hook(fs_context_dup, 0, fc, src_fc);
+ }
+ 
+-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param)
++int security_fs_context_parse_param(struct fs_context *fc,
++				    struct fs_parameter *param)
+ {
+-	return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
++	struct security_hook_list *hp;
++	int trc;
++	int rc = -ENOPARAM;
++
++	hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
++			     list) {
++		trc = hp->hook.fs_context_parse_param(fc, param);
++		if (trc == 0)
++			rc = 0;
++		else if (trc != -ENOPARAM)
++			return trc;
++	}
++	return rc;
+ }
+ 
+ int security_sb_alloc(struct super_block *sb)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 93eac9464c5f..69b0709bd156 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2916,10 +2916,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc,
+ 		return opt;
+ 
+ 	rc = selinux_add_opt(opt, param->string, &fc->security);
+-	if (!rc) {
++	if (!rc)
+ 		param->string = NULL;
+-		rc = 1;
+-	}
++
+ 	return rc;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch b/queue-5.16/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch
new file mode 100644
index 00000000000..9fbfcf86380
--- /dev/null
+++ b/queue-5.16/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch
@@ -0,0 +1,84 @@
+From f69fff9d2026d28d9d97ddd37573315c7d01e54d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 22:40:36 -0800
+Subject: m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are
+ defined
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e6e1e7b19fa132d23d09c465942aab4c110d3da9 ]
+
+When CONFIG_MCF_EDMA is set (due to COMPILE_TEST, not due to
+CONFIG_M5441x), coldfire/device.c has compile errors due to
+missing MCFEDMA_* symbols. In the .config file that was provided,
+CONFIG_M5206=y, not CONFIG_M5441x, so <asm/m5441xsim.h> is not
+included in coldfire/device.c.
+
+Only build the MCF_EDMA code in coldfire/device.c if the MCFEDMA_*
+hardware macros are defined.
+
+Fixes these build errors:
+
+../arch/m68k/coldfire/device.c:512:35: error: 'MCFEDMA_BASE' undeclared here (not in a function); did you mean 'MCFDMA_BASE1'?
+  512 |                 .start          = MCFEDMA_BASE,
+../arch/m68k/coldfire/device.c:513:50: error: 'MCFEDMA_SIZE' undeclared here (not in a function)
+  513 |                 .end            = MCFEDMA_BASE + MCFEDMA_SIZE - 1,
+../arch/m68k/coldfire/device.c:517:35: error: 'MCFEDMA_IRQ_INTR0' undeclared here (not in a function)
+  517 |                 .start          = MCFEDMA_IRQ_INTR0,
+../arch/m68k/coldfire/device.c:523:35: error: 'MCFEDMA_IRQ_INTR16' undeclared here (not in a function)
+  523 |                 .start          = MCFEDMA_IRQ_INTR16,
+../arch/m68k/coldfire/device.c:529:35: error: 'MCFEDMA_IRQ_INTR56' undeclared here (not in a function)
+  529 |                 .start          = MCFEDMA_IRQ_INTR56,
+../arch/m68k/coldfire/device.c:535:35: error: 'MCFEDMA_IRQ_ERR' undeclared here (not in a function)
+  535 |                 .start          = MCFEDMA_IRQ_ERR,
+
+Fixes: d7e9d01ac292 ("m68k: add ColdFire mcf5441x eDMA platform support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: lore.kernel.org/r/202203030252.P752DK46-lkp@intel.com
+Cc: Angelo Dureghello <angelo@sysam.it>
+Cc: Greg Ungerer <gerg@kernel.org>
+Cc: Greg Ungerer <gerg@linux-m68k.org>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: linux-m68k@lists.linux-m68k.org
+Cc: uclinux-dev@uclinux.org
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/coldfire/device.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c
+index 0386252e9d04..4218750414bb 100644
+--- a/arch/m68k/coldfire/device.c
++++ b/arch/m68k/coldfire/device.c
+@@ -480,7 +480,7 @@ static struct platform_device mcf_i2c5 = {
+ #endif /* MCFI2C_BASE5 */
+ #endif /* IS_ENABLED(CONFIG_I2C_IMX) */
+ 
+-#if IS_ENABLED(CONFIG_MCF_EDMA)
++#ifdef MCFEDMA_BASE
+ 
+ static const struct dma_slave_map mcf_edma_map[] = {
+ 	{ "dreq0", "rx-tx", MCF_EDMA_FILTER_PARAM(0) },
+@@ -552,7 +552,7 @@ static struct platform_device mcf_edma = {
+ 		.platform_data = &mcf_edma_data,
+ 	}
+ };
+-#endif /* IS_ENABLED(CONFIG_MCF_EDMA) */
++#endif /* MCFEDMA_BASE */
+ 
+ #ifdef MCFSDHC_BASE
+ static struct mcf_esdhc_platform_data mcf_esdhc_data = {
+@@ -651,7 +651,7 @@ static struct platform_device *mcf_devices[] __initdata = {
+ 	&mcf_i2c5,
+ #endif
+ #endif
+-#if IS_ENABLED(CONFIG_MCF_EDMA)
++#ifdef MCFEDMA_BASE
+ 	&mcf_edma,
+ #endif
+ #ifdef MCFSDHC_BASE
+-- 
+2.34.1
+
diff --git a/queue-5.16/mac80211-limit-bandwidth-in-he-capabilities.patch b/queue-5.16/mac80211-limit-bandwidth-in-he-capabilities.patch
new file mode 100644
index 00000000000..3e78ce43de4
--- /dev/null
+++ b/queue-5.16/mac80211-limit-bandwidth-in-he-capabilities.patch
@@ -0,0 +1,155 @@
+From b93bae2c8ab840c8717726498d72b4b8916a1307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 10:49:34 +0200
+Subject: mac80211: limit bandwidth in HE capabilities
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1f2c104448477512fcf7296df54bfbc3a6f9a765 ]
+
+If we're limiting bandwidth for some reason such as regulatory
+restrictions, then advertise that limitation just like we do
+for VHT today, so the AP is aware we cannot use the higher BW
+it might be using.
+
+Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20220202104617.70c8e3e7ee76.If317630de69ff1146bec7d47f5b83038695eb71d@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h |  2 +-
+ net/mac80211/mesh.c        |  2 +-
+ net/mac80211/mlme.c        | 11 ++++++++---
+ net/mac80211/util.c        | 27 ++++++++++++++++++++++-----
+ 4 files changed, 32 insertions(+), 10 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 3354a3b905b8..541723babcf0 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2380,7 +2380,7 @@ u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
+ u8 *ieee80211_ie_build_vht_oper(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
+ 				const struct cfg80211_chan_def *chandef);
+ u8 ieee80211_ie_len_he_cap(struct ieee80211_sub_if_data *sdata, u8 iftype);
+-u8 *ieee80211_ie_build_he_cap(u8 *pos,
++u8 *ieee80211_ie_build_he_cap(u32 disable_flags, u8 *pos,
+ 			      const struct ieee80211_sta_he_cap *he_cap,
+ 			      u8 *end);
+ void ieee80211_ie_build_he_6ghz_cap(struct ieee80211_sub_if_data *sdata,
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 15ac08d111ea..6847fdf93439 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -580,7 +580,7 @@ int mesh_add_he_cap_ie(struct ieee80211_sub_if_data *sdata,
+ 		return -ENOMEM;
+ 
+ 	pos = skb_put(skb, ie_len);
+-	ieee80211_ie_build_he_cap(pos, he_cap, pos + ie_len);
++	ieee80211_ie_build_he_cap(0, pos, he_cap, pos + ie_len);
+ 
+ 	return 0;
+ }
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 13496ba48514..ce56f23a4a1f 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -630,7 +630,7 @@ static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
+ 				struct sk_buff *skb,
+ 				struct ieee80211_supported_band *sband)
+ {
+-	u8 *pos;
++	u8 *pos, *pre_he_pos;
+ 	const struct ieee80211_sta_he_cap *he_cap = NULL;
+ 	struct ieee80211_chanctx_conf *chanctx_conf;
+ 	u8 he_cap_size;
+@@ -647,16 +647,21 @@ static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
+ 
+ 	he_cap = ieee80211_get_he_iftype_cap(sband,
+ 					     ieee80211_vif_type_p2p(&sdata->vif));
+-	if (!he_cap || !reg_cap)
++	if (!he_cap || !chanctx_conf || !reg_cap)
+ 		return;
+ 
++	/* get a max size estimate */
+ 	he_cap_size =
+ 		2 + 1 + sizeof(he_cap->he_cap_elem) +
+ 		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
+ 		ieee80211_he_ppe_size(he_cap->ppe_thres[0],
+ 				      he_cap->he_cap_elem.phy_cap_info);
+ 	pos = skb_put(skb, he_cap_size);
+-	ieee80211_ie_build_he_cap(pos, he_cap, pos + he_cap_size);
++	pre_he_pos = pos;
++	pos = ieee80211_ie_build_he_cap(sdata->u.mgd.flags,
++					pos, he_cap, pos + he_cap_size);
++	/* trim excess if any */
++	skb_trim(skb, skb->len - (pre_he_pos + he_cap_size - pos));
+ 
+ 	ieee80211_ie_build_he_6ghz_cap(sdata, skb);
+ }
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 0e4e1956bcea..49a9bbb12538 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1961,7 +1961,7 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_sub_if_data *sdata,
+ 	if (he_cap &&
+ 	    cfg80211_any_usable_channels(local->hw.wiphy, BIT(sband->band),
+ 					 IEEE80211_CHAN_NO_HE)) {
+-		pos = ieee80211_ie_build_he_cap(pos, he_cap, end);
++		pos = ieee80211_ie_build_he_cap(0, pos, he_cap, end);
+ 		if (!pos)
+ 			goto out_err;
+ 	}
+@@ -2905,10 +2905,11 @@ u8 ieee80211_ie_len_he_cap(struct ieee80211_sub_if_data *sdata, u8 iftype)
+ 				     he_cap->he_cap_elem.phy_cap_info);
+ }
+ 
+-u8 *ieee80211_ie_build_he_cap(u8 *pos,
++u8 *ieee80211_ie_build_he_cap(u32 disable_flags, u8 *pos,
+ 			      const struct ieee80211_sta_he_cap *he_cap,
+ 			      u8 *end)
+ {
++	struct ieee80211_he_cap_elem elem;
+ 	u8 n;
+ 	u8 ie_len;
+ 	u8 *orig_pos = pos;
+@@ -2921,7 +2922,23 @@ u8 *ieee80211_ie_build_he_cap(u8 *pos,
+ 	if (!he_cap)
+ 		return orig_pos;
+ 
+-	n = ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem);
++	/* modify on stack first to calculate 'n' and 'ie_len' correctly */
++	elem = he_cap->he_cap_elem;
++
++	if (disable_flags & IEEE80211_STA_DISABLE_40MHZ)
++		elem.phy_cap_info[0] &=
++			~(IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
++			  IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G);
++
++	if (disable_flags & IEEE80211_STA_DISABLE_160MHZ)
++		elem.phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++
++	if (disable_flags & IEEE80211_STA_DISABLE_80P80MHZ)
++		elem.phy_cap_info[0] &=
++			~IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G;
++
++	n = ieee80211_he_mcs_nss_size(&elem);
+ 	ie_len = 2 + 1 +
+ 		 sizeof(he_cap->he_cap_elem) + n +
+ 		 ieee80211_he_ppe_size(he_cap->ppe_thres[0],
+@@ -2935,8 +2952,8 @@ u8 *ieee80211_ie_build_he_cap(u8 *pos,
+ 	*pos++ = WLAN_EID_EXT_HE_CAPABILITY;
+ 
+ 	/* Fixed data */
+-	memcpy(pos, &he_cap->he_cap_elem, sizeof(he_cap->he_cap_elem));
+-	pos += sizeof(he_cap->he_cap_elem);
++	memcpy(pos, &elem, sizeof(elem));
++	pos += sizeof(elem);
+ 
+ 	memcpy(pos, &he_cap->he_mcs_nss_supp, n);
+ 	pos += n;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mac80211-remove-a-couple-of-obsolete-todo.patch b/queue-5.16/mac80211-remove-a-couple-of-obsolete-todo.patch
new file mode 100644
index 00000000000..1f6b1aae26d
--- /dev/null
+++ b/queue-5.16/mac80211-remove-a-couple-of-obsolete-todo.patch
@@ -0,0 +1,67 @@
+From a336f5af62ed3470878c96438389ca1294119327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Nov 2021 15:32:44 +0200
+Subject: mac80211: Remove a couple of obsolete TODO
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit cee04f3c3a00ffd2a2a6ed1028e0ab58a3a28d25 ]
+
+The HE capability IE is an extension IE so remove
+an irrelevant comments.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20211129152938.550b95b5fca7.Ia31395e880172aefcc0a8c70ed060f84b94bdb83@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 13 +++++--------
+ net/mac80211/mlme.c |  4 ----
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 45fb517591ee..5311c3cd3050 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1131,17 +1131,14 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ 		local->scan_ies_len +=
+ 			2 + sizeof(struct ieee80211_vht_cap);
+ 
+-	/* HE cap element is variable in size - set len to allow max size */
+ 	/*
+-	 * TODO: 1 is added at the end of the calculation to accommodate for
+-	 *	the temporary placing of the HE capabilities IE under EXT.
+-	 *	Remove it once it is placed in the final place.
+-	 */
+-	if (supp_he)
++	 * HE cap element is variable in size - set len to allow max size */
++	if (supp_he) {
+ 		local->scan_ies_len +=
+-			2 + sizeof(struct ieee80211_he_cap_elem) +
++			3 + sizeof(struct ieee80211_he_cap_elem) +
+ 			sizeof(struct ieee80211_he_mcs_nss_supp) +
+-			IEEE80211_HE_PPE_THRES_MAX_LEN + 1;
++			IEEE80211_HE_PPE_THRES_MAX_LEN;
++	}
+ 
+ 	if (!local->ops->hw_scan) {
+ 		/* For hw_scan, driver needs to set these up. */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 404b84650161..13496ba48514 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -650,10 +650,6 @@ static void ieee80211_add_he_ie(struct ieee80211_sub_if_data *sdata,
+ 	if (!he_cap || !reg_cap)
+ 		return;
+ 
+-	/*
+-	 * TODO: the 1 added is because this temporarily is under the EXTENSION
+-	 * IE. Get rid of it when it moves.
+-	 */
+ 	he_cap_size =
+ 		2 + 1 + sizeof(he_cap->he_cap_elem) +
+ 		ieee80211_he_mcs_nss_size(&he_cap->he_cap_elem) +
+-- 
+2.34.1
+
diff --git a/queue-5.16/mailbox-imx-fix-crash-in-resume-on-i.mx8ulp.patch b/queue-5.16/mailbox-imx-fix-crash-in-resume-on-i.mx8ulp.patch
new file mode 100644
index 00000000000..e75f73e3158
--- /dev/null
+++ b/queue-5.16/mailbox-imx-fix-crash-in-resume-on-i.mx8ulp.patch
@@ -0,0 +1,38 @@
+From fc37db7e4a572bd41272bb32c43d1b5c720f78f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Feb 2022 09:52:07 +0800
+Subject: mailbox: imx: fix crash in resume on i.mx8ulp
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 8219efd08a0aa1d7944bdb66d84ba57549258968 ]
+
+check 'priv->clk' before 'imx_mu_read()' otherwise crash happens on
+i.mx8ulp, since clock not enabled.
+
+Fixes: 4f0b776ef5831 ("mailbox: imx-mailbox: support i.MX8ULP MU")
+Reviewed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/imx-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 544de2db6453..3c9c87b9c872 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -718,7 +718,7 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
+ 	 * send failed, may lead to system freeze. This issue
+ 	 * is observed by testing freeze mode suspend.
+ 	 */
+-	if (!imx_mu_read(priv, priv->dcfg->xCR[0]) && !priv->clk) {
++	if (!priv->clk && !imx_mu_read(priv, priv->dcfg->xCR[0])) {
+ 		for (i = 0; i < IMX_MU_xCR_MAX; i++)
+ 			imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-aspeed-correct-value-for-h-total-pixels.patch b/queue-5.16/media-aspeed-correct-value-for-h-total-pixels.patch
new file mode 100644
index 00000000000..913388deb50
--- /dev/null
+++ b/queue-5.16/media-aspeed-correct-value-for-h-total-pixels.patch
@@ -0,0 +1,74 @@
+From 04ae8ad80f43e49ee93fe3ed019ba3c549436f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 07:44:07 +0100
+Subject: media: aspeed: Correct value for h-total-pixels
+
+From: Jammy Huang <jammy_huang@aspeedtech.com>
+
+[ Upstream commit 4b732a0016853eaff35944f900b0db66f3914374 ]
+
+Previous reg-field, 0x98[11:0], stands for the period of the detected
+hsync signal.
+Use the correct reg, 0xa0, to get h-total in pixels.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index 7a24daf7165a..bdeecde0d997 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -153,7 +153,7 @@
+ #define  VE_SRC_TB_EDGE_DET_BOT		GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF)
+ 
+ #define VE_MODE_DETECT_STATUS		0x098
+-#define  VE_MODE_DETECT_H_PIXELS	GENMASK(11, 0)
++#define  VE_MODE_DETECT_H_PERIOD	GENMASK(11, 0)
+ #define  VE_MODE_DETECT_V_LINES_SHF	16
+ #define  VE_MODE_DETECT_V_LINES		GENMASK(27, VE_MODE_DETECT_V_LINES_SHF)
+ #define  VE_MODE_DETECT_STATUS_VSYNC	BIT(28)
+@@ -164,6 +164,8 @@
+ #define  VE_SYNC_STATUS_VSYNC_SHF	16
+ #define  VE_SYNC_STATUS_VSYNC		GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF)
+ 
++#define VE_H_TOTAL_PIXELS		0x0A0
++
+ #define VE_INTERRUPT_CTRL		0x304
+ #define VE_INTERRUPT_STATUS		0x308
+ #define  VE_INTERRUPT_MODE_DETECT_WD	BIT(0)
+@@ -802,6 +804,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 	u32 src_lr_edge;
+ 	u32 src_tb_edge;
+ 	u32 sync;
++	u32 htotal;
+ 	struct v4l2_bt_timings *det = &video->detected_timings;
+ 
+ 	det->width = MIN_WIDTH;
+@@ -847,6 +850,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 		src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET);
+ 		mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS);
+ 		sync = aspeed_video_read(video, VE_SYNC_STATUS);
++		htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS);
+ 
+ 		video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >>
+ 			VE_SRC_TB_EDGE_DET_BOT_SHF;
+@@ -863,8 +867,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 			VE_SRC_LR_EDGE_DET_RT_SHF;
+ 		video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT;
+ 		det->hfrontporch = video->frame_left;
+-		det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) -
+-			video->frame_right;
++		det->hbackporch = htotal - video->frame_right;
+ 		det->hsync = sync & VE_SYNC_STATUS_HSYNC;
+ 		if (video->frame_left > video->frame_right)
+ 			continue;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-atmel-atmel-isc-base-report-frame-sizes-as-ful.patch b/queue-5.16/media-atmel-atmel-isc-base-report-frame-sizes-as-ful.patch
new file mode 100644
index 00000000000..c403d1caeb6
--- /dev/null
+++ b/queue-5.16/media-atmel-atmel-isc-base-report-frame-sizes-as-ful.patch
@@ -0,0 +1,74 @@
+From 1e0c204fda5cd0af8227e0152e2468e6c61b1ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Dec 2021 14:49:26 +0100
+Subject: media: atmel: atmel-isc-base: report frame sizes as full supported
+ range
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 72802a86e11c34e819fbfb38f58c5aef668f833d ]
+
+The ISC supports a full broad range of frame sizes.
+Until now, the subdevice was queried for possible frame sizes and these
+were reported to the user space.
+However, the ISC should not care about which frame sizes the subdev
+supports, as long as this frame size is supported.
+Thus, report a continuous range from smallest frame size up to the max
+resolution.
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/atmel/atmel-isc-base.c | 22 +++++++++----------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/atmel/atmel-isc-base.c b/drivers/media/platform/atmel/atmel-isc-base.c
+index 660cd0ab6749..24807782c9e5 100644
+--- a/drivers/media/platform/atmel/atmel-isc-base.c
++++ b/drivers/media/platform/atmel/atmel-isc-base.c
+@@ -1369,14 +1369,12 @@ static int isc_enum_framesizes(struct file *file, void *fh,
+ 			       struct v4l2_frmsizeenum *fsize)
+ {
+ 	struct isc_device *isc = video_drvdata(file);
+-	struct v4l2_subdev_frame_size_enum fse = {
+-		.code = isc->config.sd_format->mbus_code,
+-		.index = fsize->index,
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-	};
+ 	int ret = -EINVAL;
+ 	int i;
+ 
++	if (fsize->index)
++		return -EINVAL;
++
+ 	for (i = 0; i < isc->num_user_formats; i++)
+ 		if (isc->user_formats[i]->fourcc == fsize->pixel_format)
+ 			ret = 0;
+@@ -1388,14 +1386,14 @@ static int isc_enum_framesizes(struct file *file, void *fh,
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = v4l2_subdev_call(isc->current_subdev->sd, pad, enum_frame_size,
+-			       NULL, &fse);
+-	if (ret)
+-		return ret;
++	fsize->type = V4L2_FRMSIZE_TYPE_CONTINUOUS;
+ 
+-	fsize->type = V4L2_FRMSIZE_TYPE_DISCRETE;
+-	fsize->discrete.width = fse.max_width;
+-	fsize->discrete.height = fse.max_height;
++	fsize->stepwise.min_width = 16;
++	fsize->stepwise.max_width = isc->max_width;
++	fsize->stepwise.min_height = 16;
++	fsize->stepwise.max_height = isc->max_height;
++	fsize->stepwise.step_width = 1;
++	fsize->stepwise.step_height = 1;
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-atmel-atmel-sama7g5-isc-fix-ispck-leftover.patch b/queue-5.16/media-atmel-atmel-sama7g5-isc-fix-ispck-leftover.patch
new file mode 100644
index 00000000000..fd8a1ca516d
--- /dev/null
+++ b/queue-5.16/media-atmel-atmel-sama7g5-isc-fix-ispck-leftover.patch
@@ -0,0 +1,56 @@
+From 94b0e5c22b05186d47a4a51f39ab1bad25da8247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Dec 2021 14:49:23 +0100
+Subject: media: atmel: atmel-sama7g5-isc: fix ispck leftover
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 1b52ce99e9f2dcda868a1a7026bfb58d04bd6bc8 ]
+
+The ispck is not used for sama7g5 variant of the ISC.
+Calls to ispck have to be removed also from module insert/removal.
+
+Fixes: d7f26849ed7c ("media: atmel: fix the ispck initialization")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/atmel/atmel-sama7g5-isc.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/atmel/atmel-sama7g5-isc.c b/drivers/media/platform/atmel/atmel-sama7g5-isc.c
+index 5d1c76f680f3..2b1082295c13 100644
+--- a/drivers/media/platform/atmel/atmel-sama7g5-isc.c
++++ b/drivers/media/platform/atmel/atmel-sama7g5-isc.c
+@@ -556,7 +556,6 @@ static int microchip_xisc_remove(struct platform_device *pdev)
+ 
+ 	v4l2_device_unregister(&isc->v4l2_dev);
+ 
+-	clk_disable_unprepare(isc->ispck);
+ 	clk_disable_unprepare(isc->hclock);
+ 
+ 	isc_clk_cleanup(isc);
+@@ -568,7 +567,6 @@ static int __maybe_unused xisc_runtime_suspend(struct device *dev)
+ {
+ 	struct isc_device *isc = dev_get_drvdata(dev);
+ 
+-	clk_disable_unprepare(isc->ispck);
+ 	clk_disable_unprepare(isc->hclock);
+ 
+ 	return 0;
+@@ -583,10 +581,6 @@ static int __maybe_unused xisc_runtime_resume(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = clk_prepare_enable(isc->ispck);
+-	if (ret)
+-		clk_disable_unprepare(isc->hclock);
+-
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-atomisp-fix-bad-usage-at-error-handling-logic.patch b/queue-5.16/media-atomisp-fix-bad-usage-at-error-handling-logic.patch
new file mode 100644
index 00000000000..87fe69b53d8
--- /dev/null
+++ b/queue-5.16/media-atomisp-fix-bad-usage-at-error-handling-logic.patch
@@ -0,0 +1,95 @@
+From b58751fcb3a534b7e8236c5183649acde676d40d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Mar 2022 18:11:38 +0100
+Subject: media: atomisp: fix bad usage at error handling logic
+
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+
+[ Upstream commit fc0b582c858ed73f94c8f3375c203ea46f1f7402 ]
+
+As warned by sparse:
+	atomisp: drivers/staging/media/atomisp/pci/atomisp_acc.c:508 atomisp_acc_load_extensions() warn: iterator used outside loop: 'acc_fw'
+
+The acc_fw interactor is used outside the loop, at the error handling
+logic. On most cases, this is actually safe there, but, if
+atomisp_css_set_acc_parameters() has an error, an attempt to use it
+will pick an invalid value for acc_fw.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/media/atomisp/pci/atomisp_acc.c   | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_acc.c b/drivers/staging/media/atomisp/pci/atomisp_acc.c
+index 9a1751895ab0..28cb271663c4 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_acc.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_acc.c
+@@ -439,6 +439,18 @@ int atomisp_acc_s_mapped_arg(struct atomisp_sub_device *asd,
+ 	return 0;
+ }
+ 
++static void atomisp_acc_unload_some_extensions(struct atomisp_sub_device *asd,
++					      int i,
++					      struct atomisp_acc_fw *acc_fw)
++{
++	while (--i >= 0) {
++		if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
++			atomisp_css_unload_acc_extension(asd, acc_fw->fw,
++							 acc_flag_to_pipe[i].pipe_id);
++		}
++	}
++}
++
+ /*
+  * Appends the loaded acceleration binary extensions to the
+  * current ISP mode. Must be called just before sh_css_start().
+@@ -479,16 +491,20 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
+ 								     acc_fw->fw,
+ 								     acc_flag_to_pipe[i].pipe_id,
+ 								     acc_fw->type);
+-				if (ret)
++				if (ret) {
++					atomisp_acc_unload_some_extensions(asd, i, acc_fw);
+ 					goto error;
++				}
+ 
+ 				ext_loaded = true;
+ 			}
+ 		}
+ 
+ 		ret = atomisp_css_set_acc_parameters(acc_fw);
+-		if (ret < 0)
++		if (ret < 0) {
++			atomisp_acc_unload_some_extensions(asd, i, acc_fw);
+ 			goto error;
++		}
+ 	}
+ 
+ 	if (!ext_loaded)
+@@ -497,6 +513,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
+ 	ret = atomisp_css_update_stream(asd);
+ 	if (ret) {
+ 		dev_err(isp->dev, "%s: update stream failed.\n", __func__);
++		atomisp_acc_unload_extensions(asd);
+ 		goto error;
+ 	}
+ 
+@@ -504,13 +521,6 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd)
+ 	return 0;
+ 
+ error:
+-	while (--i >= 0) {
+-		if (acc_fw->flags & acc_flag_to_pipe[i].flag) {
+-			atomisp_css_unload_acc_extension(asd, acc_fw->fw,
+-							 acc_flag_to_pipe[i].pipe_id);
+-		}
+-	}
+-
+ 	list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) {
+ 		if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT &&
+ 		    acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER)
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch b/queue-5.16/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch
new file mode 100644
index 00000000000..540051bc9bd
--- /dev/null
+++ b/queue-5.16/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch
@@ -0,0 +1,116 @@
+From 36e4008a825b37cb209c6b4d4b1b6067fff10a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Oct 2021 18:23:33 +0200
+Subject: media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
+
+From: Tsuchiya Yuto <kitakar@gmail.com>
+
+[ Upstream commit 127efdbc51fe6064336c0452ce9c910b3e107cf0 ]
+
+The dummy_ptr check in hmm_init() [1] results in the following
+"hmm_init Failed to create sysfs" error exactly once every
+two times on atomisp reload by rmmod/insmod (although atomisp module
+loads and works fine regardless of this error):
+
+	[  140.230662] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/active_bo'
+	[  140.230668] CPU: 1 PID: 2502 Comm: insmod Tainted: G         C OE     5.15.0-rc4-1-surface-mainline #1 b8acf6eb64994414b2e20bad312a7a2c45f748f9
+	[  140.230675] Hardware name: OEMB OEMB/OEMB, BIOS 1.51116.238 03/09/2015
+	[  140.230678] Call Trace:
+	[  140.230687]  dump_stack_lvl+0x46/0x5a
+	[  140.230702]  sysfs_warn_dup.cold+0x17/0x24
+	[  140.230710]  sysfs_add_file_mode_ns+0x160/0x170
+	[  140.230717]  internal_create_group+0x126/0x390
+	[  140.230723]  hmm_init+0x5c/0x70 [atomisp 7a6a680bf400629363d2a6f58fd10e7299678b99]
+	[  140.230811]  atomisp_pci_probe.cold+0x1136/0x148e [atomisp 7a6a680bf400629363d2a6f58fd10e7299678b99]
+	[  140.230875]  local_pci_probe+0x45/0x80
+	[  140.230882]  ? pci_match_device+0xd7/0x130
+	[  140.230887]  pci_device_probe+0xfa/0x1b0
+	[  140.230892]  really_probe+0x1f5/0x3f0
+	[  140.230899]  __driver_probe_device+0xfe/0x180
+	[  140.230903]  driver_probe_device+0x1e/0x90
+	[  140.230908]  __driver_attach+0xc0/0x1c0
+	[  140.230912]  ? __device_attach_driver+0xe0/0xe0
+	[  140.230915]  ? __device_attach_driver+0xe0/0xe0
+	[  140.230919]  bus_for_each_dev+0x89/0xd0
+	[  140.230924]  bus_add_driver+0x12b/0x1e0
+	[  140.230929]  driver_register+0x8f/0xe0
+	[  140.230933]  ? 0xffffffffc153f000
+	[  140.230937]  do_one_initcall+0x57/0x220
+	[  140.230945]  do_init_module+0x5c/0x260
+	[  140.230952]  load_module+0x24bd/0x26a0
+	[  140.230962]  ? __do_sys_finit_module+0xae/0x110
+	[  140.230966]  __do_sys_finit_module+0xae/0x110
+	[  140.230972]  do_syscall_64+0x5c/0x80
+	[  140.230979]  ? syscall_exit_to_user_mode+0x23/0x40
+	[  140.230983]  ? do_syscall_64+0x69/0x80
+	[  140.230988]  ? exc_page_fault+0x72/0x170
+	[  140.230991]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+	[  140.230997] RIP: 0033:0x7f7fd5d8718d
+	[  140.231003] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48
+	[  140.231006] RSP: 002b:00007ffefc25f0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+	[  140.231012] RAX: ffffffffffffffda RBX: 000055ac3edcd7f0 RCX: 00007f7fd5d8718d
+	[  140.231015] RDX: 0000000000000000 RSI: 000055ac3d723270 RDI: 0000000000000003
+	[  140.231017] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f7fd5e52380
+	[  140.231019] R10: 0000000000000003 R11: 0000000000000246 R12: 000055ac3d723270
+	[  140.231021] R13: 0000000000000000 R14: 000055ac3edd06e0 R15: 0000000000000000
+	[  140.231038] atomisp-isp2 0000:00:03.0: hmm_init Failed to create sysfs
+
+The problem is that dummy_ptr == 0 is a valid value. So, change the logic
+which checks if dummy_ptr was allocated.
+
+At this point, atomisp now gives WARN_ON() in hmm_free() [2] on atomisp
+reload by rmmod/insmod. Again, the check is wrong there.
+
+So, change both checks for mmgr_EXCEPTION, which is the error value when
+HMM allocation fails, and initialize dummy_ptr with such value.
+
+[1] added on commit
+    d9ab83953fa7 ("media: atomisp: don't cause a warn if probe failed")
+[2] added on commit
+    b83cc378dfc4 ("atomisp: clean up the hmm init/cleanup indirections")
+
+Link: https://lore.kernel.org/linux-media/20211017162337.44860-3-kitakar@gmail.com
+
+Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
+Co-developed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm.c b/drivers/staging/media/atomisp/pci/hmm/hmm.c
+index 6a5ee4607089..c1cda16f2dc0 100644
+--- a/drivers/staging/media/atomisp/pci/hmm/hmm.c
++++ b/drivers/staging/media/atomisp/pci/hmm/hmm.c
+@@ -39,7 +39,7 @@
+ struct hmm_bo_device bo_device;
+ struct hmm_pool	dynamic_pool;
+ struct hmm_pool	reserved_pool;
+-static ia_css_ptr dummy_ptr;
++static ia_css_ptr dummy_ptr = mmgr_EXCEPTION;
+ static bool hmm_initialized;
+ struct _hmm_mem_stat hmm_mem_stat;
+ 
+@@ -209,7 +209,7 @@ int hmm_init(void)
+ 
+ void hmm_cleanup(void)
+ {
+-	if (!dummy_ptr)
++	if (dummy_ptr == mmgr_EXCEPTION)
+ 		return;
+ 	sysfs_remove_group(&atomisp_dev->kobj, atomisp_attribute_group);
+ 
+@@ -288,7 +288,8 @@ void hmm_free(ia_css_ptr virt)
+ 
+ 	dev_dbg(atomisp_dev, "%s: free 0x%08x\n", __func__, virt);
+ 
+-	WARN_ON(!virt);
++	if (WARN_ON(virt == mmgr_EXCEPTION))
++		return;
+ 
+ 	bo = hmm_bo_device_search_start(&bo_device, (unsigned int)virt);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch b/queue-5.16/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch
new file mode 100644
index 00000000000..7188e0944be
--- /dev/null
+++ b/queue-5.16/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch
@@ -0,0 +1,68 @@
+From b9cae59d47168ea258a83c9f262a4f3d5013cc3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Jan 2022 22:52:04 +0100
+Subject: media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2
+ regulator off on some boards
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 2c39a01154ea57d596470afa1d278e3be3b37f6a ]
+
+The TrekStor SurfTab duo W1 10.1 has a hw bug where turning eldo2 back on
+after having turned it off causes the CPLM3218 ambient-light-sensor on
+the front camera sensor's I2C bus to crash, hanging the bus.
+
+Add a DMI quirk table for systems on which to leave eldo2 on.
+
+Note an alternative fix is to turn off the CPLM3218 ambient-light-sensor
+as long as the camera sensor is being used, this is what Windows seems
+to do as a workaround (based on analyzing the DSDT). But that is not
+easy to do cleanly under Linux.
+
+Link: https://lore.kernel.org/linux-media/20220116215204.307649-10-hdegoede@redhat.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/atomisp/pci/atomisp_gmin_platform.c  | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+index 62dc06e22476..cd0a771454da 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+@@ -729,6 +729,21 @@ static int axp_regulator_set(struct device *dev, struct gmin_subdev *gs,
+ 	return 0;
+ }
+ 
++/*
++ * Some boards contain a hw-bug where turning eldo2 back on after having turned
++ * it off causes the CPLM3218 ambient-light-sensor on the image-sensor's I2C bus
++ * to crash, hanging the bus. Do not turn eldo2 off on these systems.
++ */
++static const struct dmi_system_id axp_leave_eldo2_on_ids[] = {
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "TrekStor"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "SurfTab duo W1 10.1 (VT4)"),
++		},
++	},
++	{ }
++};
++
+ static int axp_v1p8_on(struct device *dev, struct gmin_subdev *gs)
+ {
+ 	int ret;
+@@ -763,6 +778,9 @@ static int axp_v1p8_off(struct device *dev, struct gmin_subdev *gs)
+ 	if (ret)
+ 		return ret;
+ 
++	if (dmi_check_system(axp_leave_eldo2_on_ids))
++		return 0;
++
+ 	ret = axp_regulator_set(dev, gs, gs->eldo2_sel_reg, gs->eldo2_1p8v,
+ 				ELDO_CTRL_REG, gs->eldo2_ctrl_shift, false);
+ 	return ret;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-bttv-fix-warning-regression-on-tunerless-devic.patch b/queue-5.16/media-bttv-fix-warning-regression-on-tunerless-devic.patch
new file mode 100644
index 00000000000..b2860a3e289
--- /dev/null
+++ b/queue-5.16/media-bttv-fix-warning-regression-on-tunerless-devic.patch
@@ -0,0 +1,50 @@
+From 106ae964982943a89c682c815eed7ce6638147b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Dec 2021 22:58:44 +0100
+Subject: media: bttv: fix WARNING regression on tunerless devices
+
+From: Ondrej Zary <linux@zary.sk>
+
+[ Upstream commit ef058cc8b7193d15a771272359c7454839ae74ee ]
+
+Commit 2161536516ed ("media: media/pci: set device_caps in struct video_device")
+introduced a regression: V4L2_CAP_TUNER is always present in device_caps,
+even when the device has no tuner.
+
+This causes a warning:
+WARNING: CPU: 0 PID: 249 at drivers/media/v4l2-core/v4l2-ioctl.c:1102 v4l_querycap+0xa0/0xb0 [videodev]
+
+Fixes: 2161536516ed ("media: media/pci: set device_caps in struct video_device")
+Signed-off-by: Ondrej Zary <linux@zary.sk>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 0e9df8b35ac6..661ebfa7bf3f 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -3890,7 +3890,7 @@ static int bttv_register_video(struct bttv *btv)
+ 
+ 	/* video */
+ 	vdev_init(btv, &btv->video_dev, &bttv_video_template, "video");
+-	btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER |
++	btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE |
+ 				     V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
+ 	if (btv->tuner_type != TUNER_ABSENT)
+ 		btv->video_dev.device_caps |= V4L2_CAP_TUNER;
+@@ -3911,7 +3911,7 @@ static int bttv_register_video(struct bttv *btv)
+ 	/* vbi */
+ 	vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi");
+ 	btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE |
+-				   V4L2_CAP_STREAMING | V4L2_CAP_TUNER;
++				   V4L2_CAP_STREAMING;
+ 	if (btv->tuner_type != TUNER_ABSENT)
+ 		btv->vbi_dev.device_caps |= V4L2_CAP_TUNER;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-camss-csid-170-don-t-enable-unused-irqs.patch b/queue-5.16/media-camss-csid-170-don-t-enable-unused-irqs.patch
new file mode 100644
index 00000000000..6cb2340bedb
--- /dev/null
+++ b/queue-5.16/media-camss-csid-170-don-t-enable-unused-irqs.patch
@@ -0,0 +1,47 @@
+From b8c7ca8e85f85c2f5fd03f06ee99aa7e900898c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 01:37:38 +0100
+Subject: media: camss: csid-170: don't enable unused irqs
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit a6da362491e409de0978d733441e59db6584d69f ]
+
+csid_isr() only checks for the reset irq, so enabling any other irqs
+doesn't make sense. The "RDI irq" comment is also wrong, the register
+should be CSID_CSI2_RDIN_IRQ_MASK. Without this fix there may be an
+excessive amount of irqs.
+
+Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Tested-by: Julian Grahsl <jgrahsl@snap.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-csid-170.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csid-170.c b/drivers/media/platform/qcom/camss/camss-csid-170.c
+index aa65043c3303..a006c8dbceb1 100644
+--- a/drivers/media/platform/qcom/camss/camss-csid-170.c
++++ b/drivers/media/platform/qcom/camss/camss-csid-170.c
+@@ -444,12 +444,6 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable)
+ 	val |= 1 << CSI2_RX_CFG1_MISR_EN;
+ 	writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG1); // csi2_vc_mode_shift_val ?
+ 
+-	/* error irqs start at BIT(11) */
+-	writel_relaxed(~0u, csid->base + CSID_CSI2_RX_IRQ_MASK);
+-
+-	/* RDI irq */
+-	writel_relaxed(~0u, csid->base + CSID_TOP_IRQ_MASK);
+-
+ 	val = 1 << RDI_CTRL_HALT_CMD;
+ 	writel_relaxed(val, csid->base + CSID_RDI_CTRL(0));
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-camss-csid-170-fix-non-10bit-formats.patch b/queue-5.16/media-camss-csid-170-fix-non-10bit-formats.patch
new file mode 100644
index 00000000000..54d2da3475e
--- /dev/null
+++ b/queue-5.16/media-camss-csid-170-fix-non-10bit-formats.patch
@@ -0,0 +1,52 @@
+From c2bd75abfd7710097414a39177ce3d45471f86c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 01:37:37 +0100
+Subject: media: camss: csid-170: fix non-10bit formats
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 14d510e040f85ff05734fd6db8bae44b47886464 ]
+
+Use the decode_format/data_type from the "format" struct instead of a
+hardcoded 10-bit format.
+
+Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Tested-by: Julian Grahsl <jgrahsl@snap.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-csid-170.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csid-170.c b/drivers/media/platform/qcom/camss/camss-csid-170.c
+index ac22ff29d2a9..aa65043c3303 100644
+--- a/drivers/media/platform/qcom/camss/camss-csid-170.c
++++ b/drivers/media/platform/qcom/camss/camss-csid-170.c
+@@ -366,7 +366,7 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable)
+ 			val |= input_format->width & 0x1fff << TPG_DT_n_CFG_0_FRAME_WIDTH;
+ 			writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_0(0));
+ 
+-			val = DATA_TYPE_RAW_10BIT << TPG_DT_n_CFG_1_DATA_TYPE;
++			val = format->data_type << TPG_DT_n_CFG_1_DATA_TYPE;
+ 			writel_relaxed(val, csid->base + CSID_TPG_DT_n_CFG_1(0));
+ 
+ 			val = tg->mode << TPG_DT_n_CFG_2_PAYLOAD_MODE;
+@@ -382,8 +382,9 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable)
+ 		val = 1 << RDI_CFG0_BYTE_CNTR_EN;
+ 		val |= 1 << RDI_CFG0_FORMAT_MEASURE_EN;
+ 		val |= 1 << RDI_CFG0_TIMESTAMP_EN;
++		/* note: for non-RDI path, this should be format->decode_format */
+ 		val |= DECODE_FORMAT_PAYLOAD_ONLY << RDI_CFG0_DECODE_FORMAT;
+-		val |= DATA_TYPE_RAW_10BIT << RDI_CFG0_DATA_TYPE;
++		val |= format->data_type << RDI_CFG0_DATA_TYPE;
+ 		val |= vc << RDI_CFG0_VIRTUAL_CHANNEL;
+ 		val |= dt_id << RDI_CFG0_DT_ID;
+ 		writel_relaxed(val, csid->base + CSID_RDI_CFG0(0));
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-camss-csid-170-set-the-right-halt_cmd-when-dis.patch b/queue-5.16/media-camss-csid-170-set-the-right-halt_cmd-when-dis.patch
new file mode 100644
index 00000000000..090a0dc5127
--- /dev/null
+++ b/queue-5.16/media-camss-csid-170-set-the-right-halt_cmd-when-dis.patch
@@ -0,0 +1,55 @@
+From 976748ef71b3c633b7be1af7b454c0df4743c9df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 01:37:41 +0100
+Subject: media: camss: csid-170: set the right HALT_CMD when disabled
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit ee780cd7be3b5608550bafe7d5f113db2140e99b ]
+
+Use the "HALT_CMD_RESUME_AT_FRAME_BOUNDARY" define instead of a "1" which
+is otherwise confusing, and add a "HALT_CMD_HALT_AT_FRAME_BOUNDARY" which
+is set when disabling.
+
+Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Tested-by: Julian Grahsl <jgrahsl@snap.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-csid-170.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csid-170.c b/drivers/media/platform/qcom/camss/camss-csid-170.c
+index a006c8dbceb1..82f59933ad7b 100644
+--- a/drivers/media/platform/qcom/camss/camss-csid-170.c
++++ b/drivers/media/platform/qcom/camss/camss-csid-170.c
+@@ -105,7 +105,8 @@
+ #define CSID_RDI_CTRL(rdi)			((IS_LITE ? 0x208 : 0x308)\
+ 						+ 0x100 * (rdi))
+ #define		RDI_CTRL_HALT_CMD		0
+-#define			ALT_CMD_RESUME_AT_FRAME_BOUNDARY	1
++#define			HALT_CMD_HALT_AT_FRAME_BOUNDARY		0
++#define			HALT_CMD_RESUME_AT_FRAME_BOUNDARY	1
+ #define		RDI_CTRL_HALT_MODE		2
+ 
+ #define CSID_RDI_FRM_DROP_PATTERN(rdi)			((IS_LITE ? 0x20C : 0x30C)\
+@@ -444,7 +445,10 @@ static void csid_configure_stream(struct csid_device *csid, u8 enable)
+ 	val |= 1 << CSI2_RX_CFG1_MISR_EN;
+ 	writel_relaxed(val, csid->base + CSID_CSI2_RX_CFG1); // csi2_vc_mode_shift_val ?
+ 
+-	val = 1 << RDI_CTRL_HALT_CMD;
++	if (enable)
++		val = HALT_CMD_RESUME_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD;
++	else
++		val = HALT_CMD_HALT_AT_FRAME_BOUNDARY << RDI_CTRL_HALT_CMD;
+ 	writel_relaxed(val, csid->base + CSID_RDI_CTRL(0));
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-camss-vfe-170-fix-vfe-halt-timeout-error.patch b/queue-5.16/media-camss-vfe-170-fix-vfe-halt-timeout-error.patch
new file mode 100644
index 00000000000..f96c7f354a7
--- /dev/null
+++ b/queue-5.16/media-camss-vfe-170-fix-vfe-halt-timeout-error.patch
@@ -0,0 +1,52 @@
+From b92988d7456902fdecb100946554abb544abc1aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 01:37:45 +0100
+Subject: media: camss: vfe-170: fix "VFE halt timeout" error
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 1ce8c48b06f249a9739e36c5d56883f6f49ce047 ]
+
+This function waits for halt_complete but doesn't do anything to cause
+it to complete, and always hits the "VFE halt timeout" error. Just delete
+this code for now.
+
+Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Tested-by: Julian Grahsl <jgrahsl@snap.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-vfe-170.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-vfe-170.c b/drivers/media/platform/qcom/camss/camss-vfe-170.c
+index 5c083d70d495..af71dc659bb9 100644
+--- a/drivers/media/platform/qcom/camss/camss-vfe-170.c
++++ b/drivers/media/platform/qcom/camss/camss-vfe-170.c
+@@ -402,17 +402,7 @@ static irqreturn_t vfe_isr(int irq, void *dev)
+  */
+ static int vfe_halt(struct vfe_device *vfe)
+ {
+-	unsigned long time;
+-
+-	reinit_completion(&vfe->halt_complete);
+-
+-	time = wait_for_completion_timeout(&vfe->halt_complete,
+-					   msecs_to_jiffies(VFE_HALT_TIMEOUT_MS));
+-	if (!time) {
+-		dev_err(vfe->camss->dev, "VFE halt timeout\n");
+-		return -EIO;
+-	}
+-
++	/* rely on vfe_disable_output() to stop the VFE */
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-cedrus-h264-fix-neighbour-info-buffer-size.patch b/queue-5.16/media-cedrus-h264-fix-neighbour-info-buffer-size.patch
new file mode 100644
index 00000000000..77f3659b253
--- /dev/null
+++ b/queue-5.16/media-cedrus-h264-fix-neighbour-info-buffer-size.patch
@@ -0,0 +1,44 @@
+From 5c9857998aff8dc606ab47e6773b5514e06970a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 20:08:39 +0100
+Subject: media: cedrus: h264: Fix neighbour info buffer size
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit fecd363ae2d5042553370b0adf60c47e35c34a83 ]
+
+According to BSP library source, H264 neighbour info buffer size needs
+to be 32 kiB for H6. This is similar to H265 decoding, which also needs
+double buffer size in comparison to older Cedrus core generations.
+
+Increase buffer size to cover H6 needs. Since increase is not that big
+in absolute numbers, it doesn't make sense to complicate logic for older
+generations.
+
+Issue was discovered using iommu and cross checked with BSP library
+source.
+
+Fixes: 6eb9b758e307 ("media: cedrus: Add H264 decoding support")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+index b4173a8926d6..d8fb93035470 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -38,7 +38,7 @@ struct cedrus_h264_sram_ref_pic {
+ 
+ #define CEDRUS_H264_FRAME_NUM		18
+ 
+-#define CEDRUS_NEIGHBOR_INFO_BUF_SIZE	(16 * SZ_1K)
++#define CEDRUS_NEIGHBOR_INFO_BUF_SIZE	(32 * SZ_1K)
+ #define CEDRUS_MIN_PIC_INFO_BUF_SIZE       (130 * SZ_1K)
+ 
+ static void cedrus_h264_write_sram(struct cedrus_dev *dev,
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-cedrus-h265-fix-neighbour-info-buffer-size.patch b/queue-5.16/media-cedrus-h265-fix-neighbour-info-buffer-size.patch
new file mode 100644
index 00000000000..80fc1433c65
--- /dev/null
+++ b/queue-5.16/media-cedrus-h265-fix-neighbour-info-buffer-size.patch
@@ -0,0 +1,44 @@
+From 1f3977904a5d3d3084b197102e791926fd3a0aa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 08:42:41 +0100
+Subject: media: cedrus: H265: Fix neighbour info buffer size
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit ee8b887329c78971967506f3ac79b9302c9f83c1 ]
+
+Neighbour info buffer size needs to be 794 kiB in H6. This is actually
+already indirectly mentioned in the comment, but smaller size is used
+nevertheless.
+
+Increase buffer size to cover H6 needs. Since increase is not that big
+in absolute numbers, it doesn't make sense to complicate logic for older
+generations.
+
+Bug was discovered using iommu, which reported access error when trying
+to play H265 video.
+
+Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
+index 8829a7bab07e..ffade5cbd2e4 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
+@@ -23,7 +23,7 @@
+  * Subsequent BSP implementations seem to double the neighbor info buffer size
+  * for the H6 SoC, which may be related to 10 bit H265 support.
+  */
+-#define CEDRUS_H265_NEIGHBOR_INFO_BUF_SIZE	(397 * SZ_1K)
++#define CEDRUS_H265_NEIGHBOR_INFO_BUF_SIZE	(794 * SZ_1K)
+ #define CEDRUS_H265_ENTRY_POINTS_BUF_SIZE	(4 * SZ_1K)
+ #define CEDRUS_H265_MV_COL_BUF_UNIT_CTB_SIZE	160
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-coda-fix-missing-put_device-call-in-coda_get_v.patch b/queue-5.16/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
new file mode 100644
index 00000000000..010daf8c9bc
--- /dev/null
+++ b/queue-5.16/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
@@ -0,0 +1,37 @@
+From f5f1a5b3a60535d0fe7fbee85986908bdd246ca6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 12:05:54 +0100
+Subject: media: coda: Fix missing put_device() call in coda_get_vdoa_data
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ca85d271531a1e1c86f24b892f57b7d0a3ddb5a6 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling path.
+
+Fixes: e7f3c5481035 ("[media] coda: use VDOA for un-tiling custom macroblock format")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 9a2640a9c75c..4a553f42ff0a 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -408,6 +408,7 @@ static struct vdoa_data *coda_get_vdoa_data(void)
+ 	if (!vdoa_data)
+ 		vdoa_data = ERR_PTR(-EPROBE_DEFER);
+ 
++	put_device(&vdoa_pdev->dev);
+ out:
+ 	of_node_put(vdoa_node);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-cx88-mpeg-clear-interrupt-status-register-befo.patch b/queue-5.16/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
new file mode 100644
index 00000000000..f4e61d46b85
--- /dev/null
+++ b/queue-5.16/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
@@ -0,0 +1,47 @@
+From 148637fcfb75ede7b4d8e1873bad52ccee598411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 19:19:50 +0100
+Subject: media: cx88-mpeg: clear interrupt status register before streaming
+ video
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+
+[ Upstream commit 56cb61f70e547e1b0cdfe6ff5a1f1ce6242e6d96 ]
+
+Some cx88 video cards may have transport stream status interrupts set
+to 1 from cold start, causing errors like this:
+
+  cx88xx: cx88_print_irqbits: core:irq mpeg  [0x100000] ts_err?*
+  cx8802: cx8802_mpeg_irq: mpeg:general errors: 0x00100000
+
+According to CX2388x datasheet, the interrupt status register should be
+cleared before enabling IRQs to stream video.
+
+Fix it by clearing the Transport Stream Interrupt Status register.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx88/cx88-mpeg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
+index 680e1e3fe89b..2c1d5137ac47 100644
+--- a/drivers/media/pci/cx88/cx88-mpeg.c
++++ b/drivers/media/pci/cx88/cx88-mpeg.c
+@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev    *dev,
+ 	cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET);
+ 	q->count = 0;
+ 
++	/* clear interrupt status register */
++	cx_write(MO_TS_INTSTAT,  0x1f1111);
++
+ 	/* enable irqs */
+ 	dprintk(1, "setting the interrupt mask\n");
+ 	cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-em28xx-initialize-refcount-before-kref_get.patch b/queue-5.16/media-em28xx-initialize-refcount-before-kref_get.patch
new file mode 100644
index 00000000000..287141c469a
--- /dev/null
+++ b/queue-5.16/media-em28xx-initialize-refcount-before-kref_get.patch
@@ -0,0 +1,66 @@
+From 852de70cdbb08f6ef3117f8276340e95dc4ad533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:44:59 +0800
+Subject: media: em28xx: initialize refcount before kref_get
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ]
+
+The commit 47677e51e2a4("[media] em28xx: Only deallocate struct
+em28xx after finishing all extensions") adds kref_get to many init
+functions (e.g., em28xx_audio_init). However, kref_init is called too
+late in em28xx_usb_probe, since em28xx_init_dev before will invoke
+those init functions and call kref_get function. Then refcount bug
+occurs in my local syzkaller instance.
+
+Fix it by moving kref_init before em28xx_init_dev. This issue occurs
+not only in dev but also dev->dev_next.
+
+Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index b451ce3cb169..f3b56c065ee1 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -3936,6 +3936,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 		goto err_free;
+ 	}
+ 
++	kref_init(&dev->ref);
++
+ 	dev->devno = nr;
+ 	dev->model = id->driver_info;
+ 	dev->alt   = -1;
+@@ -4036,6 +4038,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) {
++		kref_init(&dev->dev_next->ref);
++
+ 		dev->dev_next->ts = SECONDARY_TS;
+ 		dev->dev_next->alt   = -1;
+ 		dev->dev_next->is_audio_only = has_vendor_audio &&
+@@ -4090,12 +4094,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 			em28xx_write_reg(dev, 0x0b, 0x82);
+ 			mdelay(100);
+ 		}
+-
+-		kref_init(&dev->dev_next->ref);
+ 	}
+ 
+-	kref_init(&dev->ref);
+-
+ 	request_modules(dev);
+ 
+ 	/*
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-hantro-fix-overfill-bottom-register-field-name.patch b/queue-5.16/media-hantro-fix-overfill-bottom-register-field-name.patch
new file mode 100644
index 00000000000..a8e9296ad55
--- /dev/null
+++ b/queue-5.16/media-hantro-fix-overfill-bottom-register-field-name.patch
@@ -0,0 +1,64 @@
+From bccd766fa5dff04b8bb100c7b4d57912110b4134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 10:34:49 +0100
+Subject: media: hantro: Fix overfill bottom register field name
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 89d78e0133e71ba324fb67ca776223fba4353418 ]
+
+The Hantro H1 hardware can crop off pixels from the right and bottom of
+the source frame. These are controlled with the H1_REG_IN_IMG_CTRL_OVRFLB
+and H1_REG_IN_IMG_CTRL_OVRFLR in the H1_REG_IN_IMG_CTRL register.
+
+The ChromeOS kernel driver that this was based on incorrectly added the
+_D4 suffix H1_REG_IN_IMG_CTRL_OVRFLB. This field crops the bottom of the
+input frame, and the number is _not_ divided by 4. [1]
+
+Correct the name to avoid confusion when crop support with the selection
+API is added.
+
+[1] https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/ \
+	heads/chromeos-4.19/drivers/staging/media/hantro/hantro_h1_vp8_enc.c#377
+
+Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
+Fixes: a29add8c9bb2 ("media: rockchip/vpu: rename from rockchip to hantro")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +-
+ drivers/staging/media/hantro/hantro_h1_regs.h     | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+index 9cd713c02a45..686d813f5c62 100644
+--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu,
+ 
+ 	reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width)
+ 		| H1_REG_IN_IMG_CTRL_OVRFLR_D4(0)
+-		| H1_REG_IN_IMG_CTRL_OVRFLB_D4(0)
++		| H1_REG_IN_IMG_CTRL_OVRFLB(0)
+ 		| H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt);
+ 	vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL);
+ }
+diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h
+index d6e9825bb5c7..30e7e7b920b5 100644
+--- a/drivers/staging/media/hantro/hantro_h1_regs.h
++++ b/drivers/staging/media/hantro/hantro_h1_regs.h
+@@ -47,7 +47,7 @@
+ #define H1_REG_IN_IMG_CTRL				0x03c
+ #define     H1_REG_IN_IMG_CTRL_ROW_LEN(x)		((x) << 12)
+ #define     H1_REG_IN_IMG_CTRL_OVRFLR_D4(x)		((x) << 10)
+-#define     H1_REG_IN_IMG_CTRL_OVRFLB_D4(x)		((x) << 6)
++#define     H1_REG_IN_IMG_CTRL_OVRFLB(x)		((x) << 6)
+ #define     H1_REG_IN_IMG_CTRL_FMT(x)			((x) << 2)
+ #define H1_REG_ENC_CTRL0				0x040
+ #define    H1_REG_ENC_CTRL0_INIT_QP(x)			((x) << 26)
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch b/queue-5.16/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
new file mode 100644
index 00000000000..ab6e2a04374
--- /dev/null
+++ b/queue-5.16/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
@@ -0,0 +1,61 @@
+From 536ad703b48021330b4f9b440298441a6be10ebe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:41:30 +0100
+Subject: media: hdpvr: initialize dev->worker at hdpvr_register_videodev
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 07922937e9a580825f9965c46fd15e23ba5754b6 ]
+
+hdpvr_register_videodev is responsible to initialize a worker in
+hdpvr_device. However, the worker is only initialized at
+hdpvr_start_streaming other than hdpvr_register_videodev.
+When hdpvr_probe does not initialize its worker, the hdpvr_disconnect
+will encounter one WARN in flush_work.The stack trace is as follows:
+
+ hdpvr_disconnect+0xb8/0xf2 drivers/media/usb/hdpvr/hdpvr-core.c:425
+ usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
+ __device_release_driver drivers/base/dd.c:1206 [inline]
+ device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1237
+ bus_remove_device+0x108/0x160 drivers/base/bus.c:529
+ device_del+0x1fe/0x510 drivers/base/core.c:3592
+ usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
+ usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2228
+
+Fix this by moving the initialization of dev->worker to the starting of
+hdpvr_register_videodev
+
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/hdpvr/hdpvr-video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index 563128d11731..60e57e0f1927 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
+ 
+ 	dev->status = STATUS_STREAMING;
+ 
+-	INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
+ 	schedule_work(&dev->worker);
+ 
+ 	v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
+@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
+ 	bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP;
+ 	int res;
+ 
++	// initialize dev->worker
++	INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
++
+ 	dev->cur_std = V4L2_STD_525_60;
+ 	dev->width = 720;
+ 	dev->height = 480;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-i2c-ov5648-fix-lockdep-error.patch b/queue-5.16/media-i2c-ov5648-fix-lockdep-error.patch
new file mode 100644
index 00000000000..0c2ac050869
--- /dev/null
+++ b/queue-5.16/media-i2c-ov5648-fix-lockdep-error.patch
@@ -0,0 +1,53 @@
+From 34188fd61546fede348f2314881096f9ce1a4a8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 13:33:12 +0100
+Subject: media: i2c: ov5648: Fix lockdep error
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit d4cb5d3c4cee28aa89b02bc33d930a6cf75e7f79 ]
+
+ov5648_state_init() calls ov5648_state_mipi_configure() which uses
+__v4l2_ctrl_s_ctrl[_int64](). This means that sensor->mutex (which
+is also sensor->ctrls.handler.lock) must be locked before calling
+ov5648_state_init().
+
+ov5648_state_mipi_configure() is also used in other places where
+the lock is already held so it cannot be changed itself.
+
+Note this is based on an identical (tested) fix for the ov8865 driver,
+this has only been compile-tested.
+
+Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5648.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5648.c b/drivers/media/i2c/ov5648.c
+index 78040f0ac02f..ef8b52dc9401 100644
+--- a/drivers/media/i2c/ov5648.c
++++ b/drivers/media/i2c/ov5648.c
+@@ -1778,8 +1778,14 @@ static int ov5648_state_configure(struct ov5648_sensor *sensor,
+ 
+ static int ov5648_state_init(struct ov5648_sensor *sensor)
+ {
+-	return ov5648_state_configure(sensor, &ov5648_modes[0],
+-				      ov5648_mbus_codes[0]);
++	int ret;
++
++	mutex_lock(&sensor->mutex);
++	ret = ov5648_state_configure(sensor, &ov5648_modes[0],
++				     ov5648_mbus_codes[0]);
++	mutex_unlock(&sensor->mutex);
++
++	return ret;
+ }
+ 
+ /* Sensor Base */
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-imx-imx8mq-mipi-csi2-remove-wrong-irq-config-w.patch b/queue-5.16/media-imx-imx8mq-mipi-csi2-remove-wrong-irq-config-w.patch
new file mode 100644
index 00000000000..5eba2c6ff24
--- /dev/null
+++ b/queue-5.16/media-imx-imx8mq-mipi-csi2-remove-wrong-irq-config-w.patch
@@ -0,0 +1,41 @@
+From 5534d2f11a4f41f226672a6c039588e612e4c93b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Dec 2021 10:03:35 +0100
+Subject: media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+[ Upstream commit 59c2b6d51803ad6b7af28f2a60a843b24374e692 ]
+
+The place where this register writel() that masks one interrupt is placed
+does not guarantee that the device is powered so that's not allowed.
+Moreover imx8mq_mipi_csi_start_stream() masks the interrupt anyway so the
+write is not even needed. Remove it as this is a mistake that slipped in
+with the driver.
+
+Fixes: f33fd8d77dd0 ("media: imx: add a driver for i.MX8MQ mipi csi rx phy and controller")
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx8mq-mipi-csi2.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx8mq-mipi-csi2.c b/drivers/staging/media/imx/imx8mq-mipi-csi2.c
+index 7adbdd14daa9..8f3cc138c52c 100644
+--- a/drivers/staging/media/imx/imx8mq-mipi-csi2.c
++++ b/drivers/staging/media/imx/imx8mq-mipi-csi2.c
+@@ -398,9 +398,6 @@ static int imx8mq_mipi_csi_s_stream(struct v4l2_subdev *sd, int enable)
+ 	struct csi_state *state = mipi_sd_to_csi2_state(sd);
+ 	int ret = 0;
+ 
+-	imx8mq_mipi_csi_write(state, CSI2RX_IRQ_MASK,
+-			      CSI2RX_IRQ_MASK_ULPS_STATUS_CHANGE);
+-
+ 	if (enable) {
+ 		ret = pm_runtime_resume_and_get(state->dev);
+ 		if (ret < 0)
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-imx-imx8mq-mipi_csi2-fix-system-resume.patch b/queue-5.16/media-imx-imx8mq-mipi_csi2-fix-system-resume.patch
new file mode 100644
index 00000000000..fc593afdd2a
--- /dev/null
+++ b/queue-5.16/media-imx-imx8mq-mipi_csi2-fix-system-resume.patch
@@ -0,0 +1,173 @@
+From 5414f21ef29516f281066645d10dc21132571cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Dec 2021 10:03:36 +0100
+Subject: media: imx: imx8mq-mipi_csi2: fix system resume
+
+From: Martin Kepplinger <martin.kepplinger@puri.sm>
+
+[ Upstream commit f0c2ba1ed4ad868331d8c6ea9119669a729b01a9 ]
+
+during system resume, interconnect bandwidth would currently be requested
+even though the device is runtime suspended. This leaves the system in an
+unbalanced state.
+
+Fix that by only doing that in runtimem pm and splitting up runtime and
+system suspend to be a more readable:
+imx8mq_mipi_csi_pm_*() does the generic things called from system- and
+runtime functions that each do specific things on top.
+
+Fixes: f33fd8d77dd0 ("media: imx: add a driver for i.MX8MQ mipi csi rx phy and controller")
+Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx8mq-mipi-csi2.c | 71 +++++++++++++-------
+ 1 file changed, 47 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx8mq-mipi-csi2.c b/drivers/staging/media/imx/imx8mq-mipi-csi2.c
+index 8f3cc138c52c..3b9fa75efac6 100644
+--- a/drivers/staging/media/imx/imx8mq-mipi-csi2.c
++++ b/drivers/staging/media/imx/imx8mq-mipi-csi2.c
+@@ -693,7 +693,7 @@ static int imx8mq_mipi_csi_async_register(struct csi_state *state)
+  * Suspend/resume
+  */
+ 
+-static int imx8mq_mipi_csi_pm_suspend(struct device *dev, bool runtime)
++static int imx8mq_mipi_csi_pm_suspend(struct device *dev)
+ {
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct csi_state *state = mipi_sd_to_csi2_state(sd);
+@@ -705,36 +705,21 @@ static int imx8mq_mipi_csi_pm_suspend(struct device *dev, bool runtime)
+ 		imx8mq_mipi_csi_stop_stream(state);
+ 		imx8mq_mipi_csi_clk_disable(state);
+ 		state->state &= ~ST_POWERED;
+-		if (!runtime)
+-			state->state |= ST_SUSPENDED;
+ 	}
+ 
+ 	mutex_unlock(&state->lock);
+ 
+-	ret = icc_set_bw(state->icc_path, 0, 0);
+-	if (ret)
+-		dev_err(dev, "icc_set_bw failed with %d\n", ret);
+-
+ 	return ret ? -EAGAIN : 0;
+ }
+ 
+-static int imx8mq_mipi_csi_pm_resume(struct device *dev, bool runtime)
++static int imx8mq_mipi_csi_pm_resume(struct device *dev)
+ {
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct csi_state *state = mipi_sd_to_csi2_state(sd);
+ 	int ret = 0;
+ 
+-	ret = icc_set_bw(state->icc_path, 0, state->icc_path_bw);
+-	if (ret) {
+-		dev_err(dev, "icc_set_bw failed with %d\n", ret);
+-		return ret;
+-	}
+-
+ 	mutex_lock(&state->lock);
+ 
+-	if (!runtime && !(state->state & ST_SUSPENDED))
+-		goto unlock;
+-
+ 	if (!(state->state & ST_POWERED)) {
+ 		state->state |= ST_POWERED;
+ 		ret = imx8mq_mipi_csi_clk_enable(state);
+@@ -755,22 +740,60 @@ static int imx8mq_mipi_csi_pm_resume(struct device *dev, bool runtime)
+ 
+ static int __maybe_unused imx8mq_mipi_csi_suspend(struct device *dev)
+ {
+-	return imx8mq_mipi_csi_pm_suspend(dev, false);
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct csi_state *state = mipi_sd_to_csi2_state(sd);
++	int ret;
++
++	ret = imx8mq_mipi_csi_pm_suspend(dev);
++	if (ret)
++		return ret;
++
++	state->state |= ST_SUSPENDED;
++
++	return ret;
+ }
+ 
+ static int __maybe_unused imx8mq_mipi_csi_resume(struct device *dev)
+ {
+-	return imx8mq_mipi_csi_pm_resume(dev, false);
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct csi_state *state = mipi_sd_to_csi2_state(sd);
++
++	if (!(state->state & ST_SUSPENDED))
++		return 0;
++
++	return imx8mq_mipi_csi_pm_resume(dev);
+ }
+ 
+ static int __maybe_unused imx8mq_mipi_csi_runtime_suspend(struct device *dev)
+ {
+-	return imx8mq_mipi_csi_pm_suspend(dev, true);
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct csi_state *state = mipi_sd_to_csi2_state(sd);
++	int ret;
++
++	ret = imx8mq_mipi_csi_pm_suspend(dev);
++	if (ret)
++		return ret;
++
++	ret = icc_set_bw(state->icc_path, 0, 0);
++	if (ret)
++		dev_err(dev, "icc_set_bw failed with %d\n", ret);
++
++	return ret;
+ }
+ 
+ static int __maybe_unused imx8mq_mipi_csi_runtime_resume(struct device *dev)
+ {
+-	return imx8mq_mipi_csi_pm_resume(dev, true);
++	struct v4l2_subdev *sd = dev_get_drvdata(dev);
++	struct csi_state *state = mipi_sd_to_csi2_state(sd);
++	int ret;
++
++	ret = icc_set_bw(state->icc_path, 0, state->icc_path_bw);
++	if (ret) {
++		dev_err(dev, "icc_set_bw failed with %d\n", ret);
++		return ret;
++	}
++
++	return imx8mq_mipi_csi_pm_resume(dev);
+ }
+ 
+ static const struct dev_pm_ops imx8mq_mipi_csi_pm_ops = {
+@@ -918,7 +941,7 @@ static int imx8mq_mipi_csi_probe(struct platform_device *pdev)
+ 	/* Enable runtime PM. */
+ 	pm_runtime_enable(dev);
+ 	if (!pm_runtime_enabled(dev)) {
+-		ret = imx8mq_mipi_csi_pm_resume(dev, true);
++		ret = imx8mq_mipi_csi_runtime_resume(dev);
+ 		if (ret < 0)
+ 			goto icc;
+ 	}
+@@ -931,7 +954,7 @@ static int imx8mq_mipi_csi_probe(struct platform_device *pdev)
+ 
+ cleanup:
+ 	pm_runtime_disable(&pdev->dev);
+-	imx8mq_mipi_csi_pm_suspend(&pdev->dev, true);
++	imx8mq_mipi_csi_runtime_suspend(&pdev->dev);
+ 
+ 	media_entity_cleanup(&state->sd.entity);
+ 	v4l2_async_nf_unregister(&state->notifier);
+@@ -955,7 +978,7 @@ static int imx8mq_mipi_csi_remove(struct platform_device *pdev)
+ 	v4l2_async_unregister_subdev(&state->sd);
+ 
+ 	pm_runtime_disable(&pdev->dev);
+-	imx8mq_mipi_csi_pm_suspend(&pdev->dev, true);
++	imx8mq_mipi_csi_runtime_suspend(&pdev->dev);
+ 	media_entity_cleanup(&state->sd.entity);
+ 	mutex_destroy(&state->lock);
+ 	pm_runtime_set_suspended(&pdev->dev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-imx-jpeg-fix-a-bug-of-accessing-array-out-of-b.patch b/queue-5.16/media-imx-jpeg-fix-a-bug-of-accessing-array-out-of-b.patch
new file mode 100644
index 00000000000..6d8438761fc
--- /dev/null
+++ b/queue-5.16/media-imx-jpeg-fix-a-bug-of-accessing-array-out-of-b.patch
@@ -0,0 +1,41 @@
+From 002335db0e4491eea39a25b6bfd7261a6ce14c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Feb 2022 14:28:43 +0800
+Subject: media: imx-jpeg: fix a bug of accessing array out of bounds
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit 97558d170a1236280407e8d29a7d095d2c2ed554 ]
+
+When error occurs in parsing jpeg, the slot isn't acquired yet, it may
+be the default value MXC_MAX_SLOTS.
+If the driver access the slot using the incorrect slot number, it will
+access array out of bounds.
+The result is the driver will change num_domains, which follows
+slot_data in struct mxc_jpeg_dev.
+Then the driver won't detach the pm domain at rmmod, which will lead to
+kernel panic when trying to insmod again.
+
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+Reviewed-by: Mirela Rabulea <mirela.rabulea@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/imx-jpeg/mxc-jpeg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+index b249c1bbfac8..83a2b4d13bad 100644
+--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
++++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+@@ -954,7 +954,6 @@ static void mxc_jpeg_device_run(void *priv)
+ 		jpeg_src_buf->jpeg_parse_error = true;
+ 	}
+ 	if (jpeg_src_buf->jpeg_parse_error) {
+-		jpeg->slot_data[ctx->slot].used = false;
+ 		v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+ 		v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+ 		v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-imx-jpeg-prevent-decoding-nv12m-jpegs-into-sin.patch b/queue-5.16/media-imx-jpeg-prevent-decoding-nv12m-jpegs-into-sin.patch
new file mode 100644
index 00000000000..91bc988828a
--- /dev/null
+++ b/queue-5.16/media-imx-jpeg-prevent-decoding-nv12m-jpegs-into-sin.patch
@@ -0,0 +1,43 @@
+From b46425ec8d1580292469132a4abd6aa7562b37ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 20:12:08 +0100
+Subject: media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar
+ buffers
+
+From: Mirela Rabulea <mirela.rabulea@oss.nxp.com>
+
+[ Upstream commit 417591a766b3c040c346044541ff949c0b2bb7b2 ]
+
+If the application queues an NV12M jpeg as output buffer, but then
+queues a single planar capture buffer, the kernel will crash with
+"Unable to handle kernel NULL pointer dereference" in mxc_jpeg_addrs,
+prevent this by finishing the job with error.
+
+Signed-off-by: Mirela Rabulea <mirela.rabulea@oss.nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/imx-jpeg/mxc-jpeg.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+index 4ca96cf9def7..b249c1bbfac8 100644
+--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
++++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+@@ -947,6 +947,12 @@ static void mxc_jpeg_device_run(void *priv)
+ 	v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
+ 
+ 	jpeg_src_buf = vb2_to_mxc_buf(&src_buf->vb2_buf);
++	if (q_data_cap->fmt->colplanes != dst_buf->vb2_buf.num_planes) {
++		dev_err(dev, "Capture format %s has %d planes, but capture buffer has %d planes\n",
++			q_data_cap->fmt->name, q_data_cap->fmt->colplanes,
++			dst_buf->vb2_buf.num_planes);
++		jpeg_src_buf->jpeg_parse_error = true;
++	}
+ 	if (jpeg_src_buf->jpeg_parse_error) {
+ 		jpeg->slot_data[ctx->slot].used = false;
+ 		v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-iommu-mediatek-add-device_link-between-the-con.patch b/queue-5.16/media-iommu-mediatek-add-device_link-between-the-con.patch
new file mode 100644
index 00000000000..a4f1eb7b4e2
--- /dev/null
+++ b/queue-5.16/media-iommu-mediatek-add-device_link-between-the-con.patch
@@ -0,0 +1,185 @@
+From 5f3534736dbe2f9b78d81f566d3f0d21ccd93f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jan 2022 08:05:02 +0100
+Subject: media: iommu/mediatek: Add device_link between the consumer and the
+ larb devices
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 635319a4a7444ca97124d781cd96deb277ff4d40 ]
+
+MediaTek IOMMU-SMI diagram is like below. all the consumer connect with
+smi-larb, then connect with smi-common.
+
+        M4U
+         |
+    smi-common
+         |
+  -------------
+  |         |    ...
+  |         |
+larb1     larb2
+  |         |
+vdec       venc
+
+When the consumer works, it should enable the smi-larb's power which
+also need enable the smi-common's power firstly.
+
+Thus, First of all, use the device link connect the consumer and the
+smi-larbs. then add device link between the smi-larb and smi-common.
+
+This patch adds device_link between the consumer and the larbs.
+
+When device_link_add, I add the flag DL_FLAG_STATELESS to avoid calling
+pm_runtime_xx to keep the original status of clocks. It can avoid two
+issues:
+1) Display HW show fastlogo abnormally reported in [1]. At the beggining,
+all the clocks are enabled before entering kernel, but the clocks for
+display HW(always in larb0) will be gated after clk_enable and clk_disable
+called from device_link_add(->pm_runtime_resume) and rpm_idle. The clock
+operation happened before display driver probe. At that time, the display
+HW will be abnormal.
+
+2) A deadlock issue reported in [2]. Use DL_FLAG_STATELESS to skip
+pm_runtime_xx to avoid the deadlock.
+
+Corresponding, DL_FLAG_AUTOREMOVE_CONSUMER can't be added, then
+device_link_removed should be added explicitly.
+
+Meanwhile, Currently we don't have a device connect with 2 larbs at the
+same time. Disallow this case, print the error log.
+
+[1] https://lore.kernel.org/linux-mediatek/1564213888.22908.4.camel@mhfsdcap03/
+[2] https://lore.kernel.org/patchwork/patch/1086569/
+
+Suggested-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Tested-by: Frank Wunderlich <frank-w@public-files.de> # BPI-R2/MT7623
+Acked-by: Joerg Roedel <jroedel@suse.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c    | 30 ++++++++++++++++++++++++++++++
+ drivers/iommu/mtk_iommu_v1.c | 29 ++++++++++++++++++++++++++++-
+ 2 files changed, 58 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 77ae20ff9b35..5971a1168666 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -562,22 +562,52 @@ static struct iommu_device *mtk_iommu_probe_device(struct device *dev)
+ {
+ 	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ 	struct mtk_iommu_data *data;
++	struct device_link *link;
++	struct device *larbdev;
++	unsigned int larbid, larbidx, i;
+ 
+ 	if (!fwspec || fwspec->ops != &mtk_iommu_ops)
+ 		return ERR_PTR(-ENODEV); /* Not a iommu client device */
+ 
+ 	data = dev_iommu_priv_get(dev);
+ 
++	/*
++	 * Link the consumer device with the smi-larb device(supplier).
++	 * The device that connects with each a larb is a independent HW.
++	 * All the ports in each a device should be in the same larbs.
++	 */
++	larbid = MTK_M4U_TO_LARB(fwspec->ids[0]);
++	for (i = 1; i < fwspec->num_ids; i++) {
++		larbidx = MTK_M4U_TO_LARB(fwspec->ids[i]);
++		if (larbid != larbidx) {
++			dev_err(dev, "Can only use one larb. Fail@larb%d-%d.\n",
++				larbid, larbidx);
++			return ERR_PTR(-EINVAL);
++		}
++	}
++	larbdev = data->larb_imu[larbid].dev;
++	link = device_link_add(dev, larbdev,
++			       DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS);
++	if (!link)
++		dev_err(dev, "Unable to link %s\n", dev_name(larbdev));
+ 	return &data->iommu;
+ }
+ 
+ static void mtk_iommu_release_device(struct device *dev)
+ {
+ 	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
++	struct mtk_iommu_data *data;
++	struct device *larbdev;
++	unsigned int larbid;
+ 
+ 	if (!fwspec || fwspec->ops != &mtk_iommu_ops)
+ 		return;
+ 
++	data = dev_iommu_priv_get(dev);
++	larbid = MTK_M4U_TO_LARB(fwspec->ids[0]);
++	larbdev = data->larb_imu[larbid].dev;
++	device_link_remove(dev, larbdev);
++
+ 	iommu_fwspec_free(dev);
+ }
+ 
+diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
+index 68bf02f87cfd..bc7ee90b9373 100644
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -423,7 +423,9 @@ static struct iommu_device *mtk_iommu_probe_device(struct device *dev)
+ 	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ 	struct of_phandle_args iommu_spec;
+ 	struct mtk_iommu_data *data;
+-	int err, idx = 0;
++	int err, idx = 0, larbid, larbidx;
++	struct device_link *link;
++	struct device *larbdev;
+ 
+ 	/*
+ 	 * In the deferred case, free the existed fwspec.
+@@ -453,6 +455,23 @@ static struct iommu_device *mtk_iommu_probe_device(struct device *dev)
+ 
+ 	data = dev_iommu_priv_get(dev);
+ 
++	/* Link the consumer device with the smi-larb device(supplier) */
++	larbid = mt2701_m4u_to_larb(fwspec->ids[0]);
++	for (idx = 1; idx < fwspec->num_ids; idx++) {
++		larbidx = mt2701_m4u_to_larb(fwspec->ids[idx]);
++		if (larbid != larbidx) {
++			dev_err(dev, "Can only use one larb. Fail@larb%d-%d.\n",
++				larbid, larbidx);
++			return ERR_PTR(-EINVAL);
++		}
++	}
++
++	larbdev = data->larb_imu[larbid].dev;
++	link = device_link_add(dev, larbdev,
++			       DL_FLAG_PM_RUNTIME | DL_FLAG_STATELESS);
++	if (!link)
++		dev_err(dev, "Unable to link %s\n", dev_name(larbdev));
++
+ 	return &data->iommu;
+ }
+ 
+@@ -473,10 +492,18 @@ static void mtk_iommu_probe_finalize(struct device *dev)
+ static void mtk_iommu_release_device(struct device *dev)
+ {
+ 	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
++	struct mtk_iommu_data *data;
++	struct device *larbdev;
++	unsigned int larbid;
+ 
+ 	if (!fwspec || fwspec->ops != &mtk_iommu_ops)
+ 		return;
+ 
++	data = dev_iommu_priv_get(dev);
++	larbid = mt2701_m4u_to_larb(fwspec->ids[0]);
++	larbdev = data->larb_imu[larbid].dev;
++	device_link_remove(dev, larbdev);
++
+ 	iommu_fwspec_free(dev);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-iommu-mediatek-return-enodev-if-the-device-is-.patch b/queue-5.16/media-iommu-mediatek-return-enodev-if-the-device-is-.patch
new file mode 100644
index 00000000000..a051b32fbc3
--- /dev/null
+++ b/queue-5.16/media-iommu-mediatek-return-enodev-if-the-device-is-.patch
@@ -0,0 +1,58 @@
+From 6d69e877b5e2fca9e71625c55b145f69afa913fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jan 2022 08:05:00 +0100
+Subject: media: iommu/mediatek: Return ENODEV if the device is NULL
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 2fb0feed51085db77606de9b9477c96894328809 ]
+
+The platform device is created at:
+of_platform_default_populate_init:  arch_initcall_sync
+  ->of_platform_populate
+        ->of_platform_device_create_pdata
+
+When entering our probe, all the devices should be already created.
+if it is null, means NODEV. Currently we don't get the fail case.
+It's a minor fix, no need add fixes tags.
+
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c    | 2 +-
+ drivers/iommu/mtk_iommu_v1.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 25b834104790..77ae20ff9b35 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -848,7 +848,7 @@ static int mtk_iommu_probe(struct platform_device *pdev)
+ 		plarbdev = of_find_device_by_node(larbnode);
+ 		if (!plarbdev) {
+ 			of_node_put(larbnode);
+-			return -EPROBE_DEFER;
++			return -ENODEV;
+ 		}
+ 		data->larb_imu[id].dev = &plarbdev->dev;
+ 
+diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
+index 1467ba1e4417..68bf02f87cfd 100644
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -604,7 +604,7 @@ static int mtk_iommu_probe(struct platform_device *pdev)
+ 		plarbdev = of_find_device_by_node(larbnode);
+ 		if (!plarbdev) {
+ 			of_node_put(larbnode);
+-			return -EPROBE_DEFER;
++			return -ENODEV;
+ 		}
+ 		data->larb_imu[i].dev = &plarbdev->dev;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-iommu-mediatek-v1-free-the-existed-fwspec-if-t.patch b/queue-5.16/media-iommu-mediatek-v1-free-the-existed-fwspec-if-t.patch
new file mode 100644
index 00000000000..c0939c6d67b
--- /dev/null
+++ b/queue-5.16/media-iommu-mediatek-v1-free-the-existed-fwspec-if-t.patch
@@ -0,0 +1,77 @@
+From fd8b2c9d02df83f6cdd203d0ee0ba83ab4f42c2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jan 2022 08:04:59 +0100
+Subject: media: iommu/mediatek-v1: Free the existed fwspec if the master dev
+ already has
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 822a2ed8c606caf6a11b1a180b8e46292bd77d71 ]
+
+When the iommu master device enters of_iommu_xlate, the ops may be
+NULL(iommu dev is defered), then it will initialize the fwspec here:
+
+[<c0c9c5bc>] (dev_iommu_fwspec_set) from [<c06bda80>]
+(iommu_fwspec_init+0xbc/0xd4)
+[<c06bd9c4>] (iommu_fwspec_init) from [<c06c0db4>]
+(of_iommu_xlate+0x7c/0x12c)
+[<c06c0d38>] (of_iommu_xlate) from [<c06c10e8>]
+(of_iommu_configure+0x144/0x1e8)
+
+BUT the mtk_iommu_v1.c only supports arm32, the probing flow still is a bit
+weird. We always expect create the fwspec internally. otherwise it will
+enter here and return fail.
+
+static int mtk_iommu_create_mapping(struct device *dev,
+				    struct of_phandle_args *args)
+{
+        ...
+	if (!fwspec) {
+	        ....
+	} else if (dev_iommu_fwspec_get(dev)->ops != &mtk_iommu_ops) {
+                >>>>>>>>>>Enter here. return fail.<<<<<<<<<<<<
+		return -EINVAL;
+	}
+	...
+}
+
+Thus, Free the existed fwspec if the master device already has fwspec.
+
+This issue is reported at:
+https://lore.kernel.org/linux-mediatek/trinity-7d9ebdc9-4849-4d93-bfb5-429dcb4ee449-1626253158870@3c-app-gmx-bs01/
+
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Tested-by: Frank Wunderlich <frank-w@public-files.de> # BPI-R2/MT7623
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+Acked-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu_v1.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
+index be22fcf988ce..1467ba1e4417 100644
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -425,6 +425,15 @@ static struct iommu_device *mtk_iommu_probe_device(struct device *dev)
+ 	struct mtk_iommu_data *data;
+ 	int err, idx = 0;
+ 
++	/*
++	 * In the deferred case, free the existed fwspec.
++	 * Always initialize the fwspec internally.
++	 */
++	if (fwspec) {
++		iommu_fwspec_free(dev);
++		fwspec = dev_iommu_fwspec_get(dev);
++	}
++
+ 	while (!of_parse_phandle_with_args(dev->of_node, "iommus",
+ 					   "#iommu-cells",
+ 					   idx, &iommu_spec)) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-ir_toy-free-before-error-exiting.patch b/queue-5.16/media-ir_toy-free-before-error-exiting.patch
new file mode 100644
index 00000000000..59583242f8e
--- /dev/null
+++ b/queue-5.16/media-ir_toy-free-before-error-exiting.patch
@@ -0,0 +1,35 @@
+From 6a093316a6d5ee838409566432c818a27672f87e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Dec 2021 02:15:18 +0100
+Subject: media: ir_toy: free before error exiting
+
+From: Peiwei Hu <jlu.hpw@foxmail.com>
+
+[ Upstream commit 52cdb013036391d9d87aba5b4fc49cdfc6ea4b23 ]
+
+Fix leak in error path.
+
+Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/ir_toy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
+index 7e98e7e3aace..196806709259 100644
+--- a/drivers/media/rc/ir_toy.c
++++ b/drivers/media/rc/ir_toy.c
+@@ -458,7 +458,7 @@ static int irtoy_probe(struct usb_interface *intf,
+ 	err = usb_submit_urb(irtoy->urb_in, GFP_KERNEL);
+ 	if (err != 0) {
+ 		dev_err(irtoy->dev, "fail to submit in urb: %d\n", err);
+-		return err;
++		goto free_rcdev;
+ 	}
+ 
+ 	err = irtoy_setup(irtoy);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-meson-vdec-potential-dereference-of-null-point.patch b/queue-5.16/media-meson-vdec-potential-dereference-of-null-point.patch
new file mode 100644
index 00000000000..94005fa2eb7
--- /dev/null
+++ b/queue-5.16/media-meson-vdec-potential-dereference-of-null-point.patch
@@ -0,0 +1,96 @@
+From 620c8a32abca0635df4598431bc155e453f28932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jan 2022 07:59:28 +0100
+Subject: media: meson: vdec: potential dereference of null pointer
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit c8c80c996182239ff9b05eda4db50184cf3b2e99 ]
+
+As the possible failure of the kzalloc(), the 'new_ts' could be NULL
+pointer.
+Therefore, it should be better to check it in order to avoid the
+dereference of the NULL pointer.
+Also, the caller esparser_queue() needs to deal with the return value of
+the amvdec_add_ts().
+
+Fixes: 876f123b8956 ("media: meson: vdec: bring up to compliance")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Suggested-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/meson/vdec/esparser.c     | 7 ++++++-
+ drivers/staging/media/meson/vdec/vdec_helpers.c | 8 ++++++--
+ drivers/staging/media/meson/vdec/vdec_helpers.h | 4 ++--
+ 3 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c
+index db7022707ff8..86ccc8937afc 100644
+--- a/drivers/staging/media/meson/vdec/esparser.c
++++ b/drivers/staging/media/meson/vdec/esparser.c
+@@ -328,7 +328,12 @@ esparser_queue(struct amvdec_session *sess, struct vb2_v4l2_buffer *vbuf)
+ 
+ 	offset = esparser_get_offset(sess);
+ 
+-	amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags);
++	ret = amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags);
++	if (ret) {
++		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR);
++		return ret;
++	}
++
+ 	dev_dbg(core->dev, "esparser: ts = %llu pld_size = %u offset = %08X flags = %08X\n",
+ 		vb->timestamp, payload_size, offset, vbuf->flags);
+ 
+diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.c b/drivers/staging/media/meson/vdec/vdec_helpers.c
+index b9125c295d1d..06fd66539797 100644
+--- a/drivers/staging/media/meson/vdec/vdec_helpers.c
++++ b/drivers/staging/media/meson/vdec/vdec_helpers.c
+@@ -227,13 +227,16 @@ int amvdec_set_canvases(struct amvdec_session *sess,
+ }
+ EXPORT_SYMBOL_GPL(amvdec_set_canvases);
+ 
+-void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
+-		   struct v4l2_timecode tc, u32 offset, u32 vbuf_flags)
++int amvdec_add_ts(struct amvdec_session *sess, u64 ts,
++		  struct v4l2_timecode tc, u32 offset, u32 vbuf_flags)
+ {
+ 	struct amvdec_timestamp *new_ts;
+ 	unsigned long flags;
+ 
+ 	new_ts = kzalloc(sizeof(*new_ts), GFP_KERNEL);
++	if (!new_ts)
++		return -ENOMEM;
++
+ 	new_ts->ts = ts;
+ 	new_ts->tc = tc;
+ 	new_ts->offset = offset;
+@@ -242,6 +245,7 @@ void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
+ 	spin_lock_irqsave(&sess->ts_spinlock, flags);
+ 	list_add_tail(&new_ts->list, &sess->timestamps);
+ 	spin_unlock_irqrestore(&sess->ts_spinlock, flags);
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(amvdec_add_ts);
+ 
+diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.h b/drivers/staging/media/meson/vdec/vdec_helpers.h
+index 88137d15aa3a..4bf3e61d081b 100644
+--- a/drivers/staging/media/meson/vdec/vdec_helpers.h
++++ b/drivers/staging/media/meson/vdec/vdec_helpers.h
+@@ -56,8 +56,8 @@ void amvdec_dst_buf_done_offset(struct amvdec_session *sess,
+  * @offset: offset in the VIFIFO where the associated packet was written
+  * @flags: the vb2_v4l2_buffer flags
+  */
+-void amvdec_add_ts(struct amvdec_session *sess, u64 ts,
+-		   struct v4l2_timecode tc, u32 offset, u32 flags);
++int amvdec_add_ts(struct amvdec_session *sess, u64 ts,
++		  struct v4l2_timecode tc, u32 offset, u32 flags);
+ void amvdec_remove_ts(struct amvdec_session *sess, u64 ts);
+ 
+ /**
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-mexon-ge2d-fixup-frames-size-in-registers.patch b/queue-5.16/media-mexon-ge2d-fixup-frames-size-in-registers.patch
new file mode 100644
index 00000000000..1403e9a905a
--- /dev/null
+++ b/queue-5.16/media-mexon-ge2d-fixup-frames-size-in-registers.patch
@@ -0,0 +1,79 @@
+From e5277b96f44e9e156373d7bd9eeaa769b2369194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jun 2021 10:42:15 +0200
+Subject: media: mexon-ge2d: fixup frames size in registers
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 79e8c421a099bfbcebe59740153e55aa0442ced6 ]
+
+The CLIP, SRC & DST registers are coded to take the pixel/line start & end,
+starting from 0. Thus the end should be the width/height minus 1.
+
+It can be an issue with clipping and rotation, where it will add spurious
+lines from uninitialized or unwanted data with a shift in the result.
+
+Fixes: 59a635327ca7 ("media: meson: Add M2M driver for the Amlogic GE2D Accelerator Unit")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/meson/ge2d/ge2d.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/meson/ge2d/ge2d.c b/drivers/media/platform/meson/ge2d/ge2d.c
+index ccda18e5a377..5e7b319f300d 100644
+--- a/drivers/media/platform/meson/ge2d/ge2d.c
++++ b/drivers/media/platform/meson/ge2d/ge2d.c
+@@ -215,35 +215,35 @@ static void ge2d_hw_start(struct meson_ge2d *ge2d)
+ 
+ 	regmap_write(ge2d->map, GE2D_SRC1_CLIPY_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->in.crop.top) |
+-		     FIELD_PREP(GE2D_END, ctx->in.crop.top + ctx->in.crop.height));
++		     FIELD_PREP(GE2D_END, ctx->in.crop.top + ctx->in.crop.height - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC1_CLIPX_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->in.crop.left) |
+-		     FIELD_PREP(GE2D_END, ctx->in.crop.left + ctx->in.crop.width));
++		     FIELD_PREP(GE2D_END, ctx->in.crop.left + ctx->in.crop.width - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC2_CLIPY_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->out.crop.top) |
+-		     FIELD_PREP(GE2D_END, ctx->out.crop.top + ctx->out.crop.height));
++		     FIELD_PREP(GE2D_END, ctx->out.crop.top + ctx->out.crop.height - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC2_CLIPX_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->out.crop.left) |
+-		     FIELD_PREP(GE2D_END, ctx->out.crop.left + ctx->out.crop.width));
++		     FIELD_PREP(GE2D_END, ctx->out.crop.left + ctx->out.crop.width - 1));
+ 	regmap_write(ge2d->map, GE2D_DST_CLIPY_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->out.crop.top) |
+-		     FIELD_PREP(GE2D_END, ctx->out.crop.top + ctx->out.crop.height));
++		     FIELD_PREP(GE2D_END, ctx->out.crop.top + ctx->out.crop.height - 1));
+ 	regmap_write(ge2d->map, GE2D_DST_CLIPX_START_END,
+ 		     FIELD_PREP(GE2D_START, ctx->out.crop.left) |
+-		     FIELD_PREP(GE2D_END, ctx->out.crop.left + ctx->out.crop.width));
++		     FIELD_PREP(GE2D_END, ctx->out.crop.left + ctx->out.crop.width - 1));
+ 
+ 	regmap_write(ge2d->map, GE2D_SRC1_Y_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->in.pix_fmt.height));
++		     FIELD_PREP(GE2D_END, ctx->in.pix_fmt.height - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC1_X_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->in.pix_fmt.width));
++		     FIELD_PREP(GE2D_END, ctx->in.pix_fmt.width - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC2_Y_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.height));
++		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.height - 1));
+ 	regmap_write(ge2d->map, GE2D_SRC2_X_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.width));
++		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.width - 1));
+ 	regmap_write(ge2d->map, GE2D_DST_Y_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.height));
++		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.height - 1));
+ 	regmap_write(ge2d->map, GE2D_DST_X_START_END,
+-		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.width));
++		     FIELD_PREP(GE2D_END, ctx->out.pix_fmt.width - 1));
+ 
+ 	/* Color, no blend, use source color */
+ 	reg = GE2D_ALU_DO_COLOR_OPERATION_LOGIC(LOGIC_OPERATION_COPY,
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-mtk-vcodec-potential-dereference-of-null-point.patch b/queue-5.16/media-mtk-vcodec-potential-dereference-of-null-point.patch
new file mode 100644
index 00000000000..b8230fb0809
--- /dev/null
+++ b/queue-5.16/media-mtk-vcodec-potential-dereference-of-null-point.patch
@@ -0,0 +1,38 @@
+From 88555501784915e831289dec3f21bb291e35386e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Dec 2021 06:21:57 +0100
+Subject: media: mtk-vcodec: potential dereference of null pointer
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit e25a89f743b18c029bfbe5e1663ae0c7190912b0 ]
+
+The return value of devm_kzalloc() needs to be checked.
+To avoid use of null pointer in case of thefailure of alloc.
+
+Fixes: 46233e91fa24 ("media: mtk-vcodec: move firmware implementations into their own files")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Tzung-Bi Shih <tzungbi@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
+index cd27f637dbe7..cfc7ebed8fb7 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
+@@ -102,6 +102,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(struct mtk_vcodec_dev *dev,
+ 	vpu_wdt_reg_handler(fw_pdev, mtk_vcodec_vpu_reset_handler, dev, rst_id);
+ 
+ 	fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL);
++	if (!fw)
++		return ERR_PTR(-ENOMEM);
+ 	fw->type = VPU;
+ 	fw->ops = &mtk_vcodec_vpu_msg;
+ 	fw->pdev = fw_pdev;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-ov5640-fix-set-format-v4l2_mbus_pixelcode-not-.patch b/queue-5.16/media-ov5640-fix-set-format-v4l2_mbus_pixelcode-not-.patch
new file mode 100644
index 00000000000..236a205d3d3
--- /dev/null
+++ b/queue-5.16/media-ov5640-fix-set-format-v4l2_mbus_pixelcode-not-.patch
@@ -0,0 +1,80 @@
+From 9229f6d4106c65c9bce24b4aef484e80630f72dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Nov 2021 21:52:51 +0200
+Subject: media: ov5640: Fix set format, v4l2_mbus_pixelcode not updated
+
+From: Mirela Rabulea <mirela.rabulea@nxp.com>
+
+[ Upstream commit e738f5dd67eb8098d75345908a5e73782d0569a5 ]
+
+In ov5640_set_fmt, pending_fmt_change will always be false, because the
+sensor format is saved before comparing it with the previous format:
+	fmt = &sensor->fmt;...
+	*fmt = *mbus_fmt;...
+	if (mbus_fmt->code != sensor->fmt.code)
+		sensor->pending_fmt_change = true;
+This causes the sensor to capture with the previous pixelcode.
+
+Also, changes might happen even for V4L2_SUBDEV_FORMAT_TRY, so fix that.
+
+Basically, revert back to the state before
+commit 071154499193 ("media: ov5640: Fix set format regression")
+as it was more clear, and then update format even when pixelcode does
+not change, as resolution might change.
+
+Fixes: 071154499193 ("media: ov5640: Fix set format regression")
+Fixes: 6949d864776e ("media: ov5640: do not change mode if format or frame interval is unchanged")
+Fixes: fb98e29ff1ea5 ("media: ov5640: fix mode change regression")
+
+Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com>
+Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Acked-by: Hugues Fruchet <hugues.fruchet@st.com>
+Tested-by: Hugues Fruchet <hugues.fruchet@st.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index ddbd71394db3..db5a19babe67 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2293,7 +2293,6 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+ 	struct ov5640_dev *sensor = to_ov5640_dev(sd);
+ 	const struct ov5640_mode_info *new_mode;
+ 	struct v4l2_mbus_framefmt *mbus_fmt = &format->format;
+-	struct v4l2_mbus_framefmt *fmt;
+ 	int ret;
+ 
+ 	if (format->pad != 0)
+@@ -2311,12 +2310,10 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+ 	if (ret)
+ 		goto out;
+ 
+-	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
+-		fmt = v4l2_subdev_get_try_format(sd, sd_state, 0);
+-	else
+-		fmt = &sensor->fmt;
+-
+-	*fmt = *mbus_fmt;
++	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++		*v4l2_subdev_get_try_format(sd, sd_state, 0) = *mbus_fmt;
++		goto out;
++	}
+ 
+ 	if (new_mode != sensor->current_mode) {
+ 		sensor->current_mode = new_mode;
+@@ -2325,6 +2322,9 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+ 	if (mbus_fmt->code != sensor->fmt.code)
+ 		sensor->pending_fmt_change = true;
+ 
++	/* update format even if code is unchanged, resolution might change */
++	sensor->fmt = *mbus_fmt;
++
+ 	__v4l2_ctrl_s_ctrl_int64(sensor->ctrls.pixel_rate,
+ 				 ov5640_calc_pixel_rate(sensor));
+ out:
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-ov5648-don-t-pack-controls-struct.patch b/queue-5.16/media-ov5648-don-t-pack-controls-struct.patch
new file mode 100644
index 00000000000..0012ded9103
--- /dev/null
+++ b/queue-5.16/media-ov5648-don-t-pack-controls-struct.patch
@@ -0,0 +1,38 @@
+From 5cc0fdc801c420532cff817a543155866fe41a1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 17:16:51 +0100
+Subject: media: ov5648: Don't pack controls struct
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit edd4fbff5378a8103470304809195dc8f4b1d42a ]
+
+Don't pack the driver specific struct containing control pointers. This
+lead to potential alignment issues when working with the pointers.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: e43ccb0a045f ("media: i2c: Add support for the OV5648 image sensor")
+Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5648.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5648.c b/drivers/media/i2c/ov5648.c
+index 947d437ed0ef..78040f0ac02f 100644
+--- a/drivers/media/i2c/ov5648.c
++++ b/drivers/media/i2c/ov5648.c
+@@ -639,7 +639,7 @@ struct ov5648_ctrls {
+ 	struct v4l2_ctrl *pixel_rate;
+ 
+ 	struct v4l2_ctrl_handler handler;
+-} __packed;
++};
+ 
+ struct ov5648_sensor {
+ 	struct device *dev;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-ov6650-fix-set-format-try-processing-path.patch b/queue-5.16/media-ov6650-fix-set-format-try-processing-path.patch
new file mode 100644
index 00000000000..f6ec6a90b63
--- /dev/null
+++ b/queue-5.16/media-ov6650-fix-set-format-try-processing-path.patch
@@ -0,0 +1,234 @@
+From cc7b1c3e07bb555ffccc2f8c50bef2ae2d74f87b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 00:06:16 +0200
+Subject: media: ov6650: Fix set format try processing path
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 1f6f1e959a85ee999fbc86f4b094827f63194c7f ]
+
+According to subdevice interface specification found in V4L2 API
+documentation, set format pad operations should not affect image
+geometry set in preceding image processing steps. Unfortunately, that
+requirement is not respected by the driver implementation of set format
+as it was not the case when that code was still implementing a pair of
+now obsolete .s_mbus_fmt() / .try_mbus_fmt() video operations before
+they have been merged and reused as an implementation of .set_fmt() pad
+operation by commit 717fd5b4907a ("[media] v4l2: replace try_mbus_fmt
+by set_fmt").
+
+In case of set format active processing path the issue can be fixed
+easily by excluding a call to set active selection from that path. That
+will effectively limit frame size processing to optimal frame scaling
+against active crop rectangle without touching it.  Users can just call
+set active selection themselves to obtain desired frame size.  However,
+set format try processing path needs more work.
+
+First of all, the driver should be extended with set try selection
+support.  Lack of it constraints video device drivers to not use
+subdevice cropping at all while processing user requested active frame
+size, otherwise their set try format results might differ from active.
+
+Next, set format try processing path should use pad config crop
+rectangle as a reference, not the active one as it does now.  That
+issue can be resolved easily as soon as set try selection support is
+added to the driver so pad config crop rectangle can be maintained by
+users via selection API.
+
+Last, set format try processing path should give the same results as
+active in respect to active vs. pad config crop rectangle geometry.
+Both rectangles should be either not touched by set format (that's what
+we are going to achieve) or modified the same way, otherwise users
+won't be able to obtain equal results from both paths while iterating
+through set format and set selection operations in order to obtain
+desired frame size.
+
+We can't begin with modifying set format pad operation as not to touch
+crop rectangle since that depends on availability of set try selection
+for symmetry.  Neither can we begin with adding set try selection since
+that in turn depends on equal handling of active and pad config crop
+rectangles by set format.  We can either implement all required
+modifications in a single patch, or begin with fixing current set
+format try processing path to appropriately handle pad config crop
+rectangle.  This patch implements the latter approach as believed to
+be more readable.
+
+Move crop rectangle adjustments code from a helper (the former
+implementation of .s_fmt(), now called from set format active
+processing path) to the body of set format pad operation function
+where it can be also used for processing try requests for symmetry with
+active ones.  As the helper no longer processes frame geometry, only
+frame format and half scaling, simplify its API accordingly and update
+its users.
+
+Moreover, extract code that applies crop rectangle hardware limits
+(now a part of .set_selection() operation which is called from set
+format active processing path) to a new helper and call that helper
+from set format try processing path as well for symmetry with active.
+
+[Sakari Ailus: Rebase on subdev state patches]
+
+Fixes: 717fd5b4907a ("[media] v4l2: replace try_mbus_fmt by set_fmt")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 83 ++++++++++++++++++++++----------------
+ 1 file changed, 48 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index f67412150b16..8b7540e80685 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -491,6 +491,17 @@ static int ov6650_get_selection(struct v4l2_subdev *sd,
+ 	}
+ }
+ 
++static void ov6650_bind_align_crop_rectangle(struct v4l2_rect *rect)
++{
++	v4l_bound_align_image(&rect->width, 2, W_CIF, 1,
++			      &rect->height, 2, H_CIF, 1, 0);
++	v4l_bound_align_image(&rect->left, DEF_HSTRT << 1,
++			      (DEF_HSTRT << 1) + W_CIF - (__s32)rect->width, 1,
++			      &rect->top, DEF_VSTRT << 1,
++			      (DEF_VSTRT << 1) + H_CIF - (__s32)rect->height,
++			      1, 0);
++}
++
+ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ 		struct v4l2_subdev_state *sd_state,
+ 		struct v4l2_subdev_selection *sel)
+@@ -503,13 +514,7 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ 	    sel->target != V4L2_SEL_TGT_CROP)
+ 		return -EINVAL;
+ 
+-	v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1,
+-			      &sel->r.height, 2, H_CIF, 1, 0);
+-	v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1,
+-			      (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1,
+-			      &sel->r.top, DEF_VSTRT << 1,
+-			      (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height,
+-			      1, 0);
++	ov6650_bind_align_crop_rectangle(&sel->r);
+ 
+ 	ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1);
+ 	if (!ret) {
+@@ -570,22 +575,10 @@ static bool is_unscaled_ok(int width, int height, struct v4l2_rect *rect)
+ #define to_clkrc(div)	((div) - 1)
+ 
+ /* set the format we will capture in */
+-static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
++static int ov6650_s_fmt(struct v4l2_subdev *sd, u32 code, bool half_scale)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(sd);
+ 	struct ov6650 *priv = to_ov6650(client);
+-	bool half_scale = !is_unscaled_ok(mf->width, mf->height, &priv->rect);
+-	struct v4l2_subdev_selection sel = {
+-		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
+-		.target = V4L2_SEL_TGT_CROP,
+-		.r.left = priv->rect.left + (priv->rect.width >> 1) -
+-			(mf->width >> (1 - half_scale)),
+-		.r.top = priv->rect.top + (priv->rect.height >> 1) -
+-			(mf->height >> (1 - half_scale)),
+-		.r.width = mf->width << half_scale,
+-		.r.height = mf->height << half_scale,
+-	};
+-	u32 code = mf->code;
+ 	u8 coma_set = 0, coma_mask = 0, coml_set, coml_mask;
+ 	int ret;
+ 
+@@ -653,9 +646,7 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		coma_mask |= COMA_QCIF;
+ 	}
+ 
+-	ret = ov6650_set_selection(sd, NULL, &sel);
+-	if (!ret)
+-		ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask);
++	ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask);
+ 	if (!ret) {
+ 		priv->half_scale = half_scale;
+ 
+@@ -674,14 +665,16 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 	struct v4l2_mbus_framefmt *mf = &format->format;
+ 	struct i2c_client *client = v4l2_get_subdevdata(sd);
+ 	struct ov6650 *priv = to_ov6650(client);
++	struct v4l2_subdev_selection sel = {
++		.which = V4L2_SUBDEV_FORMAT_ACTIVE,
++		.target = V4L2_SEL_TGT_CROP,
++	};
++	struct v4l2_rect *crop = &sel.r;
++	bool half_scale;
+ 
+ 	if (format->pad)
+ 		return -EINVAL;
+ 
+-	if (is_unscaled_ok(mf->width, mf->height, &priv->rect))
+-		v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
+-				&mf->height, 2, H_CIF, 1, 0);
+-
+ 	switch (mf->code) {
+ 	case MEDIA_BUS_FMT_Y10_1X10:
+ 		mf->code = MEDIA_BUS_FMT_Y8_1X8;
+@@ -699,10 +692,24 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 		break;
+ 	}
+ 
++	*crop = priv->rect;
++	half_scale = !is_unscaled_ok(mf->width, mf->height, crop);
++
++	/* adjust new crop rectangle position against its current center */
++	crop->left += (crop->width - (mf->width << half_scale)) / 2;
++	crop->top += (crop->height - (mf->height << half_scale)) / 2;
++	/* adjust new crop rectangle size */
++	crop->width = mf->width << half_scale;
++	crop->height = mf->height << half_scale;
++
+ 	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+-		/* store media bus format code and frame size in pad config */
+-		sd_state->pads->try_fmt.width = mf->width;
+-		sd_state->pads->try_fmt.height = mf->height;
++		/* store new crop rectangle, hadware bound, in pad config */
++		ov6650_bind_align_crop_rectangle(crop);
++		sd_state->pads->try_crop = *crop;
++
++		/* store new mbus frame format code and size in pad config */
++		sd_state->pads->try_fmt.width = crop->width >> half_scale;
++		sd_state->pads->try_fmt.height = crop->height >> half_scale;
+ 		sd_state->pads->try_fmt.code = mf->code;
+ 
+ 		/* return default mbus frame format updated with pad config */
+@@ -712,9 +719,16 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 		mf->code = sd_state->pads->try_fmt.code;
+ 
+ 	} else {
+-		/* apply new media bus format code and frame size */
+-		int ret = ov6650_s_fmt(sd, mf);
++		int ret;
+ 
++		/* apply new crop rectangle */
++		ret = ov6650_set_selection(sd, NULL, &sel);
++		if (ret)
++			return ret;
++
++		/* apply new media bus frame format and scaling if changed */
++		if (mf->code != priv->code || half_scale != priv->half_scale)
++			ret = ov6650_s_fmt(sd, mf->code, half_scale);
+ 		if (ret)
+ 			return ret;
+ 
+@@ -890,9 +904,8 @@ static int ov6650_video_probe(struct v4l2_subdev *sd)
+ 	if (!ret)
+ 		ret = ov6650_prog_dflt(client, xclk->clkrc);
+ 	if (!ret) {
+-		struct v4l2_mbus_framefmt mf = ov6650_def_fmt;
+-
+-		ret = ov6650_s_fmt(sd, &mf);
++		/* driver default frame format, no scaling */
++		ret = ov6650_s_fmt(sd, ov6650_def_fmt.code, false);
+ 	}
+ 	if (!ret)
+ 		ret = v4l2_ctrl_handler_setup(&priv->hdl);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-revert-media-em28xx-add-missing-em28xx_close_e.patch b/queue-5.16/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
new file mode 100644
index 00000000000..0869aea7a7a
--- /dev/null
+++ b/queue-5.16/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
@@ -0,0 +1,50 @@
+From 50ac23ef84571e7a1ca76bd74f47a7ff256bec13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 20:37:30 +0100
+Subject: media: Revert "media: em28xx: add missing em28xx_close_extension"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit fde18c3bac3f964d8333ae53b304d8fee430502b ]
+
+This reverts commit 2c98b8a3458df03abdc6945bbef67ef91d181938.
+
+Reverted patch causes problems with Hauppauge WinTV dualHD as Maximilian
+reported [1]. Since quick solution didn't come up let's just revert it
+to make this device work with upstream kernels.
+
+Link: https://lore.kernel.org/all/6a72a37b-e972-187d-0322-16336e12bdc5@elbmurf.de/ [1]
+
+Reported-by: Maximilian Böhm <maximilian.boehm@elbmurf.de>
+Tested-by: Maximilian Böhm <maximilian.boehm@elbmurf.de>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index f3b56c065ee1..ae25d2cbfdfe 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4150,11 +4150,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+ 
+ 	em28xx_close_extension(dev);
+ 
+-	if (dev->dev_next) {
+-		em28xx_close_extension(dev->dev_next);
++	if (dev->dev_next)
+ 		em28xx_release_resources(dev->dev_next);
+-	}
+-
+ 	em28xx_release_resources(dev);
+ 
+ 	if (dev->dev_next) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-saa7134-fix-incorrect-use-to-determine-if-list.patch b/queue-5.16/media-saa7134-fix-incorrect-use-to-determine-if-list.patch
new file mode 100644
index 00000000000..6fa7142ef44
--- /dev/null
+++ b/queue-5.16/media-saa7134-fix-incorrect-use-to-determine-if-list.patch
@@ -0,0 +1,49 @@
+From 807c46ad47ee8477bbe07da9573aee4d1e7a5afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 15:26:26 +0100
+Subject: media: saa7134: fix incorrect use to determine if list is empty
+
+From: Jakob Koschel <jakobkoschel@gmail.com>
+
+[ Upstream commit 9f1f4b642451d35667a4dc6a9c0a89d954b530a3 ]
+
+'dev' will *always* be set by list_for_each_entry().
+It is incorrect to assume that the iterator value will be NULL if the
+list is empty.
+
+Instead of checking the pointer it should be checked if
+the list is empty.
+
+Fixes: 79dd0c69f05f ("V4L: 925: saa7134 alsa is now a standalone module")
+Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-alsa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
+index fb24d2ed3621..d3cde05a6eba 100644
+--- a/drivers/media/pci/saa7134/saa7134-alsa.c
++++ b/drivers/media/pci/saa7134/saa7134-alsa.c
+@@ -1214,7 +1214,7 @@ static int alsa_device_exit(struct saa7134_dev *dev)
+ 
+ static int saa7134_alsa_init(void)
+ {
+-	struct saa7134_dev *dev = NULL;
++	struct saa7134_dev *dev;
+ 
+ 	saa7134_dmasound_init = alsa_device_init;
+ 	saa7134_dmasound_exit = alsa_device_exit;
+@@ -1229,7 +1229,7 @@ static int saa7134_alsa_init(void)
+ 			alsa_device_init(dev);
+ 	}
+ 
+-	if (dev == NULL)
++	if (list_empty(&saa7134_devlist))
+ 		pr_info("saa7134 ALSA: no saa7134 cards found\n");
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-staging-media-imx-imx7-mipi-csis-make-subdev-n.patch b/queue-5.16/media-staging-media-imx-imx7-mipi-csis-make-subdev-n.patch
new file mode 100644
index 00000000000..c958baebe73
--- /dev/null
+++ b/queue-5.16/media-staging-media-imx-imx7-mipi-csis-make-subdev-n.patch
@@ -0,0 +1,60 @@
+From 0cd36535e6f80360d3518112a51c9ba704c51d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 04:26:35 +0200
+Subject: media: staging: media: imx: imx7-mipi-csis: Make subdev name unique
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 5be7f8c91d25089be847a71b336c13b5bb0db772 ]
+
+When multiple CSIS instances are present in a single graph, they are
+currently all named "imx7-mipi-csis.0", which breaks the entity name
+uniqueness requirement. Fix it by using the device name to create the
+subdev name.
+
+Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7")
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com> # On i.MX8MP
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx7-mipi-csis.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c
+index 2b73fa55c938..9ea723bb5f20 100644
+--- a/drivers/staging/media/imx/imx7-mipi-csis.c
++++ b/drivers/staging/media/imx/imx7-mipi-csis.c
+@@ -32,7 +32,6 @@
+ #include <media/v4l2-subdev.h>
+ 
+ #define CSIS_DRIVER_NAME			"imx7-mipi-csis"
+-#define CSIS_SUBDEV_NAME			CSIS_DRIVER_NAME
+ 
+ #define CSIS_PAD_SINK				0
+ #define CSIS_PAD_SOURCE				1
+@@ -311,7 +310,6 @@ struct csi_state {
+ 	struct reset_control *mrst;
+ 	struct regulator *mipi_phy_regulator;
+ 	const struct mipi_csis_info *info;
+-	u8 index;
+ 
+ 	struct v4l2_subdev sd;
+ 	struct media_pad pads[CSIS_PADS_NUM];
+@@ -1303,8 +1301,8 @@ static int mipi_csis_subdev_init(struct csi_state *state)
+ 
+ 	v4l2_subdev_init(sd, &mipi_csis_subdev_ops);
+ 	sd->owner = THIS_MODULE;
+-	snprintf(sd->name, sizeof(sd->name), "%s.%d",
+-		 CSIS_SUBDEV_NAME, state->index);
++	snprintf(sd->name, sizeof(sd->name), "csis-%s",
++		 dev_name(state->dev));
+ 
+ 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	sd->ctrl_handler = NULL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-staging-media-zoran-calculate-the-right-buffer.patch b/queue-5.16/media-staging-media-zoran-calculate-the-right-buffer.patch
new file mode 100644
index 00000000000..5d97ad5a2e6
--- /dev/null
+++ b/queue-5.16/media-staging-media-zoran-calculate-the-right-buffer.patch
@@ -0,0 +1,51 @@
+From 9c6b1fc80eac34ba10218749f1d06db8d8be22e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 17:16:32 +0100
+Subject: media: staging: media: zoran: calculate the right buffer number for
+ zoran_reap_stat_com
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit e3b86f4e558cea9eed71d894df2f19b10d60a207 ]
+
+On the case tmp_dcim=1, the index of buffer is miscalculated.
+This generate a NULL pointer dereference later.
+
+So let's fix the calcul and add a check to prevent this to reappear.
+
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/zoran/zoran_device.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/zoran/zoran_device.c b/drivers/staging/media/zoran/zoran_device.c
+index 5b12a730a229..fb1f0465ca87 100644
+--- a/drivers/staging/media/zoran/zoran_device.c
++++ b/drivers/staging/media/zoran/zoran_device.c
+@@ -814,7 +814,7 @@ static void zoran_reap_stat_com(struct zoran *zr)
+ 		if (zr->jpg_settings.tmp_dcm == 1)
+ 			i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM;
+ 		else
+-			i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1;
++			i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2;
+ 
+ 		stat_com = le32_to_cpu(zr->stat_com[i]);
+ 		if ((stat_com & 1) == 0) {
+@@ -826,6 +826,11 @@ static void zoran_reap_stat_com(struct zoran *zr)
+ 		size = (stat_com & GENMASK(22, 1)) >> 1;
+ 
+ 		buf = zr->inuse[i];
++		if (!buf) {
++			spin_unlock_irqrestore(&zr->queued_bufs_lock, flags);
++			pci_err(zr->pci_dev, "No buffer at slot %d\n", i);
++			return;
++		}
+ 		buf->vbuf.vb2_buf.timestamp = ktime_get_ns();
+ 
+ 		if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch b/queue-5.16/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch
new file mode 100644
index 00000000000..70d2c716d9d
--- /dev/null
+++ b/queue-5.16/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch
@@ -0,0 +1,45 @@
+From 16c1e75402a0a5942576012ad5462ce34c7d40fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 17:16:29 +0100
+Subject: media: staging: media: zoran: fix usage of
+ vb2_dma_contig_set_max_seg_size
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 241f5b67fb48def58643f279dfb8468bdd54b443 ]
+
+vb2_dma_contig_set_max_seg_size need to have a size in parameter and not
+a DMA_BIT_MASK().
+While fixing this issue, also fix error handling of all DMA size
+setting.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: d4ae3689226e5 ("media: zoran: device support only 32bit DMA address")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/zoran/zoran_card.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c
+index f259585b0689..c578ef3c32f5 100644
+--- a/drivers/staging/media/zoran/zoran_card.c
++++ b/drivers/staging/media/zoran/zoran_card.c
+@@ -1069,8 +1069,10 @@ static int zoran_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+ 	if (err)
+-		return -ENODEV;
+-	vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
++		return err;
++	err = vb2_dma_contig_set_max_seg_size(&pdev->dev, U32_MAX);
++	if (err)
++		return err;
+ 
+ 	nr = zoran_num++;
+ 	if (nr >= BUZ_MAX) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-staging-media-zoran-fix-various-v4l2-complianc.patch b/queue-5.16/media-staging-media-zoran-fix-various-v4l2-complianc.patch
new file mode 100644
index 00000000000..ba20929e0a5
--- /dev/null
+++ b/queue-5.16/media-staging-media-zoran-fix-various-v4l2-complianc.patch
@@ -0,0 +1,102 @@
+From 0893a103f56f030469bcbc831e8a524113e7e13f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 17:16:33 +0100
+Subject: media: staging: media: zoran: fix various V4L2 compliance errors
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 914941827aad5ecddf9bf3a6dee67fbec1af1fff ]
+
+This fixes several issues found with 'v4l2-compliance -s':
+
+1) read()/write() is supported, but not reported in the capabilities
+2) S_STD(G_STD()) failed: setting the same standard should just return 0.
+3) G_PARM failed to set readbuffers.
+4) different field values in the format vs. what v4l2_buffer reported.
+5) zero the sequence number when starting streaming.
+6) drop VB_USERPTR: makes no sense with dma_contig streaming.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/zoran/zoran_card.c   |  2 +-
+ drivers/staging/media/zoran/zoran_driver.c | 13 ++++++++++---
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c
+index a83314b16548..11d415c0c05d 100644
+--- a/drivers/staging/media/zoran/zoran_card.c
++++ b/drivers/staging/media/zoran/zoran_card.c
+@@ -811,7 +811,7 @@ static int zoran_init_video_device(struct zoran *zr, struct video_device *video_
+ 	*video_dev = zoran_template;
+ 	video_dev->v4l2_dev = &zr->v4l2_dev;
+ 	video_dev->lock = &zr->lock;
+-	video_dev->device_caps = V4L2_CAP_STREAMING | dir;
++	video_dev->device_caps = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE | dir;
+ 
+ 	strscpy(video_dev->name, ZR_DEVNAME(zr), sizeof(video_dev->name));
+ 	/*
+diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c
+index 551db338c7f7..84665637ebb7 100644
+--- a/drivers/staging/media/zoran/zoran_driver.c
++++ b/drivers/staging/media/zoran/zoran_driver.c
+@@ -255,8 +255,6 @@ static int zoran_querycap(struct file *file, void *__fh, struct v4l2_capability
+ 	strscpy(cap->card, ZR_DEVNAME(zr), sizeof(cap->card));
+ 	strscpy(cap->driver, "zoran", sizeof(cap->driver));
+ 	snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s", pci_name(zr->pci_dev));
+-	cap->device_caps = zr->video_dev->device_caps;
+-	cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
+ 	return 0;
+ }
+ 
+@@ -582,6 +580,9 @@ static int zoran_s_std(struct file *file, void *__fh, v4l2_std_id std)
+ 	struct zoran *zr = video_drvdata(file);
+ 	int res = 0;
+ 
++	if (zr->norm == std)
++		return 0;
++
+ 	if (zr->running != ZORAN_MAP_MODE_NONE)
+ 		return -EBUSY;
+ 
+@@ -739,6 +740,7 @@ static int zoran_g_parm(struct file *file, void *priv, struct v4l2_streamparm *p
+ 	if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+ 		return -EINVAL;
+ 
++	parm->parm.capture.readbuffers = 9;
+ 	return 0;
+ }
+ 
+@@ -869,6 +871,10 @@ int zr_set_buf(struct zoran *zr)
+ 		vbuf = &buf->vbuf;
+ 
+ 		buf->vbuf.field = V4L2_FIELD_INTERLACED;
++		if (BUZ_MAX_HEIGHT < (zr->v4l_settings.height * 2))
++			buf->vbuf.field = V4L2_FIELD_INTERLACED;
++		else
++			buf->vbuf.field = V4L2_FIELD_TOP;
+ 		vb2_set_plane_payload(&buf->vbuf.vb2_buf, 0, zr->buffer_size);
+ 		vb2_buffer_done(&buf->vbuf.vb2_buf, VB2_BUF_STATE_DONE);
+ 		zr->inuse[0] = NULL;
+@@ -928,6 +934,7 @@ static int zr_vb2_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 		zr->stat_com[j] = cpu_to_le32(1);
+ 		zr->inuse[j] = NULL;
+ 	}
++	zr->vbseq = 0;
+ 
+ 	if (zr->map_mode != ZORAN_MAP_MODE_RAW) {
+ 		pci_info(zr->pci_dev, "START JPG\n");
+@@ -1018,7 +1025,7 @@ int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir)
+ 	vq->dev = &zr->pci_dev->dev;
+ 	vq->type = dir;
+ 
+-	vq->io_modes = VB2_USERPTR | VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE;
++	vq->io_modes = VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE;
+ 	vq->drv_priv = zr;
+ 	vq->buf_struct_size = sizeof(struct zr_buffer);
+ 	vq->ops = &zr_video_qops;
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-staging-media-zoran-move-videodev-alloc.patch b/queue-5.16/media-staging-media-zoran-move-videodev-alloc.patch
new file mode 100644
index 00000000000..b03fdadc856
--- /dev/null
+++ b/queue-5.16/media-staging-media-zoran-move-videodev-alloc.patch
@@ -0,0 +1,185 @@
+From 31766537dad0c61ed44b2eb5f6baa2c6759d2023 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 17:16:26 +0100
+Subject: media: staging: media: zoran: move videodev alloc
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 82e3a496eb56da0b9f29fdc5b63cedb3289e91de ]
+
+Move some code out of zr36057_init() and create new functions for handling
+zr->video_dev. This permit to ease code reading and fix a zr->video_dev
+memory leak.
+
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/zoran/zoran.h        |  2 +-
+ drivers/staging/media/zoran/zoran_card.c   | 80 ++++++++++++++--------
+ drivers/staging/media/zoran/zoran_driver.c |  5 +-
+ 3 files changed, 54 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/staging/media/zoran/zoran.h b/drivers/staging/media/zoran/zoran.h
+index b1ad2a2b914c..50d5a7acfab6 100644
+--- a/drivers/staging/media/zoran/zoran.h
++++ b/drivers/staging/media/zoran/zoran.h
+@@ -313,6 +313,6 @@ static inline struct zoran *to_zoran(struct v4l2_device *v4l2_dev)
+ 
+ #endif
+ 
+-int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq);
++int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir);
+ void zoran_queue_exit(struct zoran *zr);
+ int zr_set_buf(struct zoran *zr);
+diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c
+index c578ef3c32f5..a83314b16548 100644
+--- a/drivers/staging/media/zoran/zoran_card.c
++++ b/drivers/staging/media/zoran/zoran_card.c
+@@ -803,6 +803,52 @@ int zoran_check_jpg_settings(struct zoran *zr,
+ 	return 0;
+ }
+ 
++static int zoran_init_video_device(struct zoran *zr, struct video_device *video_dev, int dir)
++{
++	int err;
++
++	/* Now add the template and register the device unit. */
++	*video_dev = zoran_template;
++	video_dev->v4l2_dev = &zr->v4l2_dev;
++	video_dev->lock = &zr->lock;
++	video_dev->device_caps = V4L2_CAP_STREAMING | dir;
++
++	strscpy(video_dev->name, ZR_DEVNAME(zr), sizeof(video_dev->name));
++	/*
++	 * It's not a mem2mem device, but you can both capture and output from one and the same
++	 * device. This should really be split up into two device nodes, but that's a job for
++	 * another day.
++	 */
++	video_dev->vfl_dir = VFL_DIR_M2M;
++	zoran_queue_init(zr, &zr->vq, V4L2_BUF_TYPE_VIDEO_CAPTURE);
++
++	err = video_register_device(video_dev, VFL_TYPE_VIDEO, video_nr[zr->id]);
++	if (err < 0)
++		return err;
++	video_set_drvdata(video_dev, zr);
++	return 0;
++}
++
++static void zoran_exit_video_devices(struct zoran *zr)
++{
++	video_unregister_device(zr->video_dev);
++	kfree(zr->video_dev);
++}
++
++static int zoran_init_video_devices(struct zoran *zr)
++{
++	int err;
++
++	zr->video_dev = video_device_alloc();
++	if (!zr->video_dev)
++		return -ENOMEM;
++
++	err = zoran_init_video_device(zr, zr->video_dev, V4L2_CAP_VIDEO_CAPTURE);
++	if (err)
++		kfree(zr->video_dev);
++	return err;
++}
++
+ void zoran_open_init_params(struct zoran *zr)
+ {
+ 	int i;
+@@ -874,17 +920,11 @@ static int zr36057_init(struct zoran *zr)
+ 	zoran_open_init_params(zr);
+ 
+ 	/* allocate memory *before* doing anything to the hardware in case allocation fails */
+-	zr->video_dev = video_device_alloc();
+-	if (!zr->video_dev) {
+-		err = -ENOMEM;
+-		goto exit;
+-	}
+ 	zr->stat_com = dma_alloc_coherent(&zr->pci_dev->dev,
+ 					  BUZ_NUM_STAT_COM * sizeof(u32),
+ 					  &zr->p_sc, GFP_KERNEL);
+ 	if (!zr->stat_com) {
+-		err = -ENOMEM;
+-		goto exit_video;
++		return -ENOMEM;
+ 	}
+ 	for (j = 0; j < BUZ_NUM_STAT_COM; j++)
+ 		zr->stat_com[j] = cpu_to_le32(1); /* mark as unavailable to zr36057 */
+@@ -897,26 +937,9 @@ static int zr36057_init(struct zoran *zr)
+ 		goto exit_statcom;
+ 	}
+ 
+-	/* Now add the template and register the device unit. */
+-	*zr->video_dev = zoran_template;
+-	zr->video_dev->v4l2_dev = &zr->v4l2_dev;
+-	zr->video_dev->lock = &zr->lock;
+-	zr->video_dev->device_caps = V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_CAPTURE;
+-
+-	strscpy(zr->video_dev->name, ZR_DEVNAME(zr), sizeof(zr->video_dev->name));
+-	/*
+-	 * It's not a mem2mem device, but you can both capture and output from one and the same
+-	 * device. This should really be split up into two device nodes, but that's a job for
+-	 * another day.
+-	 */
+-	zr->video_dev->vfl_dir = VFL_DIR_M2M;
+-
+-	zoran_queue_init(zr, &zr->vq);
+-
+-	err = video_register_device(zr->video_dev, VFL_TYPE_VIDEO, video_nr[zr->id]);
+-	if (err < 0)
++	err = zoran_init_video_devices(zr);
++	if (err)
+ 		goto exit_statcomb;
+-	video_set_drvdata(zr->video_dev, zr);
+ 
+ 	zoran_init_hardware(zr);
+ 	if (!pass_through) {
+@@ -931,9 +954,6 @@ static int zr36057_init(struct zoran *zr)
+ 	dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32) * 2, zr->stat_comb, zr->p_scb);
+ exit_statcom:
+ 	dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32), zr->stat_com, zr->p_sc);
+-exit_video:
+-	kfree(zr->video_dev);
+-exit:
+ 	return err;
+ }
+ 
+@@ -965,7 +985,7 @@ static void zoran_remove(struct pci_dev *pdev)
+ 	dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32) * 2, zr->stat_comb, zr->p_scb);
+ 	pci_release_regions(pdev);
+ 	pci_disable_device(zr->pci_dev);
+-	video_unregister_device(zr->video_dev);
++	zoran_exit_video_devices(zr);
+ exit_free:
+ 	v4l2_ctrl_handler_free(&zr->hdl);
+ 	v4l2_device_unregister(&zr->v4l2_dev);
+diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c
+index 46382e43f1bf..551db338c7f7 100644
+--- a/drivers/staging/media/zoran/zoran_driver.c
++++ b/drivers/staging/media/zoran/zoran_driver.c
+@@ -1008,7 +1008,7 @@ static const struct vb2_ops zr_video_qops = {
+ 	.wait_finish            = vb2_ops_wait_finish,
+ };
+ 
+-int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq)
++int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir)
+ {
+ 	int err;
+ 
+@@ -1016,7 +1016,8 @@ int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq)
+ 	INIT_LIST_HEAD(&zr->queued_bufs);
+ 
+ 	vq->dev = &zr->pci_dev->dev;
+-	vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
++	vq->type = dir;
++
+ 	vq->io_modes = VB2_USERPTR | VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE;
+ 	vq->drv_priv = zr;
+ 	vq->buf_struct_size = sizeof(struct zr_buffer);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-stk1160-if-start-stream-fails-return-buffers-w.patch b/queue-5.16/media-stk1160-if-start-stream-fails-return-buffers-w.patch
new file mode 100644
index 00000000000..290e0a4eb5b
--- /dev/null
+++ b/queue-5.16/media-stk1160-if-start-stream-fails-return-buffers-w.patch
@@ -0,0 +1,143 @@
+From 7999d182c8dfbd8c5c98238b58f100dee38a7cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 09:02:11 +0100
+Subject: media: stk1160: If start stream fails, return buffers with
+ VB2_BUF_STATE_QUEUED
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ]
+
+If the callback 'start_streaming' fails, then all
+queued buffers in the driver should be returned with
+state 'VB2_BUF_STATE_QUEUED'. Currently, they are
+returned with 'VB2_BUF_STATE_ERROR' which is wrong.
+Fix this. This also fixes the warning:
+
+[   65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6
+[   65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G        W         5.16.0-rc4-62408-g32447129cb30-dirty #14
+[   65.590293] Hardware name: Radxa ROCK Pi 4B (DT)
+[   65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common]
+[   65.592395] sp : ffff800012bc3ad0
+[   65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8
+[   65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612
+[   65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0
+[   65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff
+[   65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78
+[   65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce
+[   65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228
+[   65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78
+[   65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880
+[   65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0
+[   65.598940] Call trace:
+[   65.599155]  vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.599672]  vb2_core_streamon+0x17c/0x1a8 [videobuf2_common]
+[   65.600179]  vb2_streamon+0x54/0x88 [videobuf2_v4l2]
+[   65.600619]  vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2]
+[   65.601103]  v4l_streamon+0x3c/0x50 [videodev]
+[   65.601521]  __video_do_ioctl+0x1a4/0x428 [videodev]
+[   65.601977]  video_usercopy+0x320/0x828 [videodev]
+[   65.602419]  video_ioctl2+0x3c/0x58 [videodev]
+[   65.602830]  v4l2_ioctl+0x60/0x90 [videodev]
+[   65.603227]  __arm64_sys_ioctl+0xa8/0xe0
+[   65.603576]  invoke_syscall+0x54/0x118
+[   65.603911]  el0_svc_common.constprop.3+0x84/0x100
+[   65.604332]  do_el0_svc+0x34/0xa0
+[   65.604625]  el0_svc+0x1c/0x50
+[   65.604897]  el0t_64_sync_handler+0x88/0xb0
+[   65.605264]  el0t_64_sync+0x16c/0x170
+[   65.605587] ---[ end trace 578e0ba07742170d ]---
+
+Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails")
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stk1160/stk1160-core.c |  2 +-
+ drivers/media/usb/stk1160/stk1160-v4l.c  | 10 +++++-----
+ drivers/media/usb/stk1160/stk1160.h      |  2 +-
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
+index 4e1698f78818..ce717502ea4c 100644
+--- a/drivers/media/usb/stk1160/stk1160-core.c
++++ b/drivers/media/usb/stk1160/stk1160-core.c
+@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface)
+ 	/* Here is the only place where isoc get released */
+ 	stk1160_uninit_isoc(dev);
+ 
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+ 
+ 	video_unregister_device(&dev->vdev);
+ 	v4l2_device_disconnect(&dev->v4l2_dev);
+diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c
+index 6a4eb616d516..1aa953469402 100644
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -258,7 +258,7 @@ static int stk1160_start_streaming(struct stk1160 *dev)
+ 	stk1160_uninit_isoc(dev);
+ out_stop_hw:
+ 	usb_set_interface(dev->udev, 0, 0);
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED);
+ 
+ 	mutex_unlock(&dev->v4l_lock);
+ 
+@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev)
+ 
+ 	stk1160_stop_hw(dev);
+ 
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+ 
+ 	stk1160_dbg("streaming stopped\n");
+ 
+@@ -745,7 +745,7 @@ static const struct video_device v4l_template = {
+ /********************************************************************/
+ 
+ /* Must be called with both v4l_lock and vb_queue_lock hold */
+-void stk1160_clear_queue(struct stk1160 *dev)
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state)
+ {
+ 	struct stk1160_buffer *buf;
+ 	unsigned long flags;
+@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ 		buf = list_first_entry(&dev->avail_bufs,
+ 			struct stk1160_buffer, list);
+ 		list_del(&buf->list);
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ 		stk1160_dbg("buffer [%p/%d] aborted\n",
+ 			    buf, buf->vb.vb2_buf.index);
+ 	}
+@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ 		buf = dev->isoc_ctl.buf;
+ 		dev->isoc_ctl.buf = NULL;
+ 
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ 		stk1160_dbg("buffer [%p/%d] aborted\n",
+ 			    buf, buf->vb.vb2_buf.index);
+ 	}
+diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h
+index a31ea1c80f25..a70963ce8753 100644
+--- a/drivers/media/usb/stk1160/stk1160.h
++++ b/drivers/media/usb/stk1160/stk1160.h
+@@ -166,7 +166,7 @@ struct regval {
+ int stk1160_vb2_setup(struct stk1160 *dev);
+ int stk1160_video_register(struct stk1160 *dev);
+ void stk1160_video_unregister(struct stk1160 *dev);
+-void stk1160_clear_queue(struct stk1160 *dev);
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state);
+ 
+ /* Provided by stk1160-video.c */
+ int stk1160_alloc_isoc(struct stk1160 *dev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-ti-vpe-cal-fix-a-null-pointer-dereference-in-c.patch b/queue-5.16/media-ti-vpe-cal-fix-a-null-pointer-dereference-in-c.patch
new file mode 100644
index 00000000000..163365bc0c8
--- /dev/null
+++ b/queue-5.16/media-ti-vpe-cal-fix-a-null-pointer-dereference-in-c.patch
@@ -0,0 +1,48 @@
+From 86be2633a3aeb0c7dd6b74e08b1148cde2aaad8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 18:20:01 +0100
+Subject: media: ti-vpe: cal: Fix a NULL pointer dereference in
+ cal_ctx_v4l2_init_formats()
+
+From: Zhou Qingyang <zhou1615@umn.edu>
+
+[ Upstream commit abd77889851d2ead0d0c9c4d29f1808801477b00 ]
+
+In cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to
+ctx->active_fmt and there is a dereference of it after that, which could
+lead to NULL pointer dereference on failure of devm_kzalloc().
+
+Fix this bug by adding a NULL check of ctx->active_fmt.
+
+This bug was found by a static analyzer.
+
+Builds with 'make allyesconfig' show no new warnings, and our static
+analyzer no longer warns about this code.
+
+Fixes: 7168155002cf ("media: ti-vpe: cal: Move format handling to cal.c and expose helpers")
+Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
+Reviewed-by: Pratyush Yadav <p.yadav@ti.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/cal-video.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/ti-vpe/cal-video.c b/drivers/media/platform/ti-vpe/cal-video.c
+index 7799da1cc261..3e936a2ca36c 100644
+--- a/drivers/media/platform/ti-vpe/cal-video.c
++++ b/drivers/media/platform/ti-vpe/cal-video.c
+@@ -823,6 +823,9 @@ static int cal_ctx_v4l2_init_formats(struct cal_ctx *ctx)
+ 	/* Enumerate sub device formats and enable all matching local formats */
+ 	ctx->active_fmt = devm_kcalloc(ctx->cal->dev, cal_num_formats,
+ 				       sizeof(*ctx->active_fmt), GFP_KERNEL);
++	if (!ctx->active_fmt)
++		return -ENOMEM;
++
+ 	ctx->num_active_fmt = 0;
+ 
+ 	for (j = 0, i = 0; ; ++j) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-usb-go7007-s2250-board-fix-leak-in-probe.patch b/queue-5.16/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
new file mode 100644
index 00000000000..94f9b953937
--- /dev/null
+++ b/queue-5.16/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
@@ -0,0 +1,57 @@
+From 95541df592d0285d09eb9932318b2a8484a64a44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 20:52:01 +0300
+Subject: media: usb: go7007: s2250-board: fix leak in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 67e4550ecd6164bfbdff54c169e5bbf9ccfaf14d ]
+
+Call i2c_unregister_device(audio) on this error path.
+
+Fixes: d3b2ccd9e307 ("[media] s2250: convert to the control framework")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/s2250-board.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c
+index c742cc88fac5..1fa6f10ee157 100644
+--- a/drivers/media/usb/go7007/s2250-board.c
++++ b/drivers/media/usb/go7007/s2250-board.c
+@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client,
+ 	u8 *data;
+ 	struct go7007 *go = i2c_get_adapdata(adapter);
+ 	struct go7007_usb *usb = go->hpi_context;
++	int err = -EIO;
+ 
+ 	audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1);
+ 	if (IS_ERR(audio))
+@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client,
+ 		V4L2_CID_HUE, -512, 511, 1, 0);
+ 	sd->ctrl_handler = &state->hdl;
+ 	if (state->hdl.error) {
+-		int err = state->hdl.error;
+-
+-		v4l2_ctrl_handler_free(&state->hdl);
+-		kfree(state);
+-		return err;
++		err = state->hdl.error;
++		goto fail;
+ 	}
+ 
+ 	state->std = V4L2_STD_NTSC;
+@@ -600,7 +598,7 @@ static int s2250_probe(struct i2c_client *client,
+ 	i2c_unregister_device(audio);
+ 	v4l2_ctrl_handler_free(&state->hdl);
+ 	kfree(state);
+-	return -EIO;
++	return err;
+ }
+ 
+ static int s2250_remove(struct i2c_client *client)
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-v4l-avoid-unaligned-access-warnings-when-print.patch b/queue-5.16/media-v4l-avoid-unaligned-access-warnings-when-print.patch
new file mode 100644
index 00000000000..6b03253d1c8
--- /dev/null
+++ b/queue-5.16/media-v4l-avoid-unaligned-access-warnings-when-print.patch
@@ -0,0 +1,74 @@
+From ff2731331db1deb5651c4f7e981908c897fb1836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 15:53:12 +0100
+Subject: media: v4l: Avoid unaligned access warnings when printing 4cc
+ modifiers
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 24bb30c8c894ec7213ad810b46e2a6a4c12136c1 ]
+
+Pointers V4L2 pixelformat and dataformat fields in a few packed structs
+are directly passed to printk family of functions. This could result in an
+unaligned access albeit no such possibility appears to exist at the
+moment i.e. this clang warning appears to be a false positive.
+
+Address the warning by copying the pixelformat or dataformat value to a
+local variable first.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: e927e1e0f0dd ("v4l: ioctl: Use %p4cc printk modifier to print FourCC codes")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ioctl.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index 69b74d0e8a90..059d6debb25d 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -279,8 +279,8 @@ static void v4l_print_format(const void *arg, bool write_only)
+ 	const struct v4l2_vbi_format *vbi;
+ 	const struct v4l2_sliced_vbi_format *sliced;
+ 	const struct v4l2_window *win;
+-	const struct v4l2_sdr_format *sdr;
+ 	const struct v4l2_meta_format *meta;
++	u32 pixelformat;
+ 	u32 planes;
+ 	unsigned i;
+ 
+@@ -299,8 +299,9 @@ static void v4l_print_format(const void *arg, bool write_only)
+ 	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
+ 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
+ 		mp = &p->fmt.pix_mp;
++		pixelformat = mp->pixelformat;
+ 		pr_cont(", width=%u, height=%u, format=%p4cc, field=%s, colorspace=%d, num_planes=%u, flags=0x%x, ycbcr_enc=%u, quantization=%u, xfer_func=%u\n",
+-			mp->width, mp->height, &mp->pixelformat,
++			mp->width, mp->height, &pixelformat,
+ 			prt_names(mp->field, v4l2_field_names),
+ 			mp->colorspace, mp->num_planes, mp->flags,
+ 			mp->ycbcr_enc, mp->quantization, mp->xfer_func);
+@@ -343,14 +344,15 @@ static void v4l_print_format(const void *arg, bool write_only)
+ 		break;
+ 	case V4L2_BUF_TYPE_SDR_CAPTURE:
+ 	case V4L2_BUF_TYPE_SDR_OUTPUT:
+-		sdr = &p->fmt.sdr;
+-		pr_cont(", pixelformat=%p4cc\n", &sdr->pixelformat);
++		pixelformat = p->fmt.sdr.pixelformat;
++		pr_cont(", pixelformat=%p4cc\n", &pixelformat);
+ 		break;
+ 	case V4L2_BUF_TYPE_META_CAPTURE:
+ 	case V4L2_BUF_TYPE_META_OUTPUT:
+ 		meta = &p->fmt.meta;
++		pixelformat = meta->dataformat;
+ 		pr_cont(", dataformat=%p4cc, buffersize=%u\n",
+-			&meta->dataformat, meta->buffersize);
++			&pixelformat, meta->buffersize);
+ 		break;
+ 	}
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-v4l2-core-initialize-h264-scaling-matrix.patch b/queue-5.16/media-v4l2-core-initialize-h264-scaling-matrix.patch
new file mode 100644
index 00000000000..54154eb2797
--- /dev/null
+++ b/queue-5.16/media-v4l2-core-initialize-h264-scaling-matrix.patch
@@ -0,0 +1,64 @@
+From abf7838bfcb5fc5e723c65d7f014f4cf57407abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 13:42:07 -0500
+Subject: media: v4l2-core: Initialize h264 scaling matrix
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 0f6146d476fc99862899e70f2554ee77b444b7b9 ]
+
+In the final H264 API, it is not required to set scaling matrix if
+they are not present in the bitstream. A flag was added in order to let
+the driver know. The downside is that it leaves the default control
+value to 0, which isn't valid. As per the spec (see formulas 7-8/7-9),
+when the scaling matrix are absent from the bitstream, flat values
+of 16 should be used. This improves this control semantic in a way
+that the control value are always valid. Drivers can then use
+the scaling_matrix control values without having to check its presence.
+Same method was employed for MPEG2_QUANTISATION.
+
+This fixes issues with MTK VCODEC H264 decoder when using GStreamer.
+GStreamer does not set this control if its not present in the bitstream.
+As MTK VDCODEC was using the initialized to 0 values, the frames ended
+up completely gray.
+
+Fixes: 54889c51b833d236 ("media: uapi: h264: Rename and clarify PPS_FLAG_SCALING_MATRIX_PRESENT")
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ctrls-core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
+index 70adfc1b9c81..fb9b99e9e12b 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
+@@ -113,6 +113,7 @@ static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
+ 	struct v4l2_ctrl_mpeg2_quantisation *p_mpeg2_quant;
+ 	struct v4l2_ctrl_vp8_frame *p_vp8_frame;
+ 	struct v4l2_ctrl_fwht_params *p_fwht_params;
++	struct v4l2_ctrl_h264_scaling_matrix *p_h264_scaling_matrix;
+ 	void *p = ptr.p + idx * ctrl->elem_size;
+ 
+ 	if (ctrl->p_def.p_const)
+@@ -160,6 +161,15 @@ static void std_init_compound(const struct v4l2_ctrl *ctrl, u32 idx,
+ 		p_fwht_params->flags = V4L2_FWHT_FL_PIXENC_YUV |
+ 			(2 << V4L2_FWHT_FL_COMPONENTS_NUM_OFFSET);
+ 		break;
++	case V4L2_CTRL_TYPE_H264_SCALING_MATRIX:
++		p_h264_scaling_matrix = p;
++		/*
++		 * The default (flat) H.264 scaling matrix when none are
++		 * specified in the bitstream, this is according to formulas
++		 *  (7-8) and (7-9) of the specification.
++		 */
++		memset(p_h264_scaling_matrix, 16, sizeof(*p_h264_scaling_matrix));
++		break;
+ 	}
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch b/queue-5.16/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch
new file mode 100644
index 00000000000..f28a6391bde
--- /dev/null
+++ b/queue-5.16/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch
@@ -0,0 +1,136 @@
+From 73a2c565a6653f84842ba5e453390559b171a454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Dec 2021 17:38:03 +0100
+Subject: media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across
+ ioctls
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 8310ca94075e784bbb06593cd6c068ee6b6e4ca6 ]
+
+DST_QUEUE_OFF_BASE is applied to offset/mem_offset on MMAP capture buffers
+only for the VIDIOC_QUERYBUF ioctl, while the userspace fields (including
+offset/mem_offset) are filled in for VIDIOC_{QUERY,PREPARE,Q,DQ}BUF
+ioctls. This leads to differences in the values presented to userspace.
+If userspace attempts to mmap the capture buffer directly using values
+from DQBUF, it will fail.
+
+Move the code that applies the magic offset into a helper, and call
+that helper from all four ioctl entry points.
+
+[hverkuil: drop unnecessary '= 0' in v4l2_m2m_querybuf() for ret]
+
+Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
+Fixes: 908a0d7c588e ("[media] v4l: mem2mem: port to videobuf2")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++++++++++++++++++------
+ 1 file changed, 41 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
+index e7f4bf5bc8dd..3de683b5e06d 100644
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -585,19 +585,14 @@ int v4l2_m2m_reqbufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_reqbufs);
+ 
+-int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+-		      struct v4l2_buffer *buf)
++static void v4l2_m2m_adjust_mem_offset(struct vb2_queue *vq,
++				       struct v4l2_buffer *buf)
+ {
+-	struct vb2_queue *vq;
+-	int ret = 0;
+-	unsigned int i;
+-
+-	vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+-	ret = vb2_querybuf(vq, buf);
+-
+ 	/* Adjust MMAP memory offsets for the CAPTURE queue */
+ 	if (buf->memory == V4L2_MEMORY_MMAP && V4L2_TYPE_IS_CAPTURE(vq->type)) {
+ 		if (V4L2_TYPE_IS_MULTIPLANAR(vq->type)) {
++			unsigned int i;
++
+ 			for (i = 0; i < buf->length; ++i)
+ 				buf->m.planes[i].m.mem_offset
+ 					+= DST_QUEUE_OFF_BASE;
+@@ -605,8 +600,23 @@ int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ 			buf->m.offset += DST_QUEUE_OFF_BASE;
+ 		}
+ 	}
++}
+ 
+-	return ret;
++int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
++		      struct v4l2_buffer *buf)
++{
++	struct vb2_queue *vq;
++	int ret;
++
++	vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
++	ret = vb2_querybuf(vq, buf);
++	if (ret)
++		return ret;
++
++	/* Adjust MMAP memory offsets for the CAPTURE queue */
++	v4l2_m2m_adjust_mem_offset(vq, buf);
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_querybuf);
+ 
+@@ -763,6 +773,9 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ 	if (ret)
+ 		return ret;
+ 
++	/* Adjust MMAP memory offsets for the CAPTURE queue */
++	v4l2_m2m_adjust_mem_offset(vq, buf);
++
+ 	/*
+ 	 * If the capture queue is streaming, but streaming hasn't started
+ 	 * on the device, but was asked to stop, mark the previously queued
+@@ -784,9 +797,17 @@ int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ 		   struct v4l2_buffer *buf)
+ {
+ 	struct vb2_queue *vq;
++	int ret;
+ 
+ 	vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+-	return vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK);
++	ret = vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK);
++	if (ret)
++		return ret;
++
++	/* Adjust MMAP memory offsets for the CAPTURE queue */
++	v4l2_m2m_adjust_mem_offset(vq, buf);
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_dqbuf);
+ 
+@@ -795,9 +816,17 @@ int v4l2_m2m_prepare_buf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ {
+ 	struct video_device *vdev = video_devdata(file);
+ 	struct vb2_queue *vq;
++	int ret;
+ 
+ 	vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+-	return vb2_prepare_buf(vq, vdev->v4l2_dev->mdev, buf);
++	ret = vb2_prepare_buf(vq, vdev->v4l2_dev->mdev, buf);
++	if (ret)
++		return ret;
++
++	/* Adjust MMAP memory offsets for the CAPTURE queue */
++	v4l2_m2m_adjust_mem_offset(vq, buf);
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_prepare_buf);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch b/queue-5.16/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
new file mode 100644
index 00000000000..43eefe35cea
--- /dev/null
+++ b/queue-5.16/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
@@ -0,0 +1,66 @@
+From 51ad862ba6561de3597a5e31d3c095df4bb31f9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 19:01:46 +0200
+Subject: media: video/hdmi: handle short reads of hdmi info frame.
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ]
+
+Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
+the size checking done later in hdmi_infoframe_unpack().  A better
+value is the amount of data read into buffer.
+
+Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7511-v4l2.c | 2 +-
+ drivers/media/i2c/adv7604.c      | 2 +-
+ drivers/media/i2c/adv7842.c      | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
+index 41f4e749a859..2217004264e4 100644
+--- a/drivers/media/i2c/adv7511-v4l2.c
++++ b/drivers/media/i2c/adv7511-v4l2.c
+@@ -544,7 +544,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_
+ 	buffer[3] = 0;
+ 	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
+ 
+-	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+ 		return;
+ 	}
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index 44768b59a6ff..0ce323836dad 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2484,7 +2484,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index,
+ 		buffer[i + 3] = infoframe_read(sd,
+ 				       adv76xx_cri[index].payload_addr + i);
+ 
+-	if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,
+ 			 adv76xx_cri[index].desc);
+ 		return -ENOENT;
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 7f8acbdf0db4..8ab4c63839b4 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -2593,7 +2593,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7842_cfg_read_
+ 	for (i = 0; i < len; i++)
+ 		buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);
+ 
+-	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+ 		return;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/media-vidtv-check-for-null-return-of-vzalloc.patch b/queue-5.16/media-vidtv-check-for-null-return-of-vzalloc.patch
new file mode 100644
index 00000000000..6db688c9ec8
--- /dev/null
+++ b/queue-5.16/media-vidtv-check-for-null-return-of-vzalloc.patch
@@ -0,0 +1,70 @@
+From b926e04291a4fdb90935a56140482f3003225a51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 07:28:40 +0100
+Subject: media: vidtv: Check for null return of vzalloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit e6a21a14106d9718aa4f8e115b1e474888eeba44 ]
+
+As the possible failure of the vzalloc(), e->encoder_buf might be NULL.
+Therefore, it should be better to check it in order
+to guarantee the success of the initialization.
+If fails, we need to free not only 'e' but also 'e->name'.
+Also, if the allocation for ctx fails, we need to free 'e->encoder_buf'
+else.
+
+Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/vidtv/vidtv_s302m.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/test-drivers/vidtv/vidtv_s302m.c b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
+index d79b65854627..4676083cee3b 100644
+--- a/drivers/media/test-drivers/vidtv/vidtv_s302m.c
++++ b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
+@@ -455,6 +455,9 @@ struct vidtv_encoder
+ 		e->name = kstrdup(args.name, GFP_KERNEL);
+ 
+ 	e->encoder_buf = vzalloc(VIDTV_S302M_BUF_SZ);
++	if (!e->encoder_buf)
++		goto out_kfree_e;
++
+ 	e->encoder_buf_sz = VIDTV_S302M_BUF_SZ;
+ 	e->encoder_buf_offset = 0;
+ 
+@@ -467,10 +470,8 @@ struct vidtv_encoder
+ 	e->is_video_encoder = false;
+ 
+ 	ctx = kzalloc(priv_sz, GFP_KERNEL);
+-	if (!ctx) {
+-		kfree(e);
+-		return NULL;
+-	}
++	if (!ctx)
++		goto out_kfree_buf;
+ 
+ 	e->ctx = ctx;
+ 	ctx->last_duration = 0;
+@@ -498,6 +499,14 @@ struct vidtv_encoder
+ 	e->next = NULL;
+ 
+ 	return e;
++
++out_kfree_buf:
++	kfree(e->encoder_buf);
++
++out_kfree_e:
++	kfree(e->name);
++	kfree(e);
++	return NULL;
+ }
+ 
+ void vidtv_s302m_encoder_destroy(struct vidtv_encoder *e)
+-- 
+2.34.1
+
diff --git a/queue-5.16/memory-emif-add-check-for-setup_interrupts.patch b/queue-5.16/memory-emif-add-check-for-setup_interrupts.patch
new file mode 100644
index 00000000000..f9668457082
--- /dev/null
+++ b/queue-5.16/memory-emif-add-check-for-setup_interrupts.patch
@@ -0,0 +1,49 @@
+From 51f2ba469ccb46a0f418c0d56135c342c9bd8a83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:54:44 +0800
+Subject: memory: emif: Add check for setup_interrupts
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit fd7bd80b46373887b390852f490f21b07e209498 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value of the
+setup_interrupts() and return error if fails.
+
+Fixes: 68b4aee35d1f ("memory: emif: add interrupt and temperature handling")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220224025444.3256530-1-jiasheng@iscas.ac.cn
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/emif.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index 762d0c0f0716..d4d4044e05b3 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -1117,7 +1117,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ {
+ 	struct emif_data	*emif;
+ 	struct resource		*res;
+-	int			irq;
++	int			irq, ret;
+ 
+ 	if (pdev->dev.of_node)
+ 		emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev);
+@@ -1147,7 +1147,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ 	emif_onetime_settings(emif);
+ 	emif_debugfs_init(emif);
+ 	disable_and_clear_all_interrupts(emif);
+-	setup_interrupts(emif, irq);
++	ret = setup_interrupts(emif, irq);
++	if (ret)
++		goto error;
+ 
+ 	/* One-time actions taken on probing the first device */
+ 	if (!emif1) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/memory-emif-check-the-pointer-temp-in-get_device_det.patch b/queue-5.16/memory-emif-check-the-pointer-temp-in-get_device_det.patch
new file mode 100644
index 00000000000..c431b847639
--- /dev/null
+++ b/queue-5.16/memory-emif-check-the-pointer-temp-in-get_device_det.patch
@@ -0,0 +1,37 @@
+From 0bdc961e39d978d41e483401c1e44645328f2a80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 05:25:52 -0800
+Subject: memory: emif: check the pointer temp in get_device_details()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 5b5ab1bfa1898c6d52936a57c25c5ceba2cb2f87 ]
+
+The pointer temp is allocated by devm_kzalloc(), so it should be
+checked for error handling.
+
+Fixes: 7ec944538dde ("memory: emif: add basic infrastructure for EMIF driver")
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220225132552.27894-1-baijiaju1990@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/emif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index d4d4044e05b3..ecc78d6f89ed 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -1025,7 +1025,7 @@ static struct emif_data *__init_or_module get_device_details(
+ 	temp	= devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+ 	dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL);
+ 
+-	if (!emif || !pd || !dev_info) {
++	if (!emif || !temp || !dev_info) {
+ 		dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__);
+ 		goto error;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/memory-tegra20-emc-correct-memory-device-mask.patch b/queue-5.16/memory-tegra20-emc-correct-memory-device-mask.patch
new file mode 100644
index 00000000000..3d92e3ec22c
--- /dev/null
+++ b/queue-5.16/memory-tegra20-emc-correct-memory-device-mask.patch
@@ -0,0 +1,38 @@
+From e4d0ecf36bdbbb6267279a33b931d20b581392df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 07:32:15 +0300
+Subject: memory: tegra20-emc: Correct memory device mask
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 9ff684342ee7d3ea2755c6e9b60bc43085baa3ad ]
+
+Memory chip select is swapped when we read mode register, correct it.
+We didn't have devices that use a single LPDDR chip and both chips are
+always identical, hence this change is just a minor improvement.
+
+Fixes: 131dd9a436d8 ("memory: tegra20-emc: Support matching timings by LPDDR2 configuration")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20211222043215.28237-2-digetx@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra20-emc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c
+index 497b6edbf3ca..25ba3c5e4ad6 100644
+--- a/drivers/memory/tegra/tegra20-emc.c
++++ b/drivers/memory/tegra/tegra20-emc.c
+@@ -540,7 +540,7 @@ static int emc_read_lpddr_mode_register(struct tegra_emc *emc,
+ 					unsigned int register_addr,
+ 					unsigned int *register_data)
+ {
+-	u32 memory_dev = emem_dev + 1;
++	u32 memory_dev = emem_dev ? 1 : 2;
+ 	u32 val, mr_mask = 0xff;
+ 	int err;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/memstick-mspro_block-fix-handling-of-read-only-devic.patch b/queue-5.16/memstick-mspro_block-fix-handling-of-read-only-devic.patch
new file mode 100644
index 00000000000..4c749e5656d
--- /dev/null
+++ b/queue-5.16/memstick-mspro_block-fix-handling-of-read-only-devic.patch
@@ -0,0 +1,53 @@
+From 07eb2e0c4aaeb1c4478cc8d0acec45457e33cfb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 10:45:12 +0100
+Subject: memstick/mspro_block: fix handling of read-only devices
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 6dab421bfe06a59bf8f212a72e34673e8acf2018 ]
+
+Use set_disk_ro to propagate the read-only state to the block layer
+instead of checking for it in ->open and leaking a reference in case
+of a read-only device.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220215094514.3828912-4-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/mspro_block.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index c0450397b673..7ea312f0840e 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -186,13 +186,8 @@ static int mspro_block_bd_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	mutex_lock(&mspro_block_disk_lock);
+ 
+-	if (msb && msb->card) {
++	if (msb && msb->card)
+ 		msb->usage_count++;
+-		if ((mode & FMODE_WRITE) && msb->read_only)
+-			rc = -EROFS;
+-		else
+-			rc = 0;
+-	}
+ 
+ 	mutex_unlock(&mspro_block_disk_lock);
+ 
+@@ -1239,6 +1234,9 @@ static int mspro_block_init_disk(struct memstick_dev *card)
+ 	set_capacity(msb->disk, capacity);
+ 	dev_dbg(&card->dev, "capacity set %ld\n", capacity);
+ 
++	if (msb->read_only)
++		set_disk_ro(msb->disk, true);
++
+ 	rc = device_add_disk(&card->dev, msb->disk, NULL);
+ 	if (rc)
+ 		goto out_cleanup_disk;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch b/queue-5.16/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
new file mode 100644
index 00000000000..06faf16f455
--- /dev/null
+++ b/queue-5.16/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
@@ -0,0 +1,59 @@
+From 6c08b4ae7a7dae8a5584cf7982f75ab4d7aa0c9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 07:29:47 +0000
+Subject: mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit e84ee1a75f944a0fe3c277aaa10c426603d2b0bc ]
+
+Add the missing iounmap() before return from asic3_mfd_probe
+in the error handling case.
+
+Fixes: 64e8867ba809 ("mfd: tmio_mmc hardware abstraction for CNF area")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20220307072947.5369-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/asic3.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
+index 8d58c8df46cf..56338f9dbd0b 100644
+--- a/drivers/mfd/asic3.c
++++ b/drivers/mfd/asic3.c
+@@ -906,14 +906,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ 		ret = mfd_add_devices(&pdev->dev, pdev->id,
+ 			&asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL);
+ 		if (ret < 0)
+-			goto out;
++			goto out_unmap;
+ 	}
+ 
+ 	if (mem_sdio && (irq >= 0)) {
+ 		ret = mfd_add_devices(&pdev->dev, pdev->id,
+ 			&asic3_cell_mmc, 1, mem_sdio, irq, NULL);
+ 		if (ret < 0)
+-			goto out;
++			goto out_unmap;
+ 	}
+ 
+ 	ret = 0;
+@@ -927,8 +927,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ 		ret = mfd_add_devices(&pdev->dev, 0,
+ 			asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL);
+ 	}
++	return ret;
+ 
+- out:
++out_unmap:
++	if (asic->tmio_cnf)
++		iounmap(asic->tmio_cnf);
++out:
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch b/queue-5.16/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
new file mode 100644
index 00000000000..55fc26d71bd
--- /dev/null
+++ b/queue-5.16/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
@@ -0,0 +1,41 @@
+From e0fa9d4465e0c886e4a0192ebc0fc87f5943aa5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:23:31 +0800
+Subject: mfd: mc13xxx: Add check for mc13xxx_irq_request
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit e477e51a41cb5d6034f3c5ea85a71ad4613996b9 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value of the
+mc13xxx_irq_request() and return error if fails.
+
+Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20220224022331.3208275-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index 8a4f1d90dcfd..1000572761a8 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ 		adc1 |= MC13783_ADC1_ATOX;
+ 
+ 	dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__);
+-	mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
++	ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
+ 			mc13xxx_handler_adcdone, __func__, &adcdone_data);
++	if (ret)
++		goto out;
+ 
+ 	mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0);
+ 	mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch b/queue-5.16/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch
new file mode 100644
index 00000000000..87b4b3794ee
--- /dev/null
+++ b/queue-5.16/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch
@@ -0,0 +1,37 @@
+From 0def1e899ab19d2f75be9a14bc8d056260072729 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 09:17:10 +0000
+Subject: mips: cdmm: Fix refcount leak in mips_cdmm_phys_base
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 4528668ca331f7ce5999b7746657b46db5b3b785 ]
+
+The of_find_compatible_node() function returns a node pointer with
+refcount incremented, We should use of_node_put() on it when done
+Add the missing of_node_put() to release the refcount.
+
+Fixes: 2121aa3e2312 ("mips: cdmm: Add mti,mips-cdmm dtb node support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mips_cdmm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
+index 626dedd110cb..fca0d0669aa9 100644
+--- a/drivers/bus/mips_cdmm.c
++++ b/drivers/bus/mips_cdmm.c
+@@ -351,6 +351,7 @@ phys_addr_t __weak mips_cdmm_phys_base(void)
+ 	np = of_find_compatible_node(NULL, NULL, "mti,mips-cdmm");
+ 	if (np) {
+ 		err = of_address_to_resource(np, 0, &res);
++		of_node_put(np);
+ 		if (!err)
+ 			return res.start;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/mips-dec-honor-config_mips_fp_support-n.patch b/queue-5.16/mips-dec-honor-config_mips_fp_support-n.patch
new file mode 100644
index 00000000000..8e8a057b28f
--- /dev/null
+++ b/queue-5.16/mips-dec-honor-config_mips_fp_support-n.patch
@@ -0,0 +1,80 @@
+From e04d98a4e105e0152785c4e275658cac84a33140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 08:24:27 -0800
+Subject: mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 97bf0395c226907e1a9b908511a35192bf1e09bb ]
+
+Include the DECstation interrupt handler in opting out of
+FPU support.
+
+Fixes a linker error:
+
+mips-linux-ld: arch/mips/dec/int-handler.o: in function `fpu':
+(.text+0x148): undefined reference to `handle_fpe_int'
+
+Fixes: 183b40f992c8 ("MIPS: Allow FP support to be disabled")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Paul Burton <paulburton@kernel.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: Maciej W. Rozycki <macro@orcam.me.uk>
+Cc: linux-mips@vger.kernel.org
+Acked-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/dec/int-handler.S | 6 +++---
+ arch/mips/dec/setup.c       | 3 ++-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
+index ea5b5a83f1e1..011d1d678840 100644
+--- a/arch/mips/dec/int-handler.S
++++ b/arch/mips/dec/int-handler.S
+@@ -131,7 +131,7 @@
+ 		 */
+ 		mfc0	t0,CP0_CAUSE		# get pending interrupts
+ 		mfc0	t1,CP0_STATUS
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ 		lw	t2,cpu_fpu_mask
+ #endif
+ 		andi	t0,ST0_IM		# CAUSE.CE may be non-zero!
+@@ -139,7 +139,7 @@
+ 
+ 		beqz	t0,spurious
+ 
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ 		 and	t2,t0
+ 		bnez	t2,fpu			# handle FPU immediately
+ #endif
+@@ -280,7 +280,7 @@ handle_it:
+ 		j	dec_irq_dispatch
+ 		 nop
+ 
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ fpu:
+ 		lw	t0,fpu_kstat_irq
+ 		nop
+diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
+index a8a30bb1dee8..82b00e45ce50 100644
+--- a/arch/mips/dec/setup.c
++++ b/arch/mips/dec/setup.c
+@@ -746,7 +746,8 @@ void __init arch_init_irq(void)
+ 		dec_interrupt[DEC_IRQ_HALT] = -1;
+ 
+ 	/* Register board interrupts: FPU and cascade. */
+-	if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) {
++	if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) &&
++	    dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) {
+ 		struct irq_desc *desc_fpu;
+ 		int irq_fpu;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch b/queue-5.16/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch
new file mode 100644
index 00000000000..bca0401121b
--- /dev/null
+++ b/queue-5.16/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch
@@ -0,0 +1,57 @@
+From 84e70ee9e7330ce8a6d2deb5d0ae9ffd31d1f342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 19:31:16 +0800
+Subject: MIPS: pgalloc: fix memory leak caused by pgd_free()
+
+From: Yaliang Wang <Yaliang.Wang@windriver.com>
+
+[ Upstream commit 2bc5bab9a763d520937e4f3fe8df51c6a1eceb97 ]
+
+pgd page is freed by generic implementation pgd_free() since commit
+f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()"),
+however, there are scenarios that the system uses more than one page as
+the pgd table, in such cases the generic implementation pgd_free() won't
+be applicable anymore. For example, when PAGE_SIZE_4KB is enabled and
+MIPS_VA_BITS_48 is not enabled in a 64bit system, the macro "PGD_ORDER"
+will be set as "1", which will cause allocating two pages as the pgd
+table. Well, at the same time, the generic implementation pgd_free()
+just free one pgd page, which will result in the memory leak.
+
+The memory leak can be easily detected by executing shell command:
+"while true; do ls > /dev/null; grep MemFree /proc/meminfo; done"
+
+Fixes: f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()")
+Signed-off-by: Yaliang Wang <Yaliang.Wang@windriver.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/pgalloc.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
+index c7925d0e9874..867e9c3db76e 100644
+--- a/arch/mips/include/asm/pgalloc.h
++++ b/arch/mips/include/asm/pgalloc.h
+@@ -15,6 +15,7 @@
+ 
+ #define __HAVE_ARCH_PMD_ALLOC_ONE
+ #define __HAVE_ARCH_PUD_ALLOC_ONE
++#define __HAVE_ARCH_PGD_FREE
+ #include <asm-generic/pgalloc.h>
+ 
+ static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
+@@ -48,6 +49,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ extern void pgd_init(unsigned long page);
+ extern pgd_t *pgd_alloc(struct mm_struct *mm);
+ 
++static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
++{
++	free_pages((unsigned long)pgd, PGD_ORDER);
++}
++
+ #define __pte_free_tlb(tlb,pte,address)			\
+ do {							\
+ 	pgtable_pte_page_dtor(pte);			\
+-- 
+2.34.1
+
diff --git a/queue-5.16/mips-rb532-fix-return-value-of-__setup-handler.patch b/queue-5.16/mips-rb532-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..89b49cb28bd
--- /dev/null
+++ b/queue-5.16/mips-rb532-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,57 @@
+From 353e78e6a987e6b2d6c65dadad85ac6a582b65f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 20:20:26 -0800
+Subject: MIPS: RB532: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 8755d57ba1ff910666572fab9e32890e8cc6ed3b ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) argument or environment
+strings. Also, error return codes don't mean anything to
+obsolete_checksetup() -- only non-zero (usually 1) or zero.
+So return 1 from setup_kmac().
+
+Fixes: 9e21c7e40b7e ("MIPS: RB532: Replace parse_mac_addr() with mac_pton().")
+Fixes: 73b4390fb234 ("[MIPS] Routerboard 532: Support for base system")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+From: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Phil Sutter <n0-1@freewrt.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Daniel Walter <dwalter@google.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/rb532/devices.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
+index 04684990e28e..b7f6f782d9a1 100644
+--- a/arch/mips/rb532/devices.c
++++ b/arch/mips/rb532/devices.c
+@@ -301,11 +301,9 @@ static int __init plat_setup_devices(void)
+ static int __init setup_kmac(char *s)
+ {
+ 	printk(KERN_INFO "korina mac = %s\n", s);
+-	if (!mac_pton(s, korina_dev0_data.mac)) {
++	if (!mac_pton(s, korina_dev0_data.mac))
+ 		printk(KERN_ERR "Invalid mac\n");
+-		return -EINVAL;
+-	}
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kmac=", setup_kmac);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mips-sanitise-cavium-switch-cases-in-tlb-handler-syn.patch b/queue-5.16/mips-sanitise-cavium-switch-cases-in-tlb-handler-syn.patch
new file mode 100644
index 00000000000..37bfb49132a
--- /dev/null
+++ b/queue-5.16/mips-sanitise-cavium-switch-cases-in-tlb-handler-syn.patch
@@ -0,0 +1,73 @@
+From af9fdb2086e46c4b612290ebcc1e4d24f8f46c7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 21:13:11 +0000
+Subject: MIPS: Sanitise Cavium switch cases in TLB handler synthesizers
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+[ Upstream commit 6ddcba9d480b6bcced4223a729794dfa6becb7eb ]
+
+It makes no sense to fall through to `break'.  Therefore reorder the
+switch statements so as to have the Cavium cases first, followed by the
+default case, which improves readability and pacifies code analysis
+tools.  No change in semantics, assembly produced is exactly the same.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Fixes: bc431d2153cc ("MIPS: Fix fall-through warnings for Clang")
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlbex.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index b131e6a77383..5cda07688f67 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -2160,16 +2160,14 @@ static void build_r4000_tlb_load_handler(void)
+ 		uasm_i_tlbr(&p);
+ 
+ 		switch (current_cpu_type()) {
+-		default:
+-			if (cpu_has_mips_r2_exec_hazard) {
+-				uasm_i_ehb(&p);
+-			fallthrough;
+-
+ 		case CPU_CAVIUM_OCTEON:
+ 		case CPU_CAVIUM_OCTEON_PLUS:
+ 		case CPU_CAVIUM_OCTEON2:
+-				break;
+-			}
++			break;
++		default:
++			if (cpu_has_mips_r2_exec_hazard)
++				uasm_i_ehb(&p);
++			break;
+ 		}
+ 
+ 		/* Examine  entrylo 0 or 1 based on ptr. */
+@@ -2236,15 +2234,14 @@ static void build_r4000_tlb_load_handler(void)
+ 		uasm_i_tlbr(&p);
+ 
+ 		switch (current_cpu_type()) {
+-		default:
+-			if (cpu_has_mips_r2_exec_hazard) {
+-				uasm_i_ehb(&p);
+-
+ 		case CPU_CAVIUM_OCTEON:
+ 		case CPU_CAVIUM_OCTEON_PLUS:
+ 		case CPU_CAVIUM_OCTEON2:
+-				break;
+-			}
++			break;
++		default:
++			if (cpu_has_mips_r2_exec_hazard)
++				uasm_i_ehb(&p);
++			break;
+ 		}
+ 
+ 		/* Examine  entrylo 0 or 1 based on ptr. */
+-- 
+2.34.1
+
diff --git a/queue-5.16/misc-alcor_pci-fix-an-error-handling-path.patch b/queue-5.16/misc-alcor_pci-fix-an-error-handling-path.patch
new file mode 100644
index 00000000000..cb5dcce8696
--- /dev/null
+++ b/queue-5.16/misc-alcor_pci-fix-an-error-handling-path.patch
@@ -0,0 +1,72 @@
+From aaf84e54fd6646633bdfd64c2ca625e88316662a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 09:39:54 +0100
+Subject: misc: alcor_pci: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5b3dc949f554379edcb8ef6111aa5ecb78feb798 ]
+
+A successful ida_simple_get() should be balanced by a corresponding
+ida_simple_remove().
+
+Add the missing call in the error handling path of the probe.
+
+While at it, switch to ida_alloc()/ida_free() instead to
+ida_simple_get()/ida_simple_remove().
+The latter is deprecated and more verbose.
+
+Fixes: 4f556bc04e3c ("misc: cardreader: add new Alcor Micro Cardreader PCI driver")
+Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/918a9875b7f67b7f8f123c4446452603422e8c5e.1644136776.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cardreader/alcor_pci.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c
+index de6d44a158bb..3f514d77a843 100644
+--- a/drivers/misc/cardreader/alcor_pci.c
++++ b/drivers/misc/cardreader/alcor_pci.c
+@@ -266,7 +266,7 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL);
++	ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL);
+ 	if (ret < 0)
+ 		return ret;
+ 	priv->id = ret;
+@@ -280,7 +280,8 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 	ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Cannot request region\n");
+-		return -ENOMEM;
++		ret = -ENOMEM;
++		goto error_free_ida;
+ 	}
+ 
+ 	if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) {
+@@ -324,6 +325,8 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 
+ error_release_regions:
+ 	pci_release_regions(pdev);
++error_free_ida:
++	ida_free(&alcor_pci_idr, priv->id);
+ 	return ret;
+ }
+ 
+@@ -337,7 +340,7 @@ static void alcor_pci_remove(struct pci_dev *pdev)
+ 
+ 	mfd_remove_devices(&pdev->dev);
+ 
+-	ida_simple_remove(&alcor_pci_idr, priv->id);
++	ida_free(&alcor_pci_idr, priv->id);
+ 
+ 	pci_release_regions(pdev);
+ 	pci_set_drvdata(pdev, NULL);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mmc-davinci_mmc-handle-error-for-clk_enable.patch b/queue-5.16/mmc-davinci_mmc-handle-error-for-clk_enable.patch
new file mode 100644
index 00000000000..b626488aa7a
--- /dev/null
+++ b/queue-5.16/mmc-davinci_mmc-handle-error-for-clk_enable.patch
@@ -0,0 +1,43 @@
+From f991356ef609e1fd869f907feacd333dfe5bd538 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 15:14:15 +0800
+Subject: mmc: davinci_mmc: Handle error for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 09e7af76db02c74f2a339b3cb2d95460fa2ddbe4 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: bbce5802afc5 ("davinci: mmc: updates to suspend/resume implementation")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220308071415.1093393-1-jiasheng@iscas.ac.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/davinci_mmc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
+index 2a757c88f9d2..80de660027d8 100644
+--- a/drivers/mmc/host/davinci_mmc.c
++++ b/drivers/mmc/host/davinci_mmc.c
+@@ -1375,8 +1375,12 @@ static int davinci_mmcsd_suspend(struct device *dev)
+ static int davinci_mmcsd_resume(struct device *dev)
+ {
+ 	struct mmc_davinci_host *host = dev_get_drvdata(dev);
++	int ret;
++
++	ret = clk_enable(host->clk);
++	if (ret)
++		return ret;
+ 
+-	clk_enable(host->clk);
+ 	mmc_davinci_reset_ctrl(host, 0);
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch b/queue-5.16/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
new file mode 100644
index 00000000000..e6279bf51e2
--- /dev/null
+++ b/queue-5.16/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
@@ -0,0 +1,60 @@
+From fd3a3ed5d10eac6aeb0367ca115d2f6334d22cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:51:42 +0100
+Subject: mmc: host: Return an error when ->enable_sdio_irq() ops is missing
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit d6c9219ca1139b74541b2a98cee47a3426d754a9 ]
+
+Even if the current WARN() notifies the user that something is severely
+wrong, we can still end up in a PANIC() when trying to invoke the missing
+->enable_sdio_irq() ops. Therefore, let's also return an error code and
+prevent the host from being added.
+
+While at it, move the code into a separate function to prepare for
+subsequent changes and for further host caps validations.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://lore.kernel.org/r/20220303165142.129745-1-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/host.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index cf140f4ec864..d739e2b631fe 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -588,6 +588,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+ 
+ EXPORT_SYMBOL(mmc_alloc_host);
+ 
++static int mmc_validate_host_caps(struct mmc_host *host)
++{
++	if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) {
++		dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ /**
+  *	mmc_add_host - initialise host hardware
+  *	@host: mmc host
+@@ -600,8 +610,9 @@ int mmc_add_host(struct mmc_host *host)
+ {
+ 	int err;
+ 
+-	WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) &&
+-		!host->ops->enable_sdio_irq);
++	err = mmc_validate_host_caps(host);
++	if (err)
++		return err;
+ 
+ 	err = device_add(&host->class_dev);
+ 	if (err)
+-- 
+2.34.1
+
diff --git a/queue-5.16/mmc-sdhci_am654-fix-the-driver-data-of-am64-soc.patch b/queue-5.16/mmc-sdhci_am654-fix-the-driver-data-of-am64-soc.patch
new file mode 100644
index 00000000000..8fa0ea0591a
--- /dev/null
+++ b/queue-5.16/mmc-sdhci_am654-fix-the-driver-data-of-am64-soc.patch
@@ -0,0 +1,70 @@
+From b6216d5d03eecafb3929955a4650ba76a812ae4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 13:20:55 +0530
+Subject: mmc: sdhci_am654: Fix the driver data of AM64 SoC
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 3b7340f1c89cc488e4df0b033bf7ae502ebbf5b2 ]
+
+The MMCSD IPs used in AM64 are the same as the ones used in J721E.
+Therefore, fix this by using the driver data from J721E for AM64 too, for
+both 8 and 4 bit instances.
+
+Fixes: 754b7f2f7d2a ("mmc: sdhci_am654: Add Support for TI's AM64 SoC")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Link: https://lore.kernel.org/r/20220211075056.26179-1-a-govindraju@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 24 ++----------------------
+ 1 file changed, 2 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index f654afbe8e83..b4891bb26648 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -514,26 +514,6 @@ static const struct sdhci_am654_driver_data sdhci_j721e_4bit_drvdata = {
+ 	.flags = IOMUX_PRESENT,
+ };
+ 
+-static const struct sdhci_pltfm_data sdhci_am64_8bit_pdata = {
+-	.ops = &sdhci_j721e_8bit_ops,
+-	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+-};
+-
+-static const struct sdhci_am654_driver_data sdhci_am64_8bit_drvdata = {
+-	.pdata = &sdhci_am64_8bit_pdata,
+-	.flags = DLL_PRESENT | DLL_CALIB,
+-};
+-
+-static const struct sdhci_pltfm_data sdhci_am64_4bit_pdata = {
+-	.ops = &sdhci_j721e_4bit_ops,
+-	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+-};
+-
+-static const struct sdhci_am654_driver_data sdhci_am64_4bit_drvdata = {
+-	.pdata = &sdhci_am64_4bit_pdata,
+-	.flags = IOMUX_PRESENT,
+-};
+-
+ static const struct soc_device_attribute sdhci_am654_devices[] = {
+ 	{ .family = "AM65X",
+ 	  .revision = "SR1.0",
+@@ -759,11 +739,11 @@ static const struct of_device_id sdhci_am654_of_match[] = {
+ 	},
+ 	{
+ 		.compatible = "ti,am64-sdhci-8bit",
+-		.data = &sdhci_am64_8bit_drvdata,
++		.data = &sdhci_j721e_8bit_drvdata,
+ 	},
+ 	{
+ 		.compatible = "ti,am64-sdhci-4bit",
+-		.data = &sdhci_am64_4bit_drvdata,
++		.data = &sdhci_j721e_4bit_drvdata,
+ 	},
+ 	{ /* sentinel */ }
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/mptcp-fix-crash-due-to-tcp_tsorted_anchor-was-initia.patch b/queue-5.16/mptcp-fix-crash-due-to-tcp_tsorted_anchor-was-initia.patch
new file mode 100644
index 00000000000..7c2a9bcac44
--- /dev/null
+++ b/queue-5.16/mptcp-fix-crash-due-to-tcp_tsorted_anchor-was-initia.patch
@@ -0,0 +1,68 @@
+From da28ace4737ede71e43def545bac5aacdfad111b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 15:09:53 -0700
+Subject: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before
+ release skb
+
+From: Yonglong Li <liyonglong@chinatelecom.cn>
+
+[ Upstream commit 3ef3905aa3b5b3e222ee6eb0210bfd999417a8cc ]
+
+Got crash when doing pressure test of mptcp:
+
+===========================================================================
+dst_release: dst:ffffa06ce6e5c058 refcnt:-1
+kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
+BUG: unable to handle kernel paging request at ffffa06ce6e5c058
+PGD 190a01067 P4D 190a01067 PUD 43fffb067 PMD 22e403063 PTE 8000000226e5c063
+Oops: 0011 [#1] SMP PTI
+CPU: 7 PID: 7823 Comm: kworker/7:0 Kdump: loaded Tainted: G            E
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.2.1 04/01/2014
+Call Trace:
+ ? skb_release_head_state+0x68/0x100
+ ? skb_release_all+0xe/0x30
+ ? kfree_skb+0x32/0xa0
+ ? mptcp_sendmsg_frag+0x57e/0x750
+ ? __mptcp_retrans+0x21b/0x3c0
+ ? __switch_to_asm+0x35/0x70
+ ? mptcp_worker+0x25e/0x320
+ ? process_one_work+0x1a7/0x360
+ ? worker_thread+0x30/0x390
+ ? create_worker+0x1a0/0x1a0
+ ? kthread+0x112/0x130
+ ? kthread_flush_work_fn+0x10/0x10
+ ? ret_from_fork+0x35/0x40
+===========================================================================
+
+In __mptcp_alloc_tx_skb skb was allocated and skb->tcp_tsorted_anchor will
+be initialized, in under memory pressure situation sk_wmem_schedule will
+return false and then kfree_skb. In this case skb->_skb_refdst is not null
+because_skb_refdst and tcp_tsorted_anchor are stored in the same mem, and
+kfree_skb will try to release dst and cause crash.
+
+Fixes: f70cad1085d1 ("mptcp: stop relying on tcp_tx_skb_cache")
+Reviewed-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Yonglong Li <liyonglong@chinatelecom.cn>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Link: https://lore.kernel.org/r/20220317220953.426024-1-mathew.j.martineau@linux.intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 7566c9dc6681..1784e528704a 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1202,6 +1202,7 @@ static struct sk_buff *__mptcp_alloc_tx_skb(struct sock *sk, struct sock *ssk, g
+ 		tcp_skb_entail(ssk, skb);
+ 		return skb;
+ 	}
++	tcp_skb_tsorted_anchor_cleanup(skb);
+ 	kfree_skb(skb);
+ 	return NULL;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-connac-fix-sta_rec_wtbl-tag-len.patch b/queue-5.16/mt76-connac-fix-sta_rec_wtbl-tag-len.patch
new file mode 100644
index 00000000000..523a288d08c
--- /dev/null
+++ b/queue-5.16/mt76-connac-fix-sta_rec_wtbl-tag-len.patch
@@ -0,0 +1,36 @@
+From 8004303d91814e032a8e29ac1d47d9d76f6ac47e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Dec 2021 18:40:06 +0100
+Subject: mt76: connac: fix sta_rec_wtbl tag len
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 74c337ec0905d99111fc63a15f2e0784b9ed5503 ]
+
+Similar to mt7915 driver, fix tag len error for sta_rec_wtbl, which
+causes fw parsing error for the tags placed behind it.
+
+Fixes: d0e274af2f2e4 ("mt76: mt76_connac: create mcu library")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 1fb8432aa27c..6235ed3a332b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -313,7 +313,7 @@ mt76_connac_mcu_alloc_wtbl_req(struct mt76_dev *dev, struct mt76_wcid *wcid,
+ 	}
+ 
+ 	if (sta_hdr)
+-		sta_hdr->len = cpu_to_le16(sizeof(hdr));
++		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
+ 
+ 	return skb_put_data(nskb, &hdr, sizeof(hdr));
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch b/queue-5.16/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
new file mode 100644
index 00000000000..6bcbe90a3af
--- /dev/null
+++ b/queue-5.16/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
@@ -0,0 +1,37 @@
+From 2ce311c387b5241c466988fde97172a93ce169b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:58:57 +0100
+Subject: mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fc8e2c707ce11c8ec2e992885b0d53a5e04031ac ]
+
+Check sta_rates pointer value in mt7603_sta_rate_tbl_update routine
+since minstrel_ht_update_rates can fail allocating rates array.
+
+Fixes: c8846e1015022 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+index 7ac4cd247a73..689fcee282b3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+@@ -623,6 +623,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates);
+ 	int i;
+ 
++	if (!sta_rates)
++		return;
++
+ 	spin_lock_bh(&dev->mt76.lock);
+ 	for (i = 0; i < ARRAY_SIZE(msta->rates); i++) {
+ 		msta->rates[i].idx = sta_rates->rate[i].idx;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch b/queue-5.16/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
new file mode 100644
index 00000000000..53d0998e407
--- /dev/null
+++ b/queue-5.16/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
@@ -0,0 +1,37 @@
+From a20e03ec59715f258d90932e2af13cc005bf7c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:58:58 +0100
+Subject: mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 6a6f457ed5fdf6777536c20644a9e42128a50ec2 ]
+
+Check sta_rates pointer value in mt7615_sta_rate_tbl_update routine
+since minstrel_ht_update_rates can fail allocating rates array.
+
+Fixes: 04b8e65922f63 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+index 1fdcada157d6..18a320d00d8d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+@@ -686,6 +686,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw,
+ 	struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates);
+ 	int i;
+ 
++	if (!sta_rates)
++		return;
++
+ 	spin_lock_bh(&dev->mt76.lock);
+ 	for (i = 0; i < ARRAY_SIZE(msta->rates); i++) {
+ 		msta->rates[i].idx = sta_rates->rate[i].idx;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7615-fix-a-leftover-race-in-runtime-pm.patch b/queue-5.16/mt76-mt7615-fix-a-leftover-race-in-runtime-pm.patch
new file mode 100644
index 00000000000..0856d8767a9
--- /dev/null
+++ b/queue-5.16/mt76-mt7615-fix-a-leftover-race-in-runtime-pm.patch
@@ -0,0 +1,43 @@
+From e375f72e5905b5bb4e40d2e303cd397d2853e707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 21:47:06 +0100
+Subject: mt76: mt7615: fix a leftover race in runtime-pm
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 42ce8d3b623162f3248db50a38359f294e6b06fd ]
+
+Fix a possible race in mt7615_pm_power_save_work() if rx/tx napi
+schedules ps_work and we are currently accessing device register
+on a different cpu.
+
+Fixes: db928f1ab9789 ("mt76: mt7663: rely on mt76_connac_pm_ref/mt76_connac_pm_unref in tx/rx napi")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index c79abce543f3..ed8f7bc18977 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -2000,6 +2000,14 @@ void mt7615_pm_power_save_work(struct work_struct *work)
+ 	    test_bit(MT76_HW_SCHED_SCANNING, &dev->mphy.state))
+ 		goto out;
+ 
++	if (mutex_is_locked(&dev->mt76.mutex))
++		/* if mt76 mutex is held we should not put the device
++		 * to sleep since we are currently accessing device
++		 * register map. We need to wait for the next power_save
++		 * trigger.
++		 */
++		goto out;
++
+ 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
+ 		delta = dev->pm.last_activity + delta - jiffies;
+ 		goto out;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt76_connac-fix-mcu_ce_cmd_set_roc-definition-e.patch b/queue-5.16/mt76-mt76_connac-fix-mcu_ce_cmd_set_roc-definition-e.patch
new file mode 100644
index 00000000000..81fc0b7a89a
--- /dev/null
+++ b/queue-5.16/mt76-mt76_connac-fix-mcu_ce_cmd_set_roc-definition-e.patch
@@ -0,0 +1,36 @@
+From cd55e3e14f49377540a03bca44ecc1ac134f2cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Dec 2021 16:33:55 +0800
+Subject: mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit bf9727a27442a50c75b7d99a5088330c578b2a42 ]
+
+Fixed an MCU_CE_CMD_SET_ROC definition error that occurred from a previous
+refactor work.
+
+Fixes: d0e274af2f2e4 ("mt76: mt76_connac: create mcu library")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index acb9a286d354..63fc331e98bd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -598,7 +598,7 @@ enum {
+ 	MCU_CE_CMD_SET_BSS_CONNECTED = 0x16,
+ 	MCU_CE_CMD_SET_BSS_ABORT = 0x17,
+ 	MCU_CE_CMD_CANCEL_HW_SCAN = 0x1b,
+-	MCU_CE_CMD_SET_ROC = 0x1d,
++	MCU_CE_CMD_SET_ROC = 0x1c,
+ 	MCU_CE_CMD_SET_P2P_OPPPS = 0x33,
+ 	MCU_CE_CMD_SET_RATE_TX_POWER = 0x5d,
+ 	MCU_CE_CMD_SCHED_SCAN_ENABLE = 0x61,
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch b/queue-5.16/mt76-mt7915-fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch
new file mode 100644
index 00000000000..894e3da1131
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch
@@ -0,0 +1,35 @@
+From 6f1caca8354cb55a682178fa6a4580eaf60598c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jan 2022 14:20:56 +0800
+Subject: mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb()
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit d8e4e8d148fb68858d6a997d88a87a2c615629ce ]
+
+The mcs value of HT mode reported by mt7915_mac_add_txs_skb()
+has already been converted to the expected format.
+
+Fixes: 9908d98ae72cd ("mt76: mt7915: report tx rate directly from tx status")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index 38d66411444a..a1da514ca256 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -1412,7 +1412,6 @@ mt7915_mac_add_txs_skb(struct mt7915_dev *dev, struct mt76_wcid *wcid, int pid,
+ 		break;
+ 	case MT_PHY_TYPE_HT:
+ 	case MT_PHY_TYPE_HT_GF:
+-		rate.mcs += (rate.nss - 1) * 8;
+ 		if (rate.mcs > 31)
+ 			goto out;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-fix-mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch b/queue-5.16/mt76-mt7915-fix-mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch
new file mode 100644
index 00000000000..905860a5b9f
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-fix-mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch
@@ -0,0 +1,95 @@
+From 403b5862da5b5e5b12d547a9f5857eca5cd799c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jan 2022 10:05:29 +0800
+Subject: mt76: mt7915: fix mcs_map in mt7915_mcu_set_sta_he_mcs()
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit ade25ca7950bc8930356d98ec89aa41560a9dab5 ]
+
+Should use peer's bandwidth instead of chandef->width to
+get correct mcs_map.
+
+Fixes: 76be6c076c077 ("mt76: mt7915: add .set_bitrate_mask() callback")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 29 +++++--------------
+ 1 file changed, 8 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 0b6fecc8b3b6..ef8b0d0a05ef 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -211,24 +211,12 @@ mt7915_mcu_get_sta_nss(u16 mcs_map)
+ 
+ static void
+ mt7915_mcu_set_sta_he_mcs(struct ieee80211_sta *sta, __le16 *he_mcs,
+-			  const u16 *mask)
++			  u16 mcs_map)
+ {
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+-	struct cfg80211_chan_def *chandef = &msta->vif->phy->mt76->chandef;
++	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
++	const u16 *mask = msta->vif->bitrate_mask.control[band].he_mcs;
+ 	int nss, max_nss = sta->rx_nss > 3 ? 4 : sta->rx_nss;
+-	u16 mcs_map;
+-
+-	switch (chandef->width) {
+-	case NL80211_CHAN_WIDTH_80P80:
+-		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80p80);
+-		break;
+-	case NL80211_CHAN_WIDTH_160:
+-		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_160);
+-		break;
+-	default:
+-		mcs_map = le16_to_cpu(sta->he_cap.he_mcs_nss_supp.rx_mcs_80);
+-		break;
+-	}
+ 
+ 	for (nss = 0; nss < max_nss; nss++) {
+ 		int mcs;
+@@ -1344,11 +1332,9 @@ static void
+ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 		      struct ieee80211_vif *vif)
+ {
+-	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+ 	struct mt7915_vif *mvif = (struct mt7915_vif *)vif->drv_priv;
+ 	struct ieee80211_he_cap_elem *elem = &sta->he_cap.he_cap_elem;
+-	enum nl80211_band band = msta->vif->phy->mt76->chandef.chan->band;
+-	const u16 *mcs_mask = msta->vif->bitrate_mask.control[band].he_mcs;
++	struct ieee80211_he_mcs_nss_supp mcs_map;
+ 	struct sta_rec_he *he;
+ 	struct tlv *tlv;
+ 	u32 cap = 0;
+@@ -1438,22 +1424,23 @@ mt7915_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 
+ 	he->he_cap = cpu_to_le32(cap);
+ 
++	mcs_map = sta->he_cap.he_mcs_nss_supp;
+ 	switch (sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_160:
+ 		if (elem->phy_cap_info[0] &
+ 		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)
+ 			mt7915_mcu_set_sta_he_mcs(sta,
+ 						  &he->max_nss_mcs[CMD_HE_MCS_BW8080],
+-						  mcs_mask);
++						  le16_to_cpu(mcs_map.rx_mcs_80p80));
+ 
+ 		mt7915_mcu_set_sta_he_mcs(sta,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW160],
+-					  mcs_mask);
++					  le16_to_cpu(mcs_map.rx_mcs_160));
+ 		fallthrough;
+ 	default:
+ 		mt7915_mcu_set_sta_he_mcs(sta,
+ 					  &he->max_nss_mcs[CMD_HE_MCS_BW80],
+-					  mcs_mask);
++					  le16_to_cpu(mcs_map.rx_mcs_80));
+ 		break;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch b/queue-5.16/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch
new file mode 100644
index 00000000000..45a02e8c36b
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch
@@ -0,0 +1,50 @@
+From c0ac892a257d65ac0b284ffdff701f5da3e33392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 20:36:52 +0100
+Subject: mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit a43736cd12d82913102eb49cb56787a5553e028f ]
+
+Free allocated skb in mt7915_mcu_add_sta routine in case of failures.
+
+Fixes: 89bbd3730f382 ("mt76: mt7915: rework starec TLV tags")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index abc798536a81..0b6fecc8b3b6 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -2397,8 +2397,10 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	}
+ 
+ 	ret = mt7915_mcu_sta_wtbl_tlv(dev, skb, vif, sta);
+-	if (ret)
++	if (ret) {
++		dev_kfree_skb(skb);
+ 		return ret;
++	}
+ 
+ 	if (sta && sta->ht_cap.ht_supported) {
+ 		/* starec amsdu */
+@@ -2412,8 +2414,10 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif,
+ 	}
+ 
+ 	ret = mt7915_mcu_add_group(dev, vif, sta);
+-	if (ret)
++	if (ret) {
++		dev_kfree_skb(skb);
+ 		return ret;
++	}
+ out:
+ 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
+ 				     MCU_EXT_CMD(STA_REC_UPDATE), true);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-fix-the-muru-tlv-issue.patch b/queue-5.16/mt76-mt7915-fix-the-muru-tlv-issue.patch
new file mode 100644
index 00000000000..5c88b76db4a
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-fix-the-muru-tlv-issue.patch
@@ -0,0 +1,68 @@
+From 0fe5683b6c988e8af6143abb7d212b48bbd21d9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 16:48:58 +0800
+Subject: mt76: mt7915: fix the muru tlv issue
+
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+
+[ Upstream commit d98a72725bc96c98f68eac12e5a91ec349322c88 ]
+
+The muru enable/disable are only set after the first station connection.
+Without this patch, the firmware couldn't enable muru
+if the first connected station is non-HE type.
+
+Fixes: 16bff457dd33a ("mt76: mt7915: rework mt7915_mcu_sta_muru_tlv()")
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 21fbe7a6141f..5ea82f05fd91 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -1515,9 +1515,6 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 	    vif->type != NL80211_IFTYPE_AP)
+ 		return;
+ 
+-	if (!sta->vht_cap.vht_supported)
+-		return;
+-
+ 	tlv = mt7915_mcu_add_tlv(skb, STA_REC_MURU, sizeof(*muru));
+ 
+ 	muru = (struct sta_rec_muru *)tlv;
+@@ -1525,9 +1522,12 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 	muru->cfg.mimo_dl_en = mvif->cap.he_mu_ebfer ||
+ 			       mvif->cap.vht_mu_ebfer ||
+ 			       mvif->cap.vht_mu_ebfee;
++	muru->cfg.mimo_ul_en = true;
++	muru->cfg.ofdma_dl_en = true;
+ 
+-	muru->mimo_dl.vht_mu_bfee =
+-		!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
++	if (sta->vht_cap.vht_supported)
++		muru->mimo_dl.vht_mu_bfee =
++			!!(sta->vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE);
+ 
+ 	if (!sta->he_cap.has_he)
+ 		return;
+@@ -1535,13 +1535,11 @@ mt7915_mcu_sta_muru_tlv(struct sk_buff *skb, struct ieee80211_sta *sta,
+ 	muru->mimo_dl.partial_bw_dl_mimo =
+ 		HE_PHY(CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO, elem->phy_cap_info[6]);
+ 
+-	muru->cfg.mimo_ul_en = true;
+ 	muru->mimo_ul.full_ul_mimo =
+ 		HE_PHY(CAP2_UL_MU_FULL_MU_MIMO, elem->phy_cap_info[2]);
+ 	muru->mimo_ul.partial_ul_mimo =
+ 		HE_PHY(CAP2_UL_MU_PARTIAL_MU_MIMO, elem->phy_cap_info[2]);
+ 
+-	muru->cfg.ofdma_dl_en = true;
+ 	muru->ofdma_dl.punc_pream_rx =
+ 		HE_PHY(CAP1_PREAMBLE_PUNC_RX_MASK, elem->phy_cap_info[1]);
+ 	muru->ofdma_dl.he_20m_in_40m_2g =
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-fix-the-nss-setting-in-bitrates.patch b/queue-5.16/mt76-mt7915-fix-the-nss-setting-in-bitrates.patch
new file mode 100644
index 00000000000..95fab8aefee
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-fix-the-nss-setting-in-bitrates.patch
@@ -0,0 +1,43 @@
+From 228cd3d2911490918db83a40c6d9a0d479800959 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 21:32:26 +0800
+Subject: mt76: mt7915: fix the nss setting in bitrates
+
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+
+[ Upstream commit c41d2a075206fcbdc89695b874a6ac06160b4f1a ]
+
+without this change, the fixed MCS only supports 1 Nss.
+
+Fixes: 70fd1333cd32f ("mt76: mt7915: rework .set_bitrate_mask() to support more options")
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index ef8b0d0a05ef..21fbe7a6141f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -2124,9 +2124,12 @@ mt7915_mcu_add_rate_ctrl_fixed(struct mt7915_dev *dev,
+ 			phy.sgi |= gi << (i << (_he));				\
+ 			phy.he_ltf |= mask->control[band].he_ltf << (i << (_he));\
+ 		}								\
+-		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) 	\
+-			nrates += hweight16(mask->control[band]._mcs[i]);  	\
+-		phy.mcs = ffs(mask->control[band]._mcs[0]) - 1;			\
++		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
++			if (!mask->control[band]._mcs[i])			\
++				continue;					\
++			nrates += hweight16(mask->control[band]._mcs[i]);	\
++			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
++		}								\
+ 	} while (0)
+ 
+ 	if (sta->he_cap.has_he) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch b/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch
new file mode 100644
index 00000000000..9bf51f8c87b
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch
@@ -0,0 +1,51 @@
+From 43882cca51f3ff24b52ae005330fe39915c8f55b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 17:06:36 +0100
+Subject: mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit abdb8bc94be4cf68aa71c9a8ee0bad9b3e6f52d3 ]
+
+Similar to mt7915_mcu_wtbl_generic_tlv, rely on vif->bss_conf.aid for
+aid in sta mode and not on sta->aid.
+
+Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 8cdf689b383e..abc798536a81 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -1321,12 +1321,15 @@ mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 	case NL80211_IFTYPE_AP:
+ 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA);
++		basic->aid = cpu_to_le16(sta->aid);
+ 		break;
+ 	case NL80211_IFTYPE_STATION:
+ 		basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP);
++		basic->aid = cpu_to_le16(vif->bss_conf.aid);
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC);
++		basic->aid = cpu_to_le16(sta->aid);
+ 		break;
+ 	default:
+ 		WARN_ON(1);
+@@ -1334,7 +1337,6 @@ mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	}
+ 
+ 	memcpy(basic->peer_addr, sta->addr, ETH_ALEN);
+-	basic->aid = cpu_to_le16(sta->aid);
+ 	basic->qos = sta->wme;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch b/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch
new file mode 100644
index 00000000000..dfc277a1df4
--- /dev/null
+++ b/queue-5.16/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch
@@ -0,0 +1,42 @@
+From d93c602a2a2658657484515d223d7a5723ef99ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Dec 2021 12:52:17 +0100
+Subject: mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in
+ sta mode
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit a56b1b0f145ef2d6bb9312dedf3ab8558ef50a5b ]
+
+mac80211 provides aid in vif->bss_conf.aid for sta mode and not in
+sta->aid. Fix mt7915_mcu_wtbl_generic_tlv routine using proper value for
+aid in sta mode.
+
+Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 8215b3d79bbd..8cdf689b383e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -1263,8 +1263,11 @@ mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 	generic = (struct wtbl_generic *)tlv;
+ 
+ 	if (sta) {
++		if (vif->type == NL80211_IFTYPE_STATION)
++			generic->partial_aid = cpu_to_le16(vif->bss_conf.aid);
++		else
++			generic->partial_aid = cpu_to_le16(sta->aid);
+ 		memcpy(generic->peer_addr, sta->addr, ETH_ALEN);
+-		generic->partial_aid = cpu_to_le16(sta->aid);
+ 		generic->muar_idx = mvif->omac_idx;
+ 		generic->qos = sta->wme;
+ 	} else {
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921-do-not-always-disable-fw-runtime-pm.patch b/queue-5.16/mt76-mt7921-do-not-always-disable-fw-runtime-pm.patch
new file mode 100644
index 00000000000..bc7530aa82e
--- /dev/null
+++ b/queue-5.16/mt76-mt7921-do-not-always-disable-fw-runtime-pm.patch
@@ -0,0 +1,46 @@
+From 226a5f59e55d6da6dd09515ee26b48f58cad0bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Dec 2021 12:36:02 +0100
+Subject: mt76: mt7921: do not always disable fw runtime-pm
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit b44eeb8cbdf2b88f2844f11e4f263b0abed5b5b0 ]
+
+After commit 'd430dffbe9dd ("mt76: mt7921: fix a possible race
+enabling/disabling runtime-pm")', runtime-pm is always disabled in the
+fw even if the user requests to enable it toggling debugfs node since
+mt7921_pm_interface_iter routine will use pm->enable to configure the fw.
+Fix the issue moving enable variable configuration before running
+mt7921_pm_interface_iter routine.
+
+Fixes: d430dffbe9dd ("mt76: mt7921: fix a possible race enabling/disabling runtime-pm")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+index 86fd7292b229..45a393070e46 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+@@ -291,13 +291,12 @@ mt7921_pm_set(void *data, u64 val)
+ 	pm->enable = false;
+ 	mt76_connac_pm_wake(&dev->mphy, pm);
+ 
++	pm->enable = val;
+ 	ieee80211_iterate_active_interfaces(mt76_hw(dev),
+ 					    IEEE80211_IFACE_ITER_RESUME_ALL,
+ 					    mt7921_pm_interface_iter, dev);
+ 
+ 	mt76_connac_mcu_set_deep_sleep(&dev->mt76, pm->ds_enable);
+-
+-	pm->enable = val;
+ 	mt76_connac_power_save_sched(&dev->mphy, pm);
+ out:
+ 	mutex_unlock(&dev->mt76.mutex);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921-fix-a-leftover-race-in-runtime-pm.patch b/queue-5.16/mt76-mt7921-fix-a-leftover-race-in-runtime-pm.patch
new file mode 100644
index 00000000000..cfd8f666d5b
--- /dev/null
+++ b/queue-5.16/mt76-mt7921-fix-a-leftover-race-in-runtime-pm.patch
@@ -0,0 +1,43 @@
+From ad3fe538afce8c7eefba8253810870a5e951f9f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 21:47:05 +0100
+Subject: mt76: mt7921: fix a leftover race in runtime-pm
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 591cdccebdd4d02eb46d400dea911136400cc567 ]
+
+Fix a possible race in mt7921_pm_power_save_work() if rx/tx napi
+schedules ps_work and we are currently accessing device register
+on a different cpu.
+
+Fixes: 1d8efc741df8 ("mt76: mt7921: introduce Runtime PM support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index fc21a78b37c4..1fea9266d4b8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -1472,6 +1472,14 @@ void mt7921_pm_power_save_work(struct work_struct *work)
+ 	    test_bit(MT76_HW_SCHED_SCANNING, &mphy->state))
+ 		goto out;
+ 
++	if (mutex_is_locked(&dev->mt76.mutex))
++		/* if mt76 mutex is held we should not put the device
++		 * to sleep since we are currently accessing device
++		 * register map. We need to wait for the next power_save
++		 * trigger.
++		 */
++		goto out;
++
+ 	if (time_is_after_jiffies(dev->pm.last_activity + delta)) {
+ 		delta = dev->pm.last_activity + delta - jiffies;
+ 		goto out;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921-fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch b/queue-5.16/mt76-mt7921-fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch
new file mode 100644
index 00000000000..4bdda1bb82e
--- /dev/null
+++ b/queue-5.16/mt76-mt7921-fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch
@@ -0,0 +1,35 @@
+From 19bb8d50e4f3dffef7ef3b9b5bfcb71825c719d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jan 2022 14:20:57 +0800
+Subject: mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb()
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit b1fe07ed21024f64719315ba0f3a5676d8b36db6 ]
+
+The mcs value of HT mode reported by mt7921_mac_add_txs_skb()
+has already been converted to the expected format.
+
+Fixes: 970ab80ef9f63 ("mt76: mt7921: report tx rate directly from tx status")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index 1fea9266d4b8..ea5ae0fc8f54 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -1014,7 +1014,6 @@ mt7921_mac_add_txs_skb(struct mt7921_dev *dev, struct mt76_wcid *wcid, int pid,
+ 		break;
+ 	case MT_PHY_TYPE_HT:
+ 	case MT_PHY_TYPE_HT_GF:
+-		rate.mcs += (rate.nss - 1) * 8;
+ 		if (rate.mcs > 31)
+ 			goto out;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921-fix-mt7921_queues_acq-implementation.patch b/queue-5.16/mt76-mt7921-fix-mt7921_queues_acq-implementation.patch
new file mode 100644
index 00000000000..795b3a533ac
--- /dev/null
+++ b/queue-5.16/mt76-mt7921-fix-mt7921_queues_acq-implementation.patch
@@ -0,0 +1,80 @@
+From 9df2046ae2bef031e5f1427ee70e79b037ffd1f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 09:46:41 +0100
+Subject: mt76: mt7921: fix mt7921_queues_acq implementation
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 849ee6ac9dd3efd0a57cbc98b9a9d6ae87374aff ]
+
+Fix mt7921_queues_acq implementation according to the vendor sdk.
+
+Fixes: 474a9f21e2e20 ("mt76: mt7921: add debugfs support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c | 13 ++++++-------
+ drivers/net/wireless/mediatek/mt76/mt7921/regs.h    | 11 +++++------
+ 2 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+index 45a393070e46..196b50e616fe 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/debugfs.c
+@@ -129,23 +129,22 @@ mt7921_queues_acq(struct seq_file *s, void *data)
+ 
+ 	mt7921_mutex_acquire(dev);
+ 
+-	for (i = 0; i < 16; i++) {
+-		int j, acs = i / 4, index = i % 4;
++	for (i = 0; i < 4; i++) {
+ 		u32 ctrl, val, qlen = 0;
++		int j;
+ 
+-		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(acs, index));
+-		ctrl = BIT(31) | BIT(15) | (acs << 8);
++		val = mt76_rr(dev, MT_PLE_AC_QEMPTY(i));
++		ctrl = BIT(31) | BIT(11) | (i << 24);
+ 
+ 		for (j = 0; j < 32; j++) {
+ 			if (val & BIT(j))
+ 				continue;
+ 
+-			mt76_wr(dev, MT_PLE_FL_Q0_CTRL,
+-				ctrl | (j + (index << 5)));
++			mt76_wr(dev, MT_PLE_FL_Q0_CTRL, ctrl | j);
+ 			qlen += mt76_get_field(dev, MT_PLE_FL_Q3_CTRL,
+ 					       GENMASK(11, 0));
+ 		}
+-		seq_printf(s, "AC%d%d: queued=%d\n", acs, index, qlen);
++		seq_printf(s, "AC%d: queued=%d\n", i, qlen);
+ 	}
+ 
+ 	mt7921_mutex_release(dev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+index cbd38122c510..c8c92faa4624 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h
+@@ -17,13 +17,12 @@
+ #define MT_PLE_BASE			0x820c0000
+ #define MT_PLE(ofs)			(MT_PLE_BASE + (ofs))
+ 
+-#define MT_PLE_FL_Q0_CTRL		MT_PLE(0x1b0)
+-#define MT_PLE_FL_Q1_CTRL		MT_PLE(0x1b4)
+-#define MT_PLE_FL_Q2_CTRL		MT_PLE(0x1b8)
+-#define MT_PLE_FL_Q3_CTRL		MT_PLE(0x1bc)
++#define MT_PLE_FL_Q0_CTRL		MT_PLE(0x3e0)
++#define MT_PLE_FL_Q1_CTRL		MT_PLE(0x3e4)
++#define MT_PLE_FL_Q2_CTRL		MT_PLE(0x3e8)
++#define MT_PLE_FL_Q3_CTRL		MT_PLE(0x3ec)
+ 
+-#define MT_PLE_AC_QEMPTY(ac, n)		MT_PLE(0x300 + 0x10 * (ac) + \
+-					       ((n) << 2))
++#define MT_PLE_AC_QEMPTY(_n)		MT_PLE(0x500 + 0x40 * (_n))
+ #define MT_PLE_AMSDU_PACK_MSDU_CNT(n)	MT_PLE(0x10e0 + ((n) << 2))
+ 
+ #define MT_MDP_BASE			0x820cd000
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921-set-edca-parameters-with-the-mcu-ce-comm.patch b/queue-5.16/mt76-mt7921-set-edca-parameters-with-the-mcu-ce-comm.patch
new file mode 100644
index 00000000000..c3f5d687f2e
--- /dev/null
+++ b/queue-5.16/mt76-mt7921-set-edca-parameters-with-the-mcu-ce-comm.patch
@@ -0,0 +1,136 @@
+From 34e0080c22fa44fac9832025cbf537d77f91cace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Dec 2021 16:33:56 +0800
+Subject: mt76: mt7921: set EDCA parameters with the MCU CE command
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 66ca1a7b2d5503f561b751abdd6ec6fa96343eb6 ]
+
+The command MCU_EXT_CMD_EDCA_UPDATE is not fully supported by the MT7921
+firmware, so we apply CE command MCU_CE_CMD_SET_EDCA_PARAMS instead which
+is supported even in the oldest firmware to properly set up EDCA parameters
+for each AC.
+
+Fixes: 1c099ab44727 ("mt76: mt7921: add MCU support")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |  1 +
+ .../net/wireless/mediatek/mt76/mt7921/mcu.c   | 49 ++++++++-----------
+ 2 files changed, 22 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index 63fc331e98bd..43a8b3651dc2 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -599,6 +599,7 @@ enum {
+ 	MCU_CE_CMD_SET_BSS_ABORT = 0x17,
+ 	MCU_CE_CMD_CANCEL_HW_SCAN = 0x1b,
+ 	MCU_CE_CMD_SET_ROC = 0x1c,
++	MCU_CE_CMD_SET_EDCA_PARMS = 0x1d,
+ 	MCU_CE_CMD_SET_P2P_OPPPS = 0x33,
+ 	MCU_CE_CMD_SET_RATE_TX_POWER = 0x5d,
+ 	MCU_CE_CMD_SCHED_SCAN_ENABLE = 0x61,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index 4c6adbb96955..50c953b08ed0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -912,33 +912,28 @@ EXPORT_SYMBOL_GPL(mt7921_mcu_exit);
+ 
+ int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
+ {
+-#define WMM_AIFS_SET		BIT(0)
+-#define WMM_CW_MIN_SET		BIT(1)
+-#define WMM_CW_MAX_SET		BIT(2)
+-#define WMM_TXOP_SET		BIT(3)
+-#define WMM_PARAM_SET		GENMASK(3, 0)
+-#define TX_CMD_MODE		1
++	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++
+ 	struct edca {
+-		u8 queue;
+-		u8 set;
+-		u8 aifs;
+-		u8 cw_min;
++		__le16 cw_min;
+ 		__le16 cw_max;
+ 		__le16 txop;
+-	};
++		__le16 aifs;
++		u8 guardtime;
++		u8 acm;
++	} __packed;
+ 	struct mt7921_mcu_tx {
+-		u8 total;
+-		u8 action;
+-		u8 valid;
+-		u8 mode;
+-
+ 		struct edca edca[IEEE80211_NUM_ACS];
++		u8 bss_idx;
++		u8 qos;
++		u8 wmm_idx;
++		u8 pad;
+ 	} __packed req = {
+-		.valid = true,
+-		.mode = TX_CMD_MODE,
+-		.total = IEEE80211_NUM_ACS,
++		.bss_idx = mvif->mt76.idx,
++		.qos = vif->bss_conf.qos,
++		.wmm_idx = mvif->mt76.wmm_idx,
+ 	};
+-	struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
++
+ 	struct mu_edca {
+ 		u8 cw_min;
+ 		u8 cw_max;
+@@ -962,30 +957,29 @@ int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
+ 		.qos = vif->bss_conf.qos,
+ 		.wmm_idx = mvif->mt76.wmm_idx,
+ 	};
++	int to_aci[] = {1, 0, 2, 3};
+ 	int ac, ret;
+ 
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		struct ieee80211_tx_queue_params *q = &mvif->queue_params[ac];
+-		struct edca *e = &req.edca[ac];
++		struct edca *e = &req.edca[to_aci[ac]];
+ 
+-		e->set = WMM_PARAM_SET;
+-		e->queue = ac + mvif->mt76.wmm_idx * MT7921_MAX_WMM_SETS;
+ 		e->aifs = q->aifs;
+ 		e->txop = cpu_to_le16(q->txop);
+ 
+ 		if (q->cw_min)
+-			e->cw_min = fls(q->cw_min);
++			e->cw_min = cpu_to_le16(q->cw_min);
+ 		else
+ 			e->cw_min = 5;
+ 
+ 		if (q->cw_max)
+-			e->cw_max = cpu_to_le16(fls(q->cw_max));
++			e->cw_max = cpu_to_le16(q->cw_max);
+ 		else
+ 			e->cw_max = cpu_to_le16(10);
+ 	}
+ 
+-	ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(EDCA_UPDATE),
+-				&req, sizeof(req), true);
++	ret = mt76_mcu_send_msg(&dev->mt76, MCU_CE_CMD(SET_EDCA_PARMS), &req,
++				sizeof(req), false);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -995,7 +989,6 @@ int mt7921_mcu_set_tx(struct mt7921_dev *dev, struct ieee80211_vif *vif)
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		struct ieee80211_he_mu_edca_param_ac_rec *q;
+ 		struct mu_edca *e;
+-		int to_aci[] = {1, 0, 2, 3};
+ 
+ 		if (!mvif->queue_params[ac].mu_edca)
+ 			break;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921e-fix-possible-probe-failure-after-reboot.patch b/queue-5.16/mt76-mt7921e-fix-possible-probe-failure-after-reboot.patch
new file mode 100644
index 00000000000..78cfd6c48ba
--- /dev/null
+++ b/queue-5.16/mt76-mt7921e-fix-possible-probe-failure-after-reboot.patch
@@ -0,0 +1,384 @@
+From bc11a93f7f26a6027883677204d103891f27436b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 15:30:03 +0800
+Subject: mt76: mt7921e: fix possible probe failure after reboot
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 602cc0c9618a819ab00ea3c9400742a0ca318380 ]
+
+It doesn't guarantee the mt7921e gets started with ASPM L0 after each
+machine reboot on every platform.
+
+If mt7921e gets started with not ASPM L0, it would be possible that the
+driver encounters time to time failure in mt7921_pci_probe, like a
+weird chip identifier is read
+
+[  215.514503] mt7921e 0000:05:00.0: ASIC revision: feed0000
+[  216.604741] mt7921e: probe of 0000:05:00.0 failed with error -110
+
+or failing to init hardware because the driver is not allowed to access the
+register until the device is in ASPM L0 state. So, we call
+__mt7921e_mcu_drv_pmctrl in early mt7921_pci_probe to force the device
+to bring back to the L0 state for we can safely access registers in any
+case.
+
+In the patch, we move all functions from dma.c to pci.c and register mt76
+bus operation earilier, that is the __mt7921e_mcu_drv_pmctrl depends on.
+
+Fixes: bf3747ae2e25 ("mt76: mt7921: enable aspm by default")
+Reported-by: Kai-Chuan Hsieh <kaichuan.hsieh@canonical.com>
+Co-developed-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/dma.c   | 119 -----------------
+ .../wireless/mediatek/mt76/mt7921/mt7921.h    |   1 +
+ .../net/wireless/mediatek/mt76/mt7921/pci.c   | 124 ++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7921/pci_mcu.c   |  18 ++-
+ 4 files changed, 139 insertions(+), 123 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+index cdff1fd52d93..39d6ce4ecddd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+@@ -78,110 +78,6 @@ static void mt7921_dma_prefetch(struct mt7921_dev *dev)
+ 	mt76_wr(dev, MT_WFDMA0_TX_RING17_EXT_CTRL, PREFETCH(0x380, 0x4));
+ }
+ 
+-static u32 __mt7921_reg_addr(struct mt7921_dev *dev, u32 addr)
+-{
+-	static const struct {
+-		u32 phys;
+-		u32 mapped;
+-		u32 size;
+-	} fixed_map[] = {
+-		{ 0x820d0000, 0x30000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */
+-		{ 0x820ed000, 0x24800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */
+-		{ 0x820e4000, 0x21000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */
+-		{ 0x820e7000, 0x21e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */
+-		{ 0x820eb000, 0x24200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */
+-		{ 0x820e2000, 0x20800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */
+-		{ 0x820e3000, 0x20c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */
+-		{ 0x820e5000, 0x21400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */
+-		{ 0x00400000, 0x80000, 0x10000 }, /* WF_MCU_SYSRAM */
+-		{ 0x00410000, 0x90000, 0x10000 }, /* WF_MCU_SYSRAM (configure register) */
+-		{ 0x40000000, 0x70000, 0x10000 }, /* WF_UMAC_SYSRAM */
+-		{ 0x54000000, 0x02000, 0x1000 }, /* WFDMA PCIE0 MCU DMA0 */
+-		{ 0x55000000, 0x03000, 0x1000 }, /* WFDMA PCIE0 MCU DMA1 */
+-		{ 0x58000000, 0x06000, 0x1000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */
+-		{ 0x59000000, 0x07000, 0x1000 }, /* WFDMA PCIE1 MCU DMA1 */
+-		{ 0x7c000000, 0xf0000, 0x10000 }, /* CONN_INFRA */
+-		{ 0x7c020000, 0xd0000, 0x10000 }, /* CONN_INFRA, WFDMA */
+-		{ 0x7c060000, 0xe0000, 0x10000 }, /* CONN_INFRA, conn_host_csr_top */
+-		{ 0x80020000, 0xb0000, 0x10000 }, /* WF_TOP_MISC_OFF */
+-		{ 0x81020000, 0xc0000, 0x10000 }, /* WF_TOP_MISC_ON */
+-		{ 0x820c0000, 0x08000, 0x4000 }, /* WF_UMAC_TOP (PLE) */
+-		{ 0x820c8000, 0x0c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */
+-		{ 0x820cc000, 0x0e000, 0x1000 }, /* WF_UMAC_TOP (PP) */
+-		{ 0x820cd000, 0x0f000, 0x1000 }, /* WF_MDP_TOP */
+-		{ 0x820ce000, 0x21c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */
+-		{ 0x820cf000, 0x22000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */
+-		{ 0x820e0000, 0x20000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */
+-		{ 0x820e1000, 0x20400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */
+-		{ 0x820e9000, 0x23400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */
+-		{ 0x820ea000, 0x24000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */
+-		{ 0x820ec000, 0x24600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */
+-		{ 0x820f0000, 0xa0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */
+-		{ 0x820f1000, 0xa0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */
+-		{ 0x820f2000, 0xa0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */
+-		{ 0x820f3000, 0xa0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */
+-		{ 0x820f4000, 0xa1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */
+-		{ 0x820f5000, 0xa1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */
+-		{ 0x820f7000, 0xa1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */
+-		{ 0x820f9000, 0xa3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */
+-		{ 0x820fa000, 0xa4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */
+-		{ 0x820fb000, 0xa4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */
+-		{ 0x820fc000, 0xa4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */
+-		{ 0x820fd000, 0xa4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */
+-	};
+-	int i;
+-
+-	if (addr < 0x100000)
+-		return addr;
+-
+-	for (i = 0; i < ARRAY_SIZE(fixed_map); i++) {
+-		u32 ofs;
+-
+-		if (addr < fixed_map[i].phys)
+-			continue;
+-
+-		ofs = addr - fixed_map[i].phys;
+-		if (ofs > fixed_map[i].size)
+-			continue;
+-
+-		return fixed_map[i].mapped + ofs;
+-	}
+-
+-	if ((addr >= 0x18000000 && addr < 0x18c00000) ||
+-	    (addr >= 0x70000000 && addr < 0x78000000) ||
+-	    (addr >= 0x7c000000 && addr < 0x7c400000))
+-		return mt7921_reg_map_l1(dev, addr);
+-
+-	dev_err(dev->mt76.dev, "Access currently unsupported address %08x\n",
+-		addr);
+-
+-	return 0;
+-}
+-
+-static u32 mt7921_rr(struct mt76_dev *mdev, u32 offset)
+-{
+-	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+-	u32 addr = __mt7921_reg_addr(dev, offset);
+-
+-	return dev->bus_ops->rr(mdev, addr);
+-}
+-
+-static void mt7921_wr(struct mt76_dev *mdev, u32 offset, u32 val)
+-{
+-	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+-	u32 addr = __mt7921_reg_addr(dev, offset);
+-
+-	dev->bus_ops->wr(mdev, addr, val);
+-}
+-
+-static u32 mt7921_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
+-{
+-	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
+-	u32 addr = __mt7921_reg_addr(dev, offset);
+-
+-	return dev->bus_ops->rmw(mdev, addr, mask, val);
+-}
+-
+ static int mt7921_dma_disable(struct mt7921_dev *dev, bool force)
+ {
+ 	if (force) {
+@@ -341,23 +237,8 @@ int mt7921_wpdma_reinit_cond(struct mt7921_dev *dev)
+ 
+ int mt7921_dma_init(struct mt7921_dev *dev)
+ {
+-	struct mt76_bus_ops *bus_ops;
+ 	int ret;
+ 
+-	dev->phy.dev = dev;
+-	dev->phy.mt76 = &dev->mt76.phy;
+-	dev->mt76.phy.priv = &dev->phy;
+-	dev->bus_ops = dev->mt76.bus;
+-	bus_ops = devm_kmemdup(dev->mt76.dev, dev->bus_ops, sizeof(*bus_ops),
+-			       GFP_KERNEL);
+-	if (!bus_ops)
+-		return -ENOMEM;
+-
+-	bus_ops->rr = mt7921_rr;
+-	bus_ops->wr = mt7921_wr;
+-	bus_ops->rmw = mt7921_rmw;
+-	dev->mt76.bus = bus_ops;
+-
+ 	mt76_dma_attach(&dev->mt76);
+ 
+ 	ret = mt7921_dma_disable(dev, true);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+index 96647801850a..33f8e5b541b3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+@@ -452,6 +452,7 @@ int mt7921e_mcu_init(struct mt7921_dev *dev);
+ int mt7921s_wfsys_reset(struct mt7921_dev *dev);
+ int mt7921s_mac_reset(struct mt7921_dev *dev);
+ int mt7921s_init_reset(struct mt7921_dev *dev);
++int __mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev);
+ int mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev);
+ int mt7921e_mcu_fw_pmctrl(struct mt7921_dev *dev);
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index 40186e6cd865..006e6a11e6fa 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -119,6 +119,110 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)
+ 	mt76_free_device(&dev->mt76);
+ }
+ 
++static u32 __mt7921_reg_addr(struct mt7921_dev *dev, u32 addr)
++{
++	static const struct {
++		u32 phys;
++		u32 mapped;
++		u32 size;
++	} fixed_map[] = {
++		{ 0x820d0000, 0x30000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */
++		{ 0x820ed000, 0x24800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */
++		{ 0x820e4000, 0x21000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */
++		{ 0x820e7000, 0x21e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */
++		{ 0x820eb000, 0x24200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */
++		{ 0x820e2000, 0x20800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */
++		{ 0x820e3000, 0x20c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */
++		{ 0x820e5000, 0x21400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */
++		{ 0x00400000, 0x80000, 0x10000 }, /* WF_MCU_SYSRAM */
++		{ 0x00410000, 0x90000, 0x10000 }, /* WF_MCU_SYSRAM (configure register) */
++		{ 0x40000000, 0x70000, 0x10000 }, /* WF_UMAC_SYSRAM */
++		{ 0x54000000, 0x02000, 0x1000 }, /* WFDMA PCIE0 MCU DMA0 */
++		{ 0x55000000, 0x03000, 0x1000 }, /* WFDMA PCIE0 MCU DMA1 */
++		{ 0x58000000, 0x06000, 0x1000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */
++		{ 0x59000000, 0x07000, 0x1000 }, /* WFDMA PCIE1 MCU DMA1 */
++		{ 0x7c000000, 0xf0000, 0x10000 }, /* CONN_INFRA */
++		{ 0x7c020000, 0xd0000, 0x10000 }, /* CONN_INFRA, WFDMA */
++		{ 0x7c060000, 0xe0000, 0x10000 }, /* CONN_INFRA, conn_host_csr_top */
++		{ 0x80020000, 0xb0000, 0x10000 }, /* WF_TOP_MISC_OFF */
++		{ 0x81020000, 0xc0000, 0x10000 }, /* WF_TOP_MISC_ON */
++		{ 0x820c0000, 0x08000, 0x4000 }, /* WF_UMAC_TOP (PLE) */
++		{ 0x820c8000, 0x0c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */
++		{ 0x820cc000, 0x0e000, 0x1000 }, /* WF_UMAC_TOP (PP) */
++		{ 0x820cd000, 0x0f000, 0x1000 }, /* WF_MDP_TOP */
++		{ 0x820ce000, 0x21c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */
++		{ 0x820cf000, 0x22000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */
++		{ 0x820e0000, 0x20000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */
++		{ 0x820e1000, 0x20400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */
++		{ 0x820e9000, 0x23400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */
++		{ 0x820ea000, 0x24000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */
++		{ 0x820ec000, 0x24600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */
++		{ 0x820f0000, 0xa0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */
++		{ 0x820f1000, 0xa0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */
++		{ 0x820f2000, 0xa0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */
++		{ 0x820f3000, 0xa0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */
++		{ 0x820f4000, 0xa1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */
++		{ 0x820f5000, 0xa1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */
++		{ 0x820f7000, 0xa1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */
++		{ 0x820f9000, 0xa3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */
++		{ 0x820fa000, 0xa4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */
++		{ 0x820fb000, 0xa4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */
++		{ 0x820fc000, 0xa4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */
++		{ 0x820fd000, 0xa4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */
++	};
++	int i;
++
++	if (addr < 0x100000)
++		return addr;
++
++	for (i = 0; i < ARRAY_SIZE(fixed_map); i++) {
++		u32 ofs;
++
++		if (addr < fixed_map[i].phys)
++			continue;
++
++		ofs = addr - fixed_map[i].phys;
++		if (ofs > fixed_map[i].size)
++			continue;
++
++		return fixed_map[i].mapped + ofs;
++	}
++
++	if ((addr >= 0x18000000 && addr < 0x18c00000) ||
++	    (addr >= 0x70000000 && addr < 0x78000000) ||
++	    (addr >= 0x7c000000 && addr < 0x7c400000))
++		return mt7921_reg_map_l1(dev, addr);
++
++	dev_err(dev->mt76.dev, "Access currently unsupported address %08x\n",
++		addr);
++
++	return 0;
++}
++
++static u32 mt7921_rr(struct mt76_dev *mdev, u32 offset)
++{
++	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
++	u32 addr = __mt7921_reg_addr(dev, offset);
++
++	return dev->bus_ops->rr(mdev, addr);
++}
++
++static void mt7921_wr(struct mt76_dev *mdev, u32 offset, u32 val)
++{
++	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
++	u32 addr = __mt7921_reg_addr(dev, offset);
++
++	dev->bus_ops->wr(mdev, addr, val);
++}
++
++static u32 mt7921_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
++{
++	struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76);
++	u32 addr = __mt7921_reg_addr(dev, offset);
++
++	return dev->bus_ops->rmw(mdev, addr, mask, val);
++}
++
+ static int mt7921_pci_probe(struct pci_dev *pdev,
+ 			    const struct pci_device_id *id)
+ {
+@@ -149,6 +253,7 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+ 		.fw_own = mt7921e_mcu_fw_pmctrl,
+ 	};
+ 
++	struct mt76_bus_ops *bus_ops;
+ 	struct mt7921_dev *dev;
+ 	struct mt76_dev *mdev;
+ 	int ret;
+@@ -186,6 +291,25 @@ static int mt7921_pci_probe(struct pci_dev *pdev,
+ 
+ 	mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
+ 	tasklet_init(&dev->irq_tasklet, mt7921_irq_tasklet, (unsigned long)dev);
++
++	dev->phy.dev = dev;
++	dev->phy.mt76 = &dev->mt76.phy;
++	dev->mt76.phy.priv = &dev->phy;
++	dev->bus_ops = dev->mt76.bus;
++	bus_ops = devm_kmemdup(dev->mt76.dev, dev->bus_ops, sizeof(*bus_ops),
++			       GFP_KERNEL);
++	if (!bus_ops)
++		return -ENOMEM;
++
++	bus_ops->rr = mt7921_rr;
++	bus_ops->wr = mt7921_wr;
++	bus_ops->rmw = mt7921_rmw;
++	dev->mt76.bus = bus_ops;
++
++	ret = __mt7921e_mcu_drv_pmctrl(dev);
++	if (ret)
++		return ret;
++
+ 	mdev->rev = (mt7921_l1_rr(dev, MT_HW_CHIPID) << 16) |
+ 		    (mt7921_l1_rr(dev, MT_HW_REV) & 0xff);
+ 	dev_err(mdev->dev, "ASIC revision: %04x\n", mdev->rev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c
+index 7b34c7f2ab3a..3f80beca965a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c
+@@ -59,10 +59,8 @@ int mt7921e_mcu_init(struct mt7921_dev *dev)
+ 	return err;
+ }
+ 
+-int mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev)
++int __mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev)
+ {
+-	struct mt76_phy *mphy = &dev->mt76.phy;
+-	struct mt76_connac_pm *pm = &dev->pm;
+ 	int i, err = 0;
+ 
+ 	for (i = 0; i < MT7921_DRV_OWN_RETRY_COUNT; i++) {
+@@ -75,9 +73,21 @@ int mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev)
+ 	if (i == MT7921_DRV_OWN_RETRY_COUNT) {
+ 		dev_err(dev->mt76.dev, "driver own failed\n");
+ 		err = -EIO;
+-		goto out;
+ 	}
+ 
++	return err;
++}
++
++int mt7921e_mcu_drv_pmctrl(struct mt7921_dev *dev)
++{
++	struct mt76_phy *mphy = &dev->mt76.phy;
++	struct mt76_connac_pm *pm = &dev->pm;
++	int err;
++
++	err = __mt7921e_mcu_drv_pmctrl(dev);
++	if (err < 0)
++		goto out;
++
+ 	mt7921_wpdma_reinit_cond(dev);
+ 	clear_bit(MT76_STATE_PM, &mphy->state);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921s-fix-missing-fc-type-sub-type-for-802.11.patch b/queue-5.16/mt76-mt7921s-fix-missing-fc-type-sub-type-for-802.11.patch
new file mode 100644
index 00000000000..ea2405ff992
--- /dev/null
+++ b/queue-5.16/mt76-mt7921s-fix-missing-fc-type-sub-type-for-802.11.patch
@@ -0,0 +1,64 @@
+From 4d83a827608b772ec61c108ac4478c03c2002056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 09:40:27 +0800
+Subject: mt76: mt7921s: fix missing fc type/sub-type for 802.11 pkts
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 355c060d5f38a784822d544e969121a273bcf545 ]
+
+For non-mmio devices, should set fc values to proper txwi config
+
+Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support")
+Tested-by: Sean Wang <sean.wang@mediatek.com>
+Co-developed-by: Leon Yen <Leon.Yen@mediatek.com>
+Signed-off-by: Leon Yen <Leon.Yen@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 12 +++++++++---
+ drivers/net/wireless/mediatek/mt76/mt7921/mac.h |  3 +++
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+index ea5ae0fc8f54..57fd626b40da 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+@@ -836,9 +836,15 @@ mt7921_mac_write_txwi_80211(struct mt7921_dev *dev, __le32 *txwi,
+ 		txwi[3] |= cpu_to_le32(val);
+ 	}
+ 
+-	val = FIELD_PREP(MT_TXD7_TYPE, fc_type) |
+-	      FIELD_PREP(MT_TXD7_SUB_TYPE, fc_stype);
+-	txwi[7] |= cpu_to_le32(val);
++	if (mt76_is_mmio(&dev->mt76)) {
++		val = FIELD_PREP(MT_TXD7_TYPE, fc_type) |
++		      FIELD_PREP(MT_TXD7_SUB_TYPE, fc_stype);
++		txwi[7] |= cpu_to_le32(val);
++	} else {
++		val = FIELD_PREP(MT_TXD8_L_TYPE, fc_type) |
++		      FIELD_PREP(MT_TXD8_L_SUB_TYPE, fc_stype);
++		txwi[8] |= cpu_to_le32(val);
++	}
+ }
+ 
+ void mt7921_mac_write_txwi(struct mt7921_dev *dev, __le32 *txwi,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.h b/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
+index 544a1c33126a..12e1cf8abe6e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.h
+@@ -284,6 +284,9 @@ enum tx_mcu_port_q_idx {
+ #define MT_TXD7_HW_AMSDU		BIT(10)
+ #define MT_TXD7_TX_TIME			GENMASK(9, 0)
+ 
++#define MT_TXD8_L_TYPE			GENMASK(5, 4)
++#define MT_TXD8_L_SUB_TYPE		GENMASK(3, 0)
++
+ #define MT_TX_RATE_STBC			BIT(13)
+ #define MT_TX_RATE_NSS			GENMASK(12, 10)
+ #define MT_TX_RATE_MODE			GENMASK(9, 6)
+-- 
+2.34.1
+
diff --git a/queue-5.16/mt76-mt7921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch b/queue-5.16/mt76-mt7921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch
new file mode 100644
index 00000000000..819d45371ea
--- /dev/null
+++ b/queue-5.16/mt76-mt7921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch
@@ -0,0 +1,121 @@
+From 0c83f39779317dc82c6993a13da0a15c89a29e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 03:50:10 +0800
+Subject: mt76: mt7921s: fix mt7921s_mcu_[fw|drv]_pmctrl
+
+From: Leon Yen <leon.yen@mediatek.com>
+
+[ Upstream commit b12deb5e86fa36dc6f3aa3321f5da27addec4f1f ]
+
+According to the firmware behavior (even the oldest one in linux-firmware)
+If the firmware is downloaded, MT7921S must rely on the additional mailbox
+mechanism that resides in firmware to check if the device is the right
+state for mt7921s_mcu_[fw|drv]_pmctrl. Otherwise, we still apply the old
+way for that.
+
+That is a necessary patch before we enable runtime pm for mt7921s as
+default.
+
+Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support")
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Leon Yen <leon.yen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7921/sdio_mcu.c  | 38 +++++++++++++++++++
+ drivers/net/wireless/mediatek/mt76/sdio.h     |  2 +
+ 2 files changed, 40 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mcu.c
+index 437cddad9a90..353d99fef065 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mcu.c
+@@ -49,6 +49,26 @@ mt7921s_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	return ret;
+ }
+ 
++static u32 mt7921s_read_rm3r(struct mt7921_dev *dev)
++{
++	struct mt76_sdio *sdio = &dev->mt76.sdio;
++
++	return sdio_readl(sdio->func, MCR_D2HRM3R, NULL);
++}
++
++static u32 mt7921s_clear_rm3r_drv_own(struct mt7921_dev *dev)
++{
++	struct mt76_sdio *sdio = &dev->mt76.sdio;
++	u32 val;
++
++	val = sdio_readl(sdio->func, MCR_D2HRM3R, NULL);
++	if (val)
++		sdio_writel(sdio->func, H2D_SW_INT_CLEAR_MAILBOX_ACK,
++			    MCR_WSICR, NULL);
++
++	return val;
++}
++
+ int mt7921s_mcu_init(struct mt7921_dev *dev)
+ {
+ 	static const struct mt76_mcu_ops mt7921s_mcu_ops = {
+@@ -88,6 +108,12 @@ int mt7921s_mcu_drv_pmctrl(struct mt7921_dev *dev)
+ 
+ 	err = readx_poll_timeout(mt76s_read_pcr, &dev->mt76, status,
+ 				 status & WHLPCR_IS_DRIVER_OWN, 2000, 1000000);
++
++	if (!err && test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state))
++		err = readx_poll_timeout(mt7921s_read_rm3r, dev, status,
++					 status & D2HRM3R_IS_DRIVER_OWN,
++					 2000, 1000000);
++
+ 	sdio_release_host(func);
+ 
+ 	if (err < 0) {
+@@ -115,12 +141,24 @@ int mt7921s_mcu_fw_pmctrl(struct mt7921_dev *dev)
+ 
+ 	sdio_claim_host(func);
+ 
++	if (test_bit(MT76_STATE_MCU_RUNNING, &dev->mphy.state)) {
++		err = readx_poll_timeout(mt7921s_clear_rm3r_drv_own,
++					 dev, status,
++					 !(status & D2HRM3R_IS_DRIVER_OWN),
++					 2000, 1000000);
++		if (err < 0) {
++			dev_err(dev->mt76.dev, "mailbox ACK not cleared\n");
++			goto err;
++		}
++	}
++
+ 	sdio_writel(func, WHLPCR_FW_OWN_REQ_SET, MCR_WHLPCR, NULL);
+ 
+ 	err = readx_poll_timeout(mt76s_read_pcr, &dev->mt76, status,
+ 				 !(status & WHLPCR_IS_DRIVER_OWN), 2000, 1000000);
+ 	sdio_release_host(func);
+ 
++err:
+ 	if (err < 0) {
+ 		dev_err(dev->mt76.dev, "firmware own failed\n");
+ 		clear_bit(MT76_STATE_PM, &mphy->state);
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio.h b/drivers/net/wireless/mediatek/mt76/sdio.h
+index 99db4ad93b7c..27d5d2077eba 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio.h
++++ b/drivers/net/wireless/mediatek/mt76/sdio.h
+@@ -65,6 +65,7 @@
+ #define MCR_H2DSM0R			0x0070
+ #define H2D_SW_INT_READ			BIT(16)
+ #define H2D_SW_INT_WRITE		BIT(17)
++#define H2D_SW_INT_CLEAR_MAILBOX_ACK	BIT(22)
+ 
+ #define MCR_H2DSM1R			0x0074
+ #define MCR_D2HRM0R			0x0078
+@@ -109,6 +110,7 @@
+ #define MCR_H2DSM2R			0x0160 /* supported in CONNAC2 */
+ #define MCR_H2DSM3R			0x0164 /* supported in CONNAC2 */
+ #define MCR_D2HRM3R			0x0174 /* supported in CONNAC2 */
++#define D2HRM3R_IS_DRIVER_OWN		BIT(0)
+ #define MCR_WTQCR8			0x0190 /* supported in CONNAC2 */
+ #define MCR_WTQCR9			0x0194 /* supported in CONNAC2 */
+ #define MCR_WTQCR10			0x0198 /* supported in CONNAC2 */
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-mchp23k256-add-spi-id-table.patch b/queue-5.16/mtd-mchp23k256-add-spi-id-table.patch
new file mode 100644
index 00000000000..b12668b8b98
--- /dev/null
+++ b/queue-5.16/mtd-mchp23k256-add-spi-id-table.patch
@@ -0,0 +1,60 @@
+From 404f89a32173a3150d881f0141bd7253d35f8e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 14:34:03 +0000
+Subject: mtd: mchp23k256: Add SPI ID table
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit bc7ee2e34b219da6813c17a1680dd20766648883 ]
+
+Currently autoloading for SPI devices does not use the DT ID table, it uses
+SPI modalises. Supporting OF modalises is going to be difficult if not
+impractical, an attempt was made but has been reverted, so ensure that
+module autoloading works for this driver by adding an id_table listing the
+SPI IDs for everything.
+
+Fixes: 96c8395e2166 ("spi: Revert modalias changes")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220202143404.16070-3-broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/devices/mchp23k256.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/mtd/devices/mchp23k256.c b/drivers/mtd/devices/mchp23k256.c
+index 77c872fd3d83..7d188cdff6a2 100644
+--- a/drivers/mtd/devices/mchp23k256.c
++++ b/drivers/mtd/devices/mchp23k256.c
+@@ -229,6 +229,19 @@ static const struct of_device_id mchp23k256_of_table[] = {
+ };
+ MODULE_DEVICE_TABLE(of, mchp23k256_of_table);
+ 
++static const struct spi_device_id mchp23k256_spi_ids[] = {
++	{
++		.name = "mchp23k256",
++		.driver_data = (kernel_ulong_t)&mchp23k256_caps,
++	},
++	{
++		.name = "mchp23lcv1024",
++		.driver_data = (kernel_ulong_t)&mchp23lcv1024_caps,
++	},
++	{}
++};
++MODULE_DEVICE_TABLE(spi, mchp23k256_spi_ids);
++
+ static struct spi_driver mchp23k256_driver = {
+ 	.driver = {
+ 		.name	= "mchp23k256",
+@@ -236,6 +249,7 @@ static struct spi_driver mchp23k256_driver = {
+ 	},
+ 	.probe		= mchp23k256_probe,
+ 	.remove		= mchp23k256_remove,
++	.id_table	= mchp23k256_spi_ids,
+ };
+ 
+ module_spi_driver(mchp23k256_driver);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-mchp48l640-add-spi-id-table.patch b/queue-5.16/mtd-mchp48l640-add-spi-id-table.patch
new file mode 100644
index 00000000000..4efb7c1cf73
--- /dev/null
+++ b/queue-5.16/mtd-mchp48l640-add-spi-id-table.patch
@@ -0,0 +1,56 @@
+From ad599db301ad70743f07568f5d777cc682891920 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 14:34:04 +0000
+Subject: mtd: mchp48l640: Add SPI ID table
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 69a6d06878f05d63673b0dcdc3c3ef1af2996d46 ]
+
+Currently autoloading for SPI devices does not use the DT ID table, it uses
+SPI modalises. Supporting OF modalises is going to be difficult if not
+impractical, an attempt was made but has been reverted, so ensure that
+module autoloading works for this driver by adding an id_table listing the
+SPI IDs for everything.
+
+Fixes: 96c8395e2166 ("spi: Revert modalias changes")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220202143404.16070-4-broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/devices/mchp48l640.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/mtd/devices/mchp48l640.c b/drivers/mtd/devices/mchp48l640.c
+index 99400d0fb8c1..fbd6b6bf908e 100644
+--- a/drivers/mtd/devices/mchp48l640.c
++++ b/drivers/mtd/devices/mchp48l640.c
+@@ -357,6 +357,15 @@ static const struct of_device_id mchp48l640_of_table[] = {
+ };
+ MODULE_DEVICE_TABLE(of, mchp48l640_of_table);
+ 
++static const struct spi_device_id mchp48l640_spi_ids[] = {
++	{
++		.name = "48l640",
++		.driver_data = (kernel_ulong_t)&mchp48l640_caps,
++	},
++	{}
++};
++MODULE_DEVICE_TABLE(spi, mchp48l640_spi_ids);
++
+ static struct spi_driver mchp48l640_driver = {
+ 	.driver = {
+ 		.name	= "mchp48l640",
+@@ -364,6 +373,7 @@ static struct spi_driver mchp48l640_driver = {
+ 	},
+ 	.probe		= mchp48l640_probe,
+ 	.remove		= mchp48l640_remove,
++	.id_table	= mchp48l640_spi_ids,
+ };
+ 
+ module_spi_driver(mchp48l640_driver);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-onenand-check-for-error-irq.patch b/queue-5.16/mtd-onenand-check-for-error-irq.patch
new file mode 100644
index 00000000000..1e7dd7ad46e
--- /dev/null
+++ b/queue-5.16/mtd-onenand-check-for-error-irq.patch
@@ -0,0 +1,47 @@
+From 97ae0b316e12d3525ee7e48a020ee42a46ca9770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jan 2022 00:26:58 +0800
+Subject: mtd: onenand: Check for error irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 3e68f331c8c759c0daa31cc92c3449b23119a215 ]
+
+For the possible failure of the platform_get_irq(), the returned irq
+could be error number and will finally cause the failure of the
+request_irq().
+Consider that platform_get_irq() can now in certain cases return
+-EPROBE_DEFER, and the consequences of letting request_irq() effectively
+convert that into -EINVAL, even at probe time rather than later on.
+So it might be better to check just now.
+
+Fixes: 2c22120fbd01 ("MTD: OneNAND: interrupt based wait support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220104162658.1988142-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/onenand/generic.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c
+index 8b6f4da5d720..a4b8b65fe15f 100644
+--- a/drivers/mtd/nand/onenand/generic.c
++++ b/drivers/mtd/nand/onenand/generic.c
+@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL;
+-	info->onenand.irq = platform_get_irq(pdev, 0);
++
++	err = platform_get_irq(pdev, 0);
++	if (err < 0)
++		goto out_iounmap;
++
++	info->onenand.irq = err;
+ 
+ 	info->mtd.dev.parent = &pdev->dev;
+ 	info->mtd.priv = &info->onenand;
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch b/queue-5.16/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
new file mode 100644
index 00000000000..c4b078c3bc7
--- /dev/null
+++ b/queue-5.16/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
@@ -0,0 +1,75 @@
+From 2356ce91aad4a90b75c866639574e4d4c6e2cebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:53:32 +0800
+Subject: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+[ Upstream commit fecbd4a317c95d73c849648c406bcf1b6a0ec1cf ]
+
+The reference counting issue happens in several error handling paths
+on a refcounted object "nc->dmac". In these paths, the function simply
+returns the error code, forgetting to balance the reference count of
+"nc->dmac", increased earlier by dma_request_channel(), which may
+cause refcount leaks.
+
+Fix it by decrementing the refcount of specific object in those error
+paths.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220304085330.3610-1-xiongx18@fudan.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index f3276ee9e4fe..ddd93bc38ea6 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2060,13 +2060,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ 	nc->mck = of_clk_get(dev->parent->of_node, 0);
+ 	if (IS_ERR(nc->mck)) {
+ 		dev_err(dev, "Failed to retrieve MCK clk\n");
+-		return PTR_ERR(nc->mck);
++		ret = PTR_ERR(nc->mck);
++		goto out_release_dma;
+ 	}
+ 
+ 	np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0);
+ 	if (!np) {
+ 		dev_err(dev, "Missing or invalid atmel,smc property\n");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto out_release_dma;
+ 	}
+ 
+ 	nc->smc = syscon_node_to_regmap(np);
+@@ -2074,10 +2076,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ 	if (IS_ERR(nc->smc)) {
+ 		ret = PTR_ERR(nc->smc);
+ 		dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
+-		return ret;
++		goto out_release_dma;
+ 	}
+ 
+ 	return 0;
++
++out_release_dma:
++	if (nc->dmac)
++		dma_release_channel(nc->dmac);
++
++	return ret;
+ }
+ 
+ static int
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-rawnand-gpmi-fix-controller-timings-setting.patch b/queue-5.16/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
new file mode 100644
index 00000000000..2983ad079b7
--- /dev/null
+++ b/queue-5.16/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
@@ -0,0 +1,59 @@
+From 0ef2cb93803332c612102cd157d67852b165f3da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:54:32 +0100
+Subject: mtd: rawnand: gpmi: fix controller timings setting
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 2970bf5a32f079e1e9197411db4fe9faccb1503a ]
+
+Set the controller registers according to the real clock rate. The
+controller registers configuration (setup, hold, timeout, ... cycles)
+depends on the clock rate of the GPMI. Using the real rate instead of
+the ideal one, avoids that this inaccuracy (required_rate - real_rate)
+affects the registers setting.
+
+This patch has been tested on two custom boards with i.MX28 and i.MX6
+SOCs:
+- i.MX28:
+  required rate 100MHz, real rate 99.3MHz
+- i.MX6
+  required rate 100MHz, real rate 99MHz
+
+Fixes: b1206122069a ("mtd: rawnand: gpmi: use core timings instead of an empirical derivation")
+Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220118095434.35081-3-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index 5eb20dfe4186..42e0aab1a00c 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -648,6 +648,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this,
+ 				     const struct nand_sdr_timings *sdr)
+ {
+ 	struct gpmi_nfc_hardware_timing *hw = &this->hw;
++	struct resources *r = &this->resources;
+ 	unsigned int dll_threshold_ps = this->devdata->max_chain_delay;
+ 	unsigned int period_ps, reference_period_ps;
+ 	unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles;
+@@ -671,6 +672,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this,
+ 		wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY;
+ 	}
+ 
++	hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate);
++
+ 	/* SDR core timings are given in picoseconds */
+ 	period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/mtd-rawnand-pl353-set-the-nand-chip-node-as-the-flas.patch b/queue-5.16/mtd-rawnand-pl353-set-the-nand-chip-node-as-the-flas.patch
new file mode 100644
index 00000000000..b65edbf66a6
--- /dev/null
+++ b/queue-5.16/mtd-rawnand-pl353-set-the-nand-chip-node-as-the-flas.patch
@@ -0,0 +1,38 @@
+From 22eaa52c3b546b73481452980b6a94d1e4542531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 11:04:27 +0530
+Subject: mtd: rawnand: pl353: Set the nand chip node as the flash node
+
+From: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+
+[ Upstream commit a1fe2ace2c39dcdc7c053705459a73b7598b1e4f ]
+
+In devicetree the flash information is embedded within nand chip node,
+so during nand chip initialization the nand chip node should be passed
+to nand_set_flash_node() api, instead of nand controller node.
+
+Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220209053427.27676-1-amit.kumar-mahapatra@xilinx.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/pl35x-nand-controller.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/pl35x-nand-controller.c b/drivers/mtd/nand/raw/pl35x-nand-controller.c
+index 8a91e069ee2e..3c6f6aff649f 100644
+--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c
++++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c
+@@ -1062,7 +1062,7 @@ static int pl35x_nand_chip_init(struct pl35x_nandc *nfc,
+ 	chip->controller = &nfc->controller;
+ 	mtd = nand_to_mtd(chip);
+ 	mtd->dev.parent = nfc->dev;
+-	nand_set_flash_node(chip, nfc->dev->of_node);
++	nand_set_flash_node(chip, np);
+ 	if (!mtd->name) {
+ 		mtd->name = devm_kasprintf(nfc->dev, GFP_KERNEL,
+ 					   "%s", PL35X_NANDC_DRIVER_NAME);
+-- 
+2.34.1
+
diff --git a/queue-5.16/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch b/queue-5.16/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
new file mode 100644
index 00000000000..75ac4bfcdc5
--- /dev/null
+++ b/queue-5.16/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
@@ -0,0 +1,76 @@
+From 9c5cf8c193b337e9f788f1b90a01917f632aa4f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 08:14:24 +0100
+Subject: mxser: fix xmit_buf leak in activate when LSR == 0xff
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ]
+
+When LSR is 0xff in ->activate() (rather unlike), we return an error.
+Provided ->shutdown() is not called when ->activate() fails, nothing
+actually frees the buffer in this case.
+
+Fix this by properly freeing the buffer in a designated label. We jump
+there also from the "!info->type" if now too.
+
+Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/mxser.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
+index 39458b42df7b..88d2f16fbf89 100644
+--- a/drivers/tty/mxser.c
++++ b/drivers/tty/mxser.c
+@@ -719,6 +719,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 	struct mxser_port *info = container_of(port, struct mxser_port, port);
+ 	unsigned long page;
+ 	unsigned long flags;
++	int ret;
+ 
+ 	page = __get_free_page(GFP_KERNEL);
+ 	if (!page)
+@@ -728,9 +729,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 
+ 	if (!info->type) {
+ 		set_bit(TTY_IO_ERROR, &tty->flags);
+-		free_page(page);
+ 		spin_unlock_irqrestore(&info->slock, flags);
+-		return 0;
++		ret = 0;
++		goto err_free_xmit;
+ 	}
+ 	info->port.xmit_buf = (unsigned char *) page;
+ 
+@@ -750,8 +751,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 		if (capable(CAP_SYS_ADMIN)) {
+ 			set_bit(TTY_IO_ERROR, &tty->flags);
+ 			return 0;
+-		} else
+-			return -ENODEV;
++		}
++
++		ret = -ENODEV;
++		goto err_free_xmit;
+ 	}
+ 
+ 	/*
+@@ -796,6 +799,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 	spin_unlock_irqrestore(&info->slock, flags);
+ 
+ 	return 0;
++err_free_xmit:
++	free_page(page);
++	info->port.xmit_buf = NULL;
++	return ret;
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-asix-add-proper-error-handling-of-usb-read-error.patch b/queue-5.16/net-asix-add-proper-error-handling-of-usb-read-error.patch
new file mode 100644
index 00000000000..594c97c7f98
--- /dev/null
+++ b/queue-5.16/net-asix-add-proper-error-handling-of-usb-read-error.patch
@@ -0,0 +1,146 @@
+From 293d2b1ae2ed7e63dc10d3b178c088f7e1633194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 21:05:16 +0300
+Subject: net: asix: add proper error handling of usb read errors
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 920a9fa27e7805499cfe78491b36fed2322c02ec ]
+
+Syzbot once again hit uninit value in asix driver. The problem still the
+same -- asix_read_cmd() reads less bytes, than was requested by caller.
+
+Since all read requests are performed via asix_read_cmd() let's catch
+usb related error there and add __must_check notation to be sure all
+callers actually check return value.
+
+So, this patch adds sanity check inside asix_read_cmd(), that simply
+checks if bytes read are not less, than was requested and adds missing
+error handling of asix_read_cmd() all across the driver code.
+
+Fixes: d9fe64e51114 ("net: asix: Add in_pm parameter")
+Reported-and-tested-by: syzbot+6ca9f7867b77c2d316ac@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/asix.h         |  4 ++--
+ drivers/net/usb/asix_common.c  | 19 +++++++++++++------
+ drivers/net/usb/asix_devices.c | 21 ++++++++++++++++++---
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h
+index 2a1e31defe71..4334aafab59a 100644
+--- a/drivers/net/usb/asix.h
++++ b/drivers/net/usb/asix.h
+@@ -192,8 +192,8 @@ extern const struct driver_info ax88172a_info;
+ /* ASIX specific flags */
+ #define FLAG_EEPROM_MAC		(1UL << 0)  /* init device MAC from eeprom */
+ 
+-int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+-		  u16 size, void *data, int in_pm);
++int __must_check asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
++			       u16 size, void *data, int in_pm);
+ 
+ int asix_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+ 		   u16 size, void *data, int in_pm);
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 71682970be58..524805285019 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -11,8 +11,8 @@
+ 
+ #define AX_HOST_EN_RETRIES	30
+ 
+-int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+-		  u16 size, void *data, int in_pm)
++int __must_check asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
++			       u16 size, void *data, int in_pm)
+ {
+ 	int ret;
+ 	int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
+@@ -27,9 +27,12 @@ int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+ 	ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 		 value, index, data, size);
+ 
+-	if (unlikely(ret < 0))
++	if (unlikely(ret < size)) {
++		ret = ret < 0 ? ret : -ENODATA;
++
+ 		netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
+ 			    index, ret);
++	}
+ 
+ 	return ret;
+ }
+@@ -79,7 +82,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
+ 				    0, 0, 1, &smsr, in_pm);
+ 		if (ret == -ENODEV)
+ 			break;
+-		else if (ret < sizeof(smsr))
++		else if (ret < 0)
+ 			continue;
+ 		else if (smsr & AX_HOST_EN)
+ 			break;
+@@ -579,8 +582,12 @@ int asix_mdio_read_nopm(struct net_device *netdev, int phy_id, int loc)
+ 		return ret;
+ 	}
+ 
+-	asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
+-		      (__u16)loc, 2, &res, 1);
++	ret = asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
++			    (__u16)loc, 2, &res, 1);
++	if (ret < 0) {
++		mutex_unlock(&dev->phy_mutex);
++		return ret;
++	}
+ 	asix_set_hw_mii(dev, 1);
+ 	mutex_unlock(&dev->phy_mutex);
+ 
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index 4514d35ef4c4..6b2fbdf4e0fd 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -755,7 +755,12 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	priv->phy_addr = ret;
+ 	priv->embd_phy = ((priv->phy_addr & 0x1f) == 0x10);
+ 
+-	asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
++	ret = asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
++	if (ret < 0) {
++		netdev_dbg(dev->net, "Failed to read STATMNGSTS_REG: %d\n", ret);
++		return ret;
++	}
++
+ 	chipcode &= AX_CHIPCODE_MASK;
+ 
+ 	ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+@@ -920,11 +925,21 @@ static int ax88178_reset(struct usbnet *dev)
+ 	int gpio0 = 0;
+ 	u32 phyid;
+ 
+-	asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &status, 0);
++	ret = asix_read_cmd(dev, AX_CMD_READ_GPIOS, 0, 0, 1, &status, 0);
++	if (ret < 0) {
++		netdev_dbg(dev->net, "Failed to read GPIOS: %d\n", ret);
++		return ret;
++	}
++
+ 	netdev_dbg(dev->net, "GPIO Status: 0x%04x\n", status);
+ 
+ 	asix_write_cmd(dev, AX_CMD_WRITE_ENABLE, 0, 0, 0, NULL, 0);
+-	asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom, 0);
++	ret = asix_read_cmd(dev, AX_CMD_READ_EEPROM, 0x0017, 0, 2, &eeprom, 0);
++	if (ret < 0) {
++		netdev_dbg(dev->net, "Failed to read EEPROM: %d\n", ret);
++		return ret;
++	}
++
+ 	asix_write_cmd(dev, AX_CMD_WRITE_DISABLE, 0, 0, 0, NULL, 0);
+ 
+ 	netdev_dbg(dev->net, "EEPROM index 0x17 is 0x%04x\n", eeprom);
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch b/queue-5.16/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch
new file mode 100644
index 00000000000..c0fa0100843
--- /dev/null
+++ b/queue-5.16/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch
@@ -0,0 +1,141 @@
+From 5fc567c2a2ea07f0aaa1c47b2b3b0f2357c29639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 20:24:37 -0600
+Subject: net: axienet: fix RX ring refill allocation failure handling
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 7a7d340ba4d9351e4c8847b898a2b996727a922a ]
+
+If a memory allocation error occurred during an attempt to refill a slot
+in the RX ring after the packet was received, the hardware tail pointer
+would still have been updated to point to or past the slot which remained
+marked as previously completed. This would likely result in the DMA engine
+raising an error when it eventually tried to use that slot again.
+
+If a slot cannot be refilled, then just stop processing and do not move
+the tail pointer past it. On the next attempt, we should skip receiving
+the packet from the empty slot and just try to refill it again.
+
+This failure mode has not actually been observed, but was found as part
+of other driver updates.
+
+Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++++++++++--------
+ 1 file changed, 42 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index f12eb5beaded..0e066f2432dc 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -857,46 +857,53 @@ static void axienet_recv(struct net_device *ndev)
+ 	while ((cur_p->status & XAXIDMA_BD_STS_COMPLETE_MASK)) {
+ 		dma_addr_t phys;
+ 
+-		tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci;
+-
+ 		/* Ensure we see complete descriptor update */
+ 		dma_rmb();
+-		phys = desc_get_phys_addr(lp, cur_p);
+-		dma_unmap_single(ndev->dev.parent, phys, lp->max_frm_size,
+-				 DMA_FROM_DEVICE);
+ 
+ 		skb = cur_p->skb;
+ 		cur_p->skb = NULL;
+-		length = cur_p->app4 & 0x0000FFFF;
+-
+-		skb_put(skb, length);
+-		skb->protocol = eth_type_trans(skb, ndev);
+-		/*skb_checksum_none_assert(skb);*/
+-		skb->ip_summed = CHECKSUM_NONE;
+-
+-		/* if we're doing Rx csum offload, set it up */
+-		if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
+-			csumstatus = (cur_p->app2 &
+-				      XAE_FULL_CSUM_STATUS_MASK) >> 3;
+-			if ((csumstatus == XAE_IP_TCP_CSUM_VALIDATED) ||
+-			    (csumstatus == XAE_IP_UDP_CSUM_VALIDATED)) {
+-				skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++		/* skb could be NULL if a previous pass already received the
++		 * packet for this slot in the ring, but failed to refill it
++		 * with a newly allocated buffer. In this case, don't try to
++		 * receive it again.
++		 */
++		if (likely(skb)) {
++			length = cur_p->app4 & 0x0000FFFF;
++
++			phys = desc_get_phys_addr(lp, cur_p);
++			dma_unmap_single(ndev->dev.parent, phys, lp->max_frm_size,
++					 DMA_FROM_DEVICE);
++
++			skb_put(skb, length);
++			skb->protocol = eth_type_trans(skb, ndev);
++			/*skb_checksum_none_assert(skb);*/
++			skb->ip_summed = CHECKSUM_NONE;
++
++			/* if we're doing Rx csum offload, set it up */
++			if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
++				csumstatus = (cur_p->app2 &
++					      XAE_FULL_CSUM_STATUS_MASK) >> 3;
++				if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
++				    csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
++					skb->ip_summed = CHECKSUM_UNNECESSARY;
++				}
++			} else if ((lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) != 0 &&
++				   skb->protocol == htons(ETH_P_IP) &&
++				   skb->len > 64) {
++				skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
++				skb->ip_summed = CHECKSUM_COMPLETE;
+ 			}
+-		} else if ((lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) != 0 &&
+-			   skb->protocol == htons(ETH_P_IP) &&
+-			   skb->len > 64) {
+-			skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
+-			skb->ip_summed = CHECKSUM_COMPLETE;
+-		}
+ 
+-		netif_rx(skb);
++			netif_rx(skb);
+ 
+-		size += length;
+-		packets++;
++			size += length;
++			packets++;
++		}
+ 
+ 		new_skb = netdev_alloc_skb_ip_align(ndev, lp->max_frm_size);
+ 		if (!new_skb)
+-			return;
++			break;
+ 
+ 		phys = dma_map_single(ndev->dev.parent, new_skb->data,
+ 				      lp->max_frm_size,
+@@ -905,7 +912,7 @@ static void axienet_recv(struct net_device *ndev)
+ 			if (net_ratelimit())
+ 				netdev_err(ndev, "RX DMA mapping error\n");
+ 			dev_kfree_skb(new_skb);
+-			return;
++			break;
+ 		}
+ 		desc_set_phys_addr(lp, phys, cur_p);
+ 
+@@ -913,6 +920,11 @@ static void axienet_recv(struct net_device *ndev)
+ 		cur_p->status = 0;
+ 		cur_p->skb = new_skb;
+ 
++		/* Only update tail_p to mark this slot as usable after it has
++		 * been successfully refilled.
++		 */
++		tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci;
++
+ 		if (++lp->rx_bd_ci >= lp->rx_bd_num)
+ 			lp->rx_bd_ci = 0;
+ 		cur_p = &lp->rx_bd_v[lp->rx_bd_ci];
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-bcmgenet-use-stronger-register-read-writes-to-as.patch b/queue-5.16/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
new file mode 100644
index 00000000000..f651ddbf3b3
--- /dev/null
+++ b/queue-5.16/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
@@ -0,0 +1,115 @@
+From 5a431835ab8e8168eedc9eaf946b95c778696236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 22:53:58 -0600
+Subject: net: bcmgenet: Use stronger register read/writes to assure ordering
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit 8d3ea3d402db94b61075617e71b67459a714a502 ]
+
+GCC12 appears to be much smarter about its dependency tracking and is
+aware that the relaxed variants are just normal loads and stores and
+this is causing problems like:
+
+[  210.074549] ------------[ cut here ]------------
+[  210.079223] NETDEV WATCHDOG: enabcm6e4ei0 (bcmgenet): transmit queue 1 timed out
+[  210.086717] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:529 dev_watchdog+0x234/0x240
+[  210.095044] Modules linked in: genet(E) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat]
+[  210.146561] ACPI CPPC: PCC check channel failed for ss: 0. ret=-110
+[  210.146927] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E     5.17.0-rc7G12+ #58
+[  210.153226] CPPC Cpufreq:cppc_scale_freq_workfn: failed to read perf counters
+[  210.161349] Hardware name: Raspberry Pi Foundation Raspberry Pi 4 Model B/Raspberry Pi 4 Model B, BIOS EDK2-DEV 02/08/2022
+[  210.161353] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[  210.161358] pc : dev_watchdog+0x234/0x240
+[  210.161364] lr : dev_watchdog+0x234/0x240
+[  210.161368] sp : ffff8000080a3a40
+[  210.161370] x29: ffff8000080a3a40 x28: ffffcd425af87000 x27: ffff8000080a3b20
+[  210.205150] x26: ffffcd425aa00000 x25: 0000000000000001 x24: ffffcd425af8ec08
+[  210.212321] x23: 0000000000000100 x22: ffffcd425af87000 x21: ffff55b142688000
+[  210.219491] x20: 0000000000000001 x19: ffff55b1426884c8 x18: ffffffffffffffff
+[  210.226661] x17: 64656d6974203120 x16: 0000000000000001 x15: 6d736e617274203a
+[  210.233831] x14: 2974656e65676d63 x13: ffffcd4259c300d8 x12: ffffcd425b07d5f0
+[  210.241001] x11: 00000000ffffffff x10: ffffcd425b07d5f0 x9 : ffffcd4258bdad9c
+[  210.248171] x8 : 00000000ffffdfff x7 : 000000000000003f x6 : 0000000000000000
+[  210.255341] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000001000
+[  210.262511] x2 : 0000000000001000 x1 : 0000000000000005 x0 : 0000000000000044
+[  210.269682] Call trace:
+[  210.272133]  dev_watchdog+0x234/0x240
+[  210.275811]  call_timer_fn+0x3c/0x15c
+[  210.279489]  __run_timers.part.0+0x288/0x310
+[  210.283777]  run_timer_softirq+0x48/0x80
+[  210.287716]  __do_softirq+0x128/0x360
+[  210.291392]  __irq_exit_rcu+0x138/0x140
+[  210.295243]  irq_exit_rcu+0x1c/0x30
+[  210.298745]  el1_interrupt+0x38/0x54
+[  210.302334]  el1h_64_irq_handler+0x18/0x24
+[  210.306445]  el1h_64_irq+0x7c/0x80
+[  210.309857]  arch_cpu_idle+0x18/0x2c
+[  210.313445]  default_idle_call+0x4c/0x140
+[  210.317470]  cpuidle_idle_call+0x14c/0x1a0
+[  210.321584]  do_idle+0xb0/0x100
+[  210.324737]  cpu_startup_entry+0x30/0x8c
+[  210.328675]  secondary_start_kernel+0xe4/0x110
+[  210.333138]  __secondary_switched+0x94/0x98
+
+The assumption when these were relaxed seems to be that device memory
+would be mapped non reordering, and that other constructs
+(spinlocks/etc) would provide the barriers to assure that packet data
+and in memory rings/queues were ordered with respect to device
+register reads/writes. This itself seems a bit sketchy, but the real
+problem with GCC12 is that it is moving the actual reads/writes around
+at will as though they were independent operations when in truth they
+are not, but the compiler can't know that. When looking at the
+assembly dumps for many of these routines its possible to see very
+clean, but not strictly in program order operations occurring as the
+compiler would be free to do if these weren't actually register
+reads/write operations.
+
+Its possible to suppress the timeout with a liberal bit of dma_mb()'s
+sprinkled around but the device still seems unable to reliably
+send/receive data. A better plan is to use the safer readl/writel
+everywhere.
+
+Since this partially reverts an older commit, which notes the use of
+the relaxed variants for performance reasons. I would suggest that
+any performance problems with this commit are targeted at relaxing only
+the performance critical code paths after assuring proper barriers.
+
+Fixes: 69d2ea9c79898 ("net: bcmgenet: Use correct I/O accessors")
+Reported-by: Peter Robinson <pbrobinson@gmail.com>
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Acked-by: Peter Robinson <pbrobinson@gmail.com>
+Tested-by: Peter Robinson <pbrobinson@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220310045358.224350-1-jeremy.linton@arm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 2da804f84b48..bd5998012a87 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -76,7 +76,7 @@ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ 	if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ 		__raw_writel(value, offset);
+ 	else
+-		writel_relaxed(value, offset);
++		writel(value, offset);
+ }
+ 
+ static inline u32 bcmgenet_readl(void __iomem *offset)
+@@ -84,7 +84,7 @@ static inline u32 bcmgenet_readl(void __iomem *offset)
+ 	if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ 		return __raw_readl(offset);
+ 	else
+-		return readl_relaxed(offset);
++		return readl(offset);
+ }
+ 
+ static inline void dmadesc_set_length_status(struct bcmgenet_priv *priv,
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch b/queue-5.16/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
new file mode 100644
index 00000000000..9d1afe6a652
--- /dev/null
+++ b/queue-5.16/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
@@ -0,0 +1,55 @@
+From 3e35fcf0e3fb5d192c6c0a90e9cfc86d90019c23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Mar 2022 11:24:31 +0800
+Subject: net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
+
+From: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+
+[ Upstream commit 6da69b1da130e7d96766042750cd9f902e890eba ]
+
+The bug is here:
+	return rule;
+
+The list iterator value 'rule' will *always* be set and non-NULL
+by list_for_each_entry(), so it is incorrect to assume that the
+iterator value will be NULL if the list is empty or no element
+is found.
+
+To fix the bug, return 'rule' when found, otherwise return NULL.
+
+Fixes: ae7a5aff783c7 ("net: dsa: bcm_sf2: Keep copy of inserted rules")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+Link: https://lore.kernel.org/r/20220328032431.22538-1-xiam0nd.tong@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2_cfp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
+index a7e2fcf2df2c..edbe5e7f1cb6 100644
+--- a/drivers/net/dsa/bcm_sf2_cfp.c
++++ b/drivers/net/dsa/bcm_sf2_cfp.c
+@@ -567,14 +567,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv,
+ static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv,
+ 					      int port, u32 location)
+ {
+-	struct cfp_rule *rule = NULL;
++	struct cfp_rule *rule;
+ 
+ 	list_for_each_entry(rule, &priv->cfp.rules_list, next) {
+ 		if (rule->port == port && rule->fs.location == location)
+-			break;
++			return rule;
+ 	}
+ 
+-	return rule;
++	return NULL;
+ }
+ 
+ static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port,
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-dsa-fix-panic-on-shutdown-if-multi-chip-tree-fai.patch b/queue-5.16/net-dsa-fix-panic-on-shutdown-if-multi-chip-tree-fai.patch
new file mode 100644
index 00000000000..0d13e9dd698
--- /dev/null
+++ b/queue-5.16/net-dsa-fix-panic-on-shutdown-if-multi-chip-tree-fai.patch
@@ -0,0 +1,64 @@
+From d62195b62ad04f09b413abf148629cc63fc3065d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 21:54:43 +0200
+Subject: net: dsa: fix panic on shutdown if multi-chip tree failed to probe
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 8fd36358ce82382519b50b05f437493e1e00c4a9 ]
+
+DSA probing is atypical because a tree of devices must probe all at
+once, so out of N switches which call dsa_tree_setup_routing_table()
+during probe, for (N - 1) of them, "complete" will return false and they
+will exit probing early. The Nth switch will set up the whole tree on
+their behalf.
+
+The implication is that for (N - 1) switches, the driver binds to the
+device successfully, without doing anything. When the driver is bound,
+the ->shutdown() method may run. But if the Nth switch has failed to
+initialize the tree, there is nothing to do for the (N - 1) driver
+instances, since the slave devices have not been created, etc. Moreover,
+dsa_switch_shutdown() expects that the calling @ds has been in fact
+initialized, so it jumps at dereferencing the various data structures,
+which is incorrect.
+
+Avoid the ensuing NULL pointer dereferences by simply checking whether
+the Nth switch has previously set "ds->setup = true" for the switch
+which is currently shutting down. The entire setup is serialized under
+dsa2_mutex which we already hold.
+
+Fixes: 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20220318195443.275026-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa2.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index e64ef196a984..ff29a5a3e4c1 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -1613,6 +1613,10 @@ void dsa_switch_shutdown(struct dsa_switch *ds)
+ 	struct dsa_port *dp;
+ 
+ 	mutex_lock(&dsa2_mutex);
++
++	if (!ds->setup)
++		goto out;
++
+ 	rtnl_lock();
+ 
+ 	dsa_switch_for_each_user_port(dp, ds) {
+@@ -1629,6 +1633,7 @@ void dsa_switch_shutdown(struct dsa_switch *ds)
+ 		dp->master->dsa_ptr = NULL;
+ 
+ 	rtnl_unlock();
++out:
+ 	mutex_unlock(&dsa2_mutex);
+ }
+ EXPORT_SYMBOL_GPL(dsa_switch_shutdown);
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch b/queue-5.16/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
new file mode 100644
index 00000000000..9b25d7b21f0
--- /dev/null
+++ b/queue-5.16/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
@@ -0,0 +1,35 @@
+From 2b6ad598dd720aed20a01ba413e51fe18f957e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 11:16:55 +0100
+Subject: net: dsa: mv88e6xxx: Enable port policy support on 6097
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 585d42bb57bb358d48906660a8de273b078810b1 ]
+
+This chip has support for the same per-port policy actions found in
+later versions of LinkStreet devices.
+
+Fixes: f3a2cd326e44 ("net: dsa: mv88e6xxx: introduce .port_set_policy")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index ec8b02f5459d..b420e0ef46e3 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3655,6 +3655,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = {
+ 	.port_sync_link = mv88e6185_port_sync_link,
+ 	.port_set_speed_duplex = mv88e6185_port_set_speed_duplex,
+ 	.port_tag_remap = mv88e6095_port_tag_remap,
++	.port_set_policy = mv88e6352_port_set_policy,
+ 	.port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ 	.port_set_ucast_flood = mv88e6352_port_set_ucast_flood,
+ 	.port_set_mcast_flood = mv88e6352_port_set_mcast_flood,
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-dsa-realtek-smi-fix-kdoc-warnings.patch b/queue-5.16/net-dsa-realtek-smi-fix-kdoc-warnings.patch
new file mode 100644
index 00000000000..c3235f7f5e3
--- /dev/null
+++ b/queue-5.16/net-dsa-realtek-smi-fix-kdoc-warnings.patch
@@ -0,0 +1,58 @@
+From a2cf718f7b23fb4f981215ff28a51482902258e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 03:04:57 -0300
+Subject: net: dsa: realtek-smi: fix kdoc warnings
+
+From: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+
+[ Upstream commit 0f0c6da03ba37739901ca5db4361c1ef1ae9463f ]
+
+Removed kdoc mark for incomplete struct description.
+Added a return description for rtl8366rb_drop_untagged.
+
+Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/realtek-smi-core.h | 4 ++--
+ drivers/net/dsa/rtl8366rb.c        | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/realtek-smi-core.h b/drivers/net/dsa/realtek-smi-core.h
+index 5bfa53e2480a..faed387d8db3 100644
+--- a/drivers/net/dsa/realtek-smi-core.h
++++ b/drivers/net/dsa/realtek-smi-core.h
+@@ -25,7 +25,7 @@ struct rtl8366_mib_counter {
+ 	const char	*name;
+ };
+ 
+-/**
++/*
+  * struct rtl8366_vlan_mc - Virtual LAN member configuration
+  */
+ struct rtl8366_vlan_mc {
+@@ -74,7 +74,7 @@ struct realtek_smi {
+ 	void			*chip_data; /* Per-chip extra variant data */
+ };
+ 
+-/**
++/*
+  * struct realtek_smi_ops - vtable for the per-SMI-chiptype operations
+  * @detect: detects the chiptype
+  */
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index 03deacd83e61..2a523a33529b 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -1251,6 +1251,8 @@ rtl8366rb_port_bridge_leave(struct dsa_switch *ds, int port,
+  * @smi: SMI state container
+  * @port: the port to drop untagged and C-tagged frames on
+  * @drop: whether to drop or pass untagged and C-tagged frames
++ *
++ * Return: zero for success, a negative number on error.
+  */
+ static int rtl8366rb_drop_untagged(struct realtek_smi *smi, int port, bool drop)
+ {
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-dsa-realtek-smi-move-to-subdirectory.patch b/queue-5.16/net-dsa-realtek-smi-move-to-subdirectory.patch
new file mode 100644
index 00000000000..cbf0a307934
--- /dev/null
+++ b/queue-5.16/net-dsa-realtek-smi-move-to-subdirectory.patch
@@ -0,0 +1,155 @@
+From b4f0c03ece440f60e19862ae077a54c1d3181462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 03:04:58 -0300
+Subject: net: dsa: realtek-smi: move to subdirectory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+
+[ Upstream commit 319a70a5fea9590e9431dd57f56191996c4787f4 ]
+
+Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Alvin Å ipraga <alsi@bang-olufsen.dk>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ MAINTAINERS                                   |  3 +--
+ drivers/net/dsa/Kconfig                       | 12 +----------
+ drivers/net/dsa/Makefile                      |  3 +--
+ drivers/net/dsa/realtek/Kconfig               | 20 +++++++++++++++++++
+ drivers/net/dsa/realtek/Makefile              |  3 +++
+ .../net/dsa/{ => realtek}/realtek-smi-core.c  |  0
+ .../net/dsa/{ => realtek}/realtek-smi-core.h  |  0
+ drivers/net/dsa/{ => realtek}/rtl8365mb.c     |  0
+ drivers/net/dsa/{ => realtek}/rtl8366.c       |  0
+ drivers/net/dsa/{ => realtek}/rtl8366rb.c     |  0
+ 10 files changed, 26 insertions(+), 15 deletions(-)
+ create mode 100644 drivers/net/dsa/realtek/Kconfig
+ create mode 100644 drivers/net/dsa/realtek/Makefile
+ rename drivers/net/dsa/{ => realtek}/realtek-smi-core.c (100%)
+ rename drivers/net/dsa/{ => realtek}/realtek-smi-core.h (100%)
+ rename drivers/net/dsa/{ => realtek}/rtl8365mb.c (100%)
+ rename drivers/net/dsa/{ => realtek}/rtl8366.c (100%)
+ rename drivers/net/dsa/{ => realtek}/rtl8366rb.c (100%)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index dd36acc87ce6..af9530d98717 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -16147,8 +16147,7 @@ REALTEK RTL83xx SMI DSA ROUTER CHIPS
+ M:	Linus Walleij <linus.walleij@linaro.org>
+ S:	Maintained
+ F:	Documentation/devicetree/bindings/net/dsa/realtek-smi.txt
+-F:	drivers/net/dsa/realtek-smi*
+-F:	drivers/net/dsa/rtl83*
++F:	drivers/net/dsa/realtek/*
+ 
+ REALTEK WIRELESS DRIVER (rtlwifi family)
+ M:	Ping-Ke Shih <pkshih@realtek.com>
+diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
+index 0029d279616f..37a3dabdce31 100644
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -68,17 +68,7 @@ config NET_DSA_QCA8K
+ 	  This enables support for the Qualcomm Atheros QCA8K Ethernet
+ 	  switch chips.
+ 
+-config NET_DSA_REALTEK_SMI
+-	tristate "Realtek SMI Ethernet switch family support"
+-	select NET_DSA_TAG_RTL4_A
+-	select NET_DSA_TAG_RTL8_4
+-	select FIXED_PHY
+-	select IRQ_DOMAIN
+-	select REALTEK_PHY
+-	select REGMAP
+-	help
+-	  This enables support for the Realtek SMI-based switch
+-	  chips, currently only RTL8366RB.
++source "drivers/net/dsa/realtek/Kconfig"
+ 
+ config NET_DSA_SMSC_LAN9303
+ 	tristate
+diff --git a/drivers/net/dsa/Makefile b/drivers/net/dsa/Makefile
+index 8da1569a34e6..e73838c12256 100644
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -9,8 +9,6 @@ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
+ obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
+ obj-$(CONFIG_NET_DSA_QCA8K)	+= qca8k.o
+-obj-$(CONFIG_NET_DSA_REALTEK_SMI) += realtek-smi.o
+-realtek-smi-objs		:= realtek-smi-core.o rtl8366.o rtl8366rb.o rtl8365mb.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303) += lan9303-core.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303_I2C) += lan9303_i2c.o
+ obj-$(CONFIG_NET_DSA_SMSC_LAN9303_MDIO) += lan9303_mdio.o
+@@ -23,5 +21,6 @@ obj-y				+= microchip/
+ obj-y				+= mv88e6xxx/
+ obj-y				+= ocelot/
+ obj-y				+= qca/
++obj-y				+= realtek/
+ obj-y				+= sja1105/
+ obj-y				+= xrs700x/
+diff --git a/drivers/net/dsa/realtek/Kconfig b/drivers/net/dsa/realtek/Kconfig
+new file mode 100644
+index 000000000000..1c62212fb0ec
+--- /dev/null
++++ b/drivers/net/dsa/realtek/Kconfig
+@@ -0,0 +1,20 @@
++# SPDX-License-Identifier: GPL-2.0-only
++menuconfig NET_DSA_REALTEK
++	tristate "Realtek Ethernet switch family support"
++	depends on NET_DSA
++	select NET_DSA_TAG_RTL4_A
++	select NET_DSA_TAG_RTL8_4
++	select FIXED_PHY
++	select IRQ_DOMAIN
++	select REALTEK_PHY
++	select REGMAP
++	help
++	  Select to enable support for Realtek Ethernet switch chips.
++
++config NET_DSA_REALTEK_SMI
++	tristate "Realtek SMI connected switch driver"
++	depends on NET_DSA_REALTEK
++	default y
++	help
++	  Select to enable support for registering switches connected
++	  through SMI.
+diff --git a/drivers/net/dsa/realtek/Makefile b/drivers/net/dsa/realtek/Makefile
+new file mode 100644
+index 000000000000..323b921bfce0
+--- /dev/null
++++ b/drivers/net/dsa/realtek/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier: GPL-2.0
++obj-$(CONFIG_NET_DSA_REALTEK_SMI) 	+= realtek-smi.o
++realtek-smi-objs			:= realtek-smi-core.o rtl8366.o rtl8366rb.o rtl8365mb.o
+diff --git a/drivers/net/dsa/realtek-smi-core.c b/drivers/net/dsa/realtek/realtek-smi-core.c
+similarity index 100%
+rename from drivers/net/dsa/realtek-smi-core.c
+rename to drivers/net/dsa/realtek/realtek-smi-core.c
+diff --git a/drivers/net/dsa/realtek-smi-core.h b/drivers/net/dsa/realtek/realtek-smi-core.h
+similarity index 100%
+rename from drivers/net/dsa/realtek-smi-core.h
+rename to drivers/net/dsa/realtek/realtek-smi-core.h
+diff --git a/drivers/net/dsa/rtl8365mb.c b/drivers/net/dsa/realtek/rtl8365mb.c
+similarity index 100%
+rename from drivers/net/dsa/rtl8365mb.c
+rename to drivers/net/dsa/realtek/rtl8365mb.c
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/realtek/rtl8366.c
+similarity index 100%
+rename from drivers/net/dsa/rtl8366.c
+rename to drivers/net/dsa/realtek/rtl8366.c
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/realtek/rtl8366rb.c
+similarity index 100%
+rename from drivers/net/dsa/rtl8366rb.c
+rename to drivers/net/dsa/realtek/rtl8366rb.c
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-enetc-allocate-cbd-ring-data-memory-using-dma-co.patch b/queue-5.16/net-enetc-allocate-cbd-ring-data-memory-using-dma-co.patch
new file mode 100644
index 00000000000..52631cbc858
--- /dev/null
+++ b/queue-5.16/net-enetc-allocate-cbd-ring-data-memory-using-dma-co.patch
@@ -0,0 +1,283 @@
+From cdbe73367825c3f0a4f97e1bc45becbe3dad3e0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 20:33:01 +0800
+Subject: net:enetc: allocate CBD ring data memory using DMA coherent methods
+
+From: Po Liu <po.liu@nxp.com>
+
+[ Upstream commit b3a723dbc94a6e38f67669d03b521edd766ad895 ]
+
+To replace the dma_map_single() stream DMA mapping with DMA coherent
+method dma_alloc_coherent() which is more simple.
+
+dma_map_single() found by Tim Gardner not proper. Suggested by Claudiu
+Manoil and Jakub Kicinski to use dma_alloc_coherent(). Discussion at:
+
+https://lore.kernel.org/netdev/AM9PR04MB8397F300DECD3C44D2EBD07796BD9@AM9PR04MB8397.eurprd04.prod.outlook.com/t/
+
+Fixes: 888ae5a3952ba ("net: enetc: add tc flower psfp offload driver")
+cc: Claudiu Manoil <claudiu.manoil@nxp.com>
+Reported-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Po Liu <po.liu@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/enetc/enetc_qos.c  | 128 +++++++++---------
+ 1 file changed, 64 insertions(+), 64 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+index 0536d2c76fbc..d779dde522c8 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+@@ -45,6 +45,7 @@ void enetc_sched_speed_set(struct enetc_ndev_priv *priv, int speed)
+ 		      | pspeed);
+ }
+ 
++#define ENETC_QOS_ALIGN	64
+ static int enetc_setup_taprio(struct net_device *ndev,
+ 			      struct tc_taprio_qopt_offload *admin_conf)
+ {
+@@ -52,10 +53,11 @@ static int enetc_setup_taprio(struct net_device *ndev,
+ 	struct enetc_cbd cbd = {.cmd = 0};
+ 	struct tgs_gcl_conf *gcl_config;
+ 	struct tgs_gcl_data *gcl_data;
++	dma_addr_t dma, dma_align;
+ 	struct gce *gce;
+-	dma_addr_t dma;
+ 	u16 data_size;
+ 	u16 gcl_len;
++	void *tmp;
+ 	u32 tge;
+ 	int err;
+ 	int i;
+@@ -82,9 +84,16 @@ static int enetc_setup_taprio(struct net_device *ndev,
+ 	gcl_config = &cbd.gcl_conf;
+ 
+ 	data_size = struct_size(gcl_data, entry, gcl_len);
+-	gcl_data = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
+-	if (!gcl_data)
++	tmp = dma_alloc_coherent(&priv->si->pdev->dev,
++				 data_size + ENETC_QOS_ALIGN,
++				 &dma, GFP_KERNEL);
++	if (!tmp) {
++		dev_err(&priv->si->pdev->dev,
++			"DMA mapping of taprio gate list failed!\n");
+ 		return -ENOMEM;
++	}
++	dma_align = ALIGN(dma, ENETC_QOS_ALIGN);
++	gcl_data = (struct tgs_gcl_data *)PTR_ALIGN(tmp, ENETC_QOS_ALIGN);
+ 
+ 	gce = (struct gce *)(gcl_data + 1);
+ 
+@@ -110,16 +119,8 @@ static int enetc_setup_taprio(struct net_device *ndev,
+ 	cbd.length = cpu_to_le16(data_size);
+ 	cbd.status_flags = 0;
+ 
+-	dma = dma_map_single(&priv->si->pdev->dev, gcl_data,
+-			     data_size, DMA_TO_DEVICE);
+-	if (dma_mapping_error(&priv->si->pdev->dev, dma)) {
+-		netdev_err(priv->si->ndev, "DMA mapping failed!\n");
+-		kfree(gcl_data);
+-		return -ENOMEM;
+-	}
+-
+-	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma));
+-	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma));
++	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma_align));
++	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma_align));
+ 	cbd.cls = BDCR_CMD_PORT_GCL;
+ 	cbd.status_flags = 0;
+ 
+@@ -132,8 +133,8 @@ static int enetc_setup_taprio(struct net_device *ndev,
+ 			 ENETC_QBV_PTGCR_OFFSET,
+ 			 tge & (~ENETC_QBV_TGE));
+ 
+-	dma_unmap_single(&priv->si->pdev->dev, dma, data_size, DMA_TO_DEVICE);
+-	kfree(gcl_data);
++	dma_free_coherent(&priv->si->pdev->dev, data_size + ENETC_QOS_ALIGN,
++			  tmp, dma);
+ 
+ 	return err;
+ }
+@@ -463,8 +464,9 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
+ 	struct enetc_cbd cbd = {.cmd = 0};
+ 	struct streamid_data *si_data;
+ 	struct streamid_conf *si_conf;
++	dma_addr_t dma, dma_align;
+ 	u16 data_size;
+-	dma_addr_t dma;
++	void *tmp;
+ 	int port;
+ 	int err;
+ 
+@@ -485,21 +487,20 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
+ 	cbd.status_flags = 0;
+ 
+ 	data_size = sizeof(struct streamid_data);
+-	si_data = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
+-	if (!si_data)
++	tmp = dma_alloc_coherent(&priv->si->pdev->dev,
++				 data_size + ENETC_QOS_ALIGN,
++				 &dma, GFP_KERNEL);
++	if (!tmp) {
++		dev_err(&priv->si->pdev->dev,
++			"DMA mapping of stream identify failed!\n");
+ 		return -ENOMEM;
+-	cbd.length = cpu_to_le16(data_size);
+-
+-	dma = dma_map_single(&priv->si->pdev->dev, si_data,
+-			     data_size, DMA_FROM_DEVICE);
+-	if (dma_mapping_error(&priv->si->pdev->dev, dma)) {
+-		netdev_err(priv->si->ndev, "DMA mapping failed!\n");
+-		err = -ENOMEM;
+-		goto out;
+ 	}
++	dma_align = ALIGN(dma, ENETC_QOS_ALIGN);
++	si_data = (struct streamid_data *)PTR_ALIGN(tmp, ENETC_QOS_ALIGN);
+ 
+-	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma));
+-	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma));
++	cbd.length = cpu_to_le16(data_size);
++	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma_align));
++	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma_align));
+ 	eth_broadcast_addr(si_data->dmac);
+ 	si_data->vid_vidm_tg = (ENETC_CBDR_SID_VID_MASK
+ 			       + ((0x3 << 14) | ENETC_CBDR_SID_VIDM));
+@@ -539,8 +540,8 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
+ 
+ 	cbd.length = cpu_to_le16(data_size);
+ 
+-	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma));
+-	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma));
++	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma_align));
++	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma_align));
+ 
+ 	/* VIDM default to be 1.
+ 	 * VID Match. If set (b1) then the VID must match, otherwise
+@@ -561,10 +562,8 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
+ 
+ 	err = enetc_send_cmd(priv->si, &cbd);
+ out:
+-	if (!dma_mapping_error(&priv->si->pdev->dev, dma))
+-		dma_unmap_single(&priv->si->pdev->dev, dma, data_size, DMA_FROM_DEVICE);
+-
+-	kfree(si_data);
++	dma_free_coherent(&priv->si->pdev->dev, data_size + ENETC_QOS_ALIGN,
++			  tmp, dma);
+ 
+ 	return err;
+ }
+@@ -633,8 +632,9 @@ static int enetc_streamcounter_hw_get(struct enetc_ndev_priv *priv,
+ {
+ 	struct enetc_cbd cbd = { .cmd = 2 };
+ 	struct sfi_counter_data *data_buf;
+-	dma_addr_t dma;
++	dma_addr_t dma, dma_align;
+ 	u16 data_size;
++	void *tmp;
+ 	int err;
+ 
+ 	cbd.index = cpu_to_le16((u16)index);
+@@ -643,19 +643,19 @@ static int enetc_streamcounter_hw_get(struct enetc_ndev_priv *priv,
+ 	cbd.status_flags = 0;
+ 
+ 	data_size = sizeof(struct sfi_counter_data);
+-	data_buf = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
+-	if (!data_buf)
++	tmp = dma_alloc_coherent(&priv->si->pdev->dev,
++				 data_size + ENETC_QOS_ALIGN,
++				 &dma, GFP_KERNEL);
++	if (!tmp) {
++		dev_err(&priv->si->pdev->dev,
++			"DMA mapping of stream counter failed!\n");
+ 		return -ENOMEM;
+-
+-	dma = dma_map_single(&priv->si->pdev->dev, data_buf,
+-			     data_size, DMA_FROM_DEVICE);
+-	if (dma_mapping_error(&priv->si->pdev->dev, dma)) {
+-		netdev_err(priv->si->ndev, "DMA mapping failed!\n");
+-		err = -ENOMEM;
+-		goto exit;
+ 	}
+-	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma));
+-	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma));
++	dma_align = ALIGN(dma, ENETC_QOS_ALIGN);
++	data_buf = (struct sfi_counter_data *)PTR_ALIGN(tmp, ENETC_QOS_ALIGN);
++
++	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma_align));
++	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma_align));
+ 
+ 	cbd.length = cpu_to_le16(data_size);
+ 
+@@ -684,7 +684,9 @@ static int enetc_streamcounter_hw_get(struct enetc_ndev_priv *priv,
+ 				data_buf->flow_meter_dropl;
+ 
+ exit:
+-	kfree(data_buf);
++	dma_free_coherent(&priv->si->pdev->dev, data_size + ENETC_QOS_ALIGN,
++			  tmp, dma);
++
+ 	return err;
+ }
+ 
+@@ -723,9 +725,10 @@ static int enetc_streamgate_hw_set(struct enetc_ndev_priv *priv,
+ 	struct sgcl_conf *sgcl_config;
+ 	struct sgcl_data *sgcl_data;
+ 	struct sgce *sgce;
+-	dma_addr_t dma;
++	dma_addr_t dma, dma_align;
+ 	u16 data_size;
+ 	int err, i;
++	void *tmp;
+ 	u64 now;
+ 
+ 	cbd.index = cpu_to_le16(sgi->index);
+@@ -772,24 +775,20 @@ static int enetc_streamgate_hw_set(struct enetc_ndev_priv *priv,
+ 	sgcl_config->acl_len = (sgi->num_entries - 1) & 0x3;
+ 
+ 	data_size = struct_size(sgcl_data, sgcl, sgi->num_entries);
+-
+-	sgcl_data = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
+-	if (!sgcl_data)
+-		return -ENOMEM;
+-
+-	cbd.length = cpu_to_le16(data_size);
+-
+-	dma = dma_map_single(&priv->si->pdev->dev,
+-			     sgcl_data, data_size,
+-			     DMA_FROM_DEVICE);
+-	if (dma_mapping_error(&priv->si->pdev->dev, dma)) {
+-		netdev_err(priv->si->ndev, "DMA mapping failed!\n");
+-		kfree(sgcl_data);
++	tmp = dma_alloc_coherent(&priv->si->pdev->dev,
++				 data_size + ENETC_QOS_ALIGN,
++				 &dma, GFP_KERNEL);
++	if (!tmp) {
++		dev_err(&priv->si->pdev->dev,
++			"DMA mapping of stream counter failed!\n");
+ 		return -ENOMEM;
+ 	}
++	dma_align = ALIGN(dma, ENETC_QOS_ALIGN);
++	sgcl_data = (struct sgcl_data *)PTR_ALIGN(tmp, ENETC_QOS_ALIGN);
+ 
+-	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma));
+-	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma));
++	cbd.length = cpu_to_le16(data_size);
++	cbd.addr[0] = cpu_to_le32(lower_32_bits(dma_align));
++	cbd.addr[1] = cpu_to_le32(upper_32_bits(dma_align));
+ 
+ 	sgce = &sgcl_data->sgcl[0];
+ 
+@@ -844,7 +843,8 @@ static int enetc_streamgate_hw_set(struct enetc_ndev_priv *priv,
+ 	err = enetc_send_cmd(priv->si, &cbd);
+ 
+ exit:
+-	kfree(sgcl_data);
++	dma_free_coherent(&priv->si->pdev->dev, data_size + ENETC_QOS_ALIGN,
++			  tmp, dma);
+ 
+ 	return err;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-enetc-report-software-timestamping-via-so_timest.patch b/queue-5.16/net-enetc-report-software-timestamping-via-so_timest.patch
new file mode 100644
index 00000000000..12780e6fffd
--- /dev/null
+++ b/queue-5.16/net-enetc-report-software-timestamping-via-so_timest.patch
@@ -0,0 +1,41 @@
+From c09577c08b97404ba1f960125d731d97c33e65f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 18:12:10 +0200
+Subject: net: enetc: report software timestamping via SO_TIMESTAMPING
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit feb13dcb1818b775fbd9191f797be67cd605f03e ]
+
+Let user space properly determine that the enetc driver provides
+software timestamps.
+
+Fixes: 4caefbce06d1 ("enetc: add software timestamping")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://lore.kernel.org/r/20220324161210.4122281-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+index 910b9f722504..d62c188c8748 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+@@ -672,7 +672,10 @@ static int enetc_get_ts_info(struct net_device *ndev,
+ #ifdef CONFIG_FSL_ENETC_PTP_CLOCK
+ 	info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE |
+ 				SOF_TIMESTAMPING_RX_HARDWARE |
+-				SOF_TIMESTAMPING_RAW_HARDWARE;
++				SOF_TIMESTAMPING_RAW_HARDWARE |
++				SOF_TIMESTAMPING_TX_SOFTWARE |
++				SOF_TIMESTAMPING_RX_SOFTWARE |
++				SOF_TIMESTAMPING_SOFTWARE;
+ 
+ 	info->tx_types = (1 << HWTSTAMP_TX_OFF) |
+ 			 (1 << HWTSTAMP_TX_ON) |
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-add-vlan-list-lock-to-protect-vlan-list.patch b/queue-5.16/net-hns3-add-vlan-list-lock-to-protect-vlan-list.patch
new file mode 100644
index 00000000000..d715c316cdf
--- /dev/null
+++ b/queue-5.16/net-hns3-add-vlan-list-lock-to-protect-vlan-list.patch
@@ -0,0 +1,182 @@
+From ecb85ad764c8d19951a29da4f1d9d6f6bc1ddc0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 20:54:49 +0800
+Subject: net: hns3: add vlan list lock to protect vlan list
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 1932a624ab88ff407d1a1d567fe581faa15dc725 ]
+
+When adding port base VLAN, vf VLAN need to remove from HW and modify
+the vlan state in vf VLAN list as false. If the periodicity task is
+freeing the same node, it may cause "use after free" error.
+This patch adds a vlan list lock to protect the vlan list.
+
+Fixes: c6075b193462 ("net: hns3: Record VF vlan tables")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c        | 38 +++++++++++++++++--
+ .../hisilicon/hns3/hns3pf/hclge_main.h        |  1 +
+ 2 files changed, 35 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 0338b4ffa003..3ba24c6d004d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -10237,19 +10237,28 @@ static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,
+ 				       bool writen_to_tbl)
+ {
+ 	struct hclge_vport_vlan_cfg *vlan, *tmp;
++	struct hclge_dev *hdev = vport->back;
+ 
+-	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node)
+-		if (vlan->vlan_id == vlan_id)
++	mutex_lock(&hdev->vport_lock);
++
++	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
++		if (vlan->vlan_id == vlan_id) {
++			mutex_unlock(&hdev->vport_lock);
+ 			return;
++		}
++	}
+ 
+ 	vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
+-	if (!vlan)
++	if (!vlan) {
++		mutex_unlock(&hdev->vport_lock);
+ 		return;
++	}
+ 
+ 	vlan->hd_tbl_status = writen_to_tbl;
+ 	vlan->vlan_id = vlan_id;
+ 
+ 	list_add_tail(&vlan->node, &vport->vlan_list);
++	mutex_unlock(&hdev->vport_lock);
+ }
+ 
+ static int hclge_add_vport_all_vlan_table(struct hclge_vport *vport)
+@@ -10258,6 +10267,8 @@ static int hclge_add_vport_all_vlan_table(struct hclge_vport *vport)
+ 	struct hclge_dev *hdev = vport->back;
+ 	int ret;
+ 
++	mutex_lock(&hdev->vport_lock);
++
+ 	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+ 		if (!vlan->hd_tbl_status) {
+ 			ret = hclge_set_vlan_filter_hw(hdev, htons(ETH_P_8021Q),
+@@ -10267,12 +10278,16 @@ static int hclge_add_vport_all_vlan_table(struct hclge_vport *vport)
+ 				dev_err(&hdev->pdev->dev,
+ 					"restore vport vlan list failed, ret=%d\n",
+ 					ret);
++
++				mutex_unlock(&hdev->vport_lock);
+ 				return ret;
+ 			}
+ 		}
+ 		vlan->hd_tbl_status = true;
+ 	}
+ 
++	mutex_unlock(&hdev->vport_lock);
++
+ 	return 0;
+ }
+ 
+@@ -10282,6 +10297,8 @@ static void hclge_rm_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,
+ 	struct hclge_vport_vlan_cfg *vlan, *tmp;
+ 	struct hclge_dev *hdev = vport->back;
+ 
++	mutex_lock(&hdev->vport_lock);
++
+ 	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+ 		if (vlan->vlan_id == vlan_id) {
+ 			if (is_write_tbl && vlan->hd_tbl_status)
+@@ -10296,6 +10313,8 @@ static void hclge_rm_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,
+ 			break;
+ 		}
+ 	}
++
++	mutex_unlock(&hdev->vport_lock);
+ }
+ 
+ void hclge_rm_vport_all_vlan_table(struct hclge_vport *vport, bool is_del_list)
+@@ -10303,6 +10322,8 @@ void hclge_rm_vport_all_vlan_table(struct hclge_vport *vport, bool is_del_list)
+ 	struct hclge_vport_vlan_cfg *vlan, *tmp;
+ 	struct hclge_dev *hdev = vport->back;
+ 
++	mutex_lock(&hdev->vport_lock);
++
+ 	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+ 		if (vlan->hd_tbl_status)
+ 			hclge_set_vlan_filter_hw(hdev,
+@@ -10318,6 +10339,7 @@ void hclge_rm_vport_all_vlan_table(struct hclge_vport *vport, bool is_del_list)
+ 		}
+ 	}
+ 	clear_bit(vport->vport_id, hdev->vf_vlan_full);
++	mutex_unlock(&hdev->vport_lock);
+ }
+ 
+ void hclge_uninit_vport_vlan_table(struct hclge_dev *hdev)
+@@ -10326,6 +10348,8 @@ void hclge_uninit_vport_vlan_table(struct hclge_dev *hdev)
+ 	struct hclge_vport *vport;
+ 	int i;
+ 
++	mutex_lock(&hdev->vport_lock);
++
+ 	for (i = 0; i < hdev->num_alloc_vport; i++) {
+ 		vport = &hdev->vport[i];
+ 		list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+@@ -10333,6 +10357,8 @@ void hclge_uninit_vport_vlan_table(struct hclge_dev *hdev)
+ 			kfree(vlan);
+ 		}
+ 	}
++
++	mutex_unlock(&hdev->vport_lock);
+ }
+ 
+ void hclge_restore_vport_port_base_vlan_config(struct hclge_dev *hdev)
+@@ -10372,6 +10398,8 @@ void hclge_restore_vport_vlan_table(struct hclge_vport *vport)
+ 	struct hclge_dev *hdev = vport->back;
+ 	int ret;
+ 
++	mutex_lock(&hdev->vport_lock);
++
+ 	if (vport->port_base_vlan_cfg.state == HNAE3_PORT_BASE_VLAN_DISABLE) {
+ 		list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+ 			ret = hclge_set_vlan_filter_hw(hdev, htons(ETH_P_8021Q),
+@@ -10382,6 +10410,8 @@ void hclge_restore_vport_vlan_table(struct hclge_vport *vport)
+ 			vlan->hd_tbl_status = true;
+ 		}
+ 	}
++
++	mutex_unlock(&hdev->vport_lock);
+ }
+ 
+ /* For global reset and imp reset, hardware will clear the mac table,
+@@ -12279,8 +12309,8 @@ static void hclge_uninit_ae_dev(struct hnae3_ae_dev *ae_dev)
+ 	hclge_misc_irq_uninit(hdev);
+ 	hclge_devlink_uninit(hdev);
+ 	hclge_pci_uninit(hdev);
+-	mutex_destroy(&hdev->vport_lock);
+ 	hclge_uninit_vport_vlan_table(hdev);
++	mutex_destroy(&hdev->vport_lock);
+ 	ae_dev->priv = NULL;
+ }
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 801268b61e96..c841cce2d025 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -1087,6 +1087,7 @@ struct hclge_vport {
+ 	spinlock_t mac_list_lock; /* protect mac address need to add/detele */
+ 	struct list_head uc_mac_list;   /* Store VF unicast table */
+ 	struct list_head mc_mac_list;   /* Store VF multicast table */
++
+ 	struct list_head vlan_list;     /* Store VF vlan table */
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-clean-residual-vf-config-after-disable-srio.patch b/queue-5.16/net-hns3-clean-residual-vf-config-after-disable-srio.patch
new file mode 100644
index 00000000000..93c95af1ba0
--- /dev/null
+++ b/queue-5.16/net-hns3-clean-residual-vf-config-after-disable-srio.patch
@@ -0,0 +1,153 @@
+From f8b803172e86ef980e65c9b0b9935159cc411c2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 17:51:02 +0800
+Subject: net: hns3: clean residual vf config after disable sriov
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit 671cb8cbb9c9e24b681d21b1bfae991e2386ac73 ]
+
+After disable sriov, VF still has some config and info need to be
+cleaned, which configured by PF. This patch clean the HW config
+and SW struct vport->vf_info.
+
+Fixes: fa8d82e853e8 ("net: hns3: Add support of .sriov_configure in HNS3 driver")
+Signed-off-by: Peng Li<lipeng321@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h   |  3 ++
+ .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 18 +++++++
+ .../hisilicon/hns3/hns3pf/hclge_main.c        | 50 +++++++++++++++++++
+ 3 files changed, 71 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 9298fbecb31a..adea528d79ad 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -536,6 +536,8 @@ struct hnae3_ae_dev {
+  *   Get 1588 rx hwstamp
+  * get_ts_info
+  *   Get phc info
++ * clean_vf_config
++ *   Clean residual vf info after disable sriov
+  */
+ struct hnae3_ae_ops {
+ 	int (*init_ae_dev)(struct hnae3_ae_dev *ae_dev);
+@@ -729,6 +731,7 @@ struct hnae3_ae_ops {
+ 			   struct ethtool_ts_info *info);
+ 	int (*get_link_diagnosis_info)(struct hnae3_handle *handle,
+ 				       u32 *status_code);
++	void (*clean_vf_config)(struct hnae3_ae_dev *ae_dev, int num_vfs);
+ };
+ 
+ struct hnae3_dcb_ops {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 8303863774ff..ef75223b0b55 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2954,6 +2954,21 @@ static int hns3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	return ret;
+ }
+ 
++/**
++ * hns3_clean_vf_config
++ * @pdev: pointer to a pci_dev structure
++ * @num_vfs: number of VFs allocated
++ *
++ * Clean residual vf config after disable sriov
++ **/
++static void hns3_clean_vf_config(struct pci_dev *pdev, int num_vfs)
++{
++	struct hnae3_ae_dev *ae_dev = pci_get_drvdata(pdev);
++
++	if (ae_dev->ops->clean_vf_config)
++		ae_dev->ops->clean_vf_config(ae_dev, num_vfs);
++}
++
+ /* hns3_remove - Device removal routine
+  * @pdev: PCI device information struct
+  */
+@@ -2992,7 +3007,10 @@ static int hns3_pci_sriov_configure(struct pci_dev *pdev, int num_vfs)
+ 		else
+ 			return num_vfs;
+ 	} else if (!pci_vfs_assigned(pdev)) {
++		int num_vfs_pre = pci_num_vf(pdev);
++
+ 		pci_disable_sriov(pdev);
++		hns3_clean_vf_config(pdev, num_vfs_pre);
+ 	} else {
+ 		dev_warn(&pdev->dev,
+ 			 "Unable to free VFs because some are assigned to VMs.\n");
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index cf3c798e5400..c8202d9b9e2c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -13146,6 +13146,55 @@ static int hclge_get_link_diagnosis_info(struct hnae3_handle *handle,
+ 	return 0;
+ }
+ 
++/* After disable sriov, VF still has some config and info need clean,
++ * which configed by PF.
++ */
++static void hclge_clear_vport_vf_info(struct hclge_vport *vport, int vfid)
++{
++	struct hclge_dev *hdev = vport->back;
++	struct hclge_vlan_info vlan_info;
++	int ret;
++
++	/* after disable sriov, clean VF rate configured by PF */
++	ret = hclge_tm_qs_shaper_cfg(vport, 0);
++	if (ret)
++		dev_err(&hdev->pdev->dev,
++			"failed to clean vf%d rate config, ret = %d\n",
++			vfid, ret);
++
++	vlan_info.vlan_tag = 0;
++	vlan_info.qos = 0;
++	vlan_info.vlan_proto = ETH_P_8021Q;
++	ret = hclge_update_port_base_vlan_cfg(vport,
++					      HNAE3_PORT_BASE_VLAN_DISABLE,
++					      &vlan_info);
++	if (ret)
++		dev_err(&hdev->pdev->dev,
++			"failed to clean vf%d port base vlan, ret = %d\n",
++			vfid, ret);
++
++	ret = hclge_set_vf_spoofchk_hw(hdev, vport->vport_id, false);
++	if (ret)
++		dev_err(&hdev->pdev->dev,
++			"failed to clean vf%d spoof config, ret = %d\n",
++			vfid, ret);
++
++	memset(&vport->vf_info, 0, sizeof(vport->vf_info));
++}
++
++static void hclge_clean_vport_config(struct hnae3_ae_dev *ae_dev, int num_vfs)
++{
++	struct hclge_dev *hdev = ae_dev->priv;
++	struct hclge_vport *vport;
++	int i;
++
++	for (i = 0; i < num_vfs; i++) {
++		vport = &hdev->vport[i + HCLGE_VF_VPORT_START_NUM];
++
++		hclge_clear_vport_vf_info(vport, i);
++	}
++}
++
+ static const struct hnae3_ae_ops hclge_ops = {
+ 	.init_ae_dev = hclge_init_ae_dev,
+ 	.uninit_ae_dev = hclge_uninit_ae_dev,
+@@ -13247,6 +13296,7 @@ static const struct hnae3_ae_ops hclge_ops = {
+ 	.get_rx_hwts = hclge_ptp_get_rx_hwts,
+ 	.get_ts_info = hclge_ptp_get_ts_info,
+ 	.get_link_diagnosis_info = hclge_get_link_diagnosis_info,
++	.clean_vf_config = hclge_clean_vport_config,
+ };
+ 
+ static struct hnae3_ae_algo ae_algo = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch b/queue-5.16/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch
new file mode 100644
index 00000000000..f3b71a5dd0b
--- /dev/null
+++ b/queue-5.16/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch
@@ -0,0 +1,51 @@
+From 3d3dc87f0e4fe03cf7f7d6b7961799dc9111f3a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 20:54:47 +0800
+Subject: net: hns3: fix bug when PF set the duplicate MAC address for VFs
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit ccb18f05535c96d26e2d559d402acb87700fc5a7 ]
+
+If the MAC address A is configured to vport A and then vport B. The MAC
+address of vport A in the hardware becomes invalid. If the address of
+vport A is changed to MAC address B, the driver needs to delete the MAC
+address A of vport A. Due to the MAC address A of vport A has become
+invalid in the hardware entry, so "-ENOENT" is returned. In this case, the
+"used_umv_size" value recorded in driver is not updated. As a result, the
+MAC entry status of the software is inconsistent with that of the hardware.
+
+Therefore, the driver updates the umv size even if the MAC entry cannot be
+found. Ensure that the software and hardware status is consistent.
+
+Fixes: ee4bcd3b7ae4 ("net: hns3: refactor the MAC address configure")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index c2a58101144e..0fc8810671dc 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -8888,12 +8888,11 @@ int hclge_rm_uc_addr_common(struct hclge_vport *vport,
+ 	hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
+ 	hclge_prepare_mac_addr(&req, addr, false);
+ 	ret = hclge_remove_mac_vlan_tbl(vport, &req);
+-	if (!ret) {
++	if (!ret || ret == -ENOENT) {
+ 		mutex_lock(&hdev->vport_lock);
+ 		hclge_update_umv_space(vport, true);
+ 		mutex_unlock(&hdev->vport_lock);
+-	} else if (ret == -ENOENT) {
+-		ret = 0;
++		return 0;
+ 	}
+ 
+ 	return ret;
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-fix-port-base-vlan-add-fail-when-concurrent.patch b/queue-5.16/net-hns3-fix-port-base-vlan-add-fail-when-concurrent.patch
new file mode 100644
index 00000000000..8699c82cb67
--- /dev/null
+++ b/queue-5.16/net-hns3-fix-port-base-vlan-add-fail-when-concurrent.patch
@@ -0,0 +1,169 @@
+From 793a89ef47b8e9ad860088cc77925a82b5919c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 20:54:48 +0800
+Subject: net: hns3: fix port base vlan add fail when concurrent with reset
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit c0f46de30c965d4ba208b5bf1a6d3437a7556ee2 ]
+
+Currently, Port base vlan is initiated by PF and configured to its VFs,
+by using command "ip link set <pf name> vf <vf id> vlan <vlan id>".
+When a global reset was triggered, the hardware vlan table and the soft
+recorded vlan information will be cleared by PF, and restored them until
+VFs were ready. There is a short time window between the table had been
+cleared and before table restored. If configured a new port base vlan tag
+at this moment, driver will check the soft recorded vlan information,
+and find there hasn't the old tag in it, which causing a warning print.
+
+Due to the port base vlan is managed by PF, so the VFs's port base vlan
+restoring should be handled by PF when PF was ready.
+
+This patch fixes it.
+
+Fixes: 039ba863e8d7 ("net: hns3: optimize the filter table entries handling when resetting")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c        | 62 +++++++++++++------
+ .../hisilicon/hns3/hns3pf/hclge_main.h        |  3 +
+ 2 files changed, 46 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 0fc8810671dc..0338b4ffa003 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1956,6 +1956,7 @@ static int hclge_alloc_vport(struct hclge_dev *hdev)
+ 		vport->vf_info.link_state = IFLA_VF_LINK_STATE_AUTO;
+ 		vport->mps = HCLGE_MAC_DEFAULT_FRAME;
+ 		vport->port_base_vlan_cfg.state = HNAE3_PORT_BASE_VLAN_DISABLE;
++		vport->port_base_vlan_cfg.tbl_sta = true;
+ 		vport->rxvlan_cfg.rx_vlan_offload_en = true;
+ 		vport->req_vlan_fltr_en = true;
+ 		INIT_LIST_HEAD(&vport->vlan_list);
+@@ -10334,34 +10335,52 @@ void hclge_uninit_vport_vlan_table(struct hclge_dev *hdev)
+ 	}
+ }
+ 
+-void hclge_restore_vport_vlan_table(struct hclge_vport *vport)
++void hclge_restore_vport_port_base_vlan_config(struct hclge_dev *hdev)
+ {
+-	struct hclge_vport_vlan_cfg *vlan, *tmp;
+-	struct hclge_dev *hdev = vport->back;
++	struct hclge_vlan_info *vlan_info;
++	struct hclge_vport *vport;
+ 	u16 vlan_proto;
+ 	u16 vlan_id;
+ 	u16 state;
++	int vf_id;
+ 	int ret;
+ 
+-	vlan_proto = vport->port_base_vlan_cfg.vlan_info.vlan_proto;
+-	vlan_id = vport->port_base_vlan_cfg.vlan_info.vlan_tag;
+-	state = vport->port_base_vlan_cfg.state;
++	/* PF should restore all vfs port base vlan */
++	for (vf_id = 0; vf_id < hdev->num_alloc_vfs; vf_id++) {
++		vport = &hdev->vport[vf_id + HCLGE_VF_VPORT_START_NUM];
++		vlan_info = vport->port_base_vlan_cfg.tbl_sta ?
++			    &vport->port_base_vlan_cfg.vlan_info :
++			    &vport->port_base_vlan_cfg.old_vlan_info;
+ 
+-	if (state != HNAE3_PORT_BASE_VLAN_DISABLE) {
+-		clear_bit(vport->vport_id, hdev->vlan_table[vlan_id]);
+-		hclge_set_vlan_filter_hw(hdev, htons(vlan_proto),
+-					 vport->vport_id, vlan_id,
+-					 false);
+-		return;
++		vlan_id = vlan_info->vlan_tag;
++		vlan_proto = vlan_info->vlan_proto;
++		state = vport->port_base_vlan_cfg.state;
++
++		if (state != HNAE3_PORT_BASE_VLAN_DISABLE) {
++			clear_bit(vport->vport_id, hdev->vlan_table[vlan_id]);
++			ret = hclge_set_vlan_filter_hw(hdev, htons(vlan_proto),
++						       vport->vport_id,
++						       vlan_id, false);
++			vport->port_base_vlan_cfg.tbl_sta = ret == 0;
++		}
+ 	}
++}
+ 
+-	list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
+-		ret = hclge_set_vlan_filter_hw(hdev, htons(ETH_P_8021Q),
+-					       vport->vport_id,
+-					       vlan->vlan_id, false);
+-		if (ret)
+-			break;
+-		vlan->hd_tbl_status = true;
++void hclge_restore_vport_vlan_table(struct hclge_vport *vport)
++{
++	struct hclge_vport_vlan_cfg *vlan, *tmp;
++	struct hclge_dev *hdev = vport->back;
++	int ret;
++
++	if (vport->port_base_vlan_cfg.state == HNAE3_PORT_BASE_VLAN_DISABLE) {
++		list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) {
++			ret = hclge_set_vlan_filter_hw(hdev, htons(ETH_P_8021Q),
++						       vport->vport_id,
++						       vlan->vlan_id, false);
++			if (ret)
++				break;
++			vlan->hd_tbl_status = true;
++		}
+ 	}
+ }
+ 
+@@ -10402,6 +10421,7 @@ static void hclge_restore_hw_table(struct hclge_dev *hdev)
+ 	struct hnae3_handle *handle = &vport->nic;
+ 
+ 	hclge_restore_mac_table_common(vport);
++	hclge_restore_vport_port_base_vlan_config(hdev);
+ 	hclge_restore_vport_vlan_table(vport);
+ 	set_bit(HCLGE_STATE_FD_USER_DEF_CHANGED, &hdev->state);
+ 	hclge_restore_fd_entries(handle);
+@@ -10458,6 +10478,8 @@ static int hclge_update_vlan_filter_entries(struct hclge_vport *vport,
+ 						 false);
+ 	}
+ 
++	vport->port_base_vlan_cfg.tbl_sta = false;
++
+ 	/* force add VLAN 0 */
+ 	ret = hclge_set_vf_vlan_common(hdev, vport->vport_id, false, 0);
+ 	if (ret)
+@@ -10544,7 +10566,9 @@ int hclge_update_port_base_vlan_cfg(struct hclge_vport *vport, u16 state,
+ 	else
+ 		nic->port_base_vlan_state = HNAE3_PORT_BASE_VLAN_ENABLE;
+ 
++	vport->port_base_vlan_cfg.old_vlan_info = *old_vlan_info;
+ 	vport->port_base_vlan_cfg.vlan_info = *vlan_info;
++	vport->port_base_vlan_cfg.tbl_sta = true;
+ 	hclge_set_vport_vlan_fltr_change(vport);
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index ebba603483a0..801268b61e96 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -1030,7 +1030,9 @@ struct hclge_vlan_info {
+ 
+ struct hclge_port_base_vlan_config {
+ 	u16 state;
++	bool tbl_sta;
+ 	struct hclge_vlan_info vlan_info;
++	struct hclge_vlan_info old_vlan_info;
+ };
+ 
+ struct hclge_vf_info {
+@@ -1154,6 +1156,7 @@ void hclge_rm_vport_all_mac_table(struct hclge_vport *vport, bool is_del_list,
+ void hclge_rm_vport_all_vlan_table(struct hclge_vport *vport, bool is_del_list);
+ void hclge_uninit_vport_vlan_table(struct hclge_dev *hdev);
+ void hclge_restore_mac_table_common(struct hclge_vport *vport);
++void hclge_restore_vport_port_base_vlan_config(struct hclge_dev *hdev);
+ void hclge_restore_vport_vlan_table(struct hclge_vport *vport);
+ int hclge_update_port_base_vlan_cfg(struct hclge_vport *vport, u16 state,
+ 				    struct hclge_vlan_info *vlan_info);
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-format-the-output-of-the-mac-address.patch b/queue-5.16/net-hns3-format-the-output-of-the-mac-address.patch
new file mode 100644
index 00000000000..9285935ac8c
--- /dev/null
+++ b/queue-5.16/net-hns3-format-the-output-of-the-mac-address.patch
@@ -0,0 +1,346 @@
+From 879d5c61ea32ffd31a3bcf08e77c986952558f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Nov 2021 09:06:52 +0800
+Subject: net: hns3: format the output of the MAC address
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 4f331fda35f1695af8ddd8180edc948880def74b ]
+
+Printing the whole MAC addresse may bring security risks. Therefore,
+the MAC address is partially encrypted to improve security.
+
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h   | 14 +++++
+ .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 29 +++++++---
+ .../hisilicon/hns3/hns3pf/hclge_main.c        | 55 ++++++++++++-------
+ .../hisilicon/hns3/hns3vf/hclgevf_main.c      |  7 ++-
+ 4 files changed, 74 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 63f5abcc6bf4..9298fbecb31a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -861,6 +861,20 @@ struct hnae3_handle {
+ #define hnae3_get_bit(origin, shift) \
+ 	hnae3_get_field(origin, 0x1 << (shift), shift)
+ 
++#define HNAE3_FORMAT_MAC_ADDR_LEN	18
++#define HNAE3_FORMAT_MAC_ADDR_OFFSET_0	0
++#define HNAE3_FORMAT_MAC_ADDR_OFFSET_4	4
++#define HNAE3_FORMAT_MAC_ADDR_OFFSET_5	5
++
++static inline void hnae3_format_mac_addr(char *format_mac_addr,
++					 const u8 *mac_addr)
++{
++	snprintf(format_mac_addr, HNAE3_FORMAT_MAC_ADDR_LEN, "%02x:**:**:**:%02x:%02x",
++		 mac_addr[HNAE3_FORMAT_MAC_ADDR_OFFSET_0],
++		 mac_addr[HNAE3_FORMAT_MAC_ADDR_OFFSET_4],
++		 mac_addr[HNAE3_FORMAT_MAC_ADDR_OFFSET_5]);
++}
++
+ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
+ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev);
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 9ccebbaa0d69..8303863774ff 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2255,6 +2255,8 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 
+ static int hns3_nic_net_set_mac_address(struct net_device *netdev, void *p)
+ {
++	char format_mac_addr_perm[HNAE3_FORMAT_MAC_ADDR_LEN];
++	char format_mac_addr_sa[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hnae3_handle *h = hns3_get_handle(netdev);
+ 	struct sockaddr *mac_addr = p;
+ 	int ret;
+@@ -2263,8 +2265,9 @@ static int hns3_nic_net_set_mac_address(struct net_device *netdev, void *p)
+ 		return -EADDRNOTAVAIL;
+ 
+ 	if (ether_addr_equal(netdev->dev_addr, mac_addr->sa_data)) {
+-		netdev_info(netdev, "already using mac address %pM\n",
+-			    mac_addr->sa_data);
++		hnae3_format_mac_addr(format_mac_addr_sa, mac_addr->sa_data);
++		netdev_info(netdev, "already using mac address %s\n",
++			    format_mac_addr_sa);
+ 		return 0;
+ 	}
+ 
+@@ -2273,8 +2276,10 @@ static int hns3_nic_net_set_mac_address(struct net_device *netdev, void *p)
+ 	 */
+ 	if (!hns3_is_phys_func(h->pdev) &&
+ 	    !is_zero_ether_addr(netdev->perm_addr)) {
+-		netdev_err(netdev, "has permanent MAC %pM, user MAC %pM not allow\n",
+-			   netdev->perm_addr, mac_addr->sa_data);
++		hnae3_format_mac_addr(format_mac_addr_perm, netdev->perm_addr);
++		hnae3_format_mac_addr(format_mac_addr_sa, mac_addr->sa_data);
++		netdev_err(netdev, "has permanent MAC %s, user MAC %s not allow\n",
++			   format_mac_addr_perm, format_mac_addr_sa);
+ 		return -EPERM;
+ 	}
+ 
+@@ -2836,14 +2841,16 @@ static int hns3_nic_set_vf_rate(struct net_device *ndev, int vf,
+ static int hns3_nic_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ {
+ 	struct hnae3_handle *h = hns3_get_handle(netdev);
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 
+ 	if (!h->ae_algo->ops->set_vf_mac)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (is_multicast_ether_addr(mac)) {
++		hnae3_format_mac_addr(format_mac_addr, mac);
+ 		netdev_err(netdev,
+-			   "Invalid MAC:%pM specified. Could not set MAC\n",
+-			   mac);
++			   "Invalid MAC:%s specified. Could not set MAC\n",
++			   format_mac_addr);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -4934,6 +4941,7 @@ static void hns3_uninit_all_ring(struct hns3_nic_priv *priv)
+ static int hns3_init_mac_addr(struct net_device *netdev)
+ {
+ 	struct hns3_nic_priv *priv = netdev_priv(netdev);
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hnae3_handle *h = priv->ae_handle;
+ 	u8 mac_addr_temp[ETH_ALEN];
+ 	int ret = 0;
+@@ -4944,8 +4952,9 @@ static int hns3_init_mac_addr(struct net_device *netdev)
+ 	/* Check if the MAC address is valid, if not get a random one */
+ 	if (!is_valid_ether_addr(mac_addr_temp)) {
+ 		eth_hw_addr_random(netdev);
+-		dev_warn(priv->dev, "using random MAC address %pM\n",
+-			 netdev->dev_addr);
++		hnae3_format_mac_addr(format_mac_addr, netdev->dev_addr);
++		dev_warn(priv->dev, "using random MAC address %s\n",
++			 format_mac_addr);
+ 	} else if (!ether_addr_equal(netdev->dev_addr, mac_addr_temp)) {
+ 		eth_hw_addr_set(netdev, mac_addr_temp);
+ 		ether_addr_copy(netdev->perm_addr, mac_addr_temp);
+@@ -4997,8 +5006,10 @@ static void hns3_client_stop(struct hnae3_handle *handle)
+ static void hns3_info_show(struct hns3_nic_priv *priv)
+ {
+ 	struct hnae3_knic_private_info *kinfo = &priv->ae_handle->kinfo;
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 
+-	dev_info(priv->dev, "MAC address: %pM\n", priv->netdev->dev_addr);
++	hnae3_format_mac_addr(format_mac_addr, priv->netdev->dev_addr);
++	dev_info(priv->dev, "MAC address: %s\n", format_mac_addr);
+ 	dev_info(priv->dev, "Task queue pairs numbers: %u\n", kinfo->num_tqps);
+ 	dev_info(priv->dev, "RSS size: %u\n", kinfo->rss_size);
+ 	dev_info(priv->dev, "Allocated RSS size: %u\n", kinfo->req_rss_size);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 3ba24c6d004d..9866e5c1a71b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -8744,6 +8744,7 @@ int hclge_update_mac_list(struct hclge_vport *vport,
+ 			  enum HCLGE_MAC_ADDR_TYPE mac_type,
+ 			  const unsigned char *addr)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_mac_node *mac_node;
+ 	struct list_head *list;
+@@ -8768,9 +8769,10 @@ int hclge_update_mac_list(struct hclge_vport *vport,
+ 	/* if this address is never added, unnecessary to delete */
+ 	if (state == HCLGE_MAC_TO_DEL) {
+ 		spin_unlock_bh(&vport->mac_list_lock);
++		hnae3_format_mac_addr(format_mac_addr, addr);
+ 		dev_err(&hdev->pdev->dev,
+-			"failed to delete address %pM from mac list\n",
+-			addr);
++			"failed to delete address %s from mac list\n",
++			format_mac_addr);
+ 		return -ENOENT;
+ 	}
+ 
+@@ -8803,6 +8805,7 @@ static int hclge_add_uc_addr(struct hnae3_handle *handle,
+ int hclge_add_uc_addr_common(struct hclge_vport *vport,
+ 			     const unsigned char *addr)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_mac_vlan_tbl_entry_cmd req;
+ 	struct hclge_desc desc;
+@@ -8813,9 +8816,10 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport,
+ 	if (is_zero_ether_addr(addr) ||
+ 	    is_broadcast_ether_addr(addr) ||
+ 	    is_multicast_ether_addr(addr)) {
++		hnae3_format_mac_addr(format_mac_addr, addr);
+ 		dev_err(&hdev->pdev->dev,
+-			"Set_uc mac err! invalid mac:%pM. is_zero:%d,is_br=%d,is_mul=%d\n",
+-			 addr, is_zero_ether_addr(addr),
++			"Set_uc mac err! invalid mac:%s. is_zero:%d,is_br=%d,is_mul=%d\n",
++			 format_mac_addr, is_zero_ether_addr(addr),
+ 			 is_broadcast_ether_addr(addr),
+ 			 is_multicast_ether_addr(addr));
+ 		return -EINVAL;
+@@ -8872,6 +8876,7 @@ static int hclge_rm_uc_addr(struct hnae3_handle *handle,
+ int hclge_rm_uc_addr_common(struct hclge_vport *vport,
+ 			    const unsigned char *addr)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_mac_vlan_tbl_entry_cmd req;
+ 	int ret;
+@@ -8880,8 +8885,9 @@ int hclge_rm_uc_addr_common(struct hclge_vport *vport,
+ 	if (is_zero_ether_addr(addr) ||
+ 	    is_broadcast_ether_addr(addr) ||
+ 	    is_multicast_ether_addr(addr)) {
+-		dev_dbg(&hdev->pdev->dev, "Remove mac err! invalid mac:%pM.\n",
+-			addr);
++		hnae3_format_mac_addr(format_mac_addr, addr);
++		dev_dbg(&hdev->pdev->dev, "Remove mac err! invalid mac:%s.\n",
++			format_mac_addr);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -8911,6 +8917,7 @@ static int hclge_add_mc_addr(struct hnae3_handle *handle,
+ int hclge_add_mc_addr_common(struct hclge_vport *vport,
+ 			     const unsigned char *addr)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_mac_vlan_tbl_entry_cmd req;
+ 	struct hclge_desc desc[3];
+@@ -8919,9 +8926,10 @@ int hclge_add_mc_addr_common(struct hclge_vport *vport,
+ 
+ 	/* mac addr check */
+ 	if (!is_multicast_ether_addr(addr)) {
++		hnae3_format_mac_addr(format_mac_addr, addr);
+ 		dev_err(&hdev->pdev->dev,
+-			"Add mc mac err! invalid mac:%pM.\n",
+-			 addr);
++			"Add mc mac err! invalid mac:%s.\n",
++			 format_mac_addr);
+ 		return -EINVAL;
+ 	}
+ 	memset(&req, 0, sizeof(req));
+@@ -8973,6 +8981,7 @@ static int hclge_rm_mc_addr(struct hnae3_handle *handle,
+ int hclge_rm_mc_addr_common(struct hclge_vport *vport,
+ 			    const unsigned char *addr)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_mac_vlan_tbl_entry_cmd req;
+ 	enum hclge_cmd_status status;
+@@ -8980,9 +8989,10 @@ int hclge_rm_mc_addr_common(struct hclge_vport *vport,
+ 
+ 	/* mac addr check */
+ 	if (!is_multicast_ether_addr(addr)) {
++		hnae3_format_mac_addr(format_mac_addr, addr);
+ 		dev_dbg(&hdev->pdev->dev,
+-			"Remove mc mac err! invalid mac:%pM.\n",
+-			 addr);
++			"Remove mc mac err! invalid mac:%s.\n",
++			 format_mac_addr);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -9422,16 +9432,18 @@ static int hclge_set_vf_mac(struct hnae3_handle *handle, int vf,
+ 			    u8 *mac_addr)
+ {
+ 	struct hclge_vport *vport = hclge_get_vport(handle);
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 
+ 	vport = hclge_get_vf_vport(hdev, vf);
+ 	if (!vport)
+ 		return -EINVAL;
+ 
++	hnae3_format_mac_addr(format_mac_addr, mac_addr);
+ 	if (ether_addr_equal(mac_addr, vport->vf_info.mac)) {
+ 		dev_info(&hdev->pdev->dev,
+-			 "Specified MAC(=%pM) is same as before, no change committed!\n",
+-			 mac_addr);
++			 "Specified MAC(=%s) is same as before, no change committed!\n",
++			 format_mac_addr);
+ 		return 0;
+ 	}
+ 
+@@ -9439,13 +9451,13 @@ static int hclge_set_vf_mac(struct hnae3_handle *handle, int vf,
+ 
+ 	if (test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) {
+ 		dev_info(&hdev->pdev->dev,
+-			 "MAC of VF %d has been set to %pM, and it will be reinitialized!\n",
+-			 vf, mac_addr);
++			 "MAC of VF %d has been set to %s, and it will be reinitialized!\n",
++			 vf, format_mac_addr);
+ 		return hclge_inform_reset_assert_to_vf(vport);
+ 	}
+ 
+-	dev_info(&hdev->pdev->dev, "MAC of VF %d has been set to %pM\n",
+-		 vf, mac_addr);
++	dev_info(&hdev->pdev->dev, "MAC of VF %d has been set to %s\n",
++		 vf, format_mac_addr);
+ 	return 0;
+ }
+ 
+@@ -9549,6 +9561,7 @@ static int hclge_set_mac_addr(struct hnae3_handle *handle, const void *p,
+ {
+ 	const unsigned char *new_addr = (const unsigned char *)p;
+ 	struct hclge_vport *vport = hclge_get_vport(handle);
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclge_dev *hdev = vport->back;
+ 	unsigned char *old_addr = NULL;
+ 	int ret;
+@@ -9557,9 +9570,10 @@ static int hclge_set_mac_addr(struct hnae3_handle *handle, const void *p,
+ 	if (is_zero_ether_addr(new_addr) ||
+ 	    is_broadcast_ether_addr(new_addr) ||
+ 	    is_multicast_ether_addr(new_addr)) {
++		hnae3_format_mac_addr(format_mac_addr, new_addr);
+ 		dev_err(&hdev->pdev->dev,
+-			"change uc mac err! invalid mac: %pM.\n",
+-			 new_addr);
++			"change uc mac err! invalid mac: %s.\n",
++			 format_mac_addr);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -9577,9 +9591,10 @@ static int hclge_set_mac_addr(struct hnae3_handle *handle, const void *p,
+ 	spin_lock_bh(&vport->mac_list_lock);
+ 	ret = hclge_update_mac_node_for_dev_addr(vport, old_addr, new_addr);
+ 	if (ret) {
++		hnae3_format_mac_addr(format_mac_addr, new_addr);
+ 		dev_err(&hdev->pdev->dev,
+-			"failed to change the mac addr:%pM, ret = %d\n",
+-			new_addr, ret);
++			"failed to change the mac addr:%s, ret = %d\n",
++			format_mac_addr, ret);
+ 		spin_unlock_bh(&vport->mac_list_lock);
+ 
+ 		if (!is_first)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 70491e07b0ff..4d3d14b637c0 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1514,15 +1514,18 @@ static void hclgevf_config_mac_list(struct hclgevf_dev *hdev,
+ 				    struct list_head *list,
+ 				    enum HCLGEVF_MAC_ADDR_TYPE mac_type)
+ {
++	char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN];
+ 	struct hclgevf_mac_addr_node *mac_node, *tmp;
+ 	int ret;
+ 
+ 	list_for_each_entry_safe(mac_node, tmp, list, node) {
+ 		ret = hclgevf_add_del_mac_addr(hdev, mac_node, mac_type);
+ 		if  (ret) {
++			hnae3_format_mac_addr(format_mac_addr,
++					      mac_node->mac_addr);
+ 			dev_err(&hdev->pdev->dev,
+-				"failed to configure mac %pM, state = %d, ret = %d\n",
+-				mac_node->mac_addr, mac_node->state, ret);
++				"failed to configure mac %s, state = %d, ret = %d\n",
++				format_mac_addr, mac_node->state, ret);
+ 			return;
+ 		}
+ 		if (mac_node->state == HCLGEVF_MAC_TO_ADD) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-hns3-refine-the-process-when-pf-set-vf-vlan.patch b/queue-5.16/net-hns3-refine-the-process-when-pf-set-vf-vlan.patch
new file mode 100644
index 00000000000..870d44b8360
--- /dev/null
+++ b/queue-5.16/net-hns3-refine-the-process-when-pf-set-vf-vlan.patch
@@ -0,0 +1,92 @@
+From 3975f8d667f7705bc066b8f4d6b9b5d9266e6d6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 20:54:50 +0800
+Subject: net: hns3: refine the process when PF set VF VLAN
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 190cd8a72b0181c543ecada6243be3a50636941b ]
+
+Currently, when PF set VF VLAN, it sends notify mailbox to VF
+if VF alive. VF stop its traffic, and send request mailbox
+to PF, then PF updates VF VLAN. It's a bit complex. If VF is
+killed before sending request, PF will not set VF VLAN without
+any log.
+
+This patch refines the process, PF can set VF VLAN direclty,
+and then notify the VF. If VF is resetting at that time, the
+notify may be dropped, so VF should query it after reset finished.
+
+Fixes: 92f11ea177cd ("net: hns3: fix set port based VLAN issue for VF")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c         | 18 +++++++++++++-----
+ .../hisilicon/hns3/hns3vf/hclgevf_main.c       |  5 +++++
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 9866e5c1a71b..cf3c798e5400 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -9449,11 +9449,16 @@ static int hclge_set_vf_mac(struct hnae3_handle *handle, int vf,
+ 
+ 	ether_addr_copy(vport->vf_info.mac, mac_addr);
+ 
++	/* there is a timewindow for PF to know VF unalive, it may
++	 * cause send mailbox fail, but it doesn't matter, VF will
++	 * query it when reinit.
++	 */
+ 	if (test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) {
+ 		dev_info(&hdev->pdev->dev,
+ 			 "MAC of VF %d has been set to %s, and it will be reinitialized!\n",
+ 			 vf, format_mac_addr);
+-		return hclge_inform_reset_assert_to_vf(vport);
++		(void)hclge_inform_reset_assert_to_vf(vport);
++		return 0;
+ 	}
+ 
+ 	dev_info(&hdev->pdev->dev, "MAC of VF %d has been set to %s\n",
+@@ -10681,14 +10686,17 @@ static int hclge_set_vf_vlan_filter(struct hnae3_handle *handle, int vfid,
+ 		return ret;
+ 	}
+ 
+-	/* for DEVICE_VERSION_V3, vf doesn't need to know about the port based
++	/* there is a timewindow for PF to know VF unalive, it may
++	 * cause send mailbox fail, but it doesn't matter, VF will
++	 * query it when reinit.
++	 * for DEVICE_VERSION_V3, vf doesn't need to know about the port based
+ 	 * VLAN state.
+ 	 */
+ 	if (ae_dev->dev_version < HNAE3_DEVICE_VERSION_V3 &&
+ 	    test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state))
+-		hclge_push_vf_port_base_vlan_info(&hdev->vport[0],
+-						  vport->vport_id, state,
+-						  &vlan_info);
++		(void)hclge_push_vf_port_base_vlan_info(&hdev->vport[0],
++							vport->vport_id,
++							state, &vlan_info);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 4d3d14b637c0..7e30bad08356 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -3344,6 +3344,11 @@ static int hclgevf_reset_hdev(struct hclgevf_dev *hdev)
+ 		return ret;
+ 	}
+ 
++	/* get current port based vlan state from PF */
++	ret = hclgevf_get_port_base_vlan_filter_state(hdev);
++	if (ret)
++		return ret;
++
+ 	set_bit(HCLGEVF_STATE_PROMISC_CHANGED, &hdev->state);
+ 
+ 	hclgevf_init_rxd_adv_layout(hdev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-phy-at803x-move-page-selection-fix-to-config_ini.patch b/queue-5.16/net-phy-at803x-move-page-selection-fix-to-config_ini.patch
new file mode 100644
index 00000000000..0a623782798
--- /dev/null
+++ b/queue-5.16/net-phy-at803x-move-page-selection-fix-to-config_ini.patch
@@ -0,0 +1,91 @@
+From 7a3224f1c1c0f50f8d5085c2da9b2cd1a7987936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 10:54:08 -0600
+Subject: net: phy: at803x: move page selection fix to config_init
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 4f3a00c7f5b2cfe4e127fd3fe49b55e1b318c01f ]
+
+The fix to select the copper page on AR8031 was being done in the probe
+function rather than config_init, so it would not be redone after resume
+from suspend. Move this to config_init so it is always redone when
+needed.
+
+Fixes: c329e5afb42f ("net: phy: at803x: select correct page on config init")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/at803x.c | 40 ++++++++++++++++------------------------
+ 1 file changed, 16 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
+index 32eeed672861..7e0f817d817f 100644
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -784,25 +784,7 @@ static int at803x_probe(struct phy_device *phydev)
+ 			return ret;
+ 	}
+ 
+-	/* Some bootloaders leave the fiber page selected.
+-	 * Switch to the copper page, as otherwise we read
+-	 * the PHY capabilities from the fiber side.
+-	 */
+-	if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+-		phy_lock_mdio_bus(phydev);
+-		ret = at803x_write_page(phydev, AT803X_PAGE_COPPER);
+-		phy_unlock_mdio_bus(phydev);
+-		if (ret)
+-			goto err;
+-	}
+-
+ 	return 0;
+-
+-err:
+-	if (priv->vddio)
+-		regulator_disable(priv->vddio);
+-
+-	return ret;
+ }
+ 
+ static void at803x_remove(struct phy_device *phydev)
+@@ -912,6 +894,22 @@ static int at803x_config_init(struct phy_device *phydev)
+ {
+ 	int ret;
+ 
++	if (phydev->drv->phy_id == ATH8031_PHY_ID) {
++		/* Some bootloaders leave the fiber page selected.
++		 * Switch to the copper page, as otherwise we read
++		 * the PHY capabilities from the fiber side.
++		 */
++		phy_lock_mdio_bus(phydev);
++		ret = at803x_write_page(phydev, AT803X_PAGE_COPPER);
++		phy_unlock_mdio_bus(phydev);
++		if (ret)
++			return ret;
++
++		ret = at8031_pll_config(phydev);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	/* The RX and TX delay default is:
+ 	 *   after HW reset: RX delay enabled and TX delay disabled
+ 	 *   after SW reset: RX delay enabled, while TX delay retains the
+@@ -941,12 +939,6 @@ static int at803x_config_init(struct phy_device *phydev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+-		ret = at8031_pll_config(phydev);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+ 	/* Ar803x extended next page bit is enabled by default. Cisco
+ 	 * multigig switches read this bit and attempt to negotiate 10Gbps
+ 	 * rates even if the next page bit is disabled. This is incorrect
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-phy-broadcom-fix-brcm_fet_config_init.patch b/queue-5.16/net-phy-broadcom-fix-brcm_fet_config_init.patch
new file mode 100644
index 00000000000..4ba3a1b015c
--- /dev/null
+++ b/queue-5.16/net-phy-broadcom-fix-brcm_fet_config_init.patch
@@ -0,0 +1,79 @@
+From 8b412c309afb6b97b65fa22db8c990bcd3e18a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 16:24:38 -0700
+Subject: net: phy: broadcom: Fix brcm_fet_config_init()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit bf8bfc4336f7a34e48b3bbd19b1542bf085bdc3d ]
+
+A Broadcom AC201 PHY (same entry as 5241) would be flagged by the
+Broadcom UniMAC MDIO controller as not completing the turn around
+properly since the PHY expects 65 MDC clock cycles to complete a write
+cycle, and the MDIO controller was only sending 64 MDC clock cycles as
+determined by looking at a scope shot.
+
+This would make the subsequent read fail with the UniMAC MDIO controller
+command field having MDIO_READ_FAIL set and we would abort the
+brcm_fet_config_init() function and thus not probe the PHY at all.
+
+After issuing a software reset, wait for at least 1ms which is well
+above the 1us reset delay advertised by the datasheet and issue a dummy
+read to let the PHY turn around the line properly. This read
+specifically ignores -EIO which would be returned by MDIO controllers
+checking for the line being turned around.
+
+If we have a genuine reaad failure, the next read of the interrupt
+status register would pick it up anyway.
+
+Fixes: d7a2ed9248a3 ("broadcom: Add AC131 phy support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220324232438.1156812-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 3c683e0e40e9..e36809aa6d30 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include "bcm-phy-lib.h"
++#include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ #include <linux/brcmphy.h>
+@@ -602,6 +603,26 @@ static int brcm_fet_config_init(struct phy_device *phydev)
+ 	if (err < 0)
+ 		return err;
+ 
++	/* The datasheet indicates the PHY needs up to 1us to complete a reset,
++	 * build some slack here.
++	 */
++	usleep_range(1000, 2000);
++
++	/* The PHY requires 65 MDC clock cycles to complete a write operation
++	 * and turnaround the line properly.
++	 *
++	 * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac)
++	 * may flag the lack of turn-around as a read failure. This is
++	 * particularly true with this combination since the MDIO controller
++	 * only used 64 MDC cycles. This is not a critical failure in this
++	 * specific case and it has no functional impact otherwise, so we let
++	 * that one go through. If there is a genuine bus error, the next read
++	 * of MII_BRCM_FET_INTREG will error out.
++	 */
++	err = phy_read(phydev, MII_BMCR);
++	if (err < 0 && err != -EIO)
++		return err;
++
+ 	reg = phy_read(phydev, MII_BRCM_FET_INTREG);
+ 	if (reg < 0)
+ 		return reg;
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-phy-micrel-fix-concurrent-register-access.patch b/queue-5.16/net-phy-micrel-fix-concurrent-register-access.patch
new file mode 100644
index 00000000000..17cec177708
--- /dev/null
+++ b/queue-5.16/net-phy-micrel-fix-concurrent-register-access.patch
@@ -0,0 +1,76 @@
+From f3da2ced686235dcc6e9cdbc036602c8edd3ea98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 15:04:16 +0530
+Subject: net: phy: micrel: Fix concurrent register access
+
+From: Divya Koppera <Divya.Koppera@microchip.com>
+
+[ Upstream commit 4488f6b6148045424459ef1d5b153c6895ee1dbb ]
+
+Make Extended page register accessing atomic,
+to overcome unexpected output from register
+reads/writes.
+
+Fixes: 7c2dcfa295b1 ("net: phy: micrel: Add support for LAN8804 PHY")
+Signed-off-by: Divya Koppera<Divya.Koppera@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 76ef4e019ca9..15fe0fa78092 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -1575,11 +1575,13 @@ static int lanphy_read_page_reg(struct phy_device *phydev, int page, u32 addr)
+ {
+ 	u32 data;
+ 
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL, page);
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, addr);
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL,
+-		  (page | LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC));
+-	data = phy_read(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA);
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL, page);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, addr);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL,
++		    (page | LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC));
++	data = __phy_read(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA);
++	phy_unlock_mdio_bus(phydev);
+ 
+ 	return data;
+ }
+@@ -1587,18 +1589,18 @@ static int lanphy_read_page_reg(struct phy_device *phydev, int page, u32 addr)
+ static int lanphy_write_page_reg(struct phy_device *phydev, int page, u16 addr,
+ 				 u16 val)
+ {
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL, page);
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, addr);
+-	phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL,
+-		  (page | LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC));
+-
+-	val = phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, val);
+-	if (val) {
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL, page);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, addr);
++	__phy_write(phydev, LAN_EXT_PAGE_ACCESS_CONTROL,
++		    page | LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC);
++
++	val = __phy_write(phydev, LAN_EXT_PAGE_ACCESS_ADDRESS_DATA, val);
++	if (val != 0)
+ 		phydev_err(phydev, "Error: phy_write has returned error %d\n",
+ 			   val);
+-		return val;
+-	}
+-	return 0;
++	phy_unlock_mdio_bus(phydev);
++	return val;
+ }
+ 
+ static int lan8804_config_init(struct phy_device *phydev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-prefer-nf_ct_put-instead-of-nf_conntrack_put.patch b/queue-5.16/net-prefer-nf_ct_put-instead-of-nf_conntrack_put.patch
new file mode 100644
index 00000000000..72224c226ba
--- /dev/null
+++ b/queue-5.16/net-prefer-nf_ct_put-instead-of-nf_conntrack_put.patch
@@ -0,0 +1,126 @@
+From 6f7cd99e6d4afdead25576bf62aada6e0750fe01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 05:03:26 +0100
+Subject: net: prefer nf_ct_put instead of nf_conntrack_put
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 408bdcfce8dfd6902f75fbcd3b99d8b24b506597 ]
+
+Its the same as nf_conntrack_put(), but without the
+need for an indirect call.  The downside is a module dependency on
+nf_conntrack, but all of these already depend on conntrack anyway.
+
+Cc: Paul Blakey <paulb@mellanox.com>
+Cc: dev@openvswitch.org
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_core.c |  4 ++--
+ net/openvswitch/conntrack.c       | 14 ++++++++++----
+ net/sched/act_ct.c                |  6 +++---
+ 3 files changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 7f7997460764..917e708a4561 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -989,7 +989,7 @@ static int __nf_ct_resolve_clash(struct sk_buff *skb,
+ 
+ 		nf_ct_acct_merge(ct, ctinfo, loser_ct);
+ 		nf_ct_add_to_dying_list(loser_ct);
+-		nf_conntrack_put(&loser_ct->ct_general);
++		nf_ct_put(loser_ct);
+ 		nf_ct_set(skb, ct, ctinfo);
+ 
+ 		NF_CT_STAT_INC(net, clash_resolve);
+@@ -1920,7 +1920,7 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state)
+ 		/* Invalid: inverse of the return code tells
+ 		 * the netfilter core what to do */
+ 		pr_debug("nf_conntrack_in: Can't track with proto module\n");
+-		nf_conntrack_put(&ct->ct_general);
++		nf_ct_put(ct);
+ 		skb->_nfct = 0;
+ 		/* Special case: TCP tracker reports an attempt to reopen a
+ 		 * closed/aborted connection. We have to go back and create a
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 8f47f4e78d32..f2b64cab9af7 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -574,7 +574,7 @@ ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone,
+ 			struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+ 
+ 			nf_ct_delete(ct, 0, 0);
+-			nf_conntrack_put(&ct->ct_general);
++			nf_ct_put(ct);
+ 		}
+ 	}
+ 
+@@ -723,7 +723,7 @@ static bool skb_nfct_cached(struct net *net,
+ 		if (nf_ct_is_confirmed(ct))
+ 			nf_ct_delete(ct, 0, 0);
+ 
+-		nf_conntrack_put(&ct->ct_general);
++		nf_ct_put(ct);
+ 		nf_ct_set(skb, NULL, 0);
+ 		return false;
+ 	}
+@@ -967,7 +967,8 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
+ 
+ 		/* Associate skb with specified zone. */
+ 		if (tmpl) {
+-			nf_conntrack_put(skb_nfct(skb));
++			ct = nf_ct_get(skb, &ctinfo);
++			nf_ct_put(ct);
+ 			nf_conntrack_get(&tmpl->ct_general);
+ 			nf_ct_set(skb, tmpl, IP_CT_NEW);
+ 		}
+@@ -1328,7 +1329,12 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
+ 
+ int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
+ {
+-	nf_conntrack_put(skb_nfct(skb));
++	enum ip_conntrack_info ctinfo;
++	struct nf_conn *ct;
++
++	ct = nf_ct_get(skb, &ctinfo);
++
++	nf_ct_put(ct);
+ 	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+ 	ovs_ct_fill_key(skb, key, false);
+ 
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index 4ffea1290ce1..240b3c5d2eb1 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -592,7 +592,7 @@ static bool tcf_ct_skb_nfct_cached(struct net *net, struct sk_buff *skb,
+ 		if (nf_ct_is_confirmed(ct))
+ 			nf_ct_kill(ct);
+ 
+-		nf_conntrack_put(&ct->ct_general);
++		nf_ct_put(ct);
+ 		nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+ 
+ 		return false;
+@@ -757,7 +757,7 @@ static void tcf_ct_params_free(struct rcu_head *head)
+ 	tcf_ct_flow_table_put(params);
+ 
+ 	if (params->tmpl)
+-		nf_conntrack_put(&params->tmpl->ct_general);
++		nf_ct_put(params->tmpl);
+ 	kfree(params);
+ }
+ 
+@@ -967,7 +967,7 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ 		tc_skb_cb(skb)->post_ct = false;
+ 		ct = nf_ct_get(skb, &ctinfo);
+ 		if (ct) {
+-			nf_conntrack_put(&ct->ct_general);
++			nf_ct_put(ct);
+ 			nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+ 		}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-sched-act_ct-fix-ref-leak-when-switching-zones.patch b/queue-5.16/net-sched-act_ct-fix-ref-leak-when-switching-zones.patch
new file mode 100644
index 00000000000..33c5e37ff57
--- /dev/null
+++ b/queue-5.16/net-sched-act_ct-fix-ref-leak-when-switching-zones.patch
@@ -0,0 +1,65 @@
+From 93277d7a5fc2598eea82b6a10ee54c884d573111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 16:22:10 -0300
+Subject: net/sched: act_ct: fix ref leak when switching zones
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+[ Upstream commit bcb74e132a76ce0502bb33d5b65533a4ed72d159 ]
+
+When switching zones or network namespaces without doing a ct clear in
+between, it is now leaking a reference to the old ct entry. That's
+because tcf_ct_skb_nfct_cached() returns false and
+tcf_ct_flow_table_lookup() may simply overwrite it.
+
+The fix is to, as the ct entry is not reusable, free it already at
+tcf_ct_skb_nfct_cached().
+
+Reported-by: Florian Westphal <fw@strlen.de>
+Fixes: 2f131de361f6 ("net/sched: act_ct: Fix flow table lookup after ct clear or switching zones")
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ct.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index 240b3c5d2eb1..553bf41671a6 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -583,22 +583,25 @@ static bool tcf_ct_skb_nfct_cached(struct net *net, struct sk_buff *skb,
+ 	if (!ct)
+ 		return false;
+ 	if (!net_eq(net, read_pnet(&ct->ct_net)))
+-		return false;
++		goto drop_ct;
+ 	if (nf_ct_zone(ct)->id != zone_id)
+-		return false;
++		goto drop_ct;
+ 
+ 	/* Force conntrack entry direction. */
+ 	if (force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
+ 		if (nf_ct_is_confirmed(ct))
+ 			nf_ct_kill(ct);
+ 
+-		nf_ct_put(ct);
+-		nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+-
+-		return false;
++		goto drop_ct;
+ 	}
+ 
+ 	return true;
++
++drop_ct:
++	nf_ct_put(ct);
++	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
++
++	return false;
+ }
+ 
+ /* Trim the skb to the length specified by the IP/IPv6 header,
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-sparx5-depends-on-ptp_1588_clock_optional.patch b/queue-5.16/net-sparx5-depends-on-ptp_1588_clock_optional.patch
new file mode 100644
index 00000000000..7d94b13d633
--- /dev/null
+++ b/queue-5.16/net-sparx5-depends-on-ptp_1588_clock_optional.patch
@@ -0,0 +1,56 @@
+From 40b07809196b8ce5c44a3439af492a2cc3634db8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 11:02:34 -0700
+Subject: net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 08be6b13db23f68146c600dd5adfd92e99d9ec6e ]
+
+Fix build errors when PTP_1588_CLOCK=m and SPARX5_SWTICH=y.
+
+arc-linux-ld: drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.o: in function `sparx5_get_ts_info':
+sparx5_ethtool.c:(.text+0x146): undefined reference to `ptp_clock_index'
+arc-linux-ld: sparx5_ethtool.c:(.text+0x146): undefined reference to `ptp_clock_index'
+arc-linux-ld: drivers/net/ethernet/microchip/sparx5/sparx5_ptp.o: in function `sparx5_ptp_init':
+sparx5_ptp.c:(.text+0xd56): undefined reference to `ptp_clock_register'
+arc-linux-ld: sparx5_ptp.c:(.text+0xd56): undefined reference to `ptp_clock_register'
+arc-linux-ld: drivers/net/ethernet/microchip/sparx5/sparx5_ptp.o: in function `sparx5_ptp_deinit':
+sparx5_ptp.c:(.text+0xf30): undefined reference to `ptp_clock_unregister'
+arc-linux-ld: sparx5_ptp.c:(.text+0xf30): undefined reference to `ptp_clock_unregister'
+arc-linux-ld: sparx5_ptp.c:(.text+0xf38): undefined reference to `ptp_clock_unregister'
+arc-linux-ld: sparx5_ptp.c:(.text+0xf46): undefined reference to `ptp_clock_unregister'
+arc-linux-ld: drivers/net/ethernet/microchip/sparx5/sparx5_ptp.o:sparx5_ptp.c:(.text+0xf46): more undefined references to `ptp_clock_unregister' follow
+
+Fixes: 3cfa11bac9bb ("net: sparx5: add the basic sparx5 driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Horatiu Vultur <horatiu.vultur@microchip.com>
+Cc: UNGLinuxDriver@microchip.com
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Steen Hegelund <steen.hegelund@microchip.com>
+Cc: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+Cc: Lars Povlsen <lars.povlsen@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index 7bdbb2d09a14..85b24edb65d5 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -4,6 +4,7 @@ config SPARX5_SWITCH
+ 	depends on HAS_IOMEM
+ 	depends on OF
+ 	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on PTP_1588_CLOCK_OPTIONAL
+ 	select PHYLINK
+ 	select PHY_SPARX5_SERDES
+ 	select RESET_CONTROLLER
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-sparx5-switchdev-fix-possible-null-pointer-deref.patch b/queue-5.16/net-sparx5-switchdev-fix-possible-null-pointer-deref.patch
new file mode 100644
index 00000000000..4bafb7194f9
--- /dev/null
+++ b/queue-5.16/net-sparx5-switchdev-fix-possible-null-pointer-deref.patch
@@ -0,0 +1,38 @@
+From 29eb073ad192d60b7b96ed5788c473d24491bd39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 08:12:39 +0000
+Subject: net: sparx5: switchdev: fix possible NULL pointer dereference
+
+From: Zheng Yongjun <zhengyongjun3@huawei.com>
+
+[ Upstream commit 0906f3a3df07835e37077d8971aac65347f2ed57 ]
+
+As the possible failure of the allocation, devm_kzalloc() may return NULL
+pointer.
+Therefore, it should be better to check the 'db' in order to prevent
+the dereference of NULL pointer.
+
+Fixes: 10615907e9b51 ("net: sparx5: switchdev: adding frame DMA functionality")
+Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c b/drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c
+index 7436f62fa152..174ad95e746a 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c
+@@ -420,6 +420,8 @@ static int sparx5_fdma_tx_alloc(struct sparx5 *sparx5)
+ 			db_hw->dataptr = phys;
+ 			db_hw->status = 0;
+ 			db = devm_kzalloc(sparx5->dev, sizeof(*db), GFP_KERNEL);
++			if (!db)
++				return -ENOMEM;
+ 			db->cpu_addr = cpu_addr;
+ 			list_add_tail(&db->list, &tx->db_list);
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch b/queue-5.16/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
new file mode 100644
index 00000000000..c1f74e8b257
--- /dev/null
+++ b/queue-5.16/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
@@ -0,0 +1,65 @@
+From 3625375a7c224bab45eb2041f261d450ed45b2cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 18:43:46 +0800
+Subject: net/x25: Fix null-ptr-deref caused by x25_disconnect
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ]
+
+When the link layer is terminating, x25->neighbour will be set to NULL
+in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in
+x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is
+shown below.
+
+    (Thread 1)                 |  (Thread 2)
+x25_link_terminated()          | x25_recvmsg()
+ x25_kill_by_neigh()           |  ...
+  x25_disconnect()             |  lock_sock(sk)
+   ...                         |  ...
+   x25->neighbour = NULL //(1) |
+   ...                         |  x25->neighbour->extended //(2)
+
+The code sets NULL to x25->neighbour in position (1) and dereferences
+x25->neighbour in position (2), which could cause null-ptr-deref bug.
+
+This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize
+with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the
+sock held by lock_sock() is not NULL, because it is extracted from x25_list
+and uses x25_list_lock to synchronize.
+
+Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 3583354a7d7f..3a171828638b 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1765,10 +1765,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
+ 
+ 	write_lock_bh(&x25_list_lock);
+ 
+-	sk_for_each(s, &x25_list)
+-		if (x25_sk(s)->neighbour == nb)
++	sk_for_each(s, &x25_list) {
++		if (x25_sk(s)->neighbour == nb) {
++			write_unlock_bh(&x25_list_lock);
++			lock_sock(s);
+ 			x25_disconnect(s, ENETUNREACH, 0, 0);
+-
++			release_sock(s);
++			write_lock_bh(&x25_list_lock);
++		}
++	}
+ 	write_unlock_bh(&x25_list_lock);
+ 
+ 	/* Remove any related forwards */
+-- 
+2.34.1
+
diff --git a/queue-5.16/netfilter-conntrack-add-and-use-nf_ct_set_auto_assig.patch b/queue-5.16/netfilter-conntrack-add-and-use-nf_ct_set_auto_assig.patch
new file mode 100644
index 00000000000..3debe16f9b0
--- /dev/null
+++ b/queue-5.16/netfilter-conntrack-add-and-use-nf_ct_set_auto_assig.patch
@@ -0,0 +1,67 @@
+From 90c8ee3293fdf1f5007437b63b6c72b6f141b04b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 22:02:55 +0100
+Subject: netfilter: conntrack: Add and use
+ nf_ct_set_auto_assign_helper_warned()
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 31d0bb9763efad30377505f3467f958d1ebe1e3d ]
+
+The function sets the pernet boolean to avoid the spurious warning from
+nf_ct_lookup_helper() when assigning conntrack helpers via nftables.
+
+Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_conntrack_helper.h | 1 +
+ net/netfilter/nf_conntrack_helper.c         | 6 ++++++
+ net/netfilter/nft_ct.c                      | 3 +++
+ 3 files changed, 10 insertions(+)
+
+diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
+index 37f0fbefb060..9939c366f720 100644
+--- a/include/net/netfilter/nf_conntrack_helper.h
++++ b/include/net/netfilter/nf_conntrack_helper.h
+@@ -177,4 +177,5 @@ void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat);
+ int nf_nat_helper_try_module_get(const char *name, u16 l3num,
+ 				 u8 protonum);
+ void nf_nat_helper_put(struct nf_conntrack_helper *helper);
++void nf_ct_set_auto_assign_helper_warned(struct net *net);
+ #endif /*_NF_CONNTRACK_HELPER_H*/
+diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
+index ae4488a13c70..ceb38a7b37cb 100644
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -556,6 +556,12 @@ static const struct nf_ct_ext_type helper_extend = {
+ 	.id	= NF_CT_EXT_HELPER,
+ };
+ 
++void nf_ct_set_auto_assign_helper_warned(struct net *net)
++{
++	nf_ct_pernet(net)->auto_assign_helper_warned = true;
++}
++EXPORT_SYMBOL_GPL(nf_ct_set_auto_assign_helper_warned);
++
+ void nf_conntrack_helper_pernet_init(struct net *net)
+ {
+ 	struct nf_conntrack_net *cnet = nf_ct_pernet(net);
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index 99b1de14ff7e..54ecb9fbf2de 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -1040,6 +1040,9 @@ static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
+ 	if (err < 0)
+ 		goto err_put_helper;
+ 
++	/* Avoid the bogus warning, helper will be assigned after CT init */
++	nf_ct_set_auto_assign_helper_warned(ctx->net);
++
+ 	return 0;
+ 
+ err_put_helper:
+-- 
+2.34.1
+
diff --git a/queue-5.16/netfilter-egress-report-interface-as-outgoing.patch b/queue-5.16/netfilter-egress-report-interface-as-outgoing.patch
new file mode 100644
index 00000000000..7dbf228474e
--- /dev/null
+++ b/queue-5.16/netfilter-egress-report-interface-as-outgoing.patch
@@ -0,0 +1,36 @@
+From bc32295b9e9ae71c9ec982862469aa2e51c6d10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 15:02:40 +0100
+Subject: netfilter: egress: Report interface as outgoing
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit d645552e9bd96671079b27015294ec7f9748fa2b ]
+
+Otherwise packets in egress chains seem like they are being received by
+the interface, not sent out via it.
+
+Fixes: 42df6e1d221dd ("netfilter: Introduce egress hook")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter_netdev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netfilter_netdev.h b/include/linux/netfilter_netdev.h
+index e6487a691136..8676316547cc 100644
+--- a/include/linux/netfilter_netdev.h
++++ b/include/linux/netfilter_netdev.h
+@@ -99,7 +99,7 @@ static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc,
+ 		return skb;
+ 
+ 	nf_hook_state_init(&state, NF_NETDEV_EGRESS,
+-			   NFPROTO_NETDEV, dev, NULL, NULL,
++			   NFPROTO_NETDEV, NULL, dev, NULL,
+ 			   dev_net(dev), NULL);
+ 
+ 	/* nf assumes rcu_read_lock, not just read_lock_bh */
+-- 
+2.34.1
+
diff --git a/queue-5.16/netfilter-flowtable-fix-qinq-and-pppoe-support-for-i.patch b/queue-5.16/netfilter-flowtable-fix-qinq-and-pppoe-support-for-i.patch
new file mode 100644
index 00000000000..69dc30c54a2
--- /dev/null
+++ b/queue-5.16/netfilter-flowtable-fix-qinq-and-pppoe-support-for-i.patch
@@ -0,0 +1,129 @@
+From 5121f16eec4f693dfb83433c8712ed00b56de193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 11:19:43 +0100
+Subject: netfilter: flowtable: Fix QinQ and pppoe support for inet table
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 0492d857636e1c52cd71594a723c4b26a7b31978 ]
+
+nf_flow_offload_inet_hook() does not check for 802.1q and PPPoE.
+Fetch inner ethertype from these encapsulation protocols.
+
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Fixes: 4cd91f7c290f ("netfilter: flowtable: add vlan support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_flow_table.h | 18 ++++++++++++++++++
+ net/netfilter/nf_flow_table_inet.c    | 17 +++++++++++++++++
+ net/netfilter/nf_flow_table_ip.c      | 18 ------------------
+ 3 files changed, 35 insertions(+), 18 deletions(-)
+
+diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
+index a3647fadf1cc..9f927c44087d 100644
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -10,6 +10,8 @@
+ #include <linux/netfilter/nf_conntrack_tuple_common.h>
+ #include <net/flow_offload.h>
+ #include <net/dst.h>
++#include <linux/if_pppox.h>
++#include <linux/ppp_defs.h>
+ 
+ struct nf_flowtable;
+ struct nf_flow_rule;
+@@ -313,4 +315,20 @@ int nf_flow_rule_route_ipv6(struct net *net, const struct flow_offload *flow,
+ int nf_flow_table_offload_init(void);
+ void nf_flow_table_offload_exit(void);
+ 
++static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
++{
++	__be16 proto;
++
++	proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
++			     sizeof(struct pppoe_hdr)));
++	switch (proto) {
++	case htons(PPP_IP):
++		return htons(ETH_P_IP);
++	case htons(PPP_IPV6):
++		return htons(ETH_P_IPV6);
++	}
++
++	return 0;
++}
++
+ #endif /* _NF_FLOW_TABLE_H */
+diff --git a/net/netfilter/nf_flow_table_inet.c b/net/netfilter/nf_flow_table_inet.c
+index bc4126d8ef65..280fdd32965f 100644
+--- a/net/netfilter/nf_flow_table_inet.c
++++ b/net/netfilter/nf_flow_table_inet.c
+@@ -6,12 +6,29 @@
+ #include <linux/rhashtable.h>
+ #include <net/netfilter/nf_flow_table.h>
+ #include <net/netfilter/nf_tables.h>
++#include <linux/if_vlan.h>
+ 
+ static unsigned int
+ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb,
+ 			  const struct nf_hook_state *state)
+ {
++	struct vlan_ethhdr *veth;
++	__be16 proto;
++
+ 	switch (skb->protocol) {
++	case htons(ETH_P_8021Q):
++		veth = (struct vlan_ethhdr *)skb_mac_header(skb);
++		proto = veth->h_vlan_encapsulated_proto;
++		break;
++	case htons(ETH_P_PPP_SES):
++		proto = nf_flow_pppoe_proto(skb);
++		break;
++	default:
++		proto = skb->protocol;
++		break;
++	}
++
++	switch (proto) {
+ 	case htons(ETH_P_IP):
+ 		return nf_flow_offload_ip_hook(priv, skb, state);
+ 	case htons(ETH_P_IPV6):
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index 889cf88d3dba..6257d87c3a56 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -8,8 +8,6 @@
+ #include <linux/ipv6.h>
+ #include <linux/netdevice.h>
+ #include <linux/if_ether.h>
+-#include <linux/if_pppox.h>
+-#include <linux/ppp_defs.h>
+ #include <net/ip.h>
+ #include <net/ipv6.h>
+ #include <net/ip6_route.h>
+@@ -239,22 +237,6 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+ 	return NF_STOLEN;
+ }
+ 
+-static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
+-{
+-	__be16 proto;
+-
+-	proto = *((__be16 *)(skb_mac_header(skb) + ETH_HLEN +
+-			     sizeof(struct pppoe_hdr)));
+-	switch (proto) {
+-	case htons(PPP_IP):
+-		return htons(ETH_P_IP);
+-	case htons(PPP_IPV6):
+-		return htons(ETH_P_IPV6);
+-	}
+-
+-	return 0;
+-}
+-
+ static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
+ 				       u32 *offset)
+ {
+-- 
+2.34.1
+
diff --git a/queue-5.16/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch b/queue-5.16/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
new file mode 100644
index 00000000000..56517862069
--- /dev/null
+++ b/queue-5.16/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
@@ -0,0 +1,71 @@
+From 1b4973c5127054b8d801d8b93882b84474cba395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 11:38:32 +0100
+Subject: netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]
+
+Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
+coming before the TCP window tracking, otherwise such connections will
+fail in the window check.
+
+Update tcp_options() to leave this flag in place and add a new helper
+function to reset the tcp window state.
+
+Based on patch from Sven Auhagen.
+
+Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
+Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index af5115e127cf..3cee5d8ee702 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -341,8 +341,8 @@ static void tcp_options(const struct sk_buff *skb,
+ 	if (!ptr)
+ 		return;
+ 
+-	state->td_scale =
+-	state->flags = 0;
++	state->td_scale = 0;
++	state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
+ 
+ 	while (length > 0) {
+ 		int opcode=*ptr++;
+@@ -839,6 +839,16 @@ static bool tcp_can_early_drop(const struct nf_conn *ct)
+ 	return false;
+ }
+ 
++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
++{
++	state->td_end		= 0;
++	state->td_maxend	= 0;
++	state->td_maxwin	= 0;
++	state->td_maxack	= 0;
++	state->td_scale		= 0;
++	state->flags		&= IP_CT_TCP_FLAG_BE_LIBERAL;
++}
++
+ /* Returns verdict for packet, or -1 for invalid. */
+ int nf_conntrack_tcp_packet(struct nf_conn *ct,
+ 			    struct sk_buff *skb,
+@@ -945,8 +955,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
+ 			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
+ 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
+ 				ct->proto.tcp.last_flags;
+-			memset(&ct->proto.tcp.seen[dir], 0,
+-			       sizeof(struct ip_ct_tcp_state));
++			nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
+ 			break;
+ 		}
+ 		ct->proto.tcp.last_index = index;
+-- 
+2.34.1
+
diff --git a/queue-5.16/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch b/queue-5.16/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
new file mode 100644
index 00000000000..b1f5a6efde6
--- /dev/null
+++ b/queue-5.16/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
@@ -0,0 +1,74 @@
+From 9f5912660f099eb78799c5af7a07dca81837b1d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:05 -0700
+Subject: netfilter: nf_nat_h323: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit fd4213929053bb58b0b2a080ca17f2dd1a9b6df4 ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_nat_h323.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
+index 3e2685c120c7..76a411ae9fe6 100644
+--- a/net/ipv4/netfilter/nf_nat_h323.c
++++ b/net/ipv4/netfilter/nf_nat_h323.c
+@@ -580,7 +580,7 @@ static struct nf_ct_helper_expectfn callforwarding_nat = {
+ };
+ 
+ /****************************************************************************/
+-static int __init init(void)
++static int __init nf_nat_h323_init(void)
+ {
+ 	BUG_ON(set_h245_addr_hook != NULL);
+ 	BUG_ON(set_h225_addr_hook != NULL);
+@@ -607,7 +607,7 @@ static int __init init(void)
+ }
+ 
+ /****************************************************************************/
+-static void __exit fini(void)
++static void __exit nf_nat_h323_fini(void)
+ {
+ 	RCU_INIT_POINTER(set_h245_addr_hook, NULL);
+ 	RCU_INIT_POINTER(set_h225_addr_hook, NULL);
+@@ -624,8 +624,8 @@ static void __exit fini(void)
+ }
+ 
+ /****************************************************************************/
+-module_init(init);
+-module_exit(fini);
++module_init(nf_nat_h323_init);
++module_exit(nf_nat_h323_fini);
+ 
+ MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
+ MODULE_DESCRIPTION("H.323 NAT helper");
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfs-don-t-loop-forever-in-nfs_do_recoalesce.patch b/queue-5.16/nfs-don-t-loop-forever-in-nfs_do_recoalesce.patch
new file mode 100644
index 00000000000..e1f87ebcb92
--- /dev/null
+++ b/queue-5.16/nfs-don-t-loop-forever-in-nfs_do_recoalesce.patch
@@ -0,0 +1,40 @@
+From 98519a02c2113bd5800c3eecab74f3463d91743b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 21:51:03 -0400
+Subject: NFS: Don't loop forever in nfs_do_recoalesce()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d02d81efc7564b4d5446a02e0214a164cf00b1f3 ]
+
+If __nfs_pageio_add_request() fails to add the request, it will return
+with either desc->pg_error < 0, or mirror->pg_recoalesce will be set, so
+we are guaranteed either to exit the function altogether, or to loop.
+
+However if there is nothing left in mirror->pg_list to coalesce, we must
+exit, so make sure that we clear mirror->pg_recoalesce every time we
+loop.
+
+Reported-by: Olga Kornievskaia <aglo@umich.edu>
+Fixes: 70536bf4eb07 ("NFS: Clean up reset of the mirror accounting variables")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pagelist.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index ad7f83dc9a2d..815d63080245 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1218,6 +1218,7 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+ 
+ 	do {
+ 		list_splice_init(&mirror->pg_list, &head);
++		mirror->pg_recoalesce = 0;
+ 
+ 		while (!list_empty(&head)) {
+ 			struct nfs_page *req;
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch b/queue-5.16/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
new file mode 100644
index 00000000000..0ce76cbc059
--- /dev/null
+++ b/queue-5.16/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
@@ -0,0 +1,39 @@
+From 477096ef473837e8e13df3dd3927be691c10c40c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 13:17:04 +0300
+Subject: NFS: remove unneeded check in decode_devicenotify_args()
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+[ Upstream commit cb8fac6d2727f79f211e745b16c9abbf4d8be652 ]
+
+[You don't often get email from khoroshilov@ispras.ru. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]
+
+Overflow check in not needed anymore after we switch to kmalloc_array().
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: a4f743a6bb20 ("NFSv4.1: Convert open-coded array allocation calls to kmalloc_array()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_xdr.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index f90de8043b0f..8dcb08e1a885 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ 	n = ntohl(*p++);
+ 	if (n == 0)
+ 		goto out;
+-	if (n > ULONG_MAX / sizeof(*args->devs)) {
+-		status = htonl(NFS4ERR_BADXDR);
+-		goto out;
+-	}
+ 
+ 	args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL);
+ 	if (!args->devs) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch b/queue-5.16/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
new file mode 100644
index 00000000000..00fade9962c
--- /dev/null
+++ b/queue-5.16/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
@@ -0,0 +1,106 @@
+From a7e0e6f3984da84050c9008674e58c0608de5782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:59:37 -0500
+Subject: NFS: Return valid errors from nfs2/3_decode_dirent()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 64cfca85bacde54caa64e0ab855c48734894fa37 ]
+
+Valid return values for decode_dirent() callback functions are:
+ 0: Success
+ -EBADCOOKIE: End of directory
+ -EAGAIN: End of xdr_stream
+
+All errors need to map into one of those three values.
+
+Fixes: 573c4e1ef53a ("NFS: Simplify ->decode_dirent() calling sequence")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs2xdr.c |  2 +-
+ fs/nfs/nfs3xdr.c | 21 ++++++---------------
+ 2 files changed, 7 insertions(+), 16 deletions(-)
+
+diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
+index 7fba7711e6b3..3d5ba43f44bb 100644
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -949,7 +949,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 
+ 	error = decode_filename_inline(xdr, &entry->name, &entry->len);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	/*
+ 	 * The type (size and byte order) of nfscookie isn't defined in
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 54a1d21cbcc6..7ab60ad98776 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -1967,7 +1967,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 		       bool plus)
+ {
+ 	struct user_namespace *userns = rpc_userns(entry->server->client);
+-	struct nfs_entry old = *entry;
+ 	__be32 *p;
+ 	int error;
+ 	u64 new_cookie;
+@@ -1987,15 +1986,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 
+ 	error = decode_fileid3(xdr, &entry->ino);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	error = decode_inline_filename3(xdr, &entry->name, &entry->len);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	error = decode_cookie3(xdr, &new_cookie);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	entry->d_type = DT_UNKNOWN;
+ 
+@@ -2003,7 +2002,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 		entry->fattr->valid = 0;
+ 		error = decode_post_op_attr(xdr, entry->fattr, userns);
+ 		if (unlikely(error))
+-			return error;
++			return -EAGAIN;
+ 		if (entry->fattr->valid & NFS_ATTR_FATTR_V3)
+ 			entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
+ 
+@@ -2018,11 +2017,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 			return -EAGAIN;
+ 		if (*p != xdr_zero) {
+ 			error = decode_nfs_fh3(xdr, entry->fh);
+-			if (unlikely(error)) {
+-				if (error == -E2BIG)
+-					goto out_truncated;
+-				return error;
+-			}
++			if (unlikely(error))
++				return -EAGAIN;
+ 		} else
+ 			zero_nfs_fh3(entry->fh);
+ 	}
+@@ -2031,11 +2027,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 	entry->cookie = new_cookie;
+ 
+ 	return 0;
+-
+-out_truncated:
+-	dprintk("NFS: directory entry contains invalid file handle\n");
+-	*entry = old;
+-	return -EAGAIN;
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfs-use-of-mapping_set_error-results-in-spurious-err.patch b/queue-5.16/nfs-use-of-mapping_set_error-results-in-spurious-err.patch
new file mode 100644
index 00000000000..aac2d339664
--- /dev/null
+++ b/queue-5.16/nfs-use-of-mapping_set_error-results-in-spurious-err.patch
@@ -0,0 +1,41 @@
+From 890fb630bea8df9162a8af03a6ec2c051bd1612e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 15:58:38 -0500
+Subject: NFS: Use of mapping_set_error() results in spurious errors
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 6c984083ec2453dfd3fcf98f392f34500c73e3f2 ]
+
+The use of mapping_set_error() in conjunction with calls to
+filemap_check_errors() is problematic because every error gets reported
+as either an EIO or an ENOSPC by filemap_check_errors() in functions
+such as filemap_write_and_wait() or filemap_write_and_wait_range().
+In almost all cases, we prefer to use the more nuanced wb errors.
+
+Fixes: b8946d7bfb94 ("NFS: Revalidate the file mapping on all fatal writeback errors")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 9b7619ce17a7..7a23b4644507 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -315,7 +315,10 @@ static void nfs_mapping_set_error(struct page *page, int error)
+ 	struct address_space *mapping = page_file_mapping(page);
+ 
+ 	SetPageError(page);
+-	mapping_set_error(mapping, error);
++	filemap_set_wb_err(mapping, error);
++	if (mapping->host)
++		errseq_set(&mapping->host->i_sb->s_wb_err,
++			   error == -ENOSPC ? -ENOSPC : -EIO);
+ 	nfs_set_pageerror(mapping);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch b/queue-5.16/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch
new file mode 100644
index 00000000000..4cbc86b3833
--- /dev/null
+++ b/queue-5.16/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch
@@ -0,0 +1,57 @@
+From 48461e4c02e7b4b3f8de543e4c70e56c0b82f7ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 15:30:13 -0500
+Subject: NFSD: Fix nfsd_breaker_owns_lease() return values
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 50719bf3442dd6cd05159e9c98d020b3919ce978 ]
+
+These have been incorrect since the function was introduced.
+
+A proper kerneldoc comment is added since this function, though
+static, is part of an external interface.
+
+Reported-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index ac0ddde8beef..6075a328d756 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4693,6 +4693,14 @@ nfsd_break_deleg_cb(struct file_lock *fl)
+ 	return ret;
+ }
+ 
++/**
++ * nfsd_breaker_owns_lease - Check if lease conflict was resolved
++ * @fl: Lock state to check
++ *
++ * Return values:
++ *   %true: Lease conflict was resolved
++ *   %false: Lease conflict was not resolved.
++ */
+ static bool nfsd_breaker_owns_lease(struct file_lock *fl)
+ {
+ 	struct nfs4_delegation *dl = fl->fl_owner;
+@@ -4700,11 +4708,11 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl)
+ 	struct nfs4_client *clp;
+ 
+ 	if (!i_am_nfsd())
+-		return NULL;
++		return false;
+ 	rqst = kthread_data(current);
+ 	/* Note rq_prog == NFS_ACL_PROGRAM is also possible: */
+ 	if (rqst->rq_prog != NFS_PROGRAM || rqst->rq_vers < 4)
+-		return NULL;
++		return false;
+ 	clp = *(rqst->rq_lease_breaker);
+ 	return dl->dl_stid.sc_client == clp;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch b/queue-5.16/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch
new file mode 100644
index 00000000000..dfeffe3f667
--- /dev/null
+++ b/queue-5.16/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch
@@ -0,0 +1,63 @@
+From 4fdaf577ccf159a8a0c1e90e0d43735faf8fb91c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 18:17:05 +0200
+Subject: nfsd: more robust allocation failure handling in nfsd_file_cache_init
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 4d2eeafecd6c83b4444db3dc0ada201c89b1aa44 ]
+
+The nfsd file cache table can be pretty large and its allocation
+may require as many as 80 contigious pages.
+
+Employ the same fix that was employed for similar issue that was
+reported for the reply cache hash table allocation several years ago
+by commit 8f97514b423a ("nfsd: more robust allocation failure handling
+in nfsd_reply_cache_init").
+
+Fixes: 65294c1f2c5e ("nfsd: add a new struct file caching facility to nfsd")
+Link: https://lore.kernel.org/linux-nfs/e3cdaeec85a6cfec980e87fc294327c0381c1778.camel@kernel.org/
+Suggested-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/filecache.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index fdf89fcf1a0c..4cffe05e0477 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -644,7 +644,7 @@ nfsd_file_cache_init(void)
+ 	if (!nfsd_filecache_wq)
+ 		goto out;
+ 
+-	nfsd_file_hashtbl = kcalloc(NFSD_FILE_HASH_SIZE,
++	nfsd_file_hashtbl = kvcalloc(NFSD_FILE_HASH_SIZE,
+ 				sizeof(*nfsd_file_hashtbl), GFP_KERNEL);
+ 	if (!nfsd_file_hashtbl) {
+ 		pr_err("nfsd: unable to allocate nfsd_file_hashtbl\n");
+@@ -712,7 +712,7 @@ nfsd_file_cache_init(void)
+ 	nfsd_file_slab = NULL;
+ 	kmem_cache_destroy(nfsd_file_mark_slab);
+ 	nfsd_file_mark_slab = NULL;
+-	kfree(nfsd_file_hashtbl);
++	kvfree(nfsd_file_hashtbl);
+ 	nfsd_file_hashtbl = NULL;
+ 	destroy_workqueue(nfsd_filecache_wq);
+ 	nfsd_filecache_wq = NULL;
+@@ -858,7 +858,7 @@ nfsd_file_cache_shutdown(void)
+ 	fsnotify_wait_marks_destroyed();
+ 	kmem_cache_destroy(nfsd_file_mark_slab);
+ 	nfsd_file_mark_slab = NULL;
+-	kfree(nfsd_file_hashtbl);
++	kvfree(nfsd_file_hashtbl);
+ 	nfsd_file_hashtbl = NULL;
+ 	destroy_workqueue(nfsd_filecache_wq);
+ 	nfsd_filecache_wq = NULL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch b/queue-5.16/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
new file mode 100644
index 00000000000..0adef6df564
--- /dev/null
+++ b/queue-5.16/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
@@ -0,0 +1,120 @@
+From 120f1f5208138eaa1c677df051953f9702d59176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Mar 2022 08:36:34 -0400
+Subject: NFSv4/pNFS: Fix another issue with a list iterator pointing to the
+ head
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ]
+
+In nfs4_callback_devicenotify(), if we don't find a matching entry for
+the deviceid, we're left with a pointer to 'struct nfs_server' that
+actually points to the list of super blocks associated with our struct
+nfs_client.
+Furthermore, even if we have a valid pointer, nothing pins the super
+block, and so the struct nfs_server could end up getting freed while
+we're using it.
+
+Since all we want is a pointer to the struct pnfs_layoutdriver_type,
+let's skip all the iteration over super blocks, and just use APIs to
+find the layout driver directly.
+
+Reported-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_proc.c | 27 +++++++++------------------
+ fs/nfs/pnfs.c          | 11 +++++++++++
+ fs/nfs/pnfs.h          |  2 ++
+ 3 files changed, 22 insertions(+), 18 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index c343666d9a42..6464dde03705 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -358,12 +358,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ 				  struct cb_process_state *cps)
+ {
+ 	struct cb_devicenotifyargs *args = argp;
++	const struct pnfs_layoutdriver_type *ld = NULL;
+ 	uint32_t i;
+ 	__be32 res = 0;
+-	struct nfs_client *clp = cps->clp;
+-	struct nfs_server *server = NULL;
+ 
+-	if (!clp) {
++	if (!cps->clp) {
+ 		res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION);
+ 		goto out;
+ 	}
+@@ -371,23 +370,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ 	for (i = 0; i < args->ndevs; i++) {
+ 		struct cb_devicenotifyitem *dev = &args->devs[i];
+ 
+-		if (!server ||
+-		    server->pnfs_curr_ld->id != dev->cbd_layout_type) {
+-			rcu_read_lock();
+-			list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link)
+-				if (server->pnfs_curr_ld &&
+-				    server->pnfs_curr_ld->id == dev->cbd_layout_type) {
+-					rcu_read_unlock();
+-					goto found;
+-				}
+-			rcu_read_unlock();
+-			continue;
++		if (!ld || ld->id != dev->cbd_layout_type) {
++			pnfs_put_layoutdriver(ld);
++			ld = pnfs_find_layoutdriver(dev->cbd_layout_type);
++			if (!ld)
++				continue;
+ 		}
+-
+-	found:
+-		nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id);
++		nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id);
+ 	}
+-
++	pnfs_put_layoutdriver(ld);
+ out:
+ 	kfree(args->devs);
+ 	return res;
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 7c9090a28e5c..7ddd003ab8b1 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id)
+ 	return local;
+ }
+ 
++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id)
++{
++	return find_pnfs_driver(id);
++}
++
++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld)
++{
++	if (ld)
++		module_put(ld->owner);
++}
++
+ void
+ unset_pnfs_layoutdriver(struct nfs_server *nfss)
+ {
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index f4d7548d67b2..07f11489e4e9 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -234,6 +234,8 @@ struct pnfs_devicelist {
+ 
+ extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *);
+ extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *);
++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id);
++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld);
+ 
+ /* nfs4proc.c */
+ extern size_t max_response_pages(struct nfs_server *server);
+-- 
+2.34.1
+
diff --git a/queue-5.16/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch b/queue-5.16/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
new file mode 100644
index 00000000000..855eef044ff
--- /dev/null
+++ b/queue-5.16/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
@@ -0,0 +1,35 @@
+From 13a5f529e7e47b056566d3d6f7dd4ab0ad31ad6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 10:38:42 -0400
+Subject: NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 1d15d121cc2ad4d016a7dc1493132a9696f91fc5 ]
+
+There is no reason to retry the operation if a session error had
+occurred in such case result structure isn't filled out.
+
+Fixes: dff58530c4ca ("NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 0abbbf5d2bdf..5298c3a278c5 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8275,6 +8275,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata)
+ 	case -NFS4ERR_DEADSESSION:
+ 		nfs4_schedule_session_recovery(clp->cl_session,
+ 				task->tk_status);
++		return;
+ 	}
+ 	if (args->dir == NFS4_CDFC4_FORE_OR_BOTH &&
+ 			res->dir != NFS4_CDFS4_BOTH) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/ntfs-add-sanity-check-on-allocation-size.patch b/queue-5.16/ntfs-add-sanity-check-on-allocation-size.patch
new file mode 100644
index 00000000000..7d6de842866
--- /dev/null
+++ b/queue-5.16/ntfs-add-sanity-check-on-allocation-size.patch
@@ -0,0 +1,43 @@
+From 71ccd39c9f38013293e934ea336aaf9f58787baa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:38:39 -0700
+Subject: ntfs: add sanity check on allocation size
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 714fbf2647b1a33d914edd695d4da92029c7e7c0 ]
+
+ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation
+size.  It triggers one BUG in the __ntfs_malloc function.
+
+Fix this by adding sanity check on ni->attr_list_size.
+
+Link: https://lkml.kernel.org/r/20220120094914.47736-1-dzm91@hust.edu.cn
+Reported-by: syzbot+3c765c5248797356edaa@syzkaller.appspotmail.com
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Acked-by: Anton Altaparmakov <anton@tuxera.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs/inode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index 4474adb393ca..517b71c73aa9 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi)
+ 		}
+ 		/* Now allocate memory for the attribute list. */
+ 		ni->attr_list_size = (u32)ntfs_attr_size(a);
++		if (!ni->attr_list_size) {
++			ntfs_error(sb, "Attr_list_size is zero");
++			goto put_err_out;
++		}
+ 		ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
+ 		if (!ni->attr_list) {
+ 			ntfs_error(sb, "Not enough memory to allocate buffer "
+-- 
+2.34.1
+
diff --git a/queue-5.16/nvdimm-region-fix-default-alignment-for-small-region.patch b/queue-5.16/nvdimm-region-fix-default-alignment-for-small-region.patch
new file mode 100644
index 00000000000..61455d12238
--- /dev/null
+++ b/queue-5.16/nvdimm-region-fix-default-alignment-for-small-region.patch
@@ -0,0 +1,41 @@
+From 5c7054ec3fc718e1a0ea31954afb8e9e0518df45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 19:49:21 -0800
+Subject: nvdimm/region: Fix default alignment for small regions
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit d9d290d7e659e9db3e4518040cc18b97f5535f4a ]
+
+In preparation for removing BLK aperture support the NVDIMM unit tests
+discovered that the default alignment can be set higher than the
+capacity of the region. Fall back to PAGE_SIZE in that case.
+
+Given this has not been seen in the wild, elide notifying -stable.
+
+Fixes: 2522afb86a8c ("libnvdimm/region: Introduce an 'align' attribute")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/164688416128.2879318.17890707310125575258.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/region_devs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index 9ccf3d608799..70ad891a76ba 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -1025,6 +1025,9 @@ static unsigned long default_align(struct nd_region *nd_region)
+ 		}
+ 	}
+ 
++	if (nd_region->ndr_size < MEMREMAP_COMPAT_ALIGN_MAX)
++		align = PAGE_SIZE;
++
+ 	mappings = max_t(u16, 1, nd_region->ndr_mappings);
+ 	div_u64_rem(align, mappings, &remainder);
+ 	if (remainder)
+-- 
+2.34.1
+
diff --git a/queue-5.16/nvme-cleanup-__nvme_check_ids.patch b/queue-5.16/nvme-cleanup-__nvme_check_ids.patch
new file mode 100644
index 00000000000..68e637176e8
--- /dev/null
+++ b/queue-5.16/nvme-cleanup-__nvme_check_ids.patch
@@ -0,0 +1,56 @@
+From e5be384af8a0791e8ae92a728fc8c98fa16e1287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:57:15 +0100
+Subject: nvme: cleanup __nvme_check_ids
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit fd8099e7918cd2df39ef306dd1d1af7178a15b81 ]
+
+Pass the actual nvme_ns_ids used for the comparison instead of the
+ns_head that isn't needed and use a more descriptive function name.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 5785f6abf194..078ad43b94a1 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3605,16 +3605,15 @@ static struct nvme_ns_head *nvme_find_ns_head(struct nvme_subsystem *subsys,
+ 	return NULL;
+ }
+ 
+-static int __nvme_check_ids(struct nvme_subsystem *subsys,
+-		struct nvme_ns_head *new)
++static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys,
++		struct nvme_ns_ids *ids)
+ {
+ 	struct nvme_ns_head *h;
+ 
+ 	lockdep_assert_held(&subsys->lock);
+ 
+ 	list_for_each_entry(h, &subsys->nsheads, entry) {
+-		if (nvme_ns_ids_valid(&new->ids) &&
+-		    nvme_ns_ids_equal(&new->ids, &h->ids))
++		if (nvme_ns_ids_valid(ids) && nvme_ns_ids_equal(ids, &h->ids))
+ 			return -EINVAL;
+ 	}
+ 
+@@ -3713,7 +3712,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
+ 	head->ids = *ids;
+ 	kref_init(&head->ref);
+ 
+-	ret = __nvme_check_ids(ctrl->subsys, head);
++	ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &head->ids);
+ 	if (ret) {
+ 		dev_err(ctrl->device,
+ 			"duplicate IDs for nsid %d\n", nsid);
+-- 
+2.34.1
+
diff --git a/queue-5.16/nvme-fix-the-check-for-duplicate-unique-identifiers.patch b/queue-5.16/nvme-fix-the-check-for-duplicate-unique-identifiers.patch
new file mode 100644
index 00000000000..92d56c4abe6
--- /dev/null
+++ b/queue-5.16/nvme-fix-the-check-for-duplicate-unique-identifiers.patch
@@ -0,0 +1,69 @@
+From dfe584478d102745baf176a549ef2e9bdc58423b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 11:32:58 +0100
+Subject: nvme: fix the check for duplicate unique identifiers
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit e2724cb9f0c406b8fb66efd3aa9e8b3edfd8d5c8 ]
+
+nvme_subsys_check_duplicate_ids should needs to return an error if any of
+the identifiers matches, not just if all of them match.  But it does not
+need to and should not look at the CSI value for this sanity check.
+
+Rewrite the logic to be separate from nvme_ns_ids_equal and optimize it
+by reducing duplicate checks for non-present identifiers.
+
+Fixes: ed754e5deeb1 ("nvme: track shared namespaces")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 078ad43b94a1..1b39b50cb958 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1685,13 +1685,6 @@ static void nvme_config_discard(struct gendisk *disk, struct nvme_ns *ns)
+ 		blk_queue_max_write_zeroes_sectors(queue, UINT_MAX);
+ }
+ 
+-static bool nvme_ns_ids_valid(struct nvme_ns_ids *ids)
+-{
+-	return !uuid_is_null(&ids->uuid) ||
+-		memchr_inv(ids->nguid, 0, sizeof(ids->nguid)) ||
+-		memchr_inv(ids->eui64, 0, sizeof(ids->eui64));
+-}
+-
+ static bool nvme_ns_ids_equal(struct nvme_ns_ids *a, struct nvme_ns_ids *b)
+ {
+ 	return uuid_equal(&a->uuid, &b->uuid) &&
+@@ -3608,12 +3601,21 @@ static struct nvme_ns_head *nvme_find_ns_head(struct nvme_subsystem *subsys,
+ static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys,
+ 		struct nvme_ns_ids *ids)
+ {
++	bool has_uuid = !uuid_is_null(&ids->uuid);
++	bool has_nguid = memchr_inv(ids->nguid, 0, sizeof(ids->nguid));
++	bool has_eui64 = memchr_inv(ids->eui64, 0, sizeof(ids->eui64));
+ 	struct nvme_ns_head *h;
+ 
+ 	lockdep_assert_held(&subsys->lock);
+ 
+ 	list_for_each_entry(h, &subsys->nsheads, entry) {
+-		if (nvme_ns_ids_valid(ids) && nvme_ns_ids_equal(ids, &h->ids))
++		if (has_uuid && uuid_equal(&ids->uuid, &h->ids.uuid))
++			return -EINVAL;
++		if (has_nguid &&
++		    memcmp(&ids->nguid, &h->ids.nguid, sizeof(ids->nguid)) == 0)
++			return -EINVAL;
++		if (has_eui64 &&
++		    memcmp(&ids->eui64, &h->ids.eui64, sizeof(ids->eui64)) == 0)
+ 			return -EINVAL;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch b/queue-5.16/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch
new file mode 100644
index 00000000000..c601ed401ec
--- /dev/null
+++ b/queue-5.16/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch
@@ -0,0 +1,127 @@
+From 31ca3e91bc45a3a4a91559fad10b729e38d02bd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 18:22:49 -0800
+Subject: nvme-tcp: lockdep: annotate in-kernel sockets
+
+From: Chris Leech <cleech@redhat.com>
+
+[ Upstream commit 841aee4d75f18fdfb53935080b03de0c65e9b92c ]
+
+Put NVMe/TCP sockets in their own class to avoid some lockdep warnings.
+Sockets created by nvme-tcp are not exposed to user-space, and will not
+trigger certain code paths that the general socket API exposes.
+
+Lockdep complains about a circular dependency between the socket and
+filesystem locks, because setsockopt can trigger a page fault with a
+socket lock held, but nvme-tcp sends requests on the socket while file
+system locks are held.
+
+  ======================================================
+  WARNING: possible circular locking dependency detected
+  5.15.0-rc3 #1 Not tainted
+  ------------------------------------------------------
+  fio/1496 is trying to acquire lock:
+  (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendpage+0x23/0x80
+
+  but task is already holding lock:
+  (&xfs_dir_ilock_class/5){+.+.}-{3:3}, at: xfs_ilock+0xcf/0x290 [xfs]
+
+  which lock already depends on the new lock.
+
+  other info that might help us debug this:
+
+  chain exists of:
+   sk_lock-AF_INET --> sb_internal --> &xfs_dir_ilock_class/5
+
+  Possible unsafe locking scenario:
+
+        CPU0                    CPU1
+        ----                    ----
+   lock(&xfs_dir_ilock_class/5);
+                                lock(sb_internal);
+                                lock(&xfs_dir_ilock_class/5);
+   lock(sk_lock-AF_INET);
+
+  *** DEADLOCK ***
+
+  6 locks held by fio/1496:
+   #0: (sb_writers#13){.+.+}-{0:0}, at: path_openat+0x9fc/0xa20
+   #1: (&inode->i_sb->s_type->i_mutex_dir_key){++++}-{3:3}, at: path_openat+0x296/0xa20
+   #2: (sb_internal){.+.+}-{0:0}, at: xfs_trans_alloc_icreate+0x41/0xd0 [xfs]
+   #3: (&xfs_dir_ilock_class/5){+.+.}-{3:3}, at: xfs_ilock+0xcf/0x290 [xfs]
+   #4: (hctx->srcu){....}-{0:0}, at: hctx_lock+0x51/0xd0
+   #5: (&queue->send_mutex){+.+.}-{3:3}, at: nvme_tcp_queue_rq+0x33e/0x380 [nvme_tcp]
+
+This annotation lets lockdep analyze nvme-tcp controlled sockets
+independently of what the user-space sockets API does.
+
+Link: https://lore.kernel.org/linux-nvme/CAHj4cs9MDYLJ+q+2_GXUK9HxFizv2pxUryUR0toX974M040z7g@mail.gmail.com/
+
+Signed-off-by: Chris Leech <cleech@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 65e00c64a588..d66e2de044e0 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -30,6 +30,44 @@ static int so_priority;
+ module_param(so_priority, int, 0644);
+ MODULE_PARM_DESC(so_priority, "nvme tcp socket optimize priority");
+ 
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++/* lockdep can detect a circular dependency of the form
++ *   sk_lock -> mmap_lock (page fault) -> fs locks -> sk_lock
++ * because dependencies are tracked for both nvme-tcp and user contexts. Using
++ * a separate class prevents lockdep from conflating nvme-tcp socket use with
++ * user-space socket API use.
++ */
++static struct lock_class_key nvme_tcp_sk_key[2];
++static struct lock_class_key nvme_tcp_slock_key[2];
++
++static void nvme_tcp_reclassify_socket(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++
++	if (WARN_ON_ONCE(!sock_allow_reclassification(sk)))
++		return;
++
++	switch (sk->sk_family) {
++	case AF_INET:
++		sock_lock_init_class_and_name(sk, "slock-AF_INET-NVME",
++					      &nvme_tcp_slock_key[0],
++					      "sk_lock-AF_INET-NVME",
++					      &nvme_tcp_sk_key[0]);
++		break;
++	case AF_INET6:
++		sock_lock_init_class_and_name(sk, "slock-AF_INET6-NVME",
++					      &nvme_tcp_slock_key[1],
++					      "sk_lock-AF_INET6-NVME",
++					      &nvme_tcp_sk_key[1]);
++		break;
++	default:
++		WARN_ON_ONCE(1);
++	}
++}
++#else
++static void nvme_tcp_reclassify_socket(struct socket *sock) { }
++#endif
++
+ enum nvme_tcp_send_state {
+ 	NVME_TCP_SEND_CMD_PDU = 0,
+ 	NVME_TCP_SEND_H2C_PDU,
+@@ -1469,6 +1507,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,
+ 		goto err_destroy_mutex;
+ 	}
+ 
++	nvme_tcp_reclassify_socket(queue->sock);
++
+ 	/* Single syn retry */
+ 	tcp_sock_set_syncnt(queue->sock->sk, 1);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/octeontx2-af-initialize-action-variable.patch b/queue-5.16/octeontx2-af-initialize-action-variable.patch
new file mode 100644
index 00000000000..37b979e8036
--- /dev/null
+++ b/queue-5.16/octeontx2-af-initialize-action-variable.patch
@@ -0,0 +1,109 @@
+From 22705f62a25176e8b05b55f1d171ad98de9a6b03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 09:03:06 -0700
+Subject: octeontx2-af: initialize action variable
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 33b5bc9e703383e396f275d51fc4bafa48dbae5a ]
+
+Clang static analysis reports this representative issue
+rvu_npc.c:898:15: warning: Assigned value is garbage
+  or undefined
+  req.match_id = action.match_id;
+               ^ ~~~~~~~~~~~~~~~
+
+The initial setting of action is conditional on
+ if (is_mcam_entry_enabled(...))
+The later check of action.op will sometimes be garbage.
+So initialize action.
+
+Reduce setting of
+  *(u64 *)&action = 0x00;
+to
+  *(u64 *)&action = 0;
+
+Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/rvu_npc.c   | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 91f86d77cd41..3a31fb8cc155 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -605,7 +605,7 @@ void rvu_npc_install_ucast_entry(struct rvu *rvu, u16 pcifunc,
+ 	struct npc_install_flow_req req = { 0 };
+ 	struct npc_install_flow_rsp rsp = { 0 };
+ 	struct npc_mcam *mcam = &rvu->hw->mcam;
+-	struct nix_rx_action action;
++	struct nix_rx_action action = { 0 };
+ 	int blkaddr, index;
+ 
+ 	/* AF's and SDP VFs work in promiscuous mode */
+@@ -626,7 +626,6 @@ void rvu_npc_install_ucast_entry(struct rvu *rvu, u16 pcifunc,
+ 		*(u64 *)&action = npc_get_mcam_action(rvu, mcam,
+ 						      blkaddr, index);
+ 	} else {
+-		*(u64 *)&action = 0x00;
+ 		action.op = NIX_RX_ACTIONOP_UCAST;
+ 		action.pf_func = pcifunc;
+ 	}
+@@ -657,7 +656,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc,
+ 	struct npc_mcam *mcam = &rvu->hw->mcam;
+ 	struct rvu_hwinfo *hw = rvu->hw;
+ 	int blkaddr, ucast_idx, index;
+-	struct nix_rx_action action;
++	struct nix_rx_action action = { 0 };
+ 	u64 relaxed_mask;
+ 
+ 	if (!hw->cap.nix_rx_multicast && is_cgx_vf(rvu, pcifunc))
+@@ -685,14 +684,14 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc,
+ 						      blkaddr, ucast_idx);
+ 
+ 	if (action.op != NIX_RX_ACTIONOP_RSS) {
+-		*(u64 *)&action = 0x00;
++		*(u64 *)&action = 0;
+ 		action.op = NIX_RX_ACTIONOP_UCAST;
+ 	}
+ 
+ 	/* RX_ACTION set to MCAST for CGX PF's */
+ 	if (hw->cap.nix_rx_multicast && pfvf->use_mce_list &&
+ 	    is_pf_cgxmapped(rvu, rvu_get_pf(pcifunc))) {
+-		*(u64 *)&action = 0x00;
++		*(u64 *)&action = 0;
+ 		action.op = NIX_RX_ACTIONOP_MCAST;
+ 		pfvf = rvu_get_pfvf(rvu, pcifunc & ~RVU_PFVF_FUNC_MASK);
+ 		action.index = pfvf->promisc_mce_idx;
+@@ -832,7 +831,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf,
+ 	struct rvu_hwinfo *hw = rvu->hw;
+ 	int blkaddr, ucast_idx, index;
+ 	u8 mac_addr[ETH_ALEN] = { 0 };
+-	struct nix_rx_action action;
++	struct nix_rx_action action = { 0 };
+ 	struct rvu_pfvf *pfvf;
+ 	u16 vf_func;
+ 
+@@ -861,14 +860,14 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf,
+ 							blkaddr, ucast_idx);
+ 
+ 	if (action.op != NIX_RX_ACTIONOP_RSS) {
+-		*(u64 *)&action = 0x00;
++		*(u64 *)&action = 0;
+ 		action.op = NIX_RX_ACTIONOP_UCAST;
+ 		action.pf_func = pcifunc;
+ 	}
+ 
+ 	/* RX_ACTION set to MCAST for CGX PF's */
+ 	if (hw->cap.nix_rx_multicast && pfvf->use_mce_list) {
+-		*(u64 *)&action = 0x00;
++		*(u64 *)&action = 0;
+ 		action.op = NIX_RX_ACTIONOP_MCAST;
+ 		action.index = pfvf->mcast_mce_idx;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/openvswitch-always-update-flow-key-after-nat.patch b/queue-5.16/openvswitch-always-update-flow-key-after-nat.patch
new file mode 100644
index 00000000000..a5dfe2c6660
--- /dev/null
+++ b/queue-5.16/openvswitch-always-update-flow-key-after-nat.patch
@@ -0,0 +1,200 @@
+From abc869eeabd1db900619e7f2ac5e4044ecb67c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 08:43:19 -0400
+Subject: openvswitch: always update flow key after nat
+
+From: Aaron Conole <aconole@redhat.com>
+
+[ Upstream commit 60b44ca6bd7518dd38fa2719bc9240378b6172c3 ]
+
+During NAT, a tuple collision may occur.  When this happens, openvswitch
+will make a second pass through NAT which will perform additional packet
+modification.  This will update the skb data, but not the flow key that
+OVS uses.  This means that future flow lookups, and packet matches will
+have incorrect data.  This has been supported since
+5d50aa83e2c8 ("openvswitch: support asymmetric conntrack").
+
+That commit failed to properly update the sw_flow_key attributes, since
+it only called the ovs_ct_nat_update_key once, rather than each time
+ovs_ct_nat_execute was called.  As these two operations are linked, the
+ovs_ct_nat_execute() function should always make sure that the
+sw_flow_key is updated after a successful call through NAT infrastructure.
+
+Fixes: 5d50aa83e2c8 ("openvswitch: support asymmetric conntrack")
+Cc: Dumitru Ceara <dceara@redhat.com>
+Cc: Numan Siddique <nusiddiq@redhat.com>
+Signed-off-by: Aaron Conole <aconole@redhat.com>
+Acked-by: Eelco Chaudron <echaudro@redhat.com>
+Link: https://lore.kernel.org/r/20220318124319.3056455-1-aconole@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/conntrack.c | 118 ++++++++++++++++++------------------
+ 1 file changed, 59 insertions(+), 59 deletions(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 1b5eae57bc90..8f47f4e78d32 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -732,6 +732,57 @@ static bool skb_nfct_cached(struct net *net,
+ }
+ 
+ #if IS_ENABLED(CONFIG_NF_NAT)
++static void ovs_nat_update_key(struct sw_flow_key *key,
++			       const struct sk_buff *skb,
++			       enum nf_nat_manip_type maniptype)
++{
++	if (maniptype == NF_NAT_MANIP_SRC) {
++		__be16 src;
++
++		key->ct_state |= OVS_CS_F_SRC_NAT;
++		if (key->eth.type == htons(ETH_P_IP))
++			key->ipv4.addr.src = ip_hdr(skb)->saddr;
++		else if (key->eth.type == htons(ETH_P_IPV6))
++			memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
++			       sizeof(key->ipv6.addr.src));
++		else
++			return;
++
++		if (key->ip.proto == IPPROTO_UDP)
++			src = udp_hdr(skb)->source;
++		else if (key->ip.proto == IPPROTO_TCP)
++			src = tcp_hdr(skb)->source;
++		else if (key->ip.proto == IPPROTO_SCTP)
++			src = sctp_hdr(skb)->source;
++		else
++			return;
++
++		key->tp.src = src;
++	} else {
++		__be16 dst;
++
++		key->ct_state |= OVS_CS_F_DST_NAT;
++		if (key->eth.type == htons(ETH_P_IP))
++			key->ipv4.addr.dst = ip_hdr(skb)->daddr;
++		else if (key->eth.type == htons(ETH_P_IPV6))
++			memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
++			       sizeof(key->ipv6.addr.dst));
++		else
++			return;
++
++		if (key->ip.proto == IPPROTO_UDP)
++			dst = udp_hdr(skb)->dest;
++		else if (key->ip.proto == IPPROTO_TCP)
++			dst = tcp_hdr(skb)->dest;
++		else if (key->ip.proto == IPPROTO_SCTP)
++			dst = sctp_hdr(skb)->dest;
++		else
++			return;
++
++		key->tp.dst = dst;
++	}
++}
++
+ /* Modelled after nf_nat_ipv[46]_fn().
+  * range is only used for new, uninitialized NAT state.
+  * Returns either NF_ACCEPT or NF_DROP.
+@@ -739,7 +790,7 @@ static bool skb_nfct_cached(struct net *net,
+ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
+ 			      enum ip_conntrack_info ctinfo,
+ 			      const struct nf_nat_range2 *range,
+-			      enum nf_nat_manip_type maniptype)
++			      enum nf_nat_manip_type maniptype, struct sw_flow_key *key)
+ {
+ 	int hooknum, nh_off, err = NF_ACCEPT;
+ 
+@@ -811,58 +862,11 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
+ push:
+ 	skb_push_rcsum(skb, nh_off);
+ 
+-	return err;
+-}
+-
+-static void ovs_nat_update_key(struct sw_flow_key *key,
+-			       const struct sk_buff *skb,
+-			       enum nf_nat_manip_type maniptype)
+-{
+-	if (maniptype == NF_NAT_MANIP_SRC) {
+-		__be16 src;
+-
+-		key->ct_state |= OVS_CS_F_SRC_NAT;
+-		if (key->eth.type == htons(ETH_P_IP))
+-			key->ipv4.addr.src = ip_hdr(skb)->saddr;
+-		else if (key->eth.type == htons(ETH_P_IPV6))
+-			memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
+-			       sizeof(key->ipv6.addr.src));
+-		else
+-			return;
+-
+-		if (key->ip.proto == IPPROTO_UDP)
+-			src = udp_hdr(skb)->source;
+-		else if (key->ip.proto == IPPROTO_TCP)
+-			src = tcp_hdr(skb)->source;
+-		else if (key->ip.proto == IPPROTO_SCTP)
+-			src = sctp_hdr(skb)->source;
+-		else
+-			return;
+-
+-		key->tp.src = src;
+-	} else {
+-		__be16 dst;
+-
+-		key->ct_state |= OVS_CS_F_DST_NAT;
+-		if (key->eth.type == htons(ETH_P_IP))
+-			key->ipv4.addr.dst = ip_hdr(skb)->daddr;
+-		else if (key->eth.type == htons(ETH_P_IPV6))
+-			memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
+-			       sizeof(key->ipv6.addr.dst));
+-		else
+-			return;
+-
+-		if (key->ip.proto == IPPROTO_UDP)
+-			dst = udp_hdr(skb)->dest;
+-		else if (key->ip.proto == IPPROTO_TCP)
+-			dst = tcp_hdr(skb)->dest;
+-		else if (key->ip.proto == IPPROTO_SCTP)
+-			dst = sctp_hdr(skb)->dest;
+-		else
+-			return;
++	/* Update the flow key if NAT successful. */
++	if (err == NF_ACCEPT)
++		ovs_nat_update_key(key, skb, maniptype);
+ 
+-		key->tp.dst = dst;
+-	}
++	return err;
+ }
+ 
+ /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
+@@ -904,7 +908,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 	} else {
+ 		return NF_ACCEPT; /* Connection is not NATed. */
+ 	}
+-	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
++	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key);
+ 
+ 	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
+ 		if (ct->status & IPS_SRC_NAT) {
+@@ -914,17 +918,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 				maniptype = NF_NAT_MANIP_SRC;
+ 
+ 			err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+-						 maniptype);
++						 maniptype, key);
+ 		} else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
+ 			err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
+-						 NF_NAT_MANIP_SRC);
++						 NF_NAT_MANIP_SRC, key);
+ 		}
+ 	}
+ 
+-	/* Mark NAT done if successful and update the flow key. */
+-	if (err == NF_ACCEPT)
+-		ovs_nat_update_key(key, skb, maniptype);
+-
+ 	return err;
+ }
+ #else /* !CONFIG_NF_NAT */
+-- 
+2.34.1
+
diff --git a/queue-5.16/parisc-fix-handling-off-probe-non-access-faults.patch b/queue-5.16/parisc-fix-handling-off-probe-non-access-faults.patch
new file mode 100644
index 00000000000..39294227b7b
--- /dev/null
+++ b/queue-5.16/parisc-fix-handling-off-probe-non-access-faults.patch
@@ -0,0 +1,168 @@
+From ee7bf0fe942ba2fdf428e41ca95427a662488b06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 21:14:36 +0000
+Subject: parisc: Fix handling off probe non-access faults
+
+From: John David Anglin <dave.anglin@bell.net>
+
+[ Upstream commit e00b0a2ab8ec019c344e53bfc76e31c18bb587b7 ]
+
+Currently, the parisc kernel does not fully support non-access TLB
+fault handling for probe instructions. In the fast path, we set the
+target register to zero if it is not a shadowed register. The slow
+path is not implemented, so we call do_page_fault. The architecture
+indicates that non-access faults should not cause a page fault from
+disk.
+
+This change adds to code to provide non-access fault support for
+probe instructions. It also modifies the handling of faults on
+userspace so that if the address lies in a valid VMA and the access
+type matches that for the VMA, the probe target register is set to
+one. Otherwise, the target register is set to zero.
+
+This was done to make probe instructions more useful for userspace.
+Probe instructions are not very useful if they set the target register
+to zero whenever a page is not present in memory. Nominally, the
+purpose of the probe instruction is determine whether read or write
+access to a given address is allowed.
+
+This fixes a problem in function pointer comparison noticed in the
+glibc testsuite (stdio-common/tst-vfprintf-user-type). The same
+problem is likely in glibc (_dl_lookup_address).
+
+V2 adds flush and lpa instruction support to handle_nadtlb_fault.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/traps.h |  1 +
+ arch/parisc/kernel/traps.c      |  2 +
+ arch/parisc/mm/fault.c          | 89 +++++++++++++++++++++++++++++++++
+ 3 files changed, 92 insertions(+)
+
+diff --git a/arch/parisc/include/asm/traps.h b/arch/parisc/include/asm/traps.h
+index 34619f010c63..0ccdb738a9a3 100644
+--- a/arch/parisc/include/asm/traps.h
++++ b/arch/parisc/include/asm/traps.h
+@@ -18,6 +18,7 @@ unsigned long parisc_acctyp(unsigned long code, unsigned int inst);
+ const char *trap_name(unsigned long code);
+ void do_page_fault(struct pt_regs *regs, unsigned long code,
+ 		unsigned long address);
++int handle_nadtlb_fault(struct pt_regs *regs);
+ #endif
+ 
+ #endif
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index eb41fece1910..b56aab7141ed 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -662,6 +662,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+ 			 by hand. Technically we need to emulate:
+ 			 fdc,fdce,pdc,"fic,4f",prober,probeir,probew, probeiw
+ 		*/
++		if (code == 17 && handle_nadtlb_fault(regs))
++			return;
+ 		fault_address = regs->ior;
+ 		fault_space = regs->isr;
+ 		break;
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index 4a6221b869fd..22ffe11cec72 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -424,3 +424,92 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,
+ 		goto no_context;
+ 	pagefault_out_of_memory();
+ }
++
++/* Handle non-access data TLB miss faults.
++ *
++ * For probe instructions, accesses to userspace are considered allowed
++ * if they lie in a valid VMA and the access type matches. We are not
++ * allowed to handle MM faults here so there may be situations where an
++ * actual access would fail even though a probe was successful.
++ */
++int
++handle_nadtlb_fault(struct pt_regs *regs)
++{
++	unsigned long insn = regs->iir;
++	int breg, treg, xreg, val = 0;
++	struct vm_area_struct *vma, *prev_vma;
++	struct task_struct *tsk;
++	struct mm_struct *mm;
++	unsigned long address;
++	unsigned long acc_type;
++
++	switch (insn & 0x380) {
++	case 0x280:
++		/* FDC instruction */
++		fallthrough;
++	case 0x380:
++		/* PDC and FIC instructions */
++		if (printk_ratelimit()) {
++			pr_warn("BUG: nullifying cache flush/purge instruction\n");
++			show_regs(regs);
++		}
++		if (insn & 0x20) {
++			/* Base modification */
++			breg = (insn >> 21) & 0x1f;
++			xreg = (insn >> 16) & 0x1f;
++			if (breg && xreg)
++				regs->gr[breg] += regs->gr[xreg];
++		}
++		regs->gr[0] |= PSW_N;
++		return 1;
++
++	case 0x180:
++		/* PROBE instruction */
++		treg = insn & 0x1f;
++		if (regs->isr) {
++			tsk = current;
++			mm = tsk->mm;
++			if (mm) {
++				/* Search for VMA */
++				address = regs->ior;
++				mmap_read_lock(mm);
++				vma = find_vma_prev(mm, address, &prev_vma);
++				mmap_read_unlock(mm);
++
++				/*
++				 * Check if access to the VMA is okay.
++				 * We don't allow for stack expansion.
++				 */
++				acc_type = (insn & 0x40) ? VM_WRITE : VM_READ;
++				if (vma
++				    && address >= vma->vm_start
++				    && (vma->vm_flags & acc_type) == acc_type)
++					val = 1;
++			}
++		}
++		if (treg)
++			regs->gr[treg] = val;
++		regs->gr[0] |= PSW_N;
++		return 1;
++
++	case 0x300:
++		/* LPA instruction */
++		if (insn & 0x20) {
++			/* Base modification */
++			breg = (insn >> 21) & 0x1f;
++			xreg = (insn >> 16) & 0x1f;
++			if (breg && xreg)
++				regs->gr[breg] += regs->gr[xreg];
++		}
++		treg = insn & 0x1f;
++		if (treg)
++			regs->gr[treg] = 0;
++		regs->gr[0] |= PSW_N;
++		return 1;
++
++	default:
++		break;
++	}
++
++	return 0;
++}
+-- 
+2.34.1
+
diff --git a/queue-5.16/parisc-fix-non-access-data-tlb-cache-flush-faults.patch b/queue-5.16/parisc-fix-non-access-data-tlb-cache-flush-faults.patch
new file mode 100644
index 00000000000..1b98ee2222b
--- /dev/null
+++ b/queue-5.16/parisc-fix-non-access-data-tlb-cache-flush-faults.patch
@@ -0,0 +1,92 @@
+From cf75cd591e1b20588bfb29ae62e41b4e582136c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 17:22:54 +0000
+Subject: parisc: Fix non-access data TLB cache flush faults
+
+From: John David Anglin <dave.anglin@bell.net>
+
+[ Upstream commit f839e5f1cef36ce268950c387129b1bfefdaebc9 ]
+
+When a page is not present, we get non-access data TLB faults from
+the fdc and fic instructions in flush_user_dcache_range_asm and
+flush_user_icache_range_asm. When these occur, the cache line is
+not invalidated and potentially we get memory corruption. The
+problem was hidden by the nullification of the flush instructions.
+
+These faults also affect performance. With pa8800/pa8900 processors,
+there will be 32 faults per 4 KB page since the cache line is 128
+bytes.  There will be more faults with earlier processors.
+
+The problem is fixed by using flush_cache_pages(). It does the flush
+using a tmp alias mapping.
+
+The flush_cache_pages() call in flush_cache_range() flushed too
+large a range.
+
+V2: Remove unnecessary preempt_disable() and preempt_enable() calls.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/cache.c | 28 +---------------------------
+ 1 file changed, 1 insertion(+), 27 deletions(-)
+
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 94150b91c96f..bce71cefe572 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -558,15 +558,6 @@ static void flush_cache_pages(struct vm_area_struct *vma, struct mm_struct *mm,
+ 	}
+ }
+ 
+-static void flush_user_cache_tlb(struct vm_area_struct *vma,
+-				 unsigned long start, unsigned long end)
+-{
+-	flush_user_dcache_range_asm(start, end);
+-	if (vma->vm_flags & VM_EXEC)
+-		flush_user_icache_range_asm(start, end);
+-	flush_tlb_range(vma, start, end);
+-}
+-
+ void flush_cache_mm(struct mm_struct *mm)
+ {
+ 	struct vm_area_struct *vma;
+@@ -581,17 +572,8 @@ void flush_cache_mm(struct mm_struct *mm)
+ 		return;
+ 	}
+ 
+-	preempt_disable();
+-	if (mm->context == mfsp(3)) {
+-		for (vma = mm->mmap; vma; vma = vma->vm_next)
+-			flush_user_cache_tlb(vma, vma->vm_start, vma->vm_end);
+-		preempt_enable();
+-		return;
+-	}
+-
+ 	for (vma = mm->mmap; vma; vma = vma->vm_next)
+ 		flush_cache_pages(vma, mm, vma->vm_start, vma->vm_end);
+-	preempt_enable();
+ }
+ 
+ void flush_cache_range(struct vm_area_struct *vma,
+@@ -605,15 +587,7 @@ void flush_cache_range(struct vm_area_struct *vma,
+ 		return;
+ 	}
+ 
+-	preempt_disable();
+-	if (vma->vm_mm->context == mfsp(3)) {
+-		flush_user_cache_tlb(vma, start, end);
+-		preempt_enable();
+-		return;
+-	}
+-
+-	flush_cache_pages(vma, vma->vm_mm, vma->vm_start, vma->vm_end);
+-	preempt_enable();
++	flush_cache_pages(vma, vma->vm_mm, start, end);
+ }
+ 
+ void
+-- 
+2.34.1
+
diff --git a/queue-5.16/pci-aardvark-fix-reading-msi-interrupt-number.patch b/queue-5.16/pci-aardvark-fix-reading-msi-interrupt-number.patch
new file mode 100644
index 00000000000..b9b52cfeb58
--- /dev/null
+++ b/queue-5.16/pci-aardvark-fix-reading-msi-interrupt-number.patch
@@ -0,0 +1,65 @@
+From cfeba307fc189a5716ab0d1e4561b5c298d4b3d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 02:49:57 +0100
+Subject: PCI: aardvark: Fix reading MSI interrupt number
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 805dfc18dd3d4dd97a987d4406593b5a225b1253 ]
+
+In advk_pcie_handle_msi() it is expected that when bit i in the W1C
+register PCIE_MSI_STATUS_REG is cleared, the PCIE_MSI_PAYLOAD_REG is
+updated to contain the MSI number corresponding to index i.
+
+Experiments show that this is not so, and instead PCIE_MSI_PAYLOAD_REG
+always contains the number of the last received MSI, overall.
+
+Do not read PCIE_MSI_PAYLOAD_REG register for determining MSI interrupt
+number. Since Aardvark already forbids more than 32 interrupts and uses
+own allocated hwirq numbers, the msi_idx already corresponds to the
+received MSI number.
+
+Link: https://lore.kernel.org/r/20220110015018.26359-3-kabel@kernel.org
+Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index b2217e2b3efd..7aa6d6336223 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -1381,7 +1381,6 @@ static void advk_pcie_remove_irq_domain(struct advk_pcie *pcie)
+ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
+ {
+ 	u32 msi_val, msi_mask, msi_status, msi_idx;
+-	u16 msi_data;
+ 
+ 	msi_mask = advk_readl(pcie, PCIE_MSI_MASK_REG);
+ 	msi_val = advk_readl(pcie, PCIE_MSI_STATUS_REG);
+@@ -1391,13 +1390,9 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
+ 		if (!(BIT(msi_idx) & msi_status))
+ 			continue;
+ 
+-		/*
+-		 * msi_idx contains bits [4:0] of the msi_data and msi_data
+-		 * contains 16bit MSI interrupt number
+-		 */
+ 		advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
+-		msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
+-		generic_handle_irq(msi_data);
++		if (generic_handle_domain_irq(pcie->msi_inner_domain, msi_idx) == -EINVAL)
++			dev_err_ratelimited(&pcie->pdev->dev, "unexpected MSI 0x%02x\n", msi_idx);
+ 	}
+ 
+ 	advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING,
+-- 
+2.34.1
+
diff --git a/queue-5.16/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch b/queue-5.16/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
new file mode 100644
index 00000000000..950ef302cf6
--- /dev/null
+++ b/queue-5.16/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
@@ -0,0 +1,55 @@
+From 20587e6686c5ec489d6ca2e9ac4b890ede5a40ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 02:50:09 +0100
+Subject: PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 735f5ae49e1b44742cc63ca9b5c1ffde3e94ba91 ]
+
+The emulated bridge returns incorrect value for PCI_EXP_RTSTA register
+during readout in advk_pci_bridge_emul_pcie_conf_read() function: the
+correct bit is BIT(16), but we are setting BIT(23), because the code
+does
+  *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16
+where
+  PCIE_MSG_PM_PME_MASK
+is
+  BIT(7).
+
+The code should probably have been something like
+  *value = (!!(isr0 & PCIE_MSG_PM_PME_MASK)) << 16,
+but we are better of using an if() and using the proper macro for this
+bit.
+
+Link: https://lore.kernel.org/r/20220110015018.26359-15-kabel@kernel.org
+Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 7aa6d6336223..a924564fdbbc 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -844,7 +844,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
+ 	case PCI_EXP_RTSTA: {
+ 		u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG);
+ 		u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG);
+-		*value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16);
++		*value = msglog >> 16;
++		if (isr0 & PCIE_MSG_PM_PME_MASK)
++			*value |= PCI_EXP_RTSTA_PME;
+ 		return PCI_BRIDGE_EMUL_HANDLED;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/pci-avoid-broken-msi-on-sb600-usb-devices.patch b/queue-5.16/pci-avoid-broken-msi-on-sb600-usb-devices.patch
new file mode 100644
index 00000000000..e687307269a
--- /dev/null
+++ b/queue-5.16/pci-avoid-broken-msi-on-sb600-usb-devices.patch
@@ -0,0 +1,61 @@
+From 15d2bcf69a1d60be7bfa1ee93831ac9447bce43e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 13:34:46 -0500
+Subject: PCI: Avoid broken MSI on SB600 USB devices
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 63cd736f449445edcd7f0bcc7d84453e9beec0aa ]
+
+Some ATI SB600 USB adapters advertise MSI, but if INTx is disabled by
+setting PCI_COMMAND_INTX_DISABLE, MSI doesn't work either.  The PCI/PCIe
+specs do not require software to set PCI_COMMAND_INTX_DISABLE when enabling
+MSI, but Linux has done that for many years.
+
+Mick reported that 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI
+devices") broke these devices.  Prior to 306c54d0edb6, they used INTx.
+Starting with 306c54d0edb6, they use MSI, and and the fact that Linux sets
+PCI_COMMAND_INTX_DISABLE means both INTx and MSI are disabled on these
+devices.
+
+Avoid this SB600 defect by disabling MSI so we use INTx as before.
+
+Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
+Link: https://lore.kernel.org/r/20220321183446.1108325-1-helgaas@kernel.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215690
+Link: https://lore.kernel.org/all/PxIByDyBRcsbpcmVhGSNDFAoUcMmb78ctXCkw6fbpx25TGlCHvA6SJjjFkNr1FfQZMntYPTNyvEnblxzAZ8a6jP9ddLpKeCN6Chi_2FuexU=@protonmail.com/
+Link: https://lore.kernel.org/r/20220314101448.90074-1-andriy.shevchenko@linux.intel.com
+BugLink: https://lore.kernel.org/all/20200702143045.23429-1-andriy.shevchenko@linux.intel.com/
+Reported-by: Mick Lorain <micklorain@protonmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index db864bf634a3..6272b122f400 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1811,6 +1811,18 @@ static void quirk_alder_ioapic(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_EESSC,	quirk_alder_ioapic);
+ #endif
+ 
++static void quirk_no_msi(struct pci_dev *dev)
++{
++	pci_info(dev, "avoiding MSI to work around a hardware defect\n");
++	dev->no_msi = 1;
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4386, quirk_no_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4387, quirk_no_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi);
++
+ static void quirk_pcie_mch(struct pci_dev *pdev)
+ {
+ 	pdev->no_msi = 1;
+-- 
+2.34.1
+
diff --git a/queue-5.16/pci-reduce-warnings-on-possible-rw1c-corruption.patch b/queue-5.16/pci-reduce-warnings-on-possible-rw1c-corruption.patch
new file mode 100644
index 00000000000..26e60cd741b
--- /dev/null
+++ b/queue-5.16/pci-reduce-warnings-on-possible-rw1c-corruption.patch
@@ -0,0 +1,71 @@
+From b4c2824b1ed3d7cc56e66f35bfd7820f2198d056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 16:14:55 +1200
+Subject: PCI: Reduce warnings on possible RW1C corruption
+
+From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+
+[ Upstream commit 92c45b63ce22c8898aa41806e8d6692bcd577510 ]
+
+For hardware that only supports 32-bit writes to PCI there is the
+possibility of clearing RW1C (write-one-to-clear) bits. A rate-limited
+messages was introduced by fb2659230120, but rate-limiting is not the best
+choice here. Some devices may not show the warnings they should if another
+device has just produced a bunch of warnings. Also, the number of messages
+can be a nuisance on devices which are otherwise working fine.
+
+Change the ratelimit to a single warning per bus. This ensures no bus is
+'starved' of emitting a warning and also that there isn't a continuous
+stream of warnings. It would be preferable to have a warning per device,
+but the pci_dev structure is not available here, and a lookup from devfn
+would be far too slow.
+
+Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
+Fixes: fb2659230120 ("PCI: Warn on possible RW1C corruption for sub-32 bit config writes")
+Link: https://lore.kernel.org/r/20200806041455.11070-1-mark.tomlinson@alliedtelesis.co.nz
+Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Acked-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/access.c | 9 ++++++---
+ include/linux/pci.h  | 1 +
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 46935695cfb9..8d0d1f61c650 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
+ 	 * write happen to have any RW1C (write-one-to-clear) bits set, we
+ 	 * just inadvertently cleared something we shouldn't have.
+ 	 */
+-	dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
+-			     size, pci_domain_nr(bus), bus->number,
+-			     PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++	if (!bus->unsafe_warn) {
++		dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
++			 size, pci_domain_nr(bus), bus->number,
++			 PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++		bus->unsafe_warn = 1;
++	}
+ 
+ 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
+ 	tmp = readl(addr) & mask;
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 18a75c8e615c..2d6118937d07 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -656,6 +656,7 @@ struct pci_bus {
+ 	struct bin_attribute	*legacy_io;	/* Legacy I/O for this bus */
+ 	struct bin_attribute	*legacy_mem;	/* Legacy mem */
+ 	unsigned int		is_added:1;
++	unsigned int		unsafe_warn:1;	/* warned about RW1C config write */
+ };
+ 
+ #define to_pci_bus(n)	container_of(n, struct pci_bus, dev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/perf-core-fix-address-filter-parser-for-multiple-fil.patch b/queue-5.16/perf-core-fix-address-filter-parser-for-multiple-fil.patch
new file mode 100644
index 00000000000..18dac2cd620
--- /dev/null
+++ b/queue-5.16/perf-core-fix-address-filter-parser-for-multiple-fil.patch
@@ -0,0 +1,40 @@
+From 143c05d09cb499d35c8158e34b31dae7b3eed997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 09:24:51 +0200
+Subject: perf/core: Fix address filter parser for multiple filters
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit d680ff24e9e14444c63945b43a37ede7cd6958f9 ]
+
+Reset appropriate variables in the parser loop between parsing separate
+filters, so that they do not interfere with parsing the next filter.
+
+Fixes: 375637bc524952 ("perf/core: Introduce address range filtering")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220131072453.2839535-4-adrian.hunter@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e4a43d475ba6..a0e196f973b9 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -10560,8 +10560,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ 			}
+ 
+ 			/* ready to consume more filters */
++			kfree(filename);
++			filename = NULL;
+ 			state = IF_STATE_ACTION;
+ 			filter = NULL;
++			kernel = 0;
+ 		}
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/perf-stat-fix-forked-applications-enablement-of-coun.patch b/queue-5.16/perf-stat-fix-forked-applications-enablement-of-coun.patch
new file mode 100644
index 00000000000..c4e636baea4
--- /dev/null
+++ b/queue-5.16/perf-stat-fix-forked-applications-enablement-of-coun.patch
@@ -0,0 +1,99 @@
+From 2a28a31fe10c7fd8e0cd53865e23e779efb18a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 16:53:46 +0100
+Subject: perf stat: Fix forked applications enablement of counters
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit d0a0a511493d269514fcbd852481cdca32c95350 ]
+
+I have run into the following issue:
+
+ # perf stat -a -e new_pmu/INSTRUCTION_7/ --  mytest -c1 7
+
+ Performance counter stats for 'system wide':
+
+                 0      new_pmu/INSTRUCTION_7/
+
+       0.000366428 seconds time elapsed
+ #
+
+The new PMU for s390 counts the execution of certain CPU instructions.
+The root cause is the extremely small run time of the mytest program. It
+just executes some assembly instructions and then exits.
+
+In above invocation the instruction is executed exactly one time (-c1
+option). The PMU is expected to report this one time execution by a
+counter value of one, but fails to do so in some cases, not all.
+
+Debugging reveals the invocation of the child process is done
+*before* the counter events are installed and enabled.
+
+Tracing reveals that sometimes the child process starts and exits before
+the event is installed on all CPUs. The more CPUs the machine has, the
+more often this miscount happens.
+
+Fix this by reversing the start of the work load after the events have
+been installed on the specified CPUs. Now the comment also matches the
+code.
+
+Output after:
+
+ # perf stat -a -e new_pmu/INSTRUCTION_7/ --  mytest -c1 7
+
+ Performance counter stats for 'system wide':
+
+                 1      new_pmu/INSTRUCTION_7/
+
+       0.000366428 seconds time elapsed
+ #
+
+Now the correct result is reported rock solid all the time regardless
+how many CPUs are online.
+
+Reviewers notes:
+
+Jiri:
+
+Right, without -a the event has enable_on_exec so the race does not
+matter, but it's a problem for system wide with fork.
+
+Namhyung:
+
+Agreed. Also we may move the enable_counters() and the clock code out of
+the if block to be shared with the else block.
+
+Fixes: acf2892270dcc428 ("perf stat: Use perf_evlist__prepare/start_workload()")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220317155346.577384-1-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 7974933dbc77..08c024038ca7 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -956,10 +956,10 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 	 * Enable counters and exec the command:
+ 	 */
+ 	if (forks) {
+-		evlist__start_workload(evsel_list);
+ 		err = enable_counters();
+ 		if (err)
+ 			return -1;
++		evlist__start_workload(evsel_list);
+ 
+ 		t0 = rdclock();
+ 		clock_gettime(CLOCK_MONOTONIC, &ref_time);
+-- 
+2.34.1
+
diff --git a/queue-5.16/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch b/queue-5.16/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
new file mode 100644
index 00000000000..2fd9eb15bdd
--- /dev/null
+++ b/queue-5.16/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
@@ -0,0 +1,37 @@
+From 285aa5a33f6107ef31b1e09b70d57ffd4a83d8bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 09:24:52 +0200
+Subject: perf/x86/intel/pt: Fix address filter config for 32-bit kernel
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit e5524bf1047eb3b3f3f33b5f59897ba67b3ade87 ]
+
+Change from shifting 'unsigned long' to 'u64' to prevent the config bits
+being lost on a 32-bit kernel.
+
+Fixes: eadf48cab4b6b0 ("perf/x86/intel/pt: Add support for address range filtering in PT")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220131072453.2839535-5-adrian.hunter@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/pt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index 2d33bba9a144..215aed65e978 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -472,7 +472,7 @@ static u64 pt_config_filters(struct perf_event *event)
+ 			pt->filters.filter[range].msr_b = filter->msr_b;
+ 		}
+ 
+-		rtit_ctl |= filter->config << pt_address_ranges[range].reg_off;
++		rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off;
+ 	}
+ 
+ 	return rtit_ctl;
+-- 
+2.34.1
+
diff --git a/queue-5.16/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch b/queue-5.16/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
new file mode 100644
index 00000000000..f1e4166bd56
--- /dev/null
+++ b/queue-5.16/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
@@ -0,0 +1,70 @@
+From 4dd6916962a0b90c5792be7931f059a2a1f3865e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 15:12:57 +0800
+Subject: phy: dphy: Correct lpx parameter and its
+ derivatives(ta_{get,go,sure})
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit 3153fa38e38af566cf6454a03b1dbadaf6f323c0 ]
+
+According to the comment of the function phy_mipi_dphy_get_default_config(),
+it uses minimum D-PHY timings based on MIPI D-PHY specification.  They are
+derived from the valid ranges specified in Section 6.9, Table 14, Page 41
+of the D-PHY specification (v1.2).  The table 14 explicitly mentions that
+the minimum T-LPX parameter is 50 nanoseconds and the minimum TA-SURE
+parameter is T-LPX nanoseconds.  Likewise, the kernel doc of the 'lpx' and
+'ta_sure' members of struct phy_configure_opts_mipi_dphy mentions that
+the minimum values are 50000 picoseconds and @lpx picoseconds respectively.
+Also, the function phy_mipi_dphy_config_validate() checks if cfg->lpx is
+less than 50000 picoseconds and if cfg->ta_sure is less than cfg->lpx,
+which hints the same minimum values.
+
+Without this patch, the function phy_mipi_dphy_get_default_config()
+wrongly sets cfg->lpx to 60000 picoseconds and cfg->ta_sure to 2 * cfg->lpx.
+So, let's correct them to 50000 picoseconds and cfg->lpx respectively.
+
+Note that I've only tested the patch with RM67191 DSI panel on i.MX8mq EVK.
+Help is needed to test with other i.MX8mq, Meson and Rockchip platforms,
+as I don't have the hardwares.
+
+Fixes: dddc97e82303 ("phy: dphy: Add configuration helpers")
+Cc: Andrzej Hajda <andrzej.hajda@intel.com>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Guido Günther <agx@sigxcpu.org>
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Link: https://lore.kernel.org/r/20220216071257.1647703-1-victor.liu@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/phy-core-mipi-dphy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c
+index ccb4045685cd..929e86d6558e 100644
+--- a/drivers/phy/phy-core-mipi-dphy.c
++++ b/drivers/phy/phy-core-mipi-dphy.c
+@@ -64,10 +64,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock,
+ 	cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui);
+ 
+ 	cfg->init = 100;
+-	cfg->lpx = 60000;
++	cfg->lpx = 50000;
+ 	cfg->ta_get = 5 * cfg->lpx;
+ 	cfg->ta_go = 4 * cfg->lpx;
+-	cfg->ta_sure = 2 * cfg->lpx;
++	cfg->ta_sure = cfg->lpx;
+ 	cfg->wakeup = 1000;
+ 
+ 	cfg->hs_clk_rate = hs_clk_rate;
+-- 
+2.34.1
+
diff --git a/queue-5.16/phy-phy-brcm-usb-fixup-bcm4908-support.patch b/queue-5.16/phy-phy-brcm-usb-fixup-bcm4908-support.patch
new file mode 100644
index 00000000000..42de1fbacb0
--- /dev/null
+++ b/queue-5.16/phy-phy-brcm-usb-fixup-bcm4908-support.patch
@@ -0,0 +1,161 @@
+From 346a634d18fbca914f73817ed598435ee4b507dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 18:24:59 +0100
+Subject: phy: phy-brcm-usb: fixup BCM4908 support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 32942d33d63d27714ed16a4176e5a99547adb6e0 ]
+
+Just like every other family BCM4908 should get its own enum value. That
+is required to properly handle it in chipset conditional code.
+
+The real change is excluding BCM4908 from the PLL reprogramming code
+(see brcmusb_usb3_pll_54mhz()). I'm not sure what's the BCM4908
+reference clock frequency but:
+1. BCM4908 custom driver from Broadcom's SDK doesn't reprogram PLL
+2. Doing that in Linux driver stopped PHY handling some USB 3.0 devices
+
+This change makes USB 3.0 PHY recognize e.g.:
+1. 04e8:6860 - Samsung Electronics Co., Ltd Galaxy series, misc. (MTP mode)
+2. 1058:259f - Western Digital My Passport 259F
+
+Broadcom's STB SoCs come with a set of SUN_TOP_CTRL_* registers that
+allow reading chip family and product ids. Such a block & register is
+missing on BCM4908 so this commit introduces "compatible" string
+specific binding.
+
+Fixes: 4b402fa8e0b7 ("phy: phy-brcm-usb: support PHY on the BCM4908")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220218172459.10431-1-zajec5@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/phy-brcm-usb-init.c | 36 ++++++++++++++++++++++++
+ drivers/phy/broadcom/phy-brcm-usb-init.h |  1 +
+ drivers/phy/broadcom/phy-brcm-usb.c      | 11 +++++++-
+ 3 files changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.c b/drivers/phy/broadcom/phy-brcm-usb-init.c
+index 9391ab42a12b..dd0f66288fbd 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb-init.c
++++ b/drivers/phy/broadcom/phy-brcm-usb-init.c
+@@ -79,6 +79,7 @@
+ 
+ enum brcm_family_type {
+ 	BRCM_FAMILY_3390A0,
++	BRCM_FAMILY_4908,
+ 	BRCM_FAMILY_7250B0,
+ 	BRCM_FAMILY_7271A0,
+ 	BRCM_FAMILY_7364A0,
+@@ -96,6 +97,7 @@ enum brcm_family_type {
+ 
+ static const char *family_names[BRCM_FAMILY_COUNT] = {
+ 	USB_BRCM_FAMILY(3390A0),
++	USB_BRCM_FAMILY(4908),
+ 	USB_BRCM_FAMILY(7250B0),
+ 	USB_BRCM_FAMILY(7271A0),
+ 	USB_BRCM_FAMILY(7364A0),
+@@ -203,6 +205,27 @@ usb_reg_bits_map_table[BRCM_FAMILY_COUNT][USB_CTRL_SELECTOR_COUNT] = {
+ 		USB_CTRL_USB_PM_USB20_HC_RESETB_VAR_MASK,
+ 		ENDIAN_SETTINGS, /* USB_CTRL_SETUP ENDIAN bits */
+ 	},
++	/* 4908 */
++	[BRCM_FAMILY_4908] = {
++		0, /* USB_CTRL_SETUP_SCB1_EN_MASK */
++		0, /* USB_CTRL_SETUP_SCB2_EN_MASK */
++		0, /* USB_CTRL_SETUP_SS_EHCI64BIT_EN_MASK */
++		0, /* USB_CTRL_SETUP_STRAP_IPP_SEL_MASK */
++		0, /* USB_CTRL_SETUP_OC3_DISABLE_MASK */
++		0, /* USB_CTRL_PLL_CTL_PLL_IDDQ_PWRDN_MASK */
++		0, /* USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK */
++		USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK,
++		USB_CTRL_USB_PM_USB_PWRDN_MASK,
++		0, /* USB_CTRL_USB30_CTL1_XHC_SOFT_RESETB_MASK */
++		0, /* USB_CTRL_USB30_CTL1_USB3_IOC_MASK */
++		0, /* USB_CTRL_USB30_CTL1_USB3_IPP_MASK */
++		0, /* USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK */
++		0, /* USB_CTRL_USB_PM_SOFT_RESET_MASK */
++		0, /* USB_CTRL_SETUP_CC_DRD_MODE_ENABLE_MASK */
++		0, /* USB_CTRL_SETUP_STRAP_CC_DRD_MODE_ENABLE_SEL_MASK */
++		0, /* USB_CTRL_USB_PM_USB20_HC_RESETB_VAR_MASK */
++		0, /* USB_CTRL_SETUP ENDIAN bits */
++	},
+ 	/* 7250b0 */
+ 	[BRCM_FAMILY_7250B0] = {
+ 		USB_CTRL_SETUP_SCB1_EN_MASK,
+@@ -559,6 +582,7 @@ static void brcmusb_usb3_pll_54mhz(struct brcm_usb_init_params *params)
+ 	 */
+ 	switch (params->selected_family) {
+ 	case BRCM_FAMILY_3390A0:
++	case BRCM_FAMILY_4908:
+ 	case BRCM_FAMILY_7250B0:
+ 	case BRCM_FAMILY_7366C0:
+ 	case BRCM_FAMILY_74371A0:
+@@ -1004,6 +1028,18 @@ static const struct brcm_usb_init_ops bcm7445_ops = {
+ 	.set_dual_select = usb_set_dual_select,
+ };
+ 
++void brcm_usb_dvr_init_4908(struct brcm_usb_init_params *params)
++{
++	int fam;
++
++	fam = BRCM_FAMILY_4908;
++	params->selected_family = fam;
++	params->usb_reg_bits_map =
++		&usb_reg_bits_map_table[fam][0];
++	params->family_name = family_names[fam];
++	params->ops = &bcm7445_ops;
++}
++
+ void brcm_usb_dvr_init_7445(struct brcm_usb_init_params *params)
+ {
+ 	int fam;
+diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.h b/drivers/phy/broadcom/phy-brcm-usb-init.h
+index a39f30fa2e99..1ccb5ddab865 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb-init.h
++++ b/drivers/phy/broadcom/phy-brcm-usb-init.h
+@@ -64,6 +64,7 @@ struct  brcm_usb_init_params {
+ 	bool suspend_with_clocks;
+ };
+ 
++void brcm_usb_dvr_init_4908(struct brcm_usb_init_params *params);
+ void brcm_usb_dvr_init_7445(struct brcm_usb_init_params *params);
+ void brcm_usb_dvr_init_7216(struct brcm_usb_init_params *params);
+ void brcm_usb_dvr_init_7211b0(struct brcm_usb_init_params *params);
+diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c
+index 0f1deb6e0eab..2cb3779fcdf8 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb.c
++++ b/drivers/phy/broadcom/phy-brcm-usb.c
+@@ -283,6 +283,15 @@ static const struct attribute_group brcm_usb_phy_group = {
+ 	.attrs = brcm_usb_phy_attrs,
+ };
+ 
++static const struct match_chip_info chip_info_4908 = {
++	.init_func = &brcm_usb_dvr_init_4908,
++	.required_regs = {
++		BRCM_REGS_CTRL,
++		BRCM_REGS_XHCI_EC,
++		-1,
++	},
++};
++
+ static const struct match_chip_info chip_info_7216 = {
+ 	.init_func = &brcm_usb_dvr_init_7216,
+ 	.required_regs = {
+@@ -318,7 +327,7 @@ static const struct match_chip_info chip_info_7445 = {
+ static const struct of_device_id brcm_usb_dt_ids[] = {
+ 	{
+ 		.compatible = "brcm,bcm4908-usb-phy",
+-		.data = &chip_info_7445,
++		.data = &chip_info_4908,
+ 	},
+ 	{
+ 		.compatible = "brcm,bcm7216-usb-phy",
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch b/queue-5.16/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
new file mode 100644
index 00000000000..1e2e2491beb
--- /dev/null
+++ b/queue-5.16/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
@@ -0,0 +1,45 @@
+From fdfe86539e370ae8fb6079de85e46cfbd4647b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 07:11:54 +0000
+Subject: pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit dab4df9ca919f59e5b9dd84385eaf34d4f20dbb0 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: a6df410d420a ("pinctrl: mediatek: Add Pinctrl/GPIO driver for mt8135.")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308071155.21114-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+index 5f7c421ab6e7..334cb85855a9 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+@@ -1038,6 +1038,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ 	node = of_parse_phandle(np, "mediatek,pctl-regmap", 0);
+ 	if (node) {
+ 		pctl->regmap1 = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(pctl->regmap1))
+ 			return PTR_ERR(pctl->regmap1);
+ 	} else if (regmap) {
+@@ -1051,6 +1052,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ 	node = of_parse_phandle(np, "mediatek,pctl-regmap", 1);
+ 	if (node) {
+ 		pctl->regmap2 = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(pctl->regmap2))
+ 			return PTR_ERR(pctl->regmap2);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch b/queue-5.16/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
new file mode 100644
index 00000000000..1a198e2f3be
--- /dev/null
+++ b/queue-5.16/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
@@ -0,0 +1,45 @@
+From 65503f990819a4d3c5c5b7a516e003c896561d90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:48 +0800
+Subject: pinctrl: mediatek: paris: Fix "argument" argument type for
+ mtk_pinconf_get()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 19bce7ce0a593c7024030a0cda9e23facea3c93d ]
+
+For mtk_pinconf_get(), the "argument" argument is typically returned by
+pinconf_to_config_argument(), which holds the value for a given pinconf
+parameter. It certainly should not have the type of "enum pin_config_param",
+which describes the type of the pinconf parameter itself.
+
+Change the type to u32, which matches the return type of
+pinconf_to_config_argument().
+
+Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-4-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index f7644530cee1..cbaad89fbe17 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -184,8 +184,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,
+ }
+ 
+ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+-			   enum pin_config_param param,
+-			   enum pin_config_param arg)
++			   enum pin_config_param param, u32 arg)
+ {
+ 	struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
+ 	const struct mtk_pin_desc *desc;
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch b/queue-5.16/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch
new file mode 100644
index 00000000000..a454df0145d
--- /dev/null
+++ b/queue-5.16/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch
@@ -0,0 +1,60 @@
+From bbe2840d4fda12b97d8f4045565f03765c0b0f91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:47 +0800
+Subject: pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 3e8c6bc608480010f360c4a59578d7841726137d ]
+
+When reading back pin bias settings, if the pin is not in the
+corresponding bias state, the function should return -EINVAL.
+
+Fix this in the mediatek-paris pinctrl library so that the read back
+state is not littered with bogus a "input bias disabled" combined with
+"pull up" or "pull down" states.
+
+Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-3-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index 4c6f6d967b18..f7644530cee1 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -96,20 +96,16 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,
+ 			err = hw->soc->bias_get_combo(hw, desc, &pullup, &ret);
+ 			if (err)
+ 				goto out;
++			if (ret == MTK_PUPD_SET_R1R0_00)
++				ret = MTK_DISABLE;
+ 			if (param == PIN_CONFIG_BIAS_DISABLE) {
+-				if (ret == MTK_PUPD_SET_R1R0_00)
+-					ret = MTK_DISABLE;
++				if (ret != MTK_DISABLE)
++					err = -EINVAL;
+ 			} else if (param == PIN_CONFIG_BIAS_PULL_UP) {
+-				/* When desire to get pull-up value, return
+-				 *  error if current setting is pull-down
+-				 */
+-				if (!pullup)
++				if (!pullup || ret == MTK_DISABLE)
+ 					err = -EINVAL;
+ 			} else if (param == PIN_CONFIG_BIAS_PULL_DOWN) {
+-				/* When desire to get pull-down value, return
+-				 *  error if current setting is pull-up
+-				 */
+-				if (pullup)
++				if (pullup || ret == MTK_DISABLE)
+ 					err = -EINVAL;
+ 			}
+ 		} else {
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch b/queue-5.16/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
new file mode 100644
index 00000000000..3c6e85962d6
--- /dev/null
+++ b/queue-5.16/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
@@ -0,0 +1,61 @@
+From 2b3e35c80bc4c6ae0e612c21245c9d375ef13982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:49 +0800
+Subject: pinctrl: mediatek: paris: Fix pingroup pin config state readback
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 54fe55fb384ade630ef20b9a8b8f3b2a89ad97f2 ]
+
+mtk_pconf_group_get(), used to read back pingroup pin config state,
+simply returns a set of configs saved from a previous invocation of
+mtk_pconf_group_set(). This is an unfiltered, unvalidated set passed
+in from the pinconf core, which does not match the current hardware
+state.
+
+Since the driver library is designed to have one pin per group, pass
+through mtk_pconf_group_get() to mtk_pinconf_get(), to read back the
+current pin config state of the only pin in the group.
+
+Also drop the assignment of pin config state to the group.
+
+Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-5-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index cbaad89fbe17..faf11c9e1db3 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -732,10 +732,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group,
+ 			       unsigned long *config)
+ {
+ 	struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
++	struct mtk_pinctrl_group *grp = &hw->groups[group];
+ 
+-	*config = hw->groups[group].config;
+-
+-	return 0;
++	 /* One pin per group only */
++	return mtk_pinconf_get(pctldev, grp->pin, config);
+ }
+ 
+ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+@@ -751,8 +751,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ 				      pinconf_to_config_argument(configs[i]));
+ 		if (ret < 0)
+ 			return ret;
+-
+-		grp->config = configs[i];
+ 	}
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch b/queue-5.16/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch
new file mode 100644
index 00000000000..0b65b376059
--- /dev/null
+++ b/queue-5.16/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch
@@ -0,0 +1,43 @@
+From a372812a2e4d9c61e0bc61616d1333544ca78cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:51 +0800
+Subject: pinctrl: mediatek: paris: Skip custom extra pin config dump for
+ virtual GPIOs
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 1763933d377ecb05454f8d20e3c8922480db2ac0 ]
+
+Virtual GPIOs do not have any hardware state associated with them. Any
+attempt to read back hardware state for these pins result in error
+codes.
+
+Skip dumping extra pin config information for these virtual GPIOs.
+
+Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-7-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index faf11c9e1db3..154d55a239e8 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -581,6 +581,9 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
+ 	if (gpio >= hw->soc->npins)
+ 		return -EINVAL;
+ 
++	if (mtk_is_virt_gpio(hw, gpio))
++		return -EINVAL;
++
+ 	desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio];
+ 	pinmux = mtk_pctrl_get_pinmux(hw, gpio);
+ 	if (pinmux >= hw->soc->nfuncs)
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-microchip-sgpio-lock-rmw-access.patch b/queue-5.16/pinctrl-microchip-sgpio-lock-rmw-access.patch
new file mode 100644
index 00000000000..394c421bd14
--- /dev/null
+++ b/queue-5.16/pinctrl-microchip-sgpio-lock-rmw-access.patch
@@ -0,0 +1,110 @@
+From 64eac0602e0a986e0316057cf1b90c00e3ab342d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 21:45:03 +0100
+Subject: pinctrl: microchip-sgpio: lock RMW access
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 7996c5f5ec7a20b3f6b8fae93fcf3cb8f1c01743 ]
+
+Protect any RMW access to the registers by a spinlock.
+
+Fixes: 7e5ea974e61c ("pinctrl: pinctrl-microchip-sgpio: Add pinctrl driver for Microsemi Serial GPIO")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20220226204507.2511633-2-michael@walle.cc
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-microchip-sgpio.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-microchip-sgpio.c b/drivers/pinctrl/pinctrl-microchip-sgpio.c
+index 78765faa245a..dfa374195694 100644
+--- a/drivers/pinctrl/pinctrl-microchip-sgpio.c
++++ b/drivers/pinctrl/pinctrl-microchip-sgpio.c
+@@ -18,6 +18,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+ #include <linux/reset.h>
++#include <linux/spinlock.h>
+ 
+ #include "core.h"
+ #include "pinconf.h"
+@@ -115,6 +116,7 @@ struct sgpio_priv {
+ 	u32 clock;
+ 	u32 __iomem *regs;
+ 	const struct sgpio_properties *properties;
++	spinlock_t lock;
+ };
+ 
+ struct sgpio_port_addr {
+@@ -216,6 +218,7 @@ static void sgpio_output_set(struct sgpio_priv *priv,
+ 			     int value)
+ {
+ 	unsigned int bit = SGPIO_SRC_BITS * addr->bit;
++	unsigned long flags;
+ 	u32 clr, set;
+ 
+ 	switch (priv->properties->arch) {
+@@ -234,7 +237,10 @@ static void sgpio_output_set(struct sgpio_priv *priv,
+ 	default:
+ 		return;
+ 	}
++
++	spin_lock_irqsave(&priv->lock, flags);
+ 	sgpio_clrsetbits(priv, REG_PORT_CONFIG, addr->port, clr, set);
++	spin_unlock_irqrestore(&priv->lock, flags);
+ }
+ 
+ static int sgpio_output_get(struct sgpio_priv *priv,
+@@ -562,10 +568,13 @@ static void microchip_sgpio_irq_settype(struct irq_data *data,
+ 	struct sgpio_bank *bank = gpiochip_get_data(chip);
+ 	unsigned int gpio = irqd_to_hwirq(data);
+ 	struct sgpio_port_addr addr;
++	unsigned long flags;
+ 	u32 ena;
+ 
+ 	sgpio_pin_to_addr(bank->priv, gpio, &addr);
+ 
++	spin_lock_irqsave(&bank->priv->lock, flags);
++
+ 	/* Disable interrupt while changing type */
+ 	ena = sgpio_readl(bank->priv, REG_INT_ENABLE, addr.bit);
+ 	sgpio_writel(bank->priv, ena & ~BIT(addr.port), REG_INT_ENABLE, addr.bit);
+@@ -582,6 +591,8 @@ static void microchip_sgpio_irq_settype(struct irq_data *data,
+ 
+ 	/* Possibly re-enable interrupts */
+ 	sgpio_writel(bank->priv, ena, REG_INT_ENABLE, addr.bit);
++
++	spin_unlock_irqrestore(&bank->priv->lock, flags);
+ }
+ 
+ static void microchip_sgpio_irq_setreg(struct irq_data *data,
+@@ -592,13 +603,16 @@ static void microchip_sgpio_irq_setreg(struct irq_data *data,
+ 	struct sgpio_bank *bank = gpiochip_get_data(chip);
+ 	unsigned int gpio = irqd_to_hwirq(data);
+ 	struct sgpio_port_addr addr;
++	unsigned long flags;
+ 
+ 	sgpio_pin_to_addr(bank->priv, gpio, &addr);
+ 
++	spin_lock_irqsave(&bank->priv->lock, flags);
+ 	if (clear)
+ 		sgpio_clrsetbits(bank->priv, reg, addr.bit, BIT(addr.port), 0);
+ 	else
+ 		sgpio_clrsetbits(bank->priv, reg, addr.bit, 0, BIT(addr.port));
++	spin_unlock_irqrestore(&bank->priv->lock, flags);
+ }
+ 
+ static void microchip_sgpio_irq_mask(struct irq_data *data)
+@@ -814,6 +828,7 @@ static int microchip_sgpio_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 
+ 	priv->dev = dev;
++	spin_lock_init(&priv->lock);
+ 
+ 	reset = devm_reset_control_get_optional_shared(&pdev->dev, "switch");
+ 	if (IS_ERR(reset))
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch b/queue-5.16/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
new file mode 100644
index 00000000000..2b973a36fe6
--- /dev/null
+++ b/queue-5.16/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
@@ -0,0 +1,41 @@
+From 72abb447a95ab8a07cf736c0de1ce9c0f61b07ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 11:51:16 +0000
+Subject: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c09ac191b1f97cfa06f394dbfd7a5db07986cefc ]
+
+This node pointer is returned by of_parse_phandle() with refcount
+incremented in this function. Calling of_node_put() to avoid
+the refcount leak.
+
+Fixes: 32e67eee670e ("pinctrl: nomadik: Allow prcm_base to be extracted from Device Tree")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307115116.25316-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index 39828e9c3120..4757bf964d3c 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1883,8 +1883,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	prcm_np = of_parse_phandle(np, "prcm", 0);
+-	if (prcm_np)
++	if (prcm_np) {
+ 		npct->prcm_base = of_iomap(prcm_np, 0);
++		of_node_put(prcm_np);
++	}
+ 	if (!npct->prcm_base) {
+ 		if (version == PINCTRL_NMK_STN8815) {
+ 			dev_info(&pdev->dev,
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch b/queue-5.16/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
new file mode 100644
index 00000000000..43ebef94a85
--- /dev/null
+++ b/queue-5.16/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
@@ -0,0 +1,125 @@
+From edc8a9e9518e7494f95c8f57f377e4084f44d89e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Feb 2022 12:03:08 +0000
+Subject: pinctrl: npcm: Fix broken references to chip->parent_device
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit f7e53e2255808ca3abcc8f38d18ad0823425e771 ]
+
+The npcm driver has a bunch of references to the irq_chip parent_device
+field, but never sets it.
+
+Fix it by fishing that reference from somewhere else, but it is
+obvious that these debug statements were never used. Also remove
+an unused field in a local data structure.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Link: https://lore.kernel.org/r/20220201120310.878267-11-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 25 +++++++++++------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+index 4d81908d6725..ba536fd4d674 100644
+--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+@@ -78,7 +78,6 @@ struct npcm7xx_gpio {
+ 	struct gpio_chip	gc;
+ 	int			irqbase;
+ 	int			irq;
+-	void			*priv;
+ 	struct irq_chip		irq_chip;
+ 	u32			pinctrl_id;
+ 	int (*direction_input)(struct gpio_chip *chip, unsigned offset);
+@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc)
+ 	chained_irq_enter(chip, desc);
+ 	sts = ioread32(bank->base + NPCM7XX_GP_N_EVST);
+ 	en  = ioread32(bank->base + NPCM7XX_GP_N_EVEN);
+-	dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts,
++	dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts,
+ 		en);
+ 
+ 	sts &= en;
+@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type)
+ 		gpiochip_get_data(irq_data_get_irq_chip_data(d));
+ 	unsigned int gpio = BIT(d->hwirq);
+ 
+-	dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio,
++	dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio,
+ 		d->irq, type);
+ 	switch (type) {
+ 	case IRQ_TYPE_EDGE_RISING:
+-		dev_dbg(d->chip->parent_device, "edge.rising\n");
++		dev_dbg(bank->gc.parent, "edge.rising\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_EDGE_FALLING:
+-		dev_dbg(d->chip->parent_device, "edge.falling\n");
++		dev_dbg(bank->gc.parent, "edge.falling\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_EDGE_BOTH:
+-		dev_dbg(d->chip->parent_device, "edge.both\n");
++		dev_dbg(bank->gc.parent, "edge.both\n");
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		break;
+ 	case IRQ_TYPE_LEVEL_LOW:
+-		dev_dbg(d->chip->parent_device, "level.low\n");
++		dev_dbg(bank->gc.parent, "level.low\n");
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_LEVEL_HIGH:
+-		dev_dbg(d->chip->parent_device, "level.high\n");
++		dev_dbg(bank->gc.parent, "level.high\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	default:
+-		dev_dbg(d->chip->parent_device, "invalid irq type\n");
++		dev_dbg(bank->gc.parent, "invalid irq type\n");
+ 		return -EINVAL;
+ 	}
+ 
+@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d)
+ 		gpiochip_get_data(irq_data_get_irq_chip_data(d));
+ 	unsigned int gpio = d->hwirq;
+ 
+-	dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST);
+ }
+ 
+@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* Clear events */
+-	dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC);
+ }
+ 
+@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* Enable events */
+-	dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS);
+ }
+ 
+@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* active-high, input, clear interrupt, enable interrupt */
+-	dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq);
++	dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq);
+ 	npcmgpio_direction_input(gc, gpio);
+ 	npcmgpio_irq_ack(d);
+ 	npcmgpio_irq_unmask(d);
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-renesas-checker-fix-miscalculation-of-number.patch b/queue-5.16/pinctrl-renesas-checker-fix-miscalculation-of-number.patch
new file mode 100644
index 00000000000..5b321d84fa9
--- /dev/null
+++ b/queue-5.16/pinctrl-renesas-checker-fix-miscalculation-of-number.patch
@@ -0,0 +1,51 @@
+From b7cf6074a4bd47c6726aa47717b2aa9ef3c83174 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 17:21:58 +0100
+Subject: pinctrl: renesas: checker: Fix miscalculation of number of states
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit de9b861018d46af27a5edff8b6baef35c0c0ad4f ]
+
+The checker failed to validate all enum IDs in the description of a
+register with fixed-width register fields, due to a miscalculation of
+the number of described states: each register field of n bits can have
+"1 << n" possible states, not "1".
+
+Increase SH_PFC_MAX_ENUMS accordingly, now more enum IDs are checked
+(SH-Mobile AG5 has more than 4000 enum IDs defined).
+
+Fixes: 12d057bad683b1c6 ("pinctrl: sh-pfc: checker: Add check for enum ID conflicts")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/6d8a6a05564f38f9d20464c1c17f96e52740cf6a.1645460429.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/core.c b/drivers/pinctrl/renesas/core.c
+index 0d4ea2e22a53..12d41ac017b5 100644
+--- a/drivers/pinctrl/renesas/core.c
++++ b/drivers/pinctrl/renesas/core.c
+@@ -741,7 +741,7 @@ static int sh_pfc_suspend_init(struct sh_pfc *pfc) { return 0; }
+ 
+ #ifdef DEBUG
+ #define SH_PFC_MAX_REGS		300
+-#define SH_PFC_MAX_ENUMS	3000
++#define SH_PFC_MAX_ENUMS	5000
+ 
+ static unsigned int sh_pfc_errors __initdata;
+ static unsigned int sh_pfc_warnings __initdata;
+@@ -865,7 +865,8 @@ static void __init sh_pfc_check_cfg_reg(const char *drvname,
+ 			 GENMASK(cfg_reg->reg_width - 1, 0));
+ 
+ 	if (cfg_reg->field_width) {
+-		n = cfg_reg->reg_width / cfg_reg->field_width;
++		fw = cfg_reg->field_width;
++		n = (cfg_reg->reg_width / fw) << fw;
+ 		/* Skip field checks (done at build time) */
+ 		goto check_enum_ids;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch b/queue-5.16/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
new file mode 100644
index 00000000000..df39d79ecce
--- /dev/null
+++ b/queue-5.16/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
@@ -0,0 +1,50 @@
+From 47c07bbfaa8c832efc4b459a7810ee0565919686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 15:41:11 +0100
+Subject: pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9e04a0eda84fccab0ac22a33825ad53f47c968c7 ]
+
+The second video-in channel on RZ/G1C has only 12 data lanes, but the
+pin control driver uses the vin_data union, which is meant for 24 data
+lanes, thus wasting space.
+
+Fix this by using the vin_data12 union instead.
+
+This reduces kernel size by 96 bytes.
+
+Fixes: 50f3f2d73e3426ba ("pinctrl: sh-pfc: Reduce kernel size for narrow VIN channels")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/52716fa89139f6f92592633edb52804d4c5e18f0.1640269757.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a77470.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a77470.c b/drivers/pinctrl/renesas/pfc-r8a77470.c
+index e6e5487691c1..cf7153d06a95 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a77470.c
++++ b/drivers/pinctrl/renesas/pfc-r8a77470.c
+@@ -2140,7 +2140,7 @@ static const unsigned int vin0_clk_mux[] = {
+ 	VI0_CLK_MARK,
+ };
+ /* - VIN1 ------------------------------------------------------------------- */
+-static const union vin_data vin1_data_pins = {
++static const union vin_data12 vin1_data_pins = {
+ 	.data12 = {
+ 		RCAR_GP_PIN(3,  1), RCAR_GP_PIN(3, 2),
+ 		RCAR_GP_PIN(3,  3), RCAR_GP_PIN(3, 4),
+@@ -2150,7 +2150,7 @@ static const union vin_data vin1_data_pins = {
+ 		RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16),
+ 	},
+ };
+-static const union vin_data vin1_data_mux = {
++static const union vin_data12 vin1_data_mux = {
+ 	.data12 = {
+ 		VI1_DATA0_MARK, VI1_DATA1_MARK,
+ 		VI1_DATA2_MARK, VI1_DATA3_MARK,
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch b/queue-5.16/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
new file mode 100644
index 00000000000..41c11db18bb
--- /dev/null
+++ b/queue-5.16/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
@@ -0,0 +1,45 @@
+From 6d1ac9e70c0358d1feed1b16378d189be821ec1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:02:34 +0000
+Subject: pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 89388f8730699c259f8090ec435fb43569efe4ac ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: 1e747e59cc4d ("pinctrl: rockchip: base regmap supplied by a syscon")
+Fixes: 14dee8677e19 ("pinctrl: rockchip: let pmu registers be supplied by a syscon")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307120234.28657-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-rockchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index dc52da94af0b..923ff21a44c0 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -2702,6 +2702,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ 	node = of_parse_phandle(np, "rockchip,grf", 0);
+ 	if (node) {
+ 		info->regmap_base = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(info->regmap_base))
+ 			return PTR_ERR(info->regmap_base);
+ 	} else {
+@@ -2738,6 +2739,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ 	node = of_parse_phandle(np, "rockchip,pmu", 0);
+ 	if (node) {
+ 		info->regmap_pmu = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(info->regmap_pmu))
+ 			return PTR_ERR(info->regmap_pmu);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/pinctrl-samsung-remove-eint-handler-for-exynos850-al.patch b/queue-5.16/pinctrl-samsung-remove-eint-handler-for-exynos850-al.patch
new file mode 100644
index 00000000000..e64a1ecf10e
--- /dev/null
+++ b/queue-5.16/pinctrl-samsung-remove-eint-handler-for-exynos850-al.patch
@@ -0,0 +1,53 @@
+From d65cb9b034dcfa174f83eb3b17d5530e10cbfd3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 22:37:57 +0200
+Subject: pinctrl: samsung: Remove EINT handler for Exynos850 ALIVE and CMGP
+ gpios
+
+From: Sam Protsenko <semen.protsenko@linaro.org>
+
+[ Upstream commit 96f79935015cf3d7ca6fabf63cd13b8af45a7713 ]
+
+GPIO_ALIVE and GPIO_CMGP blocks in Exynos850 SoC don't have EINT
+capabilities (like EINT_SVC register), and there are no corresponding
+interrupts wired to GIC. Instead those blocks have wake-up interrupts
+for each pin. The ".eint_gpio_init" callbacks were specified by mistake
+for these blocks, when porting pinctrl code from downstream kernel. That
+leads to error messages like this:
+
+    samsung-pinctrl 11850000.pinctrl: irq number not available
+
+Remove ".eint_gpio_init" for pinctrl_alive and pinctrl_gpmc to fix this
+error. This change doesn't affect proper interrupt handling for related
+pins, as all those pins are handled in ".eint_wkup_init".
+
+Fixes: cdd3d945dcec ("pinctrl: samsung: Add Exynos850 SoC specific data")
+Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20220114203757.4860-1-semen.protsenko@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/samsung/pinctrl-exynos-arm64.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+index 6b77fd24571e..5c00be179082 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+@@ -504,13 +504,11 @@ static const struct samsung_pin_ctrl exynos850_pin_ctrl[] __initconst = {
+ 		/* pin-controller instance 0 ALIVE data */
+ 		.pin_banks	= exynos850_pin_banks0,
+ 		.nr_banks	= ARRAY_SIZE(exynos850_pin_banks0),
+-		.eint_gpio_init = exynos_eint_gpio_init,
+ 		.eint_wkup_init = exynos_eint_wkup_init,
+ 	}, {
+ 		/* pin-controller instance 1 CMGP data */
+ 		.pin_banks	= exynos850_pin_banks1,
+ 		.nr_banks	= ARRAY_SIZE(exynos850_pin_banks1),
+-		.eint_gpio_init = exynos_eint_gpio_init,
+ 		.eint_wkup_init = exynos_eint_wkup_init,
+ 	}, {
+ 		/* pin-controller instance 2 AUD data */
+-- 
+2.34.1
+
diff --git a/queue-5.16/platform-x86-huawei-wmi-check-the-return-value-of-de.patch b/queue-5.16/platform-x86-huawei-wmi-check-the-return-value-of-de.patch
new file mode 100644
index 00000000000..66db8355cb1
--- /dev/null
+++ b/queue-5.16/platform-x86-huawei-wmi-check-the-return-value-of-de.patch
@@ -0,0 +1,52 @@
+From 652d5aaa58c90d6b0044d6c3ac8426e0b9a0d35f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 18:24:21 -0800
+Subject: platform/x86: huawei-wmi: check the return value of
+ device_create_file()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit c91a5b1c221a58d008485cf7d02ccce73108b119 ]
+
+The function device_create_file() in huawei_wmi_battery_add() can fail,
+so its return value should be checked.
+
+Fixes: 355a070b09ab ("platform/x86: huawei-wmi: Add battery charging thresholds")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220303022421.313-1-baijiaju1990@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index a2d846c4a7ee..eac3e6b4ea11 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -470,10 +470,17 @@ static DEVICE_ATTR_RW(charge_control_thresholds);
+ 
+ static int huawei_wmi_battery_add(struct power_supply *battery)
+ {
+-	device_create_file(&battery->dev, &dev_attr_charge_control_start_threshold);
+-	device_create_file(&battery->dev, &dev_attr_charge_control_end_threshold);
++	int err = 0;
+ 
+-	return 0;
++	err = device_create_file(&battery->dev, &dev_attr_charge_control_start_threshold);
++	if (err)
++		return err;
++
++	err = device_create_file(&battery->dev, &dev_attr_charge_control_end_threshold);
++	if (err)
++		device_remove_file(&battery->dev, &dev_attr_charge_control_start_threshold);
++
++	return err;
+ }
+ 
+ static int huawei_wmi_battery_remove(struct power_supply *battery)
+-- 
+2.34.1
+
diff --git a/queue-5.16/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch b/queue-5.16/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
new file mode 100644
index 00000000000..8529185f059
--- /dev/null
+++ b/queue-5.16/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
@@ -0,0 +1,107 @@
+From 2f41a9b805b3cb50eb78dcddc9fdf99f2fbb1951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 14:02:14 +0300
+Subject: PM: core: keep irq flags in device_pm_check_callbacks()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 524bb1da785a7ae43dd413cd392b5071c6c367f8 ]
+
+The function device_pm_check_callbacks() can be called under the spin
+lock (in the reported case it happens from genpd_add_device() ->
+dev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes.
+
+However this function uncoditionally uses spin_lock_irq() /
+spin_unlock_irq(), thus not preserving the CPU flags. Use the
+irqsave/irqrestore instead.
+
+The backtrace for the reference:
+[    2.752010] ------------[ cut here ]------------
+[    2.756769] raw_local_irq_restore() called with IRQs enabled
+[    2.762596] WARNING: CPU: 4 PID: 1 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x50
+[    2.772338] Modules linked in:
+[    2.775487] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G S                5.17.0-rc6-00384-ge330d0d82eff-dirty #684
+[    2.781384] Freeing initrd memory: 46024K
+[    2.785839] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[    2.785841] pc : warn_bogus_irq_restore+0x34/0x50
+[    2.785844] lr : warn_bogus_irq_restore+0x34/0x50
+[    2.785846] sp : ffff80000805b7d0
+[    2.785847] x29: ffff80000805b7d0 x28: 0000000000000000 x27: 0000000000000002
+[    2.785850] x26: ffffd40e80930b18 x25: ffff7ee2329192b8 x24: ffff7edfc9f60800
+[    2.785853] x23: ffffd40e80930b18 x22: ffffd40e80930d30 x21: ffff7edfc0dffa00
+[    2.785856] x20: ffff7edfc09e3768 x19: 0000000000000000 x18: ffffffffffffffff
+[    2.845775] x17: 6572206f74206465 x16: 6c696166203a3030 x15: ffff80008805b4f7
+[    2.853108] x14: 0000000000000000 x13: ffffd40e809550b0 x12: 00000000000003d8
+[    2.860441] x11: 0000000000000148 x10: ffffd40e809550b0 x9 : ffffd40e809550b0
+[    2.867774] x8 : 00000000ffffefff x7 : ffffd40e809ad0b0 x6 : ffffd40e809ad0b0
+[    2.875107] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
+[    2.882440] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7edfc03a8000
+[    2.889774] Call trace:
+[    2.892290]  warn_bogus_irq_restore+0x34/0x50
+[    2.896770]  _raw_spin_unlock_irqrestore+0x94/0xa0
+[    2.901690]  genpd_unlock_spin+0x20/0x30
+[    2.905724]  genpd_add_device+0x100/0x2d0
+[    2.909850]  __genpd_dev_pm_attach+0xa8/0x23c
+[    2.914329]  genpd_dev_pm_attach_by_id+0xc4/0x190
+[    2.919167]  genpd_dev_pm_attach_by_name+0x3c/0xd0
+[    2.924086]  dev_pm_domain_attach_by_name+0x24/0x30
+[    2.929102]  psci_dt_attach_cpu+0x24/0x90
+[    2.933230]  psci_cpuidle_probe+0x2d4/0x46c
+[    2.937534]  platform_probe+0x68/0xe0
+[    2.941304]  really_probe.part.0+0x9c/0x2fc
+[    2.945605]  __driver_probe_device+0x98/0x144
+[    2.950085]  driver_probe_device+0x44/0x15c
+[    2.954385]  __device_attach_driver+0xb8/0x120
+[    2.958950]  bus_for_each_drv+0x78/0xd0
+[    2.962896]  __device_attach+0xd8/0x180
+[    2.966843]  device_initial_probe+0x14/0x20
+[    2.971144]  bus_probe_device+0x9c/0xa4
+[    2.975092]  device_add+0x380/0x88c
+[    2.978679]  platform_device_add+0x114/0x234
+[    2.983067]  platform_device_register_full+0x100/0x190
+[    2.988344]  psci_idle_init+0x6c/0xb0
+[    2.992113]  do_one_initcall+0x74/0x3a0
+[    2.996060]  kernel_init_freeable+0x2fc/0x384
+[    3.000543]  kernel_init+0x28/0x130
+[    3.004132]  ret_from_fork+0x10/0x20
+[    3.007817] irq event stamp: 319826
+[    3.011404] hardirqs last  enabled at (319825): [<ffffd40e7eda0268>] __up_console_sem+0x78/0x84
+[    3.020332] hardirqs last disabled at (319826): [<ffffd40e7fd6d9d8>] el1_dbg+0x24/0x8c
+[    3.028458] softirqs last  enabled at (318312): [<ffffd40e7ec90410>] _stext+0x410/0x588
+[    3.036678] softirqs last disabled at (318299): [<ffffd40e7ed1bf68>] __irq_exit_rcu+0x158/0x174
+[    3.045607] ---[ end trace 0000000000000000 ]---
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 04ea92cbd9cf..08c8a69d7b81 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -2018,7 +2018,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops)
+ 
+ void device_pm_check_callbacks(struct device *dev)
+ {
+-	spin_lock_irq(&dev->power.lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&dev->power.lock, flags);
+ 	dev->power.no_pm_callbacks =
+ 		(!dev->bus || (pm_ops_is_empty(dev->bus->pm) &&
+ 		 !dev->bus->suspend && !dev->bus->resume)) &&
+@@ -2027,7 +2029,7 @@ void device_pm_check_callbacks(struct device *dev)
+ 		(!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) &&
+ 		(!dev->driver || (pm_ops_is_empty(dev->driver->pm) &&
+ 		 !dev->driver->suspend && !dev->driver->resume));
+-	spin_unlock_irq(&dev->power.lock);
++	spin_unlock_irqrestore(&dev->power.lock, flags);
+ }
+ 
+ bool dev_pm_skip_suspend(struct device *dev)
+-- 
+2.34.1
+
diff --git a/queue-5.16/pm-hibernate-fix-__setup-handler-error-handling.patch b/queue-5.16/pm-hibernate-fix-__setup-handler-error-handling.patch
new file mode 100644
index 00000000000..4bbc4649aea
--- /dev/null
+++ b/queue-5.16/pm-hibernate-fix-__setup-handler-error-handling.patch
@@ -0,0 +1,40 @@
+From 8996afc123efbeb317a79035c72a79017c80f772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:32 -0800
+Subject: PM: hibernate: fix __setup handler error handling
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ba7ffcd4c4da374b0f64666354eeeda7d3827131 ]
+
+If an invalid value is used in "resumedelay=<seconds>", it is
+silently ignored. Add a warning message and then let the __setup
+handler return 1 to indicate that the kernel command line option
+has been handled.
+
+Fixes: 317cf7e5e85e3 ("PM / hibernate: convert simple_strtoul to kstrtoul")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index e6af502c2fd7..08780a466fdf 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -1328,7 +1328,7 @@ static int __init resumedelay_setup(char *str)
+ 	int rc = kstrtouint(str, 0, &resume_delay);
+ 
+ 	if (rc)
+-		return rc;
++		pr_warn("resumedelay: bad option string '%s'\n", str);
+ 	return 1;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/pm-suspend-fix-return-value-of-__setup-handler.patch b/queue-5.16/pm-suspend-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..af4b5f72290
--- /dev/null
+++ b/queue-5.16/pm-suspend-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,73 @@
+From 79bd629d8ca0bf8af6a2675839f6ce92f7962b4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:44 -0800
+Subject: PM: suspend: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7a64ca17e4dd50d5f910769167f3553902777844 ]
+
+If an invalid option is given for "test_suspend=<option>", the entire
+string is added to init's environment, so return 1 instead of 0 from
+the __setup handler.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5
+    test_suspend=invalid"
+
+and
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     test_suspend=invalid
+
+Fixes: 2ce986892faf ("PM / sleep: Enhance test_suspend option with repeat capability")
+Fixes: 27ddcc6596e5 ("PM / sleep: Add state field to pm_states[] entries")
+Fixes: a9d7052363a6 ("PM: Separate suspend to RAM functionality from core")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/suspend_test.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
+index d20526c5be15..b663a97f5867 100644
+--- a/kernel/power/suspend_test.c
++++ b/kernel/power/suspend_test.c
+@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value)
+ 	value++;
+ 	suspend_type = strsep(&value, ",");
+ 	if (!suspend_type)
+-		return 0;
++		return 1;
+ 
+ 	repeat = strsep(&value, ",");
+ 	if (repeat) {
+ 		if (kstrtou32(repeat, 0, &test_repeat_count_max))
+-			return 0;
++			return 1;
+ 	}
+ 
+ 	for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
+ 		if (!strcmp(pm_labels[i], suspend_type)) {
+ 			test_state_label = pm_labels[i];
+-			return 0;
++			return 1;
+ 		}
+ 
+ 	printk(warn_bad_state, suspend_type);
+-	return 0;
++	return 1;
+ }
+ __setup("test_suspend", setup_test_suspend);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-ab8500_chargalg-use-clock_monotonic.patch b/queue-5.16/power-ab8500_chargalg-use-clock_monotonic.patch
new file mode 100644
index 00000000000..153200659e5
--- /dev/null
+++ b/queue-5.16/power-ab8500_chargalg-use-clock_monotonic.patch
@@ -0,0 +1,58 @@
+From 028636561769e094adab3c76d0cc2ca2c07070cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 16:44:25 +0100
+Subject: power: ab8500_chargalg: Use CLOCK_MONOTONIC
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit c22fca40522e2be8af168f3087d87d85e404ea72 ]
+
+The HRTimer in the AB8500 charging code is using CLOCK_REALTIME
+to set an alarm some hours forward in time +/- 5 min for a safety
+timer.
+
+I have observed that this will sometimes fire sporadically
+early when charging a battery with the result that
+charging stops.
+
+As CLOCK_REALTIME can be subject to adjustments of time from
+sources such as NTP, this cannot be trusted and will likely
+for example fire events if the clock is set forward some hours
+by say NTP.
+
+Use CLOCK_MONOTONIC as indicated in other instances and the
+problem goes away. Also initialize the timer to REL mode
+as this is what will be used later.
+
+Fixes: 257107ae6b9b ("ab8500-chargalg: Use hrtimer")
+Cc: Lee Jones <lee.jones@linaro.org>
+Suggested-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_chargalg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/ab8500_chargalg.c b/drivers/power/supply/ab8500_chargalg.c
+index ff4b26b1ceca..b809fa5abbba 100644
+--- a/drivers/power/supply/ab8500_chargalg.c
++++ b/drivers/power/supply/ab8500_chargalg.c
+@@ -2019,11 +2019,11 @@ static int ab8500_chargalg_probe(struct platform_device *pdev)
+ 	psy_cfg.drv_data = di;
+ 
+ 	/* Initilialize safety timer */
+-	hrtimer_init(&di->safety_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
++	hrtimer_init(&di->safety_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	di->safety_timer.function = ab8500_chargalg_safety_timer_expired;
+ 
+ 	/* Initilialize maintenance timer */
+-	hrtimer_init(&di->maintenance_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
++	hrtimer_init(&di->maintenance_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	di->maintenance_timer.function =
+ 		ab8500_chargalg_maintenance_timer_expired;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch b/queue-5.16/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
new file mode 100644
index 00000000000..2379ae80a21
--- /dev/null
+++ b/queue-5.16/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
@@ -0,0 +1,45 @@
+From c883b0d66db40df3542e1040f2932478f694bf4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 10:46:54 +0000
+Subject: power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ba18dad0fb880cd29aa97b6b75560ef14d1061ba ]
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+    int irq = platform_get_irq(pdev, 0);
+    if (irq < 0)
+        return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: f7a388d6cd1c ("power: reset: Add a driver for the Gemini poweroff")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/gemini-poweroff.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c
+index 90e35c07240a..b7f7a8225f22 100644
+--- a/drivers/power/reset/gemini-poweroff.c
++++ b/drivers/power/reset/gemini-poweroff.c
+@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev)
+ 		return PTR_ERR(gpw->base);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq)
+-		return -EINVAL;
++	if (irq < 0)
++		return irq;
+ 
+ 	gpw->dev = dev;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch b/queue-5.16/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
new file mode 100644
index 00000000000..7c58713ac63
--- /dev/null
+++ b/queue-5.16/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
@@ -0,0 +1,47 @@
+From 86fee2c49e725029cdbecbb6397607fb07ea11a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 13:13:46 +0000
+Subject: power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6a4760463dbc6b603690938c468839985189ce0a ]
+
+kobject_init_and_add() takes reference even when it fails.
+According to the doc of kobject_init_and_add()：
+
+   If this function returns an error, kobject_put() must be called to
+   properly clean up the memory associated with the object.
+
+Fix memory leak by calling kobject_put().
+
+Fixes: 8c0984e5a753 ("power: move power supply drivers to power/supply")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_fg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 05fe9724ba50..57799a8079d4 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2545,8 +2545,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di)
+ 	ret = kobject_init_and_add(&di->fg_kobject,
+ 		&ab8500_fg_ktype,
+ 		NULL, "battery");
+-	if (ret < 0)
++	if (ret < 0) {
++		kobject_put(&di->fg_kobject);
+ 		dev_err(di->dev, "failed to create sysfs entry\n");
++	}
+ 
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch b/queue-5.16/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
new file mode 100644
index 00000000000..10f04e9cb8d
--- /dev/null
+++ b/queue-5.16/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
@@ -0,0 +1,58 @@
+From 3f0e4a6666f10e2611c5bbeccace78c003c3b466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 17:48:16 +0100
+Subject: power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong
+ false return
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit f7731754fdce33dad19be746f647d6ac47c5d695 ]
+
+The datasheet says that the BQ24190_REG_POC_CHG_CONFIG bits can
+have a value of either 10(0x2) or 11(0x3) for OTG (5V boost regulator)
+mode.
+
+Sofar bq24190_vbus_is_enabled() was only checking for 10 but some BIOS-es
+uses 11 when enabling the regulator at boot.
+
+Make bq24190_vbus_is_enabled() also check for 11 so that it does not
+wrongly returns false when the bits are set to 11.
+
+Fixes: 66b6bef2c4e0 ("power: supply: bq24190_charger: Export 5V boost converter as regulator")
+Cc: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq24190_charger.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index 35ff0c8fe96f..16c4876fe5af 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -39,6 +39,7 @@
+ #define BQ24190_REG_POC_CHG_CONFIG_DISABLE		0x0
+ #define BQ24190_REG_POC_CHG_CONFIG_CHARGE		0x1
+ #define BQ24190_REG_POC_CHG_CONFIG_OTG			0x2
++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT		0x3
+ #define BQ24190_REG_POC_SYS_MIN_MASK		(BIT(3) | BIT(2) | BIT(1))
+ #define BQ24190_REG_POC_SYS_MIN_SHIFT		1
+ #define BQ24190_REG_POC_SYS_MIN_MIN			3000
+@@ -550,7 +551,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev)
+ 	pm_runtime_mark_last_busy(bdi->dev);
+ 	pm_runtime_put_autosuspend(bdi->dev);
+ 
+-	return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG;
++	if (ret)
++		return ret;
++
++	return (val == BQ24190_REG_POC_CHG_CONFIG_OTG ||
++		val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT);
+ }
+ 
+ static const struct regulator_ops bq24190_vbus_ops = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-supply-sbs-charger-don-t-cancel-work-that-is-n.patch b/queue-5.16/power-supply-sbs-charger-don-t-cancel-work-that-is-n.patch
new file mode 100644
index 00000000000..1888089542f
--- /dev/null
+++ b/queue-5.16/power-supply-sbs-charger-don-t-cancel-work-that-is-n.patch
@@ -0,0 +1,82 @@
+From 39953c4c900d2eefb9761d32ffe600507d083047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Feb 2022 18:07:03 +0100
+Subject: power: supply: sbs-charger: Don't cancel work that is not initialized
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit de85193cff0d94d030a53656d8fcc41794807bef ]
+
+This driver can use an interrupt or polling in order get the charger's
+status.
+
+When using polling, a delayed work is used.
+
+However, the remove() function unconditionally call
+cancel_delayed_work_sync(), even if the delayed work is not used and is not
+initialized.
+
+In order to fix it, use devm_delayed_work_autocancel() and remove the now
+useless remove() function.
+
+Fixes: feb583e37f8a ("power: supply: add sbs-charger driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/sbs-charger.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index 6fa65d118ec1..b08f7d0c4181 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -18,6 +18,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/regmap.h>
+ #include <linux/bitops.h>
++#include <linux/devm-helpers.h>
+ 
+ #define SBS_CHARGER_REG_SPEC_INFO		0x11
+ #define SBS_CHARGER_REG_STATUS			0x13
+@@ -209,7 +210,12 @@ static int sbs_probe(struct i2c_client *client,
+ 		if (ret)
+ 			return dev_err_probe(&client->dev, ret, "Failed to request irq\n");
+ 	} else {
+-		INIT_DELAYED_WORK(&chip->work, sbs_delayed_work);
++		ret = devm_delayed_work_autocancel(&client->dev, &chip->work,
++						   sbs_delayed_work);
++		if (ret)
++			return dev_err_probe(&client->dev, ret,
++					     "Failed to init work for polling\n");
++
+ 		schedule_delayed_work(&chip->work,
+ 				      msecs_to_jiffies(SBS_CHARGER_POLL_TIME));
+ 	}
+@@ -220,15 +226,6 @@ static int sbs_probe(struct i2c_client *client,
+ 	return 0;
+ }
+ 
+-static int sbs_remove(struct i2c_client *client)
+-{
+-	struct sbs_info *chip = i2c_get_clientdata(client);
+-
+-	cancel_delayed_work_sync(&chip->work);
+-
+-	return 0;
+-}
+-
+ #ifdef CONFIG_OF
+ static const struct of_device_id sbs_dt_ids[] = {
+ 	{ .compatible = "sbs,sbs-charger" },
+@@ -245,7 +242,6 @@ MODULE_DEVICE_TABLE(i2c, sbs_id);
+ 
+ static struct i2c_driver sbs_driver = {
+ 	.probe		= sbs_probe,
+-	.remove		= sbs_remove,
+ 	.id_table	= sbs_id,
+ 	.driver = {
+ 		.name	= "sbs-charger",
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-supply-wm8350-power-add-missing-free-in-free_c.patch b/queue-5.16/power-supply-wm8350-power-add-missing-free-in-free_c.patch
new file mode 100644
index 00000000000..6234b64000b
--- /dev/null
+++ b/queue-5.16/power-supply-wm8350-power-add-missing-free-in-free_c.patch
@@ -0,0 +1,36 @@
+From f2b09e5e0ea8b95eb3359fe88fd4e9bf4d247245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:43:22 +0800
+Subject: power: supply: wm8350-power: Add missing free in free_charger_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 6dee930f6f6776d1e5a7edf542c6863b47d9f078 ]
+
+In free_charger_irq(), there is no free for 'WM8350_IRQ_CHG_FAST_RDY'.
+Therefore, it should be better to add it in order to avoid the memory leak.
+
+Fixes: 14431aa0c5a4 ("power_supply: Add support for WM8350 PMU")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/wm8350_power.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c
+index 9c46c48dccb1..908cfd45d262 100644
+--- a/drivers/power/supply/wm8350_power.c
++++ b/drivers/power/supply/wm8350_power.c
+@@ -524,6 +524,7 @@ static void free_charger_irq(struct wm8350 *wm8350)
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
+-- 
+2.34.1
+
diff --git a/queue-5.16/power-supply-wm8350-power-handle-error-for-wm8350_re.patch b/queue-5.16/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
new file mode 100644
index 00000000000..ced24901163
--- /dev/null
+++ b/queue-5.16/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
@@ -0,0 +1,156 @@
+From 7430d572cadf1edaa5136cbd6ed524c7bfbdf42d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 09:57:51 +0800
+Subject: power: supply: wm8350-power: Handle error for wm8350_register_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b0b14b5ba11bec56fad344a4a0b2e16449cc8b94 ]
+
+As the potential failure of the wm8350_register_irq(),
+it should be better to check it and return error if fails.
+Also, use 'free_' in order to avoid same code.
+
+Fixes: 14431aa0c5a4 ("power_supply: Add support for WM8350 PMU")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/wm8350_power.c | 96 ++++++++++++++++++++++++-----
+ 1 file changed, 82 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c
+index e05cee457471..9c46c48dccb1 100644
+--- a/drivers/power/supply/wm8350_power.c
++++ b/drivers/power/supply/wm8350_power.c
+@@ -408,44 +408,112 @@ static const struct power_supply_desc wm8350_usb_desc = {
+  *		Initialisation
+  *********************************************************************/
+ 
+-static void wm8350_init_charger(struct wm8350 *wm8350)
++static int wm8350_init_charger(struct wm8350 *wm8350)
+ {
++	int ret;
++
+ 	/* register our interest in charger events */
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
+ 			    wm8350_charger_handler, 0, "Battery hot", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
++	if (ret)
++		goto err;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
+ 			    wm8350_charger_handler, 0, "Battery cold", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
++	if (ret)
++		goto free_chg_bat_hot;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
+ 			    wm8350_charger_handler, 0, "Battery fail", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
++	if (ret)
++		goto free_chg_bat_cold;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charger timeout", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
++	if (ret)
++		goto free_chg_bat_fail;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charge end", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
++	if (ret)
++		goto free_chg_to;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charge start", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
++	if (ret)
++		goto free_chg_end;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
+ 			    wm8350_charger_handler, 0,
+ 			    "Fast charge ready", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
++	if (ret)
++		goto free_chg_start;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <3.9V", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
++	if (ret)
++		goto free_chg_fast_rdy;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <3.1V", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
++	if (ret)
++		goto free_chg_vbatt_lt_3p9;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <2.85V", wm8350);
++	if (ret)
++		goto free_chg_vbatt_lt_3p1;
+ 
+ 	/* and supply change events */
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
+ 			    wm8350_charger_handler, 0, "USB", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
++	if (ret)
++		goto free_chg_vbatt_lt_2p85;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
+ 			    wm8350_charger_handler, 0, "Wall", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
++	if (ret)
++		goto free_ext_usb_fb;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
+ 			    wm8350_charger_handler, 0, "Battery", wm8350);
++	if (ret)
++		goto free_ext_wall_fb;
++
++	return 0;
++
++free_ext_wall_fb:
++	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350);
++free_ext_usb_fb:
++	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350);
++free_chg_vbatt_lt_2p85:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
++free_chg_vbatt_lt_3p1:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
++free_chg_vbatt_lt_3p9:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
++free_chg_fast_rdy:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
++free_chg_start:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++free_chg_end:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
++free_chg_to:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
++free_chg_bat_fail:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350);
++free_chg_bat_cold:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350);
++free_chg_bat_hot:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350);
++err:
++	return ret;
+ }
+ 
+ static void free_charger_irq(struct wm8350 *wm8350)
+-- 
+2.34.1
+
diff --git a/queue-5.16/powercap-dtpm_cpu-reset-per_cpu-variable-in-the-rele.patch b/queue-5.16/powercap-dtpm_cpu-reset-per_cpu-variable-in-the-rele.patch
new file mode 100644
index 00000000000..0265d7a689b
--- /dev/null
+++ b/queue-5.16/powercap-dtpm_cpu-reset-per_cpu-variable-in-the-rele.patch
@@ -0,0 +1,48 @@
+From 3ab5680ea227083673a912ddd2e50f353459130b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jan 2022 22:02:04 +0100
+Subject: powercap/dtpm_cpu: Reset per_cpu variable in the release function
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 0aea2e4ec2a2bfa2d7e8820e37ba5b5ce04f20a5 ]
+
+The release function does not reset the per cpu variable when it is
+called. That will prevent creation again as the variable will be
+already from the previous creation.
+
+Fix it by resetting them.
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://lore.kernel.org/r/20220130210210.549877-2-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/dtpm_cpu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c
+index b740866b228d..1e8cac699646 100644
+--- a/drivers/powercap/dtpm_cpu.c
++++ b/drivers/powercap/dtpm_cpu.c
+@@ -150,10 +150,17 @@ static int update_pd_power_uw(struct dtpm *dtpm)
+ static void pd_release(struct dtpm *dtpm)
+ {
+ 	struct dtpm_cpu *dtpm_cpu = to_dtpm_cpu(dtpm);
++	struct cpufreq_policy *policy;
+ 
+ 	if (freq_qos_request_active(&dtpm_cpu->qos_req))
+ 		freq_qos_remove_request(&dtpm_cpu->qos_req);
+ 
++	policy = cpufreq_cpu_get(dtpm_cpu->cpu);
++	if (policy) {
++		for_each_cpu(dtpm_cpu->cpu, policy->related_cpus)
++			per_cpu(dtpm_per_cpu, dtpm_cpu->cpu) = NULL;
++	}
++	
+ 	kfree(dtpm_cpu);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-64s-don-t-use-dsisr-for-slb-faults.patch b/queue-5.16/powerpc-64s-don-t-use-dsisr-for-slb-faults.patch
new file mode 100644
index 00000000000..dd28eacd73e
--- /dev/null
+++ b/queue-5.16/powerpc-64s-don-t-use-dsisr-for-slb-faults.patch
@@ -0,0 +1,103 @@
+From f1e37e5f8ce573421e446f546bcfc4d5298084a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 22:34:49 +1100
+Subject: powerpc/64s: Don't use DSISR for SLB faults
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit d4679ac8ea2e5078704aa1c026db36580cc1bf9a ]
+
+Since commit 46ddcb3950a2 ("powerpc/mm: Show if a bad page fault on data
+is read or write.") we use page_fault_is_write(regs->dsisr) in
+__bad_page_fault() to determine if the fault is for a read or write, and
+change the message printed accordingly.
+
+But SLB faults, aka Data Segment Interrupts, don't set DSISR (Data
+Storage Interrupt Status Register) to a useful value. All ISA versions
+from v2.03 through v3.1 specify that the Data Segment Interrupt sets
+DSISR "to an undefined value". As far as I can see there's no mention of
+SLB faults setting DSISR in any BookIV content either.
+
+This manifests as accesses that should be a read being incorrectly
+reported as writes, for example, using the xmon "dump" command:
+
+  0:mon> d 0x5deadbeef0000000
+  5deadbeef0000000
+  [359526.415354][    C6] BUG: Unable to handle kernel data access on write at 0x5deadbeef0000000
+  [359526.415611][    C6] Faulting instruction address: 0xc00000000010a300
+  cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf400]
+      pc: c00000000010a300: mread+0x90/0x190
+
+If we disassemble the PC, we see a load instruction:
+
+  0:mon> di c00000000010a300
+  c00000000010a300 89490000      lbz     r10,0(r9)
+
+We can also see in exceptions-64s.S that the data_access_slb block
+doesn't set IDSISR=1, which means it doesn't load DSISR into pt_regs. So
+the value we're using to determine if the fault is a read/write is some
+stale value in pt_regs from a previous page fault.
+
+Rework the printing logic to separate the SLB fault case out, and only
+print read/write in the cases where we can determine it.
+
+The result looks like eg:
+
+  0:mon> d 0x5deadbeef0000000
+  5deadbeef0000000
+  [  721.779525][    C6] BUG: Unable to handle kernel data access at 0x5deadbeef0000000
+  [  721.779697][    C6] Faulting instruction address: 0xc00000000014cbe0
+  cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf390]
+
+  0:mon> d 0
+  0000000000000000
+  [  742.793242][    C6] BUG: Kernel NULL pointer dereference at 0x00000000
+  [  742.793316][    C6] Faulting instruction address: 0xc00000000014cbe0
+  cpu 0x6: Vector: 380 (Data SLB Access) at [c00000000ffbf390]
+
+Fixes: 46ddcb3950a2 ("powerpc/mm: Show if a bad page fault on data is read or write.")
+Reported-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Link: https://lore.kernel.org/r/20220222113449.319193-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index a8d0ce85d39a..4a15172dfef2 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -568,18 +568,24 @@ NOKPROBE_SYMBOL(hash__do_page_fault);
+ static void __bad_page_fault(struct pt_regs *regs, int sig)
+ {
+ 	int is_write = page_fault_is_write(regs->dsisr);
++	const char *msg;
+ 
+ 	/* kernel has accessed a bad area */
+ 
++	if (regs->dar < PAGE_SIZE)
++		msg = "Kernel NULL pointer dereference";
++	else
++		msg = "Unable to handle kernel data access";
++
+ 	switch (TRAP(regs)) {
+ 	case INTERRUPT_DATA_STORAGE:
+-	case INTERRUPT_DATA_SEGMENT:
+ 	case INTERRUPT_H_DATA_STORAGE:
+-		pr_alert("BUG: %s on %s at 0x%08lx\n",
+-			 regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
+-			 "Unable to handle kernel data access",
++		pr_alert("BUG: %s on %s at 0x%08lx\n", msg,
+ 			 is_write ? "write" : "read", regs->dar);
+ 		break;
++	case INTERRUPT_DATA_SEGMENT:
++		pr_alert("BUG: %s at 0x%08lx\n", msg, regs->dar);
++		break;
+ 	case INTERRUPT_INST_STORAGE:
+ 	case INTERRUPT_INST_SEGMENT:
+ 		pr_alert("BUG: Unable to handle kernel instruction fetch%s",
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch b/queue-5.16/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
new file mode 100644
index 00000000000..973c7323bef
--- /dev/null
+++ b/queue-5.16/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
@@ -0,0 +1,38 @@
+From c213df1731166772b9ca2360bcd00ccd892d3451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 15:02:23 +0800
+Subject: powerpc: 8xx: fix a return value error in mpc8xx_pic_init
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+[ Upstream commit 3fd46e551f67f4303c3276a0d6cd20baf2d192c4 ]
+
+mpc8xx_pic_init() should return -ENOMEM instead of 0 when
+irq_domain_add_linear() return NULL. This cause mpc8xx_pics_init to continue
+executing even if mpc8xx_pic_host is NULL.
+
+Fixes: cc76404feaed ("powerpc/8xx: Fix possible device node reference leak")
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220223070223.26845-1-hbh25y@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/8xx/pic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/8xx/pic.c b/arch/powerpc/platforms/8xx/pic.c
+index f2ba837249d6..04a6abf14c29 100644
+--- a/arch/powerpc/platforms/8xx/pic.c
++++ b/arch/powerpc/platforms/8xx/pic.c
+@@ -153,6 +153,7 @@ int __init mpc8xx_pic_init(void)
+ 	if (mpc8xx_pic_host == NULL) {
+ 		printk(KERN_ERR "MPC8xx PIC: failed to allocate irq host!\n");
+ 		ret = -ENOMEM;
++		goto out;
+ 	}
+ 
+ 	ret = 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-dts-t1040rdb-fix-ports-names-for-seville-eth.patch b/queue-5.16/powerpc-dts-t1040rdb-fix-ports-names-for-seville-eth.patch
new file mode 100644
index 00000000000..531f4d2f382
--- /dev/null
+++ b/queue-5.16/powerpc-dts-t1040rdb-fix-ports-names-for-seville-eth.patch
@@ -0,0 +1,111 @@
+From aa625f60c72def598d1cb0e7ee358b81be5250ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jan 2022 12:14:47 +0300
+Subject: powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch
+
+From: Maxim Kiselev <bigunclemax@gmail.com>
+
+[ Upstream commit 5ebb74749202a25da4b3cc2eb15470225a05527c ]
+
+On board rev A, the network interface labels for the switch ports
+written on the front panel are different than on rev B and later.
+
+This patch fixes network interface names for the switch ports according
+to labels that are written on the front panel of the board rev B.
+They start from ETH3 and end at ETH10.
+
+This patch also introduces a separate device tree for rev A.
+The main device tree is supposed to cover rev B and later.
+
+Fixes: e69eb0824d8c ("powerpc: dts: t1040rdb: add ports for Seville Ethernet switch")
+Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
+Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220121091447.3412907-1-bigunclemax@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts | 30 ++++++++++++++++++++
+ arch/powerpc/boot/dts/fsl/t1040rdb.dts       |  8 +++---
+ 2 files changed, 34 insertions(+), 4 deletions(-)
+ create mode 100644 arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts
+
+diff --git a/arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts b/arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts
+new file mode 100644
+index 000000000000..73f8c998c64d
+--- /dev/null
++++ b/arch/powerpc/boot/dts/fsl/t1040rdb-rev-a.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * T1040RDB-REV-A Device Tree Source
++ *
++ * Copyright 2014 - 2015 Freescale Semiconductor Inc.
++ *
++ */
++
++#include "t1040rdb.dts"
++
++/ {
++	model = "fsl,T1040RDB-REV-A";
++	compatible = "fsl,T1040RDB-REV-A";
++};
++
++&seville_port0 {
++	label = "ETH5";
++};
++
++&seville_port2 {
++	label = "ETH7";
++};
++
++&seville_port4 {
++	label = "ETH9";
++};
++
++&seville_port6 {
++	label = "ETH11";
++};
+diff --git a/arch/powerpc/boot/dts/fsl/t1040rdb.dts b/arch/powerpc/boot/dts/fsl/t1040rdb.dts
+index af0c8a6f5613..b6733e7e6580 100644
+--- a/arch/powerpc/boot/dts/fsl/t1040rdb.dts
++++ b/arch/powerpc/boot/dts/fsl/t1040rdb.dts
+@@ -119,7 +119,7 @@
+ 	managed = "in-band-status";
+ 	phy-handle = <&phy_qsgmii_0>;
+ 	phy-mode = "qsgmii";
+-	label = "ETH5";
++	label = "ETH3";
+ 	status = "okay";
+ };
+ 
+@@ -135,7 +135,7 @@
+ 	managed = "in-band-status";
+ 	phy-handle = <&phy_qsgmii_2>;
+ 	phy-mode = "qsgmii";
+-	label = "ETH7";
++	label = "ETH5";
+ 	status = "okay";
+ };
+ 
+@@ -151,7 +151,7 @@
+ 	managed = "in-band-status";
+ 	phy-handle = <&phy_qsgmii_4>;
+ 	phy-mode = "qsgmii";
+-	label = "ETH9";
++	label = "ETH7";
+ 	status = "okay";
+ };
+ 
+@@ -167,7 +167,7 @@
+ 	managed = "in-band-status";
+ 	phy-handle = <&phy_qsgmii_6>;
+ 	phy-mode = "qsgmii";
+-	label = "ETH11";
++	label = "ETH9";
+ 	status = "okay";
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch b/queue-5.16/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
new file mode 100644
index 00000000000..1834c05818d
--- /dev/null
+++ b/queue-5.16/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
@@ -0,0 +1,57 @@
+From 97e026dff6906b0f61449315386c7ad3025d48e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 22:28:58 +1100
+Subject: powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 2863dd2db23e0407f6c50b8ba5c0e55abef894f1 ]
+
+When CONFIG_GENERIC_CPU=y (true for all our defconfigs) we pass
+-mcpu=powerpc64 to the compiler, even when we're building a 32-bit
+kernel.
+
+This happens because we have an ifdef CONFIG_PPC_BOOK3S_64/else block in
+the Makefile that was written before 32-bit supported GENERIC_CPU. Prior
+to that the else block only applied to 64-bit Book3E.
+
+The GCC man page says -mcpu=powerpc64 "[specifies] a pure ... 64-bit big
+endian PowerPC ... architecture machine [type], with an appropriate,
+generic processor model assumed for scheduling purposes."
+
+It's unclear how that interacts with -m32, which we are also passing,
+although obviously -m32 is taking precedence in some sense, as the
+32-bit kernel only contains 32-bit instructions.
+
+This was noticed by inspection, not via any bug reports, but it does
+affect code generation. Comparing before/after code generation, there
+are some changes to instruction scheduling, and the after case (with
+-mcpu=powerpc64 removed) the compiler seems more keen to use r8.
+
+Fix it by making the else case only apply to Book3E 64, which excludes
+32-bit.
+
+Fixes: 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220215112858.304779-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index e02568f17334..3d2e74ebc014 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -171,7 +171,7 @@ else
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5))
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4)
+ endif
+-else
++else ifdef CONFIG_PPC_BOOK3E_64
+ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+ endif
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-mm-numa-skip-numa_no_node-onlining-in-parse_.patch b/queue-5.16/powerpc-mm-numa-skip-numa_no_node-onlining-in-parse_.patch
new file mode 100644
index 00000000000..15d3f467aa8
--- /dev/null
+++ b/queue-5.16/powerpc-mm-numa-skip-numa_no_node-onlining-in-parse_.patch
@@ -0,0 +1,53 @@
+From 50ecf26224ee515732034e681bc943c4c2b5175d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 15:23:12 -0300
+Subject: powerpc/mm/numa: skip NUMA_NO_NODE onlining in
+ parse_numa_properties()
+
+From: Daniel Henrique Barboza <danielhb413@gmail.com>
+
+[ Upstream commit 749ed4a20657bcea66a6e082ca3dc0d228cbec80 ]
+
+Executing node_set_online() when nid = NUMA_NO_NODE results in an
+undefined behavior. node_set_online() will call node_set_state(), into
+__node_set(), into set_bit(), and since NUMA_NO_NODE is -1 we'll end up
+doing a negative shift operation inside
+arch/powerpc/include/asm/bitops.h. This potential UB was detected
+running a kernel with CONFIG_UBSAN.
+
+The behavior was introduced by commit 10f78fd0dabb ("powerpc/numa: Fix a
+regression on memoryless node 0"), where the check for nid > 0 was
+removed to fix a problem that was happening with nid = 0, but the result
+is that now we're trying to online NUMA_NO_NODE nids as well.
+
+Checking for nid >= 0 will allow node 0 to be onlined while avoiding
+this UB with NUMA_NO_NODE.
+
+Fixes: 10f78fd0dabb ("powerpc/numa: Fix a regression on memoryless node 0")
+Reported-by: Ping Fang <pifang@redhat.com>
+Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220224182312.1012527-1-danielhb413@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/numa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 59d3cfcd7887..5fb829256b59 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -956,7 +956,9 @@ static int __init parse_numa_properties(void)
+ 			of_node_put(cpu);
+ 		}
+ 
+-		node_set_online(nid);
++		/* node_set_online() is an UB if 'nid' is negative */
++		if (likely(nid >= 0))
++			node_set_online(nid);
+ 	}
+ 
+ 	get_n_mem_cells(&n_mem_addr_cells, &n_mem_size_cells);
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch b/queue-5.16/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
new file mode 100644
index 00000000000..14385303643
--- /dev/null
+++ b/queue-5.16/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
@@ -0,0 +1,52 @@
+From 2a653bb24b3d22597f4a6d0812592f9cb483f078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 09:48:37 +0530
+Subject: powerpc/perf: Don't use perf_hw_context for trace IMC PMU
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 0198322379c25215b2778482bf1221743a76e2b5 ]
+
+Trace IMC (In-Memory collection counters) in powerpc is useful for
+application level profiling.
+
+For trace_imc, presently task context (task_ctx_nr) is set to
+perf_hw_context. But perf_hw_context should only be used for CPU PMU.
+See commit 26657848502b ("perf/core: Verify we have a single
+perf_hw_context PMU").
+
+So for trace_imc, even though it is per thread PMU, it is preferred to
+use sw_context in order to be able to do application level monitoring.
+Hence change the task_ctx_nr to use perf_sw_context.
+
+Fixes: 012ae244845f ("powerpc/perf: Trace imc PMU functions")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+[mpe: Update subject & incorporate notes into change log, reflow comment]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220202041837.65968-1-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index e106909ff9c3..e7583fbcc8fa 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -1457,7 +1457,11 @@ static int trace_imc_event_init(struct perf_event *event)
+ 
+ 	event->hw.idx = -1;
+ 
+-	event->pmu->task_ctx_nr = perf_hw_context;
++	/*
++	 * There can only be a single PMU for perf_hw_context events which is assigned to
++	 * core PMU. Hence use "perf_sw_context" for trace_imc.
++	 */
++	event->pmu->task_ctx_nr = perf_sw_context;
+ 	event->destroy = reset_global_refc;
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-pseries-fix-use-after-free-in-remove_phb_dyn.patch b/queue-5.16/powerpc-pseries-fix-use-after-free-in-remove_phb_dyn.patch
new file mode 100644
index 00000000000..6573d5d33e4
--- /dev/null
+++ b/queue-5.16/powerpc-pseries-fix-use-after-free-in-remove_phb_dyn.patch
@@ -0,0 +1,95 @@
+From 033a5b6d79df234a00e510866b45565c6545f81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 14:42:19 +1100
+Subject: powerpc/pseries: Fix use after free in remove_phb_dynamic()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit fe2640bd7a62f1f7c3f55fbda31084085075bc30 ]
+
+In remove_phb_dynamic() we use &phb->io_resource, after we've called
+device_unregister(&host_bridge->dev). But the unregister may have freed
+phb, because pcibios_free_controller_deferred() is the release function
+for the host_bridge.
+
+If there are no outstanding references when we call device_unregister()
+then phb will be freed out from under us.
+
+This has gone mainly unnoticed, but with slub_debug and page_poison
+enabled it can lead to a crash:
+
+  PID: 7574   TASK: c0000000d492cb80  CPU: 13  COMMAND: "drmgr"
+   #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc
+   #1 [c0000000e4f075d0] oops_end at c000000000029608
+   #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4
+   #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8
+   #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30
+   Data SLB Access [380] exception frame:
+   R0:  c000000000167250    R1:  c0000000e4f07a00    R2:  c000000002a46100
+   R3:  c000000002b39ce8    R4:  00000000000000c0    R5:  00000000000000a9
+   R6:  3894674d000000c0    R7:  0000000000000000    R8:  00000000000000ff
+   R9:  0000000000000100    R10: 6b6b6b6b6b6b6b6b    R11: 0000000000008000
+   R12: c00000000023da80    R13: c0000009ffd38b00    R14: 0000000000000000
+   R15: 000000011c87f0f0    R16: 0000000000000006    R17: 0000000000000003
+   R18: 0000000000000002    R19: 0000000000000004    R20: 0000000000000005
+   R21: 000000011c87ede8    R22: 000000011c87c5a8    R23: 000000011c87d3a0
+   R24: 0000000000000000    R25: 0000000000000001    R26: c0000000e4f07cc8
+   R27: c00000004d1cc400    R28: c0080000031d00e8    R29: c00000004d23d800
+   R30: c00000004d1d2400    R31: c00000004d1d2540
+   NIP: c000000000167258    MSR: 8000000000009033    OR3: c000000000e9f474
+   CTR: 0000000000000000    LR:  c000000000167250    XER: 0000000020040003
+   CCR: 0000000024088420    MQ:  0000000000000000    DAR: 6b6b6b6b6b6b6ba3
+   DSISR: c0000000e4f07920     Syscall Result: fffffffffffffff2
+   [NIP  : release_resource+56]
+   [LR   : release_resource+48]
+   #5 [c0000000e4f07a00] release_resource at c000000000167258  (unreliable)
+   #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648
+   #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io]
+   #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io]
+   #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c
+  #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504
+  #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868
+  #12 [c0000000e4f07c70] new_sync_write at c00000000054339c
+  #13 [c0000000e4f07d10] vfs_write at c000000000546624
+  #14 [c0000000e4f07d60] ksys_write at c0000000005469f4
+  #15 [c0000000e4f07db0] system_call_exception at c000000000030840
+  #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168
+
+To avoid it, we can take a reference to the host_bridge->dev until we're
+done using phb. Then when we drop the reference the phb will be freed.
+
+Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb)")
+Reported-by: David Dai <zdai@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Tested-by: Sachin Sant <sachinp@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220318034219.1188008-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index 90c9d3531694..4ba824568119 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -78,6 +78,9 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ 
+ 	pseries_msi_free_domains(phb);
+ 
++	/* Keep a reference so phb isn't freed yet */
++	get_device(&host_bridge->dev);
++
+ 	/* Remove the PCI bus and unregister the bridge device from sysfs */
+ 	phb->bus = NULL;
+ 	pci_remove_bus(b);
+@@ -101,6 +104,7 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ 	 * the pcibios_free_controller_deferred() callback;
+ 	 * see pseries_root_bridge_prepare().
+ 	 */
++	put_device(&host_bridge->dev);
+ 
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch b/queue-5.16/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
new file mode 100644
index 00000000000..3dc80785175
--- /dev/null
+++ b/queue-5.16/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
@@ -0,0 +1,50 @@
+From 11c1f83fab144243c53242a78c26cce2e1f43d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 15:24:33 +0100
+Subject: powerpc/sysdev: fix incorrect use to determine if list is empty
+
+From: Jakob Koschel <jakobkoschel@gmail.com>
+
+[ Upstream commit fa1321b11bd01752f5be2415e74a0e1a7c378262 ]
+
+'gtm' will *always* be set by list_for_each_entry().
+It is incorrect to assume that the iterator value will be NULL if the
+list is empty.
+
+Instead of checking the pointer it should be checked if
+the list is empty.
+
+Fixes: 83ff9dcf375c ("powerpc/sysdev: implement FSL GTM support")
+Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220228142434.576226-1-jakobkoschel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/fsl_gtm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c
+index 8963eaffb1b7..39186ad6b3c3 100644
+--- a/arch/powerpc/sysdev/fsl_gtm.c
++++ b/arch/powerpc/sysdev/fsl_gtm.c
+@@ -86,7 +86,7 @@ static LIST_HEAD(gtms);
+  */
+ struct gtm_timer *gtm_get_timer16(void)
+ {
+-	struct gtm *gtm = NULL;
++	struct gtm *gtm;
+ 	int i;
+ 
+ 	list_for_each_entry(gtm, &gtms, list_node) {
+@@ -103,7 +103,7 @@ struct gtm_timer *gtm_get_timer16(void)
+ 		spin_unlock_irq(&gtm->lock);
+ 	}
+ 
+-	if (gtm)
++	if (!list_empty(&gtms))
+ 		return ERR_PTR(-EBUSY);
+ 	return ERR_PTR(-ENODEV);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/pps-clients-gpio-propagate-return-value-from-pps_gpi.patch b/queue-5.16/pps-clients-gpio-propagate-return-value-from-pps_gpi.patch
new file mode 100644
index 00000000000..89ac07a2962
--- /dev/null
+++ b/queue-5.16/pps-clients-gpio-propagate-return-value-from-pps_gpi.patch
@@ -0,0 +1,43 @@
+From d36f66b5eae2ac03fe9c4a01c4e78de1aa9aa229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 14:52:14 -0600
+Subject: pps: clients: gpio: Propagate return value from pps_gpio_probe
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit abaca3179b41d4b3b115f27814ee36f6fb45e897 ]
+
+If the pps-gpio driver was probed prior to the GPIO device it uses, the
+devm_gpiod_get call returned an -EPROBE_DEFER error, but pps_gpio_probe
+replaced that error code with -EINVAL, causing the pps-gpio probe to
+fail and not be retried later. Propagate the error return value so that
+deferred probe works properly.
+
+Fixes: 161520451dfa (pps: new client driver using GPIO)
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rodolfo Giometti <giometti@enneenne.com>
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: Rodolfo Giometti <giometti@enneenne.com>
+Link: https://lore.kernel.org/r/20220112205214.2060954-1-robert.hancock@calian.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/clients/pps-gpio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
+index 35799e6401c9..2f4b11b4dfcd 100644
+--- a/drivers/pps/clients/pps-gpio.c
++++ b/drivers/pps/clients/pps-gpio.c
+@@ -169,7 +169,7 @@ static int pps_gpio_probe(struct platform_device *pdev)
+ 	/* GPIO setup */
+ 	ret = pps_gpio_setup(dev);
+ 	if (ret)
+-		return -EINVAL;
++		return ret;
+ 
+ 	/* IRQ setup */
+ 	ret = gpiod_to_irq(data->gpio_pin);
+-- 
+2.34.1
+
diff --git a/queue-5.16/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch b/queue-5.16/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
new file mode 100644
index 00000000000..50b457a2e2e
--- /dev/null
+++ b/queue-5.16/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
@@ -0,0 +1,70 @@
+From 59bf0cdf436d471343200f7b2dabe5f6847b01fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:56 -0800
+Subject: printk: fix return value of printk.devkmsg __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b665eae7a788c5e2bc10f9ac3c0137aa0ad1fc97 ]
+
+If an invalid option value is used with "printk.devkmsg=<value>",
+it is silently ignored.
+If a valid option value is used, it is honored but the wrong return
+value (0) is used, indicating that the command line option had an
+error and was not handled. This string is not added to init's
+environment strings due to init/main.c::unknown_bootoption()
+checking for a '.' in the boot option string and then considering
+that string to be an "Unused module parameter".
+
+Print a warning message if a bad option string is used.
+Always return 1 from the __setup handler to indicate that the command
+line option has been handled.
+
+Fixes: 750afe7babd1 ("printk: add kernel parameter to control writes to /dev/kmsg")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20220228220556.23484-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 57b132b658e1..4187946a28f9 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -146,8 +146,10 @@ static int __control_devkmsg(char *str)
+ 
+ static int __init control_devkmsg(char *str)
+ {
+-	if (__control_devkmsg(str) < 0)
++	if (__control_devkmsg(str) < 0) {
++		pr_warn("printk.devkmsg: bad option string '%s'\n", str);
+ 		return 1;
++	}
+ 
+ 	/*
+ 	 * Set sysctl string accordingly:
+@@ -166,7 +168,7 @@ static int __init control_devkmsg(char *str)
+ 	 */
+ 	devkmsg_log |= DEVKMSG_LOG_MASK_LOCK;
+ 
+-	return 0;
++	return 1;
+ }
+ __setup("printk.devkmsg=", control_devkmsg);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/ptp-unregister-virtual-clocks-when-unregistering-phy.patch b/queue-5.16/ptp-unregister-virtual-clocks-when-unregistering-phy.patch
new file mode 100644
index 00000000000..8cd2cda2923
--- /dev/null
+++ b/queue-5.16/ptp-unregister-virtual-clocks-when-unregistering-phy.patch
@@ -0,0 +1,68 @@
+From a20fc6e0200c53512b42b63203e7f6c843c0ae37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 10:33:55 +0100
+Subject: ptp: unregister virtual clocks when unregistering physical clock.
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit bfcbb76b0f595ea9ede9f7a218086fef85242f10 ]
+
+When unregistering a physical clock which has some virtual clocks,
+unregister the virtual clocks with it.
+
+This fixes the following oops, which can be triggered by unloading
+a driver providing a PTP clock when it has enabled virtual clocks:
+
+BUG: unable to handle page fault for address: ffffffffc04fc4d8
+Oops: 0000 [#1] PREEMPT SMP NOPTI
+RIP: 0010:ptp_vclock_read+0x31/0xb0
+Call Trace:
+ timecounter_read+0xf/0x50
+ ptp_vclock_refresh+0x2c/0x50
+ ? ptp_clock_release+0x40/0x40
+ ptp_aux_kworker+0x17/0x30
+ kthread_worker_fn+0x9b/0x240
+ ? kthread_should_park+0x30/0x30
+ kthread+0xe2/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+
+Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Cc: Yangbo Lu <yangbo.lu@nxp.com>
+Cc: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 0e4bc8b9329d..b6f2cfd15dd2 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -317,11 +317,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ }
+ EXPORT_SYMBOL(ptp_clock_register);
+ 
++static int unregister_vclock(struct device *dev, void *data)
++{
++	struct ptp_clock *ptp = dev_get_drvdata(dev);
++
++	ptp_vclock_unregister(info_to_vclock(ptp->info));
++	return 0;
++}
++
+ int ptp_clock_unregister(struct ptp_clock *ptp)
+ {
+ 	if (ptp_vclock_in_use(ptp)) {
+-		pr_err("ptp: virtual clock in use\n");
+-		return -EBUSY;
++		device_for_each_child(&ptp->dev, NULL, unregister_vclock);
+ 	}
+ 
+ 	ptp->defunct = 1;
+-- 
+2.34.1
+
diff --git a/queue-5.16/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch b/queue-5.16/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
new file mode 100644
index 00000000000..d7386bb4ac9
--- /dev/null
+++ b/queue-5.16/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
@@ -0,0 +1,83 @@
+From cbd61ebd975a60ec3798262688789333cb91df77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Nov 2021 09:49:48 +0100
+Subject: pwm: lpc18xx-sct: Initialize driver data and hardware before
+ pwmchip_add()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 0401f24cd238ae200a23a13925f98de3d2c883b8 ]
+
+When a driver calls pwmchip_add() it has to be prepared to immediately
+get its callbacks called. So move allocation of driver data and hardware
+initialization before the call to pwmchip_add().
+
+This fixes a potential NULL pointer exception and a race condition on
+register writes.
+
+Fixes: 841e6f90bb78 ("pwm: NXP LPC18xx PWM/SCT driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpc18xx-sct.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c
+index 8e461f3baa05..8cc8ae16553c 100644
+--- a/drivers/pwm/pwm-lpc18xx-sct.c
++++ b/drivers/pwm/pwm-lpc18xx-sct.c
+@@ -395,12 +395,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 	lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT,
+ 			   BIT(lpc18xx_pwm->period_event));
+ 
+-	ret = pwmchip_add(&lpc18xx_pwm->chip);
+-	if (ret < 0) {
+-		dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
+-		goto disable_pwmclk;
+-	}
+-
+ 	for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) {
+ 		struct lpc18xx_pwm_data *data;
+ 
+@@ -410,14 +404,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 				    GFP_KERNEL);
+ 		if (!data) {
+ 			ret = -ENOMEM;
+-			goto remove_pwmchip;
++			goto disable_pwmclk;
+ 		}
+ 
+ 		pwm_set_chip_data(pwm, data);
+ 	}
+ 
+-	platform_set_drvdata(pdev, lpc18xx_pwm);
+-
+ 	val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL);
+ 	val &= ~LPC18XX_PWM_BIDIR;
+ 	val &= ~LPC18XX_PWM_CTRL_HALT;
+@@ -425,10 +417,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 	val |= LPC18XX_PWM_PRE(0);
+ 	lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val);
+ 
++	ret = pwmchip_add(&lpc18xx_pwm->chip);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
++		goto disable_pwmclk;
++	}
++
++	platform_set_drvdata(pdev, lpc18xx_pwm);
++
+ 	return 0;
+ 
+-remove_pwmchip:
+-	pwmchip_remove(&lpc18xx_pwm->chip);
+ disable_pwmclk:
+ 	clk_disable_unprepare(lpc18xx_pwm->pwm_clk);
+ 	return ret;
+-- 
+2.34.1
+
diff --git a/queue-5.16/qlcnic-dcb-default-to-returning-eopnotsupp.patch b/queue-5.16/qlcnic-dcb-default-to-returning-eopnotsupp.patch
new file mode 100644
index 00000000000..c87db3d4335
--- /dev/null
+++ b/queue-5.16/qlcnic-dcb-default-to-returning-eopnotsupp.patch
@@ -0,0 +1,81 @@
+From cdb09d9ce96aa546020633feb02eb343e2b1b5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 10:20:03 -0700
+Subject: qlcnic: dcb: default to returning -EOPNOTSUPP
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 1521db37f0d42334a88e8ff28198a27d1ed5cd7b ]
+
+Clang static analysis reports this issue
+qlcnic_dcb.c:382:10: warning: Assigned value is
+  garbage or undefined
+  mbx_out = *val;
+          ^ ~~~~
+
+val is set in the qlcnic_dcb_query_hw_capability() wrapper.
+If there is no query_hw_capability op in dcp, success is
+returned without setting the val.
+
+For this and similar wrappers, return -EOPNOTSUPP.
+
+Fixes: 14d385b99059 ("qlcnic: dcb: Query adapter DCB capabilities.")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+index 5d79ee4370bc..7519773eaca6 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+@@ -51,7 +51,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->get_hw_capability)
+ 		return dcb->ops->get_hw_capability(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb)
+@@ -65,7 +65,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->attach)
+ 		return dcb->ops->attach(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline int
+@@ -74,7 +74,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf)
+ 	if (dcb && dcb->ops->query_hw_capability)
+ 		return dcb->ops->query_hw_capability(dcb, buf);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb)
+@@ -89,7 +89,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type)
+ 	if (dcb && dcb->ops->query_cee_param)
+ 		return dcb->ops->query_cee_param(dcb, buf, type);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+@@ -97,7 +97,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->get_cee_cfg)
+ 		return dcb->ops->get_cee_cfg(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg)
+-- 
+2.34.1
+
diff --git a/queue-5.16/ray_cs-check-ioremap-return-value.patch b/queue-5.16/ray_cs-check-ioremap-return-value.patch
new file mode 100644
index 00000000000..1d8056a05f1
--- /dev/null
+++ b/queue-5.16/ray_cs-check-ioremap-return-value.patch
@@ -0,0 +1,57 @@
+From 786ac514a67fd7805f6d7b26d88f708549d96bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 10:29:26 +0800
+Subject: ray_cs: Check ioremap return value
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 7e4760713391ee46dc913194b33ae234389a174e ]
+
+As the possible failure of the ioremap(), the 'local->sram' and other
+two could be NULL.
+Therefore it should be better to check it in order to avoid the later
+dev_dbg.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20211230022926.1846757-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ray_cs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index e3a3dc3e45b4..03f0953440b5 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -382,6 +382,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->sram = ioremap(link->resource[2]->start,
+ 			resource_size(link->resource[2]));
++	if (!local->sram)
++		goto failed;
+ 
+ /*** Set up 16k window for shared memory (receive buffer) ***************/
+ 	link->resource[3]->flags |=
+@@ -396,6 +398,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->rmem = ioremap(link->resource[3]->start,
+ 			resource_size(link->resource[3]));
++	if (!local->rmem)
++		goto failed;
+ 
+ /*** Set up window for attribute memory ***********************************/
+ 	link->resource[4]->flags |=
+@@ -410,6 +414,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->amem = ioremap(link->resource[4]->start,
+ 			resource_size(link->resource[4]));
++	if (!local->amem)
++		goto failed;
+ 
+ 	dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram);
+ 	dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem);
+-- 
+2.34.1
+
diff --git a/queue-5.16/rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch b/queue-5.16/rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch
new file mode 100644
index 00000000000..446b90152aa
--- /dev/null
+++ b/queue-5.16/rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch
@@ -0,0 +1,221 @@
+From 504f23bb548a077cd0e587a0fb3439f77e1b860b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:04:34 +0000
+Subject: rcu: Kill rnp->ofl_seq and use only rcu_state.ofl_lock for exclusion
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit 82980b1622d97017053c6792382469d7dc26a486 ]
+
+If we allow architectures to bring APs online in parallel, then we end
+up requiring rcu_cpu_starting() to be reentrant. But currently, the
+manipulation of rnp->ofl_seq is not thread-safe.
+
+However, rnp->ofl_seq is also fairly much pointless anyway since both
+rcu_cpu_starting() and rcu_report_dead() hold rcu_state.ofl_lock for
+fairly much the whole time that rnp->ofl_seq is set to an odd number
+to indicate that an operation is in progress.
+
+So drop rnp->ofl_seq completely, and use only rcu_state.ofl_lock.
+
+This has a couple of minor complexities: lockdep will complain when we
+take rcu_state.ofl_lock, and currently accepts the 'excuse' of having
+an odd value in rnp->ofl_seq. So switch it to an arch_spinlock_t to
+avoid that false positive complaint. Since we're killing rnp->ofl_seq
+of course that 'excuse' has to be changed too, so make it check for
+arch_spin_is_locked(rcu_state.ofl_lock).
+
+There's no arch_spin_lock_irqsave() so we have to manually save and
+restore local interrupts around the locking.
+
+At Paul's request based on Neeraj's analysis, make rcu_gp_init not just
+wait but *exclude* any CPU online/offline activity, which was fairly
+much true already by virtue of it holding rcu_state.ofl_lock.
+
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 71 ++++++++++++++++++++++++-----------------------
+ kernel/rcu/tree.h |  4 +--
+ 2 files changed, 37 insertions(+), 38 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 28fd0cef9b1f..0e70fe0ab690 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -91,7 +91,7 @@ static struct rcu_state rcu_state = {
+ 	.abbr = RCU_ABBR,
+ 	.exp_mutex = __MUTEX_INITIALIZER(rcu_state.exp_mutex),
+ 	.exp_wake_mutex = __MUTEX_INITIALIZER(rcu_state.exp_wake_mutex),
+-	.ofl_lock = __RAW_SPIN_LOCK_UNLOCKED(rcu_state.ofl_lock),
++	.ofl_lock = __ARCH_SPIN_LOCK_UNLOCKED,
+ };
+ 
+ /* Dump rcu_node combining tree at boot to verify correct setup. */
+@@ -1168,7 +1168,15 @@ bool rcu_lockdep_current_cpu_online(void)
+ 	preempt_disable_notrace();
+ 	rdp = this_cpu_ptr(&rcu_data);
+ 	rnp = rdp->mynode;
+-	if (rdp->grpmask & rcu_rnp_online_cpus(rnp) || READ_ONCE(rnp->ofl_seq) & 0x1)
++	/*
++	 * Strictly, we care here about the case where the current CPU is
++	 * in rcu_cpu_starting() and thus has an excuse for rdp->grpmask
++	 * not being up to date. So arch_spin_is_locked() might have a
++	 * false positive if it's held by some *other* CPU, but that's
++	 * OK because that just means a false *negative* on the warning.
++	 */
++	if (rdp->grpmask & rcu_rnp_online_cpus(rnp) ||
++	    arch_spin_is_locked(&rcu_state.ofl_lock))
+ 		ret = true;
+ 	preempt_enable_notrace();
+ 	return ret;
+@@ -1732,7 +1740,6 @@ static void rcu_strict_gp_boundary(void *unused)
+  */
+ static noinline_for_stack bool rcu_gp_init(void)
+ {
+-	unsigned long firstseq;
+ 	unsigned long flags;
+ 	unsigned long oldmask;
+ 	unsigned long mask;
+@@ -1775,22 +1782,17 @@ static noinline_for_stack bool rcu_gp_init(void)
+ 	 * of RCU's Requirements documentation.
+ 	 */
+ 	WRITE_ONCE(rcu_state.gp_state, RCU_GP_ONOFF);
++	/* Exclude CPU hotplug operations. */
+ 	rcu_for_each_leaf_node(rnp) {
+-		// Wait for CPU-hotplug operations that might have
+-		// started before this grace period did.
+-		smp_mb(); // Pair with barriers used when updating ->ofl_seq to odd values.
+-		firstseq = READ_ONCE(rnp->ofl_seq);
+-		if (firstseq & 0x1)
+-			while (firstseq == READ_ONCE(rnp->ofl_seq))
+-				schedule_timeout_idle(1);  // Can't wake unless RCU is watching.
+-		smp_mb(); // Pair with barriers used when updating ->ofl_seq to even values.
+-		raw_spin_lock(&rcu_state.ofl_lock);
+-		raw_spin_lock_irq_rcu_node(rnp);
++		local_irq_save(flags);
++		arch_spin_lock(&rcu_state.ofl_lock);
++		raw_spin_lock_rcu_node(rnp);
+ 		if (rnp->qsmaskinit == rnp->qsmaskinitnext &&
+ 		    !rnp->wait_blkd_tasks) {
+ 			/* Nothing to do on this leaf rcu_node structure. */
+-			raw_spin_unlock_irq_rcu_node(rnp);
+-			raw_spin_unlock(&rcu_state.ofl_lock);
++			raw_spin_unlock_rcu_node(rnp);
++			arch_spin_unlock(&rcu_state.ofl_lock);
++			local_irq_restore(flags);
+ 			continue;
+ 		}
+ 
+@@ -1825,8 +1827,9 @@ static noinline_for_stack bool rcu_gp_init(void)
+ 				rcu_cleanup_dead_rnp(rnp);
+ 		}
+ 
+-		raw_spin_unlock_irq_rcu_node(rnp);
+-		raw_spin_unlock(&rcu_state.ofl_lock);
++		raw_spin_unlock_rcu_node(rnp);
++		arch_spin_unlock(&rcu_state.ofl_lock);
++		local_irq_restore(flags);
+ 	}
+ 	rcu_gp_slow(gp_preinit_delay); /* Races with CPU hotplug. */
+ 
+@@ -4247,11 +4250,10 @@ void rcu_cpu_starting(unsigned int cpu)
+ 
+ 	rnp = rdp->mynode;
+ 	mask = rdp->grpmask;
+-	WRITE_ONCE(rnp->ofl_seq, rnp->ofl_seq + 1);
+-	WARN_ON_ONCE(!(rnp->ofl_seq & 0x1));
++	local_irq_save(flags);
++	arch_spin_lock(&rcu_state.ofl_lock);
+ 	rcu_dynticks_eqs_online();
+-	smp_mb(); // Pair with rcu_gp_cleanup()'s ->ofl_seq barrier().
+-	raw_spin_lock_irqsave_rcu_node(rnp, flags);
++	raw_spin_lock_rcu_node(rnp);
+ 	WRITE_ONCE(rnp->qsmaskinitnext, rnp->qsmaskinitnext | mask);
+ 	newcpu = !(rnp->expmaskinitnext & mask);
+ 	rnp->expmaskinitnext |= mask;
+@@ -4264,15 +4266,18 @@ void rcu_cpu_starting(unsigned int cpu)
+ 
+ 	/* An incoming CPU should never be blocking a grace period. */
+ 	if (WARN_ON_ONCE(rnp->qsmask & mask)) { /* RCU waiting on incoming CPU? */
++		/* rcu_report_qs_rnp() *really* wants some flags to restore */
++		unsigned long flags2;
++
++		local_irq_save(flags2);
+ 		rcu_disable_urgency_upon_qs(rdp);
+ 		/* Report QS -after- changing ->qsmaskinitnext! */
+-		rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags);
++		rcu_report_qs_rnp(mask, rnp, rnp->gp_seq, flags2);
+ 	} else {
+-		raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
++		raw_spin_unlock_rcu_node(rnp);
+ 	}
+-	smp_mb(); // Pair with rcu_gp_cleanup()'s ->ofl_seq barrier().
+-	WRITE_ONCE(rnp->ofl_seq, rnp->ofl_seq + 1);
+-	WARN_ON_ONCE(rnp->ofl_seq & 0x1);
++	arch_spin_unlock(&rcu_state.ofl_lock);
++	local_irq_restore(flags);
+ 	smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
+ }
+ 
+@@ -4286,7 +4291,7 @@ void rcu_cpu_starting(unsigned int cpu)
+  */
+ void rcu_report_dead(unsigned int cpu)
+ {
+-	unsigned long flags;
++	unsigned long flags, seq_flags;
+ 	unsigned long mask;
+ 	struct rcu_data *rdp = per_cpu_ptr(&rcu_data, cpu);
+ 	struct rcu_node *rnp = rdp->mynode;  /* Outgoing CPU's rdp & rnp. */
+@@ -4300,10 +4305,8 @@ void rcu_report_dead(unsigned int cpu)
+ 
+ 	/* Remove outgoing CPU from mask in the leaf rcu_node structure. */
+ 	mask = rdp->grpmask;
+-	WRITE_ONCE(rnp->ofl_seq, rnp->ofl_seq + 1);
+-	WARN_ON_ONCE(!(rnp->ofl_seq & 0x1));
+-	smp_mb(); // Pair with rcu_gp_cleanup()'s ->ofl_seq barrier().
+-	raw_spin_lock(&rcu_state.ofl_lock);
++	local_irq_save(seq_flags);
++	arch_spin_lock(&rcu_state.ofl_lock);
+ 	raw_spin_lock_irqsave_rcu_node(rnp, flags); /* Enforce GP memory-order guarantee. */
+ 	rdp->rcu_ofl_gp_seq = READ_ONCE(rcu_state.gp_seq);
+ 	rdp->rcu_ofl_gp_flags = READ_ONCE(rcu_state.gp_flags);
+@@ -4314,10 +4317,8 @@ void rcu_report_dead(unsigned int cpu)
+ 	}
+ 	WRITE_ONCE(rnp->qsmaskinitnext, rnp->qsmaskinitnext & ~mask);
+ 	raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+-	raw_spin_unlock(&rcu_state.ofl_lock);
+-	smp_mb(); // Pair with rcu_gp_cleanup()'s ->ofl_seq barrier().
+-	WRITE_ONCE(rnp->ofl_seq, rnp->ofl_seq + 1);
+-	WARN_ON_ONCE(rnp->ofl_seq & 0x1);
++	arch_spin_unlock(&rcu_state.ofl_lock);
++	local_irq_restore(seq_flags);
+ 
+ 	rdp->cpu_started = false;
+ }
+diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
+index 305cf6aeb408..aff4cc9303fb 100644
+--- a/kernel/rcu/tree.h
++++ b/kernel/rcu/tree.h
+@@ -56,8 +56,6 @@ struct rcu_node {
+ 				/*  Initialized from ->qsmaskinitnext at the */
+ 				/*  beginning of each grace period. */
+ 	unsigned long qsmaskinitnext;
+-	unsigned long ofl_seq;	/* CPU-hotplug operation sequence count. */
+-				/* Online CPUs for next grace period. */
+ 	unsigned long expmask;	/* CPUs or groups that need to check in */
+ 				/*  to allow the current expedited GP */
+ 				/*  to complete. */
+@@ -358,7 +356,7 @@ struct rcu_state {
+ 	const char *name;			/* Name of structure. */
+ 	char abbr;				/* Abbreviated name. */
+ 
+-	raw_spinlock_t ofl_lock ____cacheline_internodealigned_in_smp;
++	arch_spinlock_t ofl_lock ____cacheline_internodealigned_in_smp;
+ 						/* Synchronize offline with */
+ 						/*  GP pre-initialization. */
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/rcu-mark-writes-to-the-rcu_segcblist-structure-s-fla.patch b/queue-5.16/rcu-mark-writes-to-the-rcu_segcblist-structure-s-fla.patch
new file mode 100644
index 00000000000..0ed529b4d07
--- /dev/null
+++ b/queue-5.16/rcu-mark-writes-to-the-rcu_segcblist-structure-s-fla.patch
@@ -0,0 +1,47 @@
+From a5e5c353316d93f255a166e78766e2674607cbc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jan 2022 10:34:34 -0800
+Subject: rcu: Mark writes to the rcu_segcblist structure's ->flags field
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit c09929031018913b5783872a8b8cdddef4a543c7 ]
+
+KCSAN reports data races between the rcu_segcblist_clear_flags() and
+rcu_segcblist_set_flags() functions, though misreporting the latter
+as a call to rcu_segcblist_is_enabled() from call_rcu().  This commit
+converts the updates of this field to WRITE_ONCE(), relying on the
+resulting unmarked reads to continue to detect buggy concurrent writes
+to this field.
+
+Reported-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcu_segcblist.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/rcu/rcu_segcblist.h b/kernel/rcu/rcu_segcblist.h
+index 9a19328ff251..5d405943823e 100644
+--- a/kernel/rcu/rcu_segcblist.h
++++ b/kernel/rcu/rcu_segcblist.h
+@@ -56,13 +56,13 @@ static inline long rcu_segcblist_n_cbs(struct rcu_segcblist *rsclp)
+ static inline void rcu_segcblist_set_flags(struct rcu_segcblist *rsclp,
+ 					   int flags)
+ {
+-	rsclp->flags |= flags;
++	WRITE_ONCE(rsclp->flags, rsclp->flags | flags);
+ }
+ 
+ static inline void rcu_segcblist_clear_flags(struct rcu_segcblist *rsclp,
+ 					     int flags)
+ {
+-	rsclp->flags &= ~flags;
++	WRITE_ONCE(rsclp->flags, rsclp->flags & ~flags);
+ }
+ 
+ static inline bool rcu_segcblist_test_flags(struct rcu_segcblist *rsclp,
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-core-fix-ib_qp_usecnt_dec-called-when-error.patch b/queue-5.16/rdma-core-fix-ib_qp_usecnt_dec-called-when-error.patch
new file mode 100644
index 00000000000..562b802d671
--- /dev/null
+++ b/queue-5.16/rdma-core-fix-ib_qp_usecnt_dec-called-when-error.patch
@@ -0,0 +1,74 @@
+From a8b252f070f72ac93ac2421acdbe4fa077c8bc5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 10:42:32 +0800
+Subject: RDMA/core: Fix ib_qp_usecnt_dec() called when error
+
+From: Yajun Deng <yajun.deng@linux.dev>
+
+[ Upstream commit 7c4a539ec38f4ce400a0f3fcb5ff6c940fcd67bb ]
+
+ib_destroy_qp() would called by ib_create_qp_user() if error, the former
+contains ib_qp_usecnt_dec(), but ib_qp_usecnt_inc() was not called before.
+
+So move ib_qp_usecnt_inc() into create_qp().
+
+Fixes: d2b10794fc13 ("RDMA/core: Create clean QP creations interface for uverbs")
+Link: https://lore.kernel.org/r/20220303024232.2847388-1-yajun.deng@linux.dev
+Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_cmd.c          | 1 -
+ drivers/infiniband/core/uverbs_std_types_qp.c | 1 -
+ drivers/infiniband/core/verbs.c               | 3 +--
+ 3 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index d1345d76d9b1..5a99e31df5f5 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1438,7 +1438,6 @@ static int create_qp(struct uverbs_attr_bundle *attrs,
+ 		ret = PTR_ERR(qp);
+ 		goto err_put;
+ 	}
+-	ib_qp_usecnt_inc(qp);
+ 
+ 	obj->uevent.uobject.object = qp;
+ 	obj->uevent.event_file = READ_ONCE(attrs->ufile->default_async_file);
+diff --git a/drivers/infiniband/core/uverbs_std_types_qp.c b/drivers/infiniband/core/uverbs_std_types_qp.c
+index dd1075466f61..75353e09c6fe 100644
+--- a/drivers/infiniband/core/uverbs_std_types_qp.c
++++ b/drivers/infiniband/core/uverbs_std_types_qp.c
+@@ -254,7 +254,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
+ 		ret = PTR_ERR(qp);
+ 		goto err_put;
+ 	}
+-	ib_qp_usecnt_inc(qp);
+ 
+ 	if (attr.qp_type == IB_QPT_XRC_TGT) {
+ 		obj->uxrcd = container_of(xrcd_uobj, struct ib_uxrcd_object,
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index e821dc94a43e..961055eb330d 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1253,6 +1253,7 @@ static struct ib_qp *create_qp(struct ib_device *dev, struct ib_pd *pd,
+ 	if (ret)
+ 		goto err_security;
+ 
++	ib_qp_usecnt_inc(qp);
+ 	rdma_restrack_add(&qp->res);
+ 	return qp;
+ 
+@@ -1353,8 +1354,6 @@ struct ib_qp *ib_create_qp_kernel(struct ib_pd *pd,
+ 	if (IS_ERR(qp))
+ 		return qp;
+ 
+-	ib_qp_usecnt_inc(qp);
+-
+ 	if (qp_init_attr->cap.max_rdma_ctxs) {
+ 		ret = rdma_rw_init_mrs(qp, qp_init_attr);
+ 		if (ret)
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-core-set-mr-type-in-ib_reg_user_mr.patch b/queue-5.16/rdma-core-set-mr-type-in-ib_reg_user_mr.patch
new file mode 100644
index 00000000000..7cf1c9051c1
--- /dev/null
+++ b/queue-5.16/rdma-core-set-mr-type-in-ib_reg_user_mr.patch
@@ -0,0 +1,36 @@
+From 6a698f251e3564b413319861bbf3741a6f62fadb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 09:35:02 +0200
+Subject: RDMA/core: Set MR type in ib_reg_user_mr
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 32a88d16615c2be295571c29273c4ac94cb75309 ]
+
+Add missing assignment of MR type to IB_MR_TYPE_USER.
+
+Fixes: 33006bd4f37f ("IB/core: Introduce ib_reg_user_mr")
+Link: https://lore.kernel.org/r/be2e91bcd6e52dc36be289ae92f30d3a5cc6dcb1.1642491047.git.leonro@nvidia.com
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index c18634bec212..e821dc94a43e 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -2153,6 +2153,7 @@ struct ib_mr *ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ 		return mr;
+ 
+ 	mr->device = pd->device;
++	mr->type = IB_MR_TYPE_USER;
+ 	mr->pd = pd;
+ 	mr->dm = NULL;
+ 	atomic_inc(&pd->usecnt);
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-irdma-fix-netdev-notifications-for-vlan-s.patch b/queue-5.16/rdma-irdma-fix-netdev-notifications-for-vlan-s.patch
new file mode 100644
index 00000000000..e54629881be
--- /dev/null
+++ b/queue-5.16/rdma-irdma-fix-netdev-notifications-for-vlan-s.patch
@@ -0,0 +1,140 @@
+From 6597fff08a9f2bb3be7b0413e612e04b728fedb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 10:32:09 -0600
+Subject: RDMA/irdma: Fix netdev notifications for vlan's
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+[ Upstream commit 6702bc14744847842a87fed21a795b6e8bab6965 ]
+
+Currently, events on vlan netdevs are being ignored. Fix this by finding
+the real netdev and processing the notifications for vlan netdevs.
+
+Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions")
+Link: https://lore.kernel.org/r/20220225163211.127-2-shiraz.saleem@intel.com
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/utils.c | 48 ++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c
+index 398736d8c78a..e81b74a518dd 100644
+--- a/drivers/infiniband/hw/irdma/utils.c
++++ b/drivers/infiniband/hw/irdma/utils.c
+@@ -150,31 +150,35 @@ int irdma_inetaddr_event(struct notifier_block *notifier, unsigned long event,
+ 			 void *ptr)
+ {
+ 	struct in_ifaddr *ifa = ptr;
+-	struct net_device *netdev = ifa->ifa_dev->dev;
++	struct net_device *real_dev, *netdev = ifa->ifa_dev->dev;
+ 	struct irdma_device *iwdev;
+ 	struct ib_device *ibdev;
+ 	u32 local_ipaddr;
+ 
+-	ibdev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_IRDMA);
++	real_dev = rdma_vlan_dev_real_dev(netdev);
++	if (!real_dev)
++		real_dev = netdev;
++
++	ibdev = ib_device_get_by_netdev(real_dev, RDMA_DRIVER_IRDMA);
+ 	if (!ibdev)
+ 		return NOTIFY_DONE;
+ 
+ 	iwdev = to_iwdev(ibdev);
+ 	local_ipaddr = ntohl(ifa->ifa_address);
+ 	ibdev_dbg(&iwdev->ibdev,
+-		  "DEV: netdev %p event %lu local_ip=%pI4 MAC=%pM\n", netdev,
+-		  event, &local_ipaddr, netdev->dev_addr);
++		  "DEV: netdev %p event %lu local_ip=%pI4 MAC=%pM\n", real_dev,
++		  event, &local_ipaddr, real_dev->dev_addr);
+ 	switch (event) {
+ 	case NETDEV_DOWN:
+-		irdma_manage_arp_cache(iwdev->rf, netdev->dev_addr,
++		irdma_manage_arp_cache(iwdev->rf, real_dev->dev_addr,
+ 				       &local_ipaddr, true, IRDMA_ARP_DELETE);
+-		irdma_if_notify(iwdev, netdev, &local_ipaddr, true, false);
++		irdma_if_notify(iwdev, real_dev, &local_ipaddr, true, false);
+ 		irdma_gid_change_event(&iwdev->ibdev);
+ 		break;
+ 	case NETDEV_UP:
+ 	case NETDEV_CHANGEADDR:
+-		irdma_add_arp(iwdev->rf, &local_ipaddr, true, netdev->dev_addr);
+-		irdma_if_notify(iwdev, netdev, &local_ipaddr, true, true);
++		irdma_add_arp(iwdev->rf, &local_ipaddr, true, real_dev->dev_addr);
++		irdma_if_notify(iwdev, real_dev, &local_ipaddr, true, true);
+ 		irdma_gid_change_event(&iwdev->ibdev);
+ 		break;
+ 	default:
+@@ -196,32 +200,36 @@ int irdma_inet6addr_event(struct notifier_block *notifier, unsigned long event,
+ 			  void *ptr)
+ {
+ 	struct inet6_ifaddr *ifa = ptr;
+-	struct net_device *netdev = ifa->idev->dev;
++	struct net_device *real_dev, *netdev = ifa->idev->dev;
+ 	struct irdma_device *iwdev;
+ 	struct ib_device *ibdev;
+ 	u32 local_ipaddr6[4];
+ 
+-	ibdev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_IRDMA);
++	real_dev = rdma_vlan_dev_real_dev(netdev);
++	if (!real_dev)
++		real_dev = netdev;
++
++	ibdev = ib_device_get_by_netdev(real_dev, RDMA_DRIVER_IRDMA);
+ 	if (!ibdev)
+ 		return NOTIFY_DONE;
+ 
+ 	iwdev = to_iwdev(ibdev);
+ 	irdma_copy_ip_ntohl(local_ipaddr6, ifa->addr.in6_u.u6_addr32);
+ 	ibdev_dbg(&iwdev->ibdev,
+-		  "DEV: netdev %p event %lu local_ip=%pI6 MAC=%pM\n", netdev,
+-		  event, local_ipaddr6, netdev->dev_addr);
++		  "DEV: netdev %p event %lu local_ip=%pI6 MAC=%pM\n", real_dev,
++		  event, local_ipaddr6, real_dev->dev_addr);
+ 	switch (event) {
+ 	case NETDEV_DOWN:
+-		irdma_manage_arp_cache(iwdev->rf, netdev->dev_addr,
++		irdma_manage_arp_cache(iwdev->rf, real_dev->dev_addr,
+ 				       local_ipaddr6, false, IRDMA_ARP_DELETE);
+-		irdma_if_notify(iwdev, netdev, local_ipaddr6, false, false);
++		irdma_if_notify(iwdev, real_dev, local_ipaddr6, false, false);
+ 		irdma_gid_change_event(&iwdev->ibdev);
+ 		break;
+ 	case NETDEV_UP:
+ 	case NETDEV_CHANGEADDR:
+ 		irdma_add_arp(iwdev->rf, local_ipaddr6, false,
+-			      netdev->dev_addr);
+-		irdma_if_notify(iwdev, netdev, local_ipaddr6, false, true);
++			      real_dev->dev_addr);
++		irdma_if_notify(iwdev, real_dev, local_ipaddr6, false, true);
+ 		irdma_gid_change_event(&iwdev->ibdev);
+ 		break;
+ 	default:
+@@ -243,14 +251,18 @@ int irdma_net_event(struct notifier_block *notifier, unsigned long event,
+ 		    void *ptr)
+ {
+ 	struct neighbour *neigh = ptr;
++	struct net_device *real_dev, *netdev = (struct net_device *)neigh->dev;
+ 	struct irdma_device *iwdev;
+ 	struct ib_device *ibdev;
+ 	__be32 *p;
+ 	u32 local_ipaddr[4] = {};
+ 	bool ipv4 = true;
+ 
+-	ibdev = ib_device_get_by_netdev((struct net_device *)neigh->dev,
+-					RDMA_DRIVER_IRDMA);
++	real_dev = rdma_vlan_dev_real_dev(netdev);
++	if (!real_dev)
++		real_dev = netdev;
++
++	ibdev = ib_device_get_by_netdev(real_dev, RDMA_DRIVER_IRDMA);
+ 	if (!ibdev)
+ 		return NOTIFY_DONE;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-irdma-fix-passthrough-mode-in-vm.patch b/queue-5.16/rdma-irdma-fix-passthrough-mode-in-vm.patch
new file mode 100644
index 00000000000..dfe4c0a58e4
--- /dev/null
+++ b/queue-5.16/rdma-irdma-fix-passthrough-mode-in-vm.patch
@@ -0,0 +1,81 @@
+From 8b57b172803e50960bd65c19d04848f2f1ad8abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 10:32:10 -0600
+Subject: RDMA/irdma: Fix Passthrough mode in VM
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+[ Upstream commit b200189626b5cefbaf8be9cadd7a28215e065bb9 ]
+
+Using PCI_FUNC macro in a VM, when the device is in passthrough mode does
+not provide the real function instance. This means that currently, devices
+will not probe unless the instance in the VM matches the instance in the
+host.
+
+Fix this by getting the pf_id from the LAN during the probe.
+
+Fixes: 8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and implement private channel OPs")
+Link: https://lore.kernel.org/r/20220225163211.127-3-shiraz.saleem@intel.com
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/hw.c       | 2 +-
+ drivers/infiniband/hw/irdma/i40iw_if.c | 1 +
+ drivers/infiniband/hw/irdma/main.c     | 1 +
+ drivers/infiniband/hw/irdma/main.h     | 1 +
+ 4 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
+index b4c657f5f2f9..f99c40893ffa 100644
+--- a/drivers/infiniband/hw/irdma/hw.c
++++ b/drivers/infiniband/hw/irdma/hw.c
+@@ -1608,7 +1608,7 @@ static enum irdma_status_code irdma_initialize_dev(struct irdma_pci_f *rf)
+ 	info.fpm_commit_buf = mem.va;
+ 
+ 	info.bar0 = rf->hw.hw_addr;
+-	info.hmc_fn_id = PCI_FUNC(rf->pcidev->devfn);
++	info.hmc_fn_id = rf->pf_id;
+ 	info.hw = &rf->hw;
+ 	status = irdma_sc_dev_init(rf->rdma_ver, &rf->sc_dev, &info);
+ 	if (status)
+diff --git a/drivers/infiniband/hw/irdma/i40iw_if.c b/drivers/infiniband/hw/irdma/i40iw_if.c
+index d219f64b2c3d..a6f758b61b0c 100644
+--- a/drivers/infiniband/hw/irdma/i40iw_if.c
++++ b/drivers/infiniband/hw/irdma/i40iw_if.c
+@@ -77,6 +77,7 @@ static void i40iw_fill_device_info(struct irdma_device *iwdev, struct i40e_info
+ 	rf->rdma_ver = IRDMA_GEN_1;
+ 	rf->gen_ops.request_reset = i40iw_request_reset;
+ 	rf->pcidev = cdev_info->pcidev;
++	rf->pf_id = cdev_info->fid;
+ 	rf->hw.hw_addr = cdev_info->hw_addr;
+ 	rf->cdev = cdev_info;
+ 	rf->msix_count = cdev_info->msix_count;
+diff --git a/drivers/infiniband/hw/irdma/main.c b/drivers/infiniband/hw/irdma/main.c
+index 51a41359e0b4..c556a36e7670 100644
+--- a/drivers/infiniband/hw/irdma/main.c
++++ b/drivers/infiniband/hw/irdma/main.c
+@@ -226,6 +226,7 @@ static void irdma_fill_device_info(struct irdma_device *iwdev, struct ice_pf *pf
+ 	rf->hw.hw_addr = pf->hw.hw_addr;
+ 	rf->pcidev = pf->pdev;
+ 	rf->msix_count =  pf->num_rdma_msix;
++	rf->pf_id = pf->hw.pf_id;
+ 	rf->msix_entries = &pf->msix_entries[pf->rdma_base_vector];
+ 	rf->default_vsi.vsi_idx = vsi->vsi_num;
+ 	rf->protocol_used = IRDMA_ROCE_PROTOCOL_ONLY;
+diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h
+index cb218cab79ac..fb7faa85e4c9 100644
+--- a/drivers/infiniband/hw/irdma/main.h
++++ b/drivers/infiniband/hw/irdma/main.h
+@@ -257,6 +257,7 @@ struct irdma_pci_f {
+ 	u8 *mem_rsrc;
+ 	u8 rdma_ver;
+ 	u8 rst_to;
++	u8 pf_id;
+ 	enum irdma_protocol_used protocol_used;
+ 	u32 sd_type;
+ 	u32 msix_count;
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-irdma-prevent-some-integer-underflows.patch b/queue-5.16/rdma-irdma-prevent-some-integer-underflows.patch
new file mode 100644
index 00000000000..524c23c1bcd
--- /dev/null
+++ b/queue-5.16/rdma-irdma-prevent-some-integer-underflows.patch
@@ -0,0 +1,76 @@
+From 947951636e56d6410d36eb8d61ffb60fea4697b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 15:59:28 +0300
+Subject: RDMA/irdma: Prevent some integer underflows
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6f6dbb819dfc1a35bcb8b709b5c83a3ea8beff75 ]
+
+My static checker complains that:
+
+    drivers/infiniband/hw/irdma/ctrl.c:3605 irdma_sc_ceq_init()
+    warn: can subtract underflow 'info->dev->hmc_fpm_misc.max_ceqs'?
+
+It appears that "info->dev->hmc_fpm_misc.max_ceqs" comes from the firmware
+in irdma_sc_parse_fpm_query_buf() so, yes, there is a chance that it could
+be zero.  Even if we trust the firmware, it's easy enough to change the
+condition just as a hardenning measure.
+
+Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs")
+Link: https://lore.kernel.org/r/20220307125928.GE16710@kili
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/ctrl.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c
+index 7264f8c2f7d5..1d6b578dbd82 100644
+--- a/drivers/infiniband/hw/irdma/ctrl.c
++++ b/drivers/infiniband/hw/irdma/ctrl.c
+@@ -431,7 +431,7 @@ enum irdma_status_code irdma_sc_qp_create(struct irdma_sc_qp *qp, struct irdma_c
+ 
+ 	cqp = qp->dev->cqp;
+ 	if (qp->qp_uk.qp_id < cqp->dev->hw_attrs.min_hw_qp_id ||
+-	    qp->qp_uk.qp_id > (cqp->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_QP].max_cnt - 1))
++	    qp->qp_uk.qp_id >= (cqp->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_QP].max_cnt))
+ 		return IRDMA_ERR_INVALID_QP_ID;
+ 
+ 	wqe = irdma_sc_cqp_get_next_send_wqe(cqp, scratch);
+@@ -2510,10 +2510,10 @@ static enum irdma_status_code irdma_sc_cq_create(struct irdma_sc_cq *cq,
+ 	enum irdma_status_code ret_code = 0;
+ 
+ 	cqp = cq->dev->cqp;
+-	if (cq->cq_uk.cq_id > (cqp->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_CQ].max_cnt - 1))
++	if (cq->cq_uk.cq_id >= (cqp->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_CQ].max_cnt))
+ 		return IRDMA_ERR_INVALID_CQ_ID;
+ 
+-	if (cq->ceq_id > (cq->dev->hmc_fpm_misc.max_ceqs - 1))
++	if (cq->ceq_id >= (cq->dev->hmc_fpm_misc.max_ceqs))
+ 		return IRDMA_ERR_INVALID_CEQ_ID;
+ 
+ 	ceq = cq->dev->ceq[cq->ceq_id];
+@@ -3615,7 +3615,7 @@ enum irdma_status_code irdma_sc_ceq_init(struct irdma_sc_ceq *ceq,
+ 	    info->elem_cnt > info->dev->hw_attrs.max_hw_ceq_size)
+ 		return IRDMA_ERR_INVALID_SIZE;
+ 
+-	if (info->ceq_id > (info->dev->hmc_fpm_misc.max_ceqs - 1))
++	if (info->ceq_id >= (info->dev->hmc_fpm_misc.max_ceqs))
+ 		return IRDMA_ERR_INVALID_CEQ_ID;
+ 	pble_obj_cnt = info->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_PBLE].cnt;
+ 
+@@ -4164,7 +4164,7 @@ enum irdma_status_code irdma_sc_ccq_init(struct irdma_sc_cq *cq,
+ 	    info->num_elem > info->dev->hw_attrs.uk_attrs.max_hw_cq_size)
+ 		return IRDMA_ERR_INVALID_SIZE;
+ 
+-	if (info->ceq_id > (info->dev->hmc_fpm_misc.max_ceqs - 1))
++	if (info->ceq_id >= (info->dev->hmc_fpm_misc.max_ceqs ))
+ 		return IRDMA_ERR_INVALID_CEQ_ID;
+ 
+ 	pble_obj_cnt = info->dev->hmc_info->hmc_obj[IRDMA_HMC_IW_PBLE].cnt;
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-irdma-remove-incorrect-masking-of-pd.patch b/queue-5.16/rdma-irdma-remove-incorrect-masking-of-pd.patch
new file mode 100644
index 00000000000..8429e09e8fb
--- /dev/null
+++ b/queue-5.16/rdma-irdma-remove-incorrect-masking-of-pd.patch
@@ -0,0 +1,48 @@
+From d0e66911ce93d6c6842212b0c27b76e8db1e83a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 10:32:11 -0600
+Subject: RDMA/irdma: Remove incorrect masking of PD
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+[ Upstream commit 17850f2b0b4b806e47cc44df94186bfc2cdd490b ]
+
+The PD id is masked with 0x7fff, while PD can be 18 bits for GEN2 HW.
+Remove the masking as it should not be needed and can cause incorrect PD
+id to be used.
+
+Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
+Link: https://lore.kernel.org/r/20220225163211.127-4-shiraz.saleem@intel.com
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/verbs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
+index 8cd5f9261692..03d4da16604d 100644
+--- a/drivers/infiniband/hw/irdma/verbs.c
++++ b/drivers/infiniband/hw/irdma/verbs.c
+@@ -2504,7 +2504,7 @@ static int irdma_dealloc_mw(struct ib_mw *ibmw)
+ 	cqp_info = &cqp_request->info;
+ 	info = &cqp_info->in.u.dealloc_stag.info;
+ 	memset(info, 0, sizeof(*info));
+-	info->pd_id = iwpd->sc_pd.pd_id & 0x00007fff;
++	info->pd_id = iwpd->sc_pd.pd_id;
+ 	info->stag_idx = ibmw->rkey >> IRDMA_CQPSQ_STAG_IDX_S;
+ 	info->mr = false;
+ 	cqp_info->cqp_cmd = IRDMA_OP_DEALLOC_STAG;
+@@ -3016,7 +3016,7 @@ static int irdma_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
+ 	cqp_info = &cqp_request->info;
+ 	info = &cqp_info->in.u.dealloc_stag.info;
+ 	memset(info, 0, sizeof(*info));
+-	info->pd_id = iwpd->sc_pd.pd_id & 0x00007fff;
++	info->pd_id = iwpd->sc_pd.pd_id;
+ 	info->stag_idx = ib_mr->rkey >> IRDMA_CQPSQ_STAG_IDX_S;
+ 	info->mr = true;
+ 	if (iwpbl->pbl_allocated)
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch b/queue-5.16/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
new file mode 100644
index 00000000000..dbfc78508b8
--- /dev/null
+++ b/queue-5.16/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
@@ -0,0 +1,40 @@
+From 2d84cc5e8bc414c10c3a1e7d86f052582cb42e87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 09:06:01 -0800
+Subject: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
+
+From: Yongzhi Liu <lyz_cs@pku.edu.cn>
+
+[ Upstream commit 087f9c3f2309ed183f7e4b85ae57121d8663224d ]
+
+In case the second xa_insert() fails, the obj_event is not released.  Fix
+the error unwind flow to free that memory to avoid a memory leak.
+
+Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
+Link: https://lore.kernel.org/r/1647018361-18266-1-git-send-email-lyz_cs@pku.edu.cn
+Signed-off-by: Yongzhi Liu <lyz_cs@pku.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 08b7f6bc56c3..15c0884d1f49 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -1886,8 +1886,10 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table,
+ 				key_level2,
+ 				obj_event,
+ 				GFP_KERNEL);
+-		if (err)
++		if (err) {
++			kfree(obj_event);
+ 			return err;
++		}
+ 		INIT_LIST_HEAD(&obj_event->obj_sub_list);
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-mlx5-fix-the-flow-of-a-miss-in-the-allocation-o.patch b/queue-5.16/rdma-mlx5-fix-the-flow-of-a-miss-in-the-allocation-o.patch
new file mode 100644
index 00000000000..d6f26ad57fc
--- /dev/null
+++ b/queue-5.16/rdma-mlx5-fix-the-flow-of-a-miss-in-the-allocation-o.patch
@@ -0,0 +1,39 @@
+From c5b122d5b4f150d5aa9cfcf3d02a551aa13a2409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 19:55:30 +0200
+Subject: RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
+
+From: Aharon Landau <aharonl@nvidia.com>
+
+[ Upstream commit 2f0e60d5e9f96341a0c8a01be8878cdb3b29ff20 ]
+
+When an ODP MR cache entry is empty and trying to allocate it, increment
+the ent->miss counter and call to queue_adjust_cache_locked() to verify
+the entry is balanced.
+
+Fixes: aad719dcf379 ("RDMA/mlx5: Allow MRs to be created in the cache synchronously")
+Link: https://lore.kernel.org/r/09503e295276dcacc92cb1d8aef1ad0961c99dc1.1644947594.git.leonro@nvidia.com
+Signed-off-by: Aharon Landau <aharonl@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 157d862fb864..2910d7833313 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -585,6 +585,8 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev,
+ 	ent = &cache->ent[entry];
+ 	spin_lock_irq(&ent->lock);
+ 	if (list_empty(&ent->head)) {
++		queue_adjust_cache_locked(ent);
++		ent->miss++;
+ 		spin_unlock_irq(&ent->lock);
+ 		mr = create_cache_mr(ent);
+ 		if (IS_ERR(mr))
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-nldev-prevent-underflow-in-nldev_stat_set_count.patch b/queue-5.16/rdma-nldev-prevent-underflow-in-nldev_stat_set_count.patch
new file mode 100644
index 00000000000..9e144a23d2d
--- /dev/null
+++ b/queue-5.16/rdma-nldev-prevent-underflow-in-nldev_stat_set_count.patch
@@ -0,0 +1,42 @@
+From 703cc5c944a10187f29536b5bd4ad07c866f1ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 11:39:48 +0300
+Subject: RDMA/nldev: Prevent underflow in
+ nldev_stat_set_counter_dynamic_doit()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 87e0eacb176f9500c2063d140c0a1d7fa51ab8a5 ]
+
+This code checks "index" for an upper bound but it does not check for
+negatives.  Change the type to unsigned to prevent underflows.
+
+Fixes: 3c3c1f141639 ("RDMA/nldev: Allow optional-counter status configuration through RDMA netlink")
+Link: https://lore.kernel.org/r/20220316083948.GC30941@kili
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/nldev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index f5aacaf7fb8e..ca24ce34da76 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -1951,9 +1951,10 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[],
+ 					       u32 port)
+ {
+ 	struct rdma_hw_stats *stats;
+-	int rem, i, index, ret = 0;
+ 	struct nlattr *entry_attr;
+ 	unsigned long *target;
++	int rem, i, ret = 0;
++	u32 index;
+ 
+ 	stats = ib_get_hw_stats_port(device, port);
+ 	if (!stats)
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-rxe-change-variable-and-function-argument-to-pr.patch b/queue-5.16/rdma-rxe-change-variable-and-function-argument-to-pr.patch
new file mode 100644
index 00000000000..2de43b47c22
--- /dev/null
+++ b/queue-5.16/rdma-rxe-change-variable-and-function-argument-to-pr.patch
@@ -0,0 +1,73 @@
+From 8530af0992f3a188bee5f99127fea03bcc2b349b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 22:50:46 +0800
+Subject: RDMA/rxe: Change variable and function argument to proper type
+
+From: Chengguang Xu <cgxu519@mykernel.net>
+
+[ Upstream commit 7e8e611d6a0ff228577b1167335ffefb0f44d5d8 ]
+
+The type of wqe length is u32 so in order to avoid overflow and shadow
+casting change variable and relevant function argument to proper type.
+
+Link: https://lore.kernel.org/r/20220307145047.3235675-1-cgxu519@mykernel.net
+Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 0c9d2af15f3d..79ed4ca2fe2c 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -362,7 +362,7 @@ static inline int get_mtu(struct rxe_qp *qp)
+ 
+ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ 				       struct rxe_send_wqe *wqe,
+-				       int opcode, int payload,
++				       int opcode, u32 payload,
+ 				       struct rxe_pkt_info *pkt)
+ {
+ 	struct rxe_dev		*rxe = to_rdev(qp->ibqp.device);
+@@ -455,7 +455,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ 
+ static int finish_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ 		       struct rxe_pkt_info *pkt, struct sk_buff *skb,
+-		       int paylen)
++		       u32 paylen)
+ {
+ 	int err;
+ 
+@@ -503,7 +503,7 @@ static void update_wqe_state(struct rxe_qp *qp,
+ static void update_wqe_psn(struct rxe_qp *qp,
+ 			   struct rxe_send_wqe *wqe,
+ 			   struct rxe_pkt_info *pkt,
+-			   int payload)
++			   u32 payload)
+ {
+ 	/* number of packets left to send including current one */
+ 	int num_pkt = (wqe->dma.resid + payload + qp->mtu - 1) / qp->mtu;
+@@ -546,7 +546,7 @@ static void rollback_state(struct rxe_send_wqe *wqe,
+ }
+ 
+ static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+-			 struct rxe_pkt_info *pkt, int payload)
++			 struct rxe_pkt_info *pkt, u32 payload)
+ {
+ 	qp->req.opcode = pkt->opcode;
+ 
+@@ -618,7 +618,7 @@ int rxe_requester(void *arg)
+ 	struct sk_buff *skb;
+ 	struct rxe_send_wqe *wqe;
+ 	enum rxe_hdr_mask mask;
+-	int payload;
++	u32 payload;
+ 	int mtu;
+ 	int opcode;
+ 	int ret;
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-rxe-check-the-last-packet-by-rxe_end_mask.patch b/queue-5.16/rdma-rxe-check-the-last-packet-by-rxe_end_mask.patch
new file mode 100644
index 00000000000..7deaedbda92
--- /dev/null
+++ b/queue-5.16/rdma-rxe-check-the-last-packet-by-rxe_end_mask.patch
@@ -0,0 +1,54 @@
+From 8dcb29dce1d4c4da850cd1c44912e015d3cee0c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Dec 2021 11:44:38 +0800
+Subject: RDMA/rxe: Check the last packet by RXE_END_MASK
+
+From: Xiao Yang <yangx.jy@fujitsu.com>
+
+[ Upstream commit b1377cc37f6bebd57ce8747b7e16163a475af295 ]
+
+It's wrong to check the last packet by RXE_COMP_MASK because the flag is
+to indicate if responder needs to generate a completion.
+
+Fixes: 9fcd67d1772c ("IB/rxe: increment msn only when completing a request")
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20211229034438.1854908-1-yangx.jy@fujitsu.com
+Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_resp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index e8f435fa6e4d..380934e38923 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -814,6 +814,10 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+ 			return RESPST_ERR_INVALIDATE_RKEY;
+ 	}
+ 
++	if (pkt->mask & RXE_END_MASK)
++		/* We successfully processed this new request. */
++		qp->resp.msn++;
++
+ 	/* next expected psn, read handles this separately */
+ 	qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
+ 	qp->resp.ack_psn = qp->resp.psn;
+@@ -821,11 +825,9 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+ 	qp->resp.opcode = pkt->opcode;
+ 	qp->resp.status = IB_WC_SUCCESS;
+ 
+-	if (pkt->mask & RXE_COMP_MASK) {
+-		/* We successfully processed this new request. */
+-		qp->resp.msn++;
++	if (pkt->mask & RXE_COMP_MASK)
+ 		return RESPST_COMPLETE;
+-	} else if (qp_type(qp) == IB_QPT_RC)
++	else if (qp_type(qp) == IB_QPT_RC)
+ 		return RESPST_ACKNOWLEDGE;
+ 	else
+ 		return RESPST_CLEANUP;
+-- 
+2.34.1
+
diff --git a/queue-5.16/rdma-rxe-fix-ref-error-in-rxe_av.c.patch b/queue-5.16/rdma-rxe-fix-ref-error-in-rxe_av.c.patch
new file mode 100644
index 00000000000..3ac3c83329d
--- /dev/null
+++ b/queue-5.16/rdma-rxe-fix-ref-error-in-rxe_av.c.patch
@@ -0,0 +1,302 @@
+From 6ddb0f5839c0ddab66bb681f4800b84d15b2d405 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 18:07:57 -0600
+Subject: RDMA/rxe: Fix ref error in rxe_av.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 63221acb0c63141cc7650f8eefb148337061e6db ]
+
+The commit referenced below can take a reference to the AH which is never
+dropped. This only happens in the UD request path. This patch optionally
+passes that AH back to the caller so that it can hold the reference while
+the AV is being accessed and then drop it. Code to do this is added to
+rxe_req.c. The AV is also passed to rxe_prepare in rxe_net.c as an
+optimization.
+
+Fixes: e2fe06c90806 ("RDMA/rxe: Lookup kernel AH from ah index in UD WQEs")
+Link: https://lore.kernel.org/r/20220304000808.225811-2-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_av.c   | 19 +++++++++-
+ drivers/infiniband/sw/rxe/rxe_loc.h  |  5 ++-
+ drivers/infiniband/sw/rxe/rxe_net.c  | 17 +++++----
+ drivers/infiniband/sw/rxe/rxe_req.c  | 55 +++++++++++++++++-----------
+ drivers/infiniband/sw/rxe/rxe_resp.c |  2 +-
+ 5 files changed, 63 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_av.c b/drivers/infiniband/sw/rxe/rxe_av.c
+index 38c7b6fb39d7..360a567159fe 100644
+--- a/drivers/infiniband/sw/rxe/rxe_av.c
++++ b/drivers/infiniband/sw/rxe/rxe_av.c
+@@ -99,11 +99,14 @@ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr)
+ 	av->network_type = type;
+ }
+ 
+-struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt)
++struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp)
+ {
+ 	struct rxe_ah *ah;
+ 	u32 ah_num;
+ 
++	if (ahp)
++		*ahp = NULL;
++
+ 	if (!pkt || !pkt->qp)
+ 		return NULL;
+ 
+@@ -117,10 +120,22 @@ struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt)
+ 	if (ah_num) {
+ 		/* only new user provider or kernel client */
+ 		ah = rxe_pool_get_index(&pkt->rxe->ah_pool, ah_num);
+-		if (!ah || ah->ah_num != ah_num || rxe_ah_pd(ah) != pkt->qp->pd) {
++		if (!ah) {
+ 			pr_warn("Unable to find AH matching ah_num\n");
+ 			return NULL;
+ 		}
++
++		if (rxe_ah_pd(ah) != pkt->qp->pd) {
++			pr_warn("PDs don't match for AH and QP\n");
++			rxe_drop_ref(ah);
++			return NULL;
++		}
++
++		if (ahp)
++			*ahp = ah;
++		else
++			rxe_drop_ref(ah);
++
+ 		return &ah->av;
+ 	}
+ 
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 1ca43b859d80..42234744dadd 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -19,7 +19,7 @@ void rxe_av_to_attr(struct rxe_av *av, struct rdma_ah_attr *attr);
+ 
+ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr);
+ 
+-struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt);
++struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp);
+ 
+ /* rxe_cq.c */
+ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
+@@ -102,7 +102,8 @@ void rxe_mw_cleanup(struct rxe_pool_entry *arg);
+ /* rxe_net.c */
+ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
+ 				int paylen, struct rxe_pkt_info *pkt);
+-int rxe_prepare(struct rxe_pkt_info *pkt, struct sk_buff *skb);
++int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
++		struct sk_buff *skb);
+ int rxe_xmit_packet(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
+ 		    struct sk_buff *skb);
+ const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num);
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 2cb810cb890a..456e960cacd7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -293,13 +293,13 @@ static void prepare_ipv6_hdr(struct dst_entry *dst, struct sk_buff *skb,
+ 	ip6h->payload_len = htons(skb->len - sizeof(*ip6h));
+ }
+ 
+-static int prepare4(struct rxe_pkt_info *pkt, struct sk_buff *skb)
++static int prepare4(struct rxe_av *av, struct rxe_pkt_info *pkt,
++		    struct sk_buff *skb)
+ {
+ 	struct rxe_qp *qp = pkt->qp;
+ 	struct dst_entry *dst;
+ 	bool xnet = false;
+ 	__be16 df = htons(IP_DF);
+-	struct rxe_av *av = rxe_get_av(pkt);
+ 	struct in_addr *saddr = &av->sgid_addr._sockaddr_in.sin_addr;
+ 	struct in_addr *daddr = &av->dgid_addr._sockaddr_in.sin_addr;
+ 
+@@ -319,11 +319,11 @@ static int prepare4(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+ 	return 0;
+ }
+ 
+-static int prepare6(struct rxe_pkt_info *pkt, struct sk_buff *skb)
++static int prepare6(struct rxe_av *av, struct rxe_pkt_info *pkt,
++		    struct sk_buff *skb)
+ {
+ 	struct rxe_qp *qp = pkt->qp;
+ 	struct dst_entry *dst;
+-	struct rxe_av *av = rxe_get_av(pkt);
+ 	struct in6_addr *saddr = &av->sgid_addr._sockaddr_in6.sin6_addr;
+ 	struct in6_addr *daddr = &av->dgid_addr._sockaddr_in6.sin6_addr;
+ 
+@@ -344,16 +344,17 @@ static int prepare6(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+ 	return 0;
+ }
+ 
+-int rxe_prepare(struct rxe_pkt_info *pkt, struct sk_buff *skb)
++int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
++		struct sk_buff *skb)
+ {
+ 	int err = 0;
+ 
+ 	if (skb->protocol == htons(ETH_P_IP))
+-		err = prepare4(pkt, skb);
++		err = prepare4(av, pkt, skb);
+ 	else if (skb->protocol == htons(ETH_P_IPV6))
+-		err = prepare6(pkt, skb);
++		err = prepare6(av, pkt, skb);
+ 
+-	if (ether_addr_equal(skb->dev->dev_addr, rxe_get_av(pkt)->dmac))
++	if (ether_addr_equal(skb->dev->dev_addr, av->dmac))
+ 		pkt->mask |= RXE_LOOPBACK_MASK;
+ 
+ 	return err;
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 79ed4ca2fe2c..ae2a02f3d335 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -361,6 +361,7 @@ static inline int get_mtu(struct rxe_qp *qp)
+ }
+ 
+ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
++				       struct rxe_av *av,
+ 				       struct rxe_send_wqe *wqe,
+ 				       int opcode, u32 payload,
+ 				       struct rxe_pkt_info *pkt)
+@@ -368,7 +369,6 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ 	struct rxe_dev		*rxe = to_rdev(qp->ibqp.device);
+ 	struct sk_buff		*skb;
+ 	struct rxe_send_wr	*ibwr = &wqe->wr;
+-	struct rxe_av		*av;
+ 	int			pad = (-payload) & 0x3;
+ 	int			paylen;
+ 	int			solicited;
+@@ -378,21 +378,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ 
+ 	/* length from start of bth to end of icrc */
+ 	paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE;
+-
+-	/* pkt->hdr, port_num and mask are initialized in ifc layer */
+-	pkt->rxe	= rxe;
+-	pkt->opcode	= opcode;
+-	pkt->qp		= qp;
+-	pkt->psn	= qp->req.psn;
+-	pkt->mask	= rxe_opcode[opcode].mask;
+-	pkt->paylen	= paylen;
+-	pkt->wqe	= wqe;
++	pkt->paylen = paylen;
+ 
+ 	/* init skb */
+-	av = rxe_get_av(pkt);
+-	if (!av)
+-		return NULL;
+-
+ 	skb = rxe_init_packet(rxe, av, paylen, pkt);
+ 	if (unlikely(!skb))
+ 		return NULL;
+@@ -453,13 +441,13 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ 	return skb;
+ }
+ 
+-static int finish_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+-		       struct rxe_pkt_info *pkt, struct sk_buff *skb,
+-		       u32 paylen)
++static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,
++			 struct rxe_send_wqe *wqe, struct rxe_pkt_info *pkt,
++			 struct sk_buff *skb, u32 paylen)
+ {
+ 	int err;
+ 
+-	err = rxe_prepare(pkt, skb);
++	err = rxe_prepare(av, pkt, skb);
+ 	if (err)
+ 		return err;
+ 
+@@ -614,6 +602,7 @@ static int rxe_do_local_ops(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ int rxe_requester(void *arg)
+ {
+ 	struct rxe_qp *qp = (struct rxe_qp *)arg;
++	struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
+ 	struct rxe_pkt_info pkt;
+ 	struct sk_buff *skb;
+ 	struct rxe_send_wqe *wqe;
+@@ -625,6 +614,8 @@ int rxe_requester(void *arg)
+ 	struct rxe_send_wqe rollback_wqe;
+ 	u32 rollback_psn;
+ 	struct rxe_queue *q = qp->sq.queue;
++	struct rxe_ah *ah;
++	struct rxe_av *av;
+ 
+ 	rxe_add_ref(qp);
+ 
+@@ -711,14 +702,28 @@ int rxe_requester(void *arg)
+ 		payload = mtu;
+ 	}
+ 
+-	skb = init_req_packet(qp, wqe, opcode, payload, &pkt);
++	pkt.rxe = rxe;
++	pkt.opcode = opcode;
++	pkt.qp = qp;
++	pkt.psn = qp->req.psn;
++	pkt.mask = rxe_opcode[opcode].mask;
++	pkt.wqe = wqe;
++
++	av = rxe_get_av(&pkt, &ah);
++	if (unlikely(!av)) {
++		pr_err("qp#%d Failed no address vector\n", qp_num(qp));
++		wqe->status = IB_WC_LOC_QP_OP_ERR;
++		goto err_drop_ah;
++	}
++
++	skb = init_req_packet(qp, av, wqe, opcode, payload, &pkt);
+ 	if (unlikely(!skb)) {
+ 		pr_err("qp#%d Failed allocating skb\n", qp_num(qp));
+ 		wqe->status = IB_WC_LOC_QP_OP_ERR;
+-		goto err;
++		goto err_drop_ah;
+ 	}
+ 
+-	ret = finish_packet(qp, wqe, &pkt, skb, payload);
++	ret = finish_packet(qp, av, wqe, &pkt, skb, payload);
+ 	if (unlikely(ret)) {
+ 		pr_debug("qp#%d Error during finish packet\n", qp_num(qp));
+ 		if (ret == -EFAULT)
+@@ -726,9 +731,12 @@ int rxe_requester(void *arg)
+ 		else
+ 			wqe->status = IB_WC_LOC_QP_OP_ERR;
+ 		kfree_skb(skb);
+-		goto err;
++		goto err_drop_ah;
+ 	}
+ 
++	if (ah)
++		rxe_drop_ref(ah);
++
+ 	/*
+ 	 * To prevent a race on wqe access between requester and completer,
+ 	 * wqe members state and psn need to be set before calling
+@@ -757,6 +765,9 @@ int rxe_requester(void *arg)
+ 
+ 	goto next_wqe;
+ 
++err_drop_ah:
++	if (ah)
++		rxe_drop_ref(ah);
+ err:
+ 	wqe->state = wqe_state_error;
+ 	__rxe_do_task(&qp->comp.task);
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 380934e38923..192cb9a096a1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -632,7 +632,7 @@ static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp,
+ 	if (ack->mask & RXE_ATMACK_MASK)
+ 		atmack_set_orig(ack, qp->resp.atomic_orig);
+ 
+-	err = rxe_prepare(ack, skb);
++	err = rxe_prepare(&qp->pri_av, ack, skb);
+ 	if (err) {
+ 		kfree_skb(skb);
+ 		return NULL;
+-- 
+2.34.1
+
diff --git a/queue-5.16/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch b/queue-5.16/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
new file mode 100644
index 00000000000..b1ee2f978dd
--- /dev/null
+++ b/queue-5.16/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
@@ -0,0 +1,48 @@
+From 9669c6883f0619827872666296f5f25c6c0f3e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jan 2022 12:11:38 +0100
+Subject: regulator: qcom_smd: fix for_each_child.cocci warnings
+
+From: kernel test robot <lkp@intel.com>
+
+[ Upstream commit 6390d42c21efff0b4c10956a38e341f4e84ecd3d ]
+
+drivers/regulator/qcom_smd-regulator.c:1318:1-33: WARNING: Function "for_each_available_child_of_node" should have of_node_put() before return around line 1321.
+
+Semantic patch information:
+ False positives can be due to function calls within the for_each
+ loop that may encapsulate an of_node_put.
+
+Generated by: scripts/coccinelle/iterators/for_each_child.cocci
+
+Fixes: 14e2976fbabd ("regulator: qcom_smd: Align probe function with rpmh-regulator")
+CC: Konrad Dybcio <konrad.dybcio@somainline.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2201151210170.3051@hadrien
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom_smd-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
+index 9fc666107a06..8490aa8eecb1 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -1317,8 +1317,10 @@ static int rpm_reg_probe(struct platform_device *pdev)
+ 
+ 	for_each_available_child_of_node(dev->of_node, node) {
+ 		vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL);
+-		if (!vreg)
++		if (!vreg) {
++			of_node_put(node);
+ 			return -ENOMEM;
++		}
+ 
+ 		ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/regulator-rpi-panel-handle-i2c-errors-timing-to-the-.patch b/queue-5.16/regulator-rpi-panel-handle-i2c-errors-timing-to-the-.patch
new file mode 100644
index 00000000000..aeb7e543e43
--- /dev/null
+++ b/queue-5.16/regulator-rpi-panel-handle-i2c-errors-timing-to-the-.patch
@@ -0,0 +1,143 @@
+From 9e9f9243e6e384abc034e3c5de6b484aad5cc34c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 17:01:22 -0500
+Subject: regulator: rpi-panel: Handle I2C errors/timing to the Atmel
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 5665eee7a3800430e7dc3ef6f25722476b603186 ]
+
+The Atmel is doing some things in the I2C ISR, during which
+period it will not respond to further commands. This is
+particularly true of the POWERON command.
+
+Increase delays appropriately, and retry should I2C errors be
+reported.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
+Link: https://lore.kernel.org/r/20220124220129.158891-3-detlev.casanova@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../regulator/rpi-panel-attiny-regulator.c    | 56 +++++++++++++++----
+ 1 file changed, 46 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/regulator/rpi-panel-attiny-regulator.c b/drivers/regulator/rpi-panel-attiny-regulator.c
+index ee46bfbf5eee..991b4730d768 100644
+--- a/drivers/regulator/rpi-panel-attiny-regulator.c
++++ b/drivers/regulator/rpi-panel-attiny-regulator.c
+@@ -37,11 +37,24 @@ static const struct regmap_config attiny_regmap_config = {
+ static int attiny_lcd_power_enable(struct regulator_dev *rdev)
+ {
+ 	unsigned int data;
++	int ret, i;
+ 
+ 	regmap_write(rdev->regmap, REG_POWERON, 1);
++	msleep(80);
++
+ 	/* Wait for nPWRDWN to go low to indicate poweron is done. */
+-	regmap_read_poll_timeout(rdev->regmap, REG_PORTB, data,
+-					data & BIT(0), 10, 1000000);
++	for (i = 0; i < 20; i++) {
++		ret = regmap_read(rdev->regmap, REG_PORTB, &data);
++		if (!ret) {
++			if (data & BIT(0))
++				break;
++		}
++		usleep_range(10000, 12000);
++	}
++	usleep_range(10000, 12000);
++
++	if (ret)
++		pr_err("%s: regmap_read_poll_timeout failed %d\n", __func__, ret);
+ 
+ 	/* Default to the same orientation as the closed source
+ 	 * firmware used for the panel.  Runtime rotation
+@@ -57,23 +70,34 @@ static int attiny_lcd_power_disable(struct regulator_dev *rdev)
+ {
+ 	regmap_write(rdev->regmap, REG_PWM, 0);
+ 	regmap_write(rdev->regmap, REG_POWERON, 0);
+-	udelay(1);
++	msleep(30);
+ 	return 0;
+ }
+ 
+ static int attiny_lcd_power_is_enabled(struct regulator_dev *rdev)
+ {
+ 	unsigned int data;
+-	int ret;
++	int ret, i;
+ 
+-	ret = regmap_read(rdev->regmap, REG_POWERON, &data);
++	for (i = 0; i < 10; i++) {
++		ret = regmap_read(rdev->regmap, REG_POWERON, &data);
++		if (!ret)
++			break;
++		usleep_range(10000, 12000);
++	}
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	if (!(data & BIT(0)))
+ 		return 0;
+ 
+-	ret = regmap_read(rdev->regmap, REG_PORTB, &data);
++	for (i = 0; i < 10; i++) {
++		ret = regmap_read(rdev->regmap, REG_PORTB, &data);
++		if (!ret)
++			break;
++		usleep_range(10000, 12000);
++	}
++
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -103,20 +127,32 @@ static int attiny_update_status(struct backlight_device *bl)
+ {
+ 	struct regmap *regmap = bl_get_data(bl);
+ 	int brightness = bl->props.brightness;
++	int ret, i;
+ 
+ 	if (bl->props.power != FB_BLANK_UNBLANK ||
+ 	    bl->props.fb_blank != FB_BLANK_UNBLANK)
+ 		brightness = 0;
+ 
+-	return regmap_write(regmap, REG_PWM, brightness);
++	for (i = 0; i < 10; i++) {
++		ret = regmap_write(regmap, REG_PWM, brightness);
++		if (!ret)
++			break;
++	}
++
++	return ret;
+ }
+ 
+ static int attiny_get_brightness(struct backlight_device *bl)
+ {
+ 	struct regmap *regmap = bl_get_data(bl);
+-	int ret, brightness;
++	int ret, brightness, i;
++
++	for (i = 0; i < 10; i++) {
++		ret = regmap_read(regmap, REG_PWM, &brightness);
++		if (!ret)
++			break;
++	}
+ 
+-	ret = regmap_read(regmap, REG_PWM, &brightness);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -166,7 +202,7 @@ static int attiny_i2c_probe(struct i2c_client *i2c,
+ 	}
+ 
+ 	regmap_write(regmap, REG_POWERON, 0);
+-	mdelay(1);
++	msleep(30);
+ 
+ 	config.dev = &i2c->dev;
+ 	config.regmap = regmap;
+-- 
+2.34.1
+
diff --git a/queue-5.16/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch b/queue-5.16/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
new file mode 100644
index 00000000000..760bd52da2f
--- /dev/null
+++ b/queue-5.16/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
@@ -0,0 +1,36 @@
+From d8b1af0e74c6083e5741d2ae23d4b8e3680f2162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 03:12:19 +0000
+Subject: remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 505b5b1616e200042999de715dbe7c1e2735cd65 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220308031219.4718-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_adsp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
+index 098362e6e233..7c02bc132247 100644
+--- a/drivers/remoteproc/qcom_q6v5_adsp.c
++++ b/drivers/remoteproc/qcom_q6v5_adsp.c
+@@ -408,6 +408,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp)
+ 	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/remoteproc-qcom_q6v5_mss-fix-some-leaks-in-q6v5_allo.patch b/queue-5.16/remoteproc-qcom_q6v5_mss-fix-some-leaks-in-q6v5_allo.patch
new file mode 100644
index 00000000000..c53a8705d74
--- /dev/null
+++ b/queue-5.16/remoteproc-qcom_q6v5_mss-fix-some-leaks-in-q6v5_allo.patch
@@ -0,0 +1,74 @@
+From cb5abc2c90b00cf40c991b8c317842321d6a8876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 06:45:21 +0000
+Subject: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 07a5dcc4bed9d7cae54adf5aa10ff9f037a3204b ]
+
+The device_node pointer is returned by of_parse_phandle() or
+of_get_child_by_name() with refcount incremented.
+We should use of_node_put() on it when done.
+
+This function only call of_node_put(node) when of_address_to_resource
+succeeds, missing error cases.
+
+Fixes: 278d744c46fd ("remoteproc: qcom: Fix potential device node leaks")
+Fixes: 051fb70fd4ea ("remoteproc: qcom: Driver for the self-authenticating Hexagon v5")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220308064522.13804-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 43ea8455546c..b9ab91540b00 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -1806,18 +1806,20 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
+ 	 * reserved memory regions from device's memory-region property.
+ 	 */
+ 	child = of_get_child_by_name(qproc->dev->of_node, "mba");
+-	if (!child)
++	if (!child) {
+ 		node = of_parse_phandle(qproc->dev->of_node,
+ 					"memory-region", 0);
+-	else
++	} else {
+ 		node = of_parse_phandle(child, "memory-region", 0);
++		of_node_put(child);
++	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret) {
+ 		dev_err(qproc->dev, "unable to resolve mba region\n");
+ 		return ret;
+ 	}
+-	of_node_put(node);
+ 
+ 	qproc->mba_phys = r.start;
+ 	qproc->mba_size = resource_size(&r);
+@@ -1828,14 +1830,15 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
+ 	} else {
+ 		child = of_get_child_by_name(qproc->dev->of_node, "mpss");
+ 		node = of_parse_phandle(child, "memory-region", 0);
++		of_node_put(child);
+ 	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret) {
+ 		dev_err(qproc->dev, "unable to resolve mpss region\n");
+ 		return ret;
+ 	}
+-	of_node_put(node);
+ 
+ 	qproc->mpss_phys = qproc->mpss_reloc = r.start;
+ 	qproc->mpss_size = resource_size(&r);
+-- 
+2.34.1
+
diff --git a/queue-5.16/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch b/queue-5.16/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
new file mode 100644
index 00000000000..e17d28ec83d
--- /dev/null
+++ b/queue-5.16/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
@@ -0,0 +1,37 @@
+From 720154dbaafc96218b5da17af357c1808c7243dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 06:31:02 +0000
+Subject: remoteproc: qcom_wcnss: Add missing of_node_put() in
+ wcnss_alloc_memory_region
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 8f90161a66bc3d6b9fe8dde4d9028d20eae1b62a ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image loader")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220308063102.10049-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_wcnss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c
+index 80bbafee9846..9a223d394087 100644
+--- a/drivers/remoteproc/qcom_wcnss.c
++++ b/drivers/remoteproc/qcom_wcnss.c
+@@ -500,6 +500,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss)
+ 	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/revert-rdma-core-fix-ib_qp_usecnt_dec-called-when-er.patch b/queue-5.16/revert-rdma-core-fix-ib_qp_usecnt_dec-called-when-er.patch
new file mode 100644
index 00000000000..c4ab5c879b2
--- /dev/null
+++ b/queue-5.16/revert-rdma-core-fix-ib_qp_usecnt_dec-called-when-er.patch
@@ -0,0 +1,103 @@
+From f10ddd5b96051489275aca562d9e4f00b72f5062 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 20:42:13 +0200
+Subject: Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 7922d3de4d270a9aedb71212fc0d5ae697ced516 ]
+
+This reverts commit 7c4a539ec38f4ce400a0f3fcb5ff6c940fcd67bb. which causes
+to the following error in mlx4.
+
+  Destroy of kernel CQ shouldn't fail
+  WARNING: CPU: 4 PID: 18064 at include/rdma/ib_verbs.h:3936 mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
+  Modules linked in: bonding ib_ipoib ip_gre ipip tunnel4 geneve rdma_ucm nf_tables ib_umad mlx4_en mlx4_ib ib_uverbs mlx4_core ip6_gre gre ip6_tunnel tunnel6 iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay fuse [last unloaded: mlx4_core]
+  CPU: 4 PID: 18064 Comm: ibv_xsrq_pingpo Not tainted 5.17.0-rc7_master_62c6ecb #1
+  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+  RIP: 0010:mlx4_ib_dealloc_xrcd+0x12e/0x1b0 [mlx4_ib]
+  Code: 1e 93 08 00 40 80 fd 01 0f 87 fa f1 04 00 83 e5 01 0f 85 2b ff ff ff 48 c7 c7 20 4f b6 a0 c6 05 fd 92 08 00 01 e8 47 c9 82 e2 <0f> 0b e9 11 ff ff ff 0f b6 2d eb 92 08 00 40 80 fd 01 0f 87 b1 f1
+  RSP: 0018:ffff8881a4957750 EFLAGS: 00010286
+  RAX: 0000000000000000 RBX: ffff8881ac4b6800 RCX: 0000000000000000
+  RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed103492aedc
+  RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2e378eb
+  R10: ffffed109a5c6f1d R11: 0000000000000001 R12: ffff888132620000
+  R13: ffff8881a4957a90 R14: ffff8881aa2d4000 R15: ffff8881a4957ad0
+  FS:  00007f0401747740(0000) GS:ffff8884d2e00000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 000055f8ae036118 CR3: 000000012fe94005 CR4: 0000000000370ea0
+  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+  Call Trace:
+   <TASK>
+   ib_dealloc_xrcd_user+0xce/0x120 [ib_core]
+   ib_uverbs_dealloc_xrcd+0xad/0x210 [ib_uverbs]
+   uverbs_free_xrcd+0xe8/0x190 [ib_uverbs]
+   destroy_hw_idr_uobject+0x7a/0x130 [ib_uverbs]
+   uverbs_destroy_uobject+0x164/0x730 [ib_uverbs]
+   uobj_destroy+0x72/0xf0 [ib_uverbs]
+   ib_uverbs_cmd_verbs+0x19fb/0x3110 [ib_uverbs]
+   ib_uverbs_ioctl+0x169/0x260 [ib_uverbs]
+   __x64_sys_ioctl+0x856/0x1550
+   do_syscall_64+0x3d/0x90
+   entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: 7c4a539ec38f ("RDMA/core: Fix ib_qp_usecnt_dec() called when error")
+Link: https://lore.kernel.org/r/74c11029adaf449b3b9228a77cc82f39e9e892c8.1646851220.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_cmd.c          | 1 +
+ drivers/infiniband/core/uverbs_std_types_qp.c | 1 +
+ drivers/infiniband/core/verbs.c               | 3 ++-
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 5a99e31df5f5..d1345d76d9b1 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1438,6 +1438,7 @@ static int create_qp(struct uverbs_attr_bundle *attrs,
+ 		ret = PTR_ERR(qp);
+ 		goto err_put;
+ 	}
++	ib_qp_usecnt_inc(qp);
+ 
+ 	obj->uevent.uobject.object = qp;
+ 	obj->uevent.event_file = READ_ONCE(attrs->ufile->default_async_file);
+diff --git a/drivers/infiniband/core/uverbs_std_types_qp.c b/drivers/infiniband/core/uverbs_std_types_qp.c
+index 75353e09c6fe..dd1075466f61 100644
+--- a/drivers/infiniband/core/uverbs_std_types_qp.c
++++ b/drivers/infiniband/core/uverbs_std_types_qp.c
+@@ -254,6 +254,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
+ 		ret = PTR_ERR(qp);
+ 		goto err_put;
+ 	}
++	ib_qp_usecnt_inc(qp);
+ 
+ 	if (attr.qp_type == IB_QPT_XRC_TGT) {
+ 		obj->uxrcd = container_of(xrcd_uobj, struct ib_uxrcd_object,
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 961055eb330d..e821dc94a43e 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1253,7 +1253,6 @@ static struct ib_qp *create_qp(struct ib_device *dev, struct ib_pd *pd,
+ 	if (ret)
+ 		goto err_security;
+ 
+-	ib_qp_usecnt_inc(qp);
+ 	rdma_restrack_add(&qp->res);
+ 	return qp;
+ 
+@@ -1354,6 +1353,8 @@ struct ib_qp *ib_create_qp_kernel(struct ib_pd *pd,
+ 	if (IS_ERR(qp))
+ 		return qp;
+ 
++	ib_qp_usecnt_inc(qp);
++
+ 	if (qp_init_attr->cap.max_rdma_ctxs) {
+ 		ret = rdma_rw_init_mrs(qp, qp_init_attr);
+ 		if (ret)
+-- 
+2.34.1
+
diff --git a/queue-5.16/revert-revert-block-bfq-honor-already-setup-queue-me.patch b/queue-5.16/revert-revert-block-bfq-honor-already-setup-queue-me.patch
new file mode 100644
index 00000000000..89e8e7002b5
--- /dev/null
+++ b/queue-5.16/revert-revert-block-bfq-honor-already-setup-queue-me.patch
@@ -0,0 +1,78 @@
+From c357cc19f01cc87d88abb85247213705ad7f1884 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Nov 2021 19:15:10 +0100
+Subject: Revert "Revert "block, bfq: honor already-setup queue merges""
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit 15729ff8143f8135b03988a100a19e66d7cb7ecd ]
+
+A crash [1] happened to be triggered in conjunction with commit
+2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The
+latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq:
+honor already-setup queue merges""). Yet, the reverted commit was not
+the one introducing the bug. In fact, it actually triggered a UAF
+introduced by a different commit, and now fixed by commit d29bd41428cf
+("block, bfq: reset last_bfqq_created on group change").
+
+So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq:
+honor already-setup queue merges") out. This commit restores it.
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
+
+Reported-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20211125181510.15004-1-paolo.valente@linaro.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 7eecd3200d83..342e927f213b 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2662,6 +2662,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ 	 * are likely to increase the throughput.
+ 	 */
+ 	bfqq->new_bfqq = new_bfqq;
++	/*
++	 * The above assignment schedules the following redirections:
++	 * each time some I/O for bfqq arrives, the process that
++	 * generated that I/O is disassociated from bfqq and
++	 * associated with new_bfqq. Here we increases new_bfqq->ref
++	 * in advance, adding the number of processes that are
++	 * expected to be associated with new_bfqq as they happen to
++	 * issue I/O.
++	 */
+ 	new_bfqq->ref += process_refs;
+ 	return new_bfqq;
+ }
+@@ -2724,6 +2733,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ 	struct bfq_queue *in_service_bfqq, *new_bfqq;
+ 
++	/* if a merge has already been setup, then proceed with that first */
++	if (bfqq->new_bfqq)
++		return bfqq->new_bfqq;
++
+ 	/*
+ 	 * Check delayed stable merge for rotational or non-queueing
+ 	 * devs. For this branch to be executed, bfqq must not be
+@@ -2825,9 +2838,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ 	if (bfq_too_late_for_merging(bfqq))
+ 		return NULL;
+ 
+-	if (bfqq->new_bfqq)
+-		return bfqq->new_bfqq;
+-
+ 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ 		return NULL;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/rseq-remove-broken-uapi-field-layout-on-32-bit-littl.patch b/queue-5.16/rseq-remove-broken-uapi-field-layout-on-32-bit-littl.patch
new file mode 100644
index 00000000000..eece576d6dd
--- /dev/null
+++ b/queue-5.16/rseq-remove-broken-uapi-field-layout-on-32-bit-littl.patch
@@ -0,0 +1,95 @@
+From 8665fc0098076db36b6802cbad2dc3250d3db8e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 10:27:20 -0500
+Subject: rseq: Remove broken uapi field layout on 32-bit little endian
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+[ Upstream commit bfdf4e6208051ed7165b2e92035b4bf11f43eb63 ]
+
+The rseq rseq_cs.ptr.{ptr32,padding} uapi endianness handling is
+entirely wrong on 32-bit little endian: a preprocessor logic mistake
+wrongly uses the big endian field layout on 32-bit little endian
+architectures.
+
+Fortunately, those ptr32 accessors were never used within the kernel,
+and only meant as a convenience for user-space.
+
+Remove those and replace the whole rseq_cs union by a __u64 type, as
+this is the only thing really needed to express the ABI. Document how
+32-bit architectures are meant to interact with this field.
+
+Fixes: ec9c82e03a74 ("rseq: uapi: Declare rseq_cs field as union, update includes")
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20220127152720.25898-1-mathieu.desnoyers@efficios.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/rseq.h | 20 ++++----------------
+ kernel/rseq.c             |  8 ++++----
+ 2 files changed, 8 insertions(+), 20 deletions(-)
+
+diff --git a/include/uapi/linux/rseq.h b/include/uapi/linux/rseq.h
+index 9a402fdb60e9..77ee207623a9 100644
+--- a/include/uapi/linux/rseq.h
++++ b/include/uapi/linux/rseq.h
+@@ -105,23 +105,11 @@ struct rseq {
+ 	 * Read and set by the kernel. Set by user-space with single-copy
+ 	 * atomicity semantics. This field should only be updated by the
+ 	 * thread which registered this data structure. Aligned on 64-bit.
++	 *
++	 * 32-bit architectures should update the low order bits of the
++	 * rseq_cs field, leaving the high order bits initialized to 0.
+ 	 */
+-	union {
+-		__u64 ptr64;
+-#ifdef __LP64__
+-		__u64 ptr;
+-#else
+-		struct {
+-#if (defined(__BYTE_ORDER) && (__BYTE_ORDER == __BIG_ENDIAN)) || defined(__BIG_ENDIAN)
+-			__u32 padding;		/* Initialized to zero. */
+-			__u32 ptr32;
+-#else /* LITTLE */
+-			__u32 ptr32;
+-			__u32 padding;		/* Initialized to zero. */
+-#endif /* ENDIAN */
+-		} ptr;
+-#endif
+-	} rseq_cs;
++	__u64 rseq_cs;
+ 
+ 	/*
+ 	 * Restartable sequences flags field.
+diff --git a/kernel/rseq.c b/kernel/rseq.c
+index 6d45ac3dae7f..97ac20b4f738 100644
+--- a/kernel/rseq.c
++++ b/kernel/rseq.c
+@@ -128,10 +128,10 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs)
+ 	int ret;
+ 
+ #ifdef CONFIG_64BIT
+-	if (get_user(ptr, &t->rseq->rseq_cs.ptr64))
++	if (get_user(ptr, &t->rseq->rseq_cs))
+ 		return -EFAULT;
+ #else
+-	if (copy_from_user(&ptr, &t->rseq->rseq_cs.ptr64, sizeof(ptr)))
++	if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr)))
+ 		return -EFAULT;
+ #endif
+ 	if (!ptr) {
+@@ -217,9 +217,9 @@ static int clear_rseq_cs(struct task_struct *t)
+ 	 * Set rseq_cs to NULL.
+ 	 */
+ #ifdef CONFIG_64BIT
+-	return put_user(0UL, &t->rseq->rseq_cs.ptr64);
++	return put_user(0UL, &t->rseq->rseq_cs);
+ #else
+-	if (clear_user(&t->rseq->rseq_cs.ptr64, sizeof(t->rseq->rseq_cs.ptr64)))
++	if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs)))
+ 		return -EFAULT;
+ 	return 0;
+ #endif
+-- 
+2.34.1
+
diff --git a/queue-5.16/samples-bpf-xdpsock-fix-race-when-running-for-fix-du.patch b/queue-5.16/samples-bpf-xdpsock-fix-race-when-running-for-fix-du.patch
new file mode 100644
index 00000000000..19a86d1764e
--- /dev/null
+++ b/queue-5.16/samples-bpf-xdpsock-fix-race-when-running-for-fix-du.patch
@@ -0,0 +1,72 @@
+From 005112cb14275fa2f127309dbc104f84fc3ab5bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 11:29:48 +0100
+Subject: samples/bpf, xdpsock: Fix race when running for fix duration of time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund@corigine.com>
+
+[ Upstream commit 8fa42d78f6354bb96ad3a079dcbef528ca9fa9e0 ]
+
+When running xdpsock for a fix duration of time before terminating
+using --duration=<n>, there is a race condition that may cause xdpsock
+to terminate immediately.
+
+When running for a fixed duration of time the check to determine when to
+terminate execution is in is_benchmark_done() and is being executed in
+the context of the poller thread,
+
+    if (opt_duration > 0) {
+            unsigned long dt = (get_nsecs() - start_time);
+
+            if (dt >= opt_duration)
+                    benchmark_done = true;
+    }
+
+However start_time is only set after the poller thread have been
+created. This leaves a small window when the poller thread is starting
+and calls is_benchmark_done() for the first time that start_time is not
+yet set. In that case start_time have its initial value of 0 and the
+duration check fails as it do not correlate correctly for the
+applications start time and immediately sets benchmark_done which in
+turn terminates the xdpsock application.
+
+Fix this by setting start_time before creating the poller thread.
+
+Fixes: d3f11b018f6c ("samples/bpf: xdpsock: Add duration option to specify how long to run")
+Signed-off-by: Niklas Söderlund <niklas.soderlund@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220315102948.466436-1-niklas.soderlund@corigine.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdpsock_user.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
+index 49d7a6ad7e39..1fb79b3ecdd5 100644
+--- a/samples/bpf/xdpsock_user.c
++++ b/samples/bpf/xdpsock_user.c
+@@ -1673,14 +1673,15 @@ int main(int argc, char **argv)
+ 
+ 	setlocale(LC_ALL, "");
+ 
++	prev_time = get_nsecs();
++	start_time = prev_time;
++
+ 	if (!opt_quiet) {
+ 		ret = pthread_create(&pt, NULL, poller, NULL);
+ 		if (ret)
+ 			exit_with_error(ret);
+ 	}
+ 
+-	prev_time = get_nsecs();
+-	start_time = prev_time;
+ 
+ 	if (opt_bench == BENCH_RXDROP)
+ 		rx_drop_all();
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-core-export-pelt_thermal_tp.patch b/queue-5.16/sched-core-export-pelt_thermal_tp.patch
new file mode 100644
index 00000000000..2db56616a51
--- /dev/null
+++ b/queue-5.16/sched-core-export-pelt_thermal_tp.patch
@@ -0,0 +1,36 @@
+From 4b1826bd9ccab661631e41ac3247b08e78c744a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 12:50:05 +0100
+Subject: sched/core: Export pelt_thermal_tp
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit 77cf151b7bbdfa3577b3c3f3a5e267a6c60a263b ]
+
+We can't use this tracepoint in modules without having the symbol
+exported first, fix that.
+
+Fixes: 765047932f15 ("sched/pelt: Add support to track thermal pressure")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20211028115005.873539-1-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 65082cab2906..0e4b8214af31 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -36,6 +36,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_rt_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_dl_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_irq_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_se_tp);
++EXPORT_TRACEPOINT_SYMBOL_GPL(pelt_thermal_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_cpu_capacity_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_overutilized_tp);
+ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_cfs_tp);
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-cpuacct-fix-charge-percpu-cpuusage.patch b/queue-5.16/sched-cpuacct-fix-charge-percpu-cpuusage.patch
new file mode 100644
index 00000000000..10a91ff17f8
--- /dev/null
+++ b/queue-5.16/sched-cpuacct-fix-charge-percpu-cpuusage.patch
@@ -0,0 +1,49 @@
+From 22f5bb4b0ac039454ff4cbb4aed1f0f603b574ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 13:14:24 +0800
+Subject: sched/cpuacct: Fix charge percpu cpuusage
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit 248cc9993d1cc12b8e9ed716cc3fc09f6c3517dd ]
+
+The cpuacct_account_field() is always called by the current task
+itself, so it's ok to use __this_cpu_add() to charge the tick time.
+
+But cpuacct_charge() maybe called by update_curr() in load_balance()
+on a random CPU, different from the CPU on which the task is running.
+So __this_cpu_add() will charge that cputime to a random incorrect CPU.
+
+Fixes: 73e6aafd9ea8 ("sched/cpuacct: Simplify the cpuacct code")
+Reported-by: Minye Zhu <zhuminye@bytedance.com>
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220220051426.5274-1-zhouchengming@bytedance.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpuacct.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
+index ab67d97a8442..cacc2076ad21 100644
+--- a/kernel/sched/cpuacct.c
++++ b/kernel/sched/cpuacct.c
+@@ -328,12 +328,13 @@ static struct cftype files[] = {
+  */
+ void cpuacct_charge(struct task_struct *tsk, u64 cputime)
+ {
++	unsigned int cpu = task_cpu(tsk);
+ 	struct cpuacct *ca;
+ 
+ 	rcu_read_lock();
+ 
+ 	for (ca = task_ca(tsk); ca; ca = parent_ca(ca))
+-		__this_cpu_add(*ca->cpuusage, cputime);
++		*per_cpu_ptr(ca->cpuusage, cpu) += cputime;
+ 
+ 	rcu_read_unlock();
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch b/queue-5.16/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
new file mode 100644
index 00000000000..75d3d68e004
--- /dev/null
+++ b/queue-5.16/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
@@ -0,0 +1,60 @@
+From e32a0236ef448683ee3001b5ffbcef58ebdaf1e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:35:15 +0530
+Subject: sched/debug: Remove mpol_get/put and task_lock/unlock from
+ sched_show_numa
+
+From: Bharata B Rao <bharata@amd.com>
+
+[ Upstream commit 28c988c3ec29db74a1dda631b18785958d57df4f ]
+
+The older format of /proc/pid/sched printed home node info which
+required the mempolicy and task lock around mpol_get(). However
+the format has changed since then and there is no need for
+sched_show_numa() any more to have mempolicy argument,
+asssociated mpol_get/put and task_lock/unlock. Remove them.
+
+Fixes: 397f2378f1361 ("sched/numa: Fix numa balancing stats in /proc/pid/sched")
+Signed-off-by: Bharata B Rao <bharata@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Link: https://lore.kernel.org/r/20220118050515.2973-1-bharata@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 7dcbaa31c5d9..50e05c8d0d61 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -931,25 +931,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf,
+ static void sched_show_numa(struct task_struct *p, struct seq_file *m)
+ {
+ #ifdef CONFIG_NUMA_BALANCING
+-	struct mempolicy *pol;
+-
+ 	if (p->mm)
+ 		P(mm->numa_scan_seq);
+ 
+-	task_lock(p);
+-	pol = p->mempolicy;
+-	if (pol && !(pol->flags & MPOL_F_MORON))
+-		pol = NULL;
+-	mpol_get(pol);
+-	task_unlock(p);
+-
+ 	P(numa_pages_migrated);
+ 	P(numa_preferred_nid);
+ 	P(total_numa_faults);
+ 	SEQ_printf(m, "current_node=%d, numa_group_id=%d\n",
+ 			task_node(p), task_numa_group_id(p));
+ 	show_numa_stats(p, m);
+-	mpol_put(pol);
+ #endif
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-fair-improve-consistency-of-allowed-numa-balan.patch b/queue-5.16/sched-fair-improve-consistency-of-allowed-numa-balan.patch
new file mode 100644
index 00000000000..120a20a1c70
--- /dev/null
+++ b/queue-5.16/sched-fair-improve-consistency-of-allowed-numa-balan.patch
@@ -0,0 +1,81 @@
+From 70c439dd96a2279f0519f372ad5695b29125306b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 09:43:33 +0000
+Subject: sched/fair: Improve consistency of allowed NUMA balance calculations
+
+From: Mel Gorman <mgorman@techsingularity.net>
+
+[ Upstream commit 2cfb7a1b031b0e816af7a6ee0c6ab83b0acdf05a ]
+
+There are inconsistencies when determining if a NUMA imbalance is allowed
+that should be corrected.
+
+o allow_numa_imbalance changes types and is not always examining
+  the destination group so both the type should be corrected as
+  well as the naming.
+o find_idlest_group uses the sched_domain's weight instead of the
+  group weight which is different to find_busiest_group
+o find_busiest_group uses the source group instead of the destination
+  which is different to task_numa_find_cpu
+o Both find_idlest_group and find_busiest_group should account
+  for the number of running tasks if a move was allowed to be
+  consistent with task_numa_find_cpu
+
+Fixes: 7d2b5dd0bcc4 ("sched/numa: Allow a floating imbalance between NUMA nodes")
+Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Link: https://lore.kernel.org/r/20220208094334.16379-2-mgorman@techsingularity.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 069e01772d92..9637766e220d 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9062,9 +9062,10 @@ static bool update_pick_idlest(struct sched_group *idlest,
+  * This is an approximation as the number of running tasks may not be
+  * related to the number of busy CPUs due to sched_setaffinity.
+  */
+-static inline bool allow_numa_imbalance(int dst_running, int dst_weight)
++static inline bool
++allow_numa_imbalance(unsigned int running, unsigned int weight)
+ {
+-	return (dst_running < (dst_weight >> 2));
++	return (running < (weight >> 2));
+ }
+ 
+ /*
+@@ -9198,12 +9199,13 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, int this_cpu)
+ 				return idlest;
+ #endif
+ 			/*
+-			 * Otherwise, keep the task on this node to stay close
+-			 * its wakeup source and improve locality. If there is
+-			 * a real need of migration, periodic load balance will
+-			 * take care of it.
++			 * Otherwise, keep the task close to the wakeup source
++			 * and improve locality if the number of running tasks
++			 * would remain below threshold where an imbalance is
++			 * allowed. If there is a real need of migration,
++			 * periodic load balance will take care of it.
+ 			 */
+-			if (allow_numa_imbalance(local_sgs.sum_nr_running, sd->span_weight))
++			if (allow_numa_imbalance(local_sgs.sum_nr_running + 1, local_sgs.group_weight))
+ 				return NULL;
+ 		}
+ 
+@@ -9409,7 +9411,7 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
+ 		/* Consider allowing a small imbalance between NUMA groups */
+ 		if (env->sd->flags & SD_NUMA) {
+ 			env->imbalance = adjust_numa_imbalance(env->imbalance,
+-				busiest->sum_nr_running, busiest->group_weight);
++				local->sum_nr_running + 1, local->group_weight);
+ 		}
+ 
+ 		return;
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-rt-plug-rt_mutex_setprio-vs-push_rt_task-race.patch b/queue-5.16/sched-rt-plug-rt_mutex_setprio-vs-push_rt_task-race.patch
new file mode 100644
index 00000000000..0c7985e9817
--- /dev/null
+++ b/queue-5.16/sched-rt-plug-rt_mutex_setprio-vs-push_rt_task-race.patch
@@ -0,0 +1,150 @@
+From fb2afdf5790917bcca055404d2943e98c239e2a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 15:40:59 +0000
+Subject: sched/rt: Plug rt_mutex_setprio() vs push_rt_task() race
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 49bef33e4b87b743495627a529029156c6e09530 ]
+
+John reported that push_rt_task() can end up invoking
+find_lowest_rq(rq->curr) when curr is not an RT task (in this case a CFS
+one), which causes mayhem down convert_prio().
+
+This can happen when current gets demoted to e.g. CFS when releasing an
+rt_mutex, and the local CPU gets hit with an rto_push_work irqwork before
+getting the chance to reschedule. Exactly who triggers this work isn't
+entirely clear to me - switched_from_rt() only invokes rt_queue_pull_task()
+if there are no RT tasks on the local RQ, which means the local CPU can't
+be in the rto_mask.
+
+My current suspected sequence is something along the lines of the below,
+with the demoted task being current.
+
+  mark_wakeup_next_waiter()
+    rt_mutex_adjust_prio()
+      rt_mutex_setprio() // deboost originally-CFS task
+	check_class_changed()
+	  switched_from_rt() // Only rt_queue_pull_task() if !rq->rt.rt_nr_running
+	  switched_to_fair() // Sets need_resched
+      __balance_callbacks() // if pull_rt_task(), tell_cpu_to_push() can't select local CPU per the above
+      raw_spin_rq_unlock(rq)
+
+       // need_resched is set, so task_woken_rt() can't
+       // invoke push_rt_tasks(). Best I can come up with is
+       // local CPU has rt_nr_migratory >= 2 after the demotion, so stays
+       // in the rto_mask, and then:
+
+       <some other CPU running rto_push_irq_work_func() queues rto_push_work on this CPU>
+	 push_rt_task()
+	   // breakage follows here as rq->curr is CFS
+
+Move an existing check to check rq->curr vs the next pushable task's
+priority before getting anywhere near find_lowest_rq(). While at it, add an
+explicit sched_class of rq->curr check prior to invoking
+find_lowest_rq(rq->curr). Align the DL logic to also reschedule regardless
+of next_task's migratability.
+
+Fixes: a7c81556ec4d ("sched: Fix migrate_disable() vs rt/dl balancing")
+Reported-by: John Keeping <john@metanate.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Tested-by: John Keeping <john@metanate.com>
+Link: https://lore.kernel.org/r/20220127154059.974729-1-valentin.schneider@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 12 ++++++------
+ kernel/sched/rt.c       | 32 ++++++++++++++++++++++----------
+ 2 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index d2c072b0ef01..62f0cf842277 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2240,12 +2240,6 @@ static int push_dl_task(struct rq *rq)
+ 		return 0;
+ 
+ retry:
+-	if (is_migration_disabled(next_task))
+-		return 0;
+-
+-	if (WARN_ON(next_task == rq->curr))
+-		return 0;
+-
+ 	/*
+ 	 * If next_task preempts rq->curr, and rq->curr
+ 	 * can move away, it makes sense to just reschedule
+@@ -2258,6 +2252,12 @@ static int push_dl_task(struct rq *rq)
+ 		return 0;
+ 	}
+ 
++	if (is_migration_disabled(next_task))
++		return 0;
++
++	if (WARN_ON(next_task == rq->curr))
++		return 0;
++
+ 	/* We might release rq lock */
+ 	get_task_struct(next_task);
+ 
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 7b4f4fbbb404..14f273c29518 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2026,6 +2026,16 @@ static int push_rt_task(struct rq *rq, bool pull)
+ 		return 0;
+ 
+ retry:
++	/*
++	 * It's possible that the next_task slipped in of
++	 * higher priority than current. If that's the case
++	 * just reschedule current.
++	 */
++	if (unlikely(next_task->prio < rq->curr->prio)) {
++		resched_curr(rq);
++		return 0;
++	}
++
+ 	if (is_migration_disabled(next_task)) {
+ 		struct task_struct *push_task = NULL;
+ 		int cpu;
+@@ -2033,6 +2043,18 @@ static int push_rt_task(struct rq *rq, bool pull)
+ 		if (!pull || rq->push_busy)
+ 			return 0;
+ 
++		/*
++		 * Invoking find_lowest_rq() on anything but an RT task doesn't
++		 * make sense. Per the above priority check, curr has to
++		 * be of higher priority than next_task, so no need to
++		 * reschedule when bailing out.
++		 *
++		 * Note that the stoppers are masqueraded as SCHED_FIFO
++		 * (cf. sched_set_stop_task()), so we can't rely on rt_task().
++		 */
++		if (rq->curr->sched_class != &rt_sched_class)
++			return 0;
++
+ 		cpu = find_lowest_rq(rq->curr);
+ 		if (cpu == -1 || cpu == rq->cpu)
+ 			return 0;
+@@ -2057,16 +2079,6 @@ static int push_rt_task(struct rq *rq, bool pull)
+ 	if (WARN_ON(next_task == rq->curr))
+ 		return 0;
+ 
+-	/*
+-	 * It's possible that the next_task slipped in of
+-	 * higher priority than current. If that's the case
+-	 * just reschedule current.
+-	 */
+-	if (unlikely(next_task->prio < rq->curr->prio)) {
+-		resched_curr(rq);
+-		return 0;
+-	}
+-
+ 	/* We might release rq lock */
+ 	get_task_struct(next_task);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-tracing-don-t-re-read-p-state-when-emitting-sc.patch b/queue-5.16/sched-tracing-don-t-re-read-p-state-when-emitting-sc.patch
new file mode 100644
index 00000000000..044a2486db4
--- /dev/null
+++ b/queue-5.16/sched-tracing-don-t-re-read-p-state-when-emitting-sc.patch
@@ -0,0 +1,247 @@
+From a1dc99beee5717d3ef92d4c21ddf8a6240e9ea6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 16:25:19 +0000
+Subject: sched/tracing: Don't re-read p->state when emitting sched_switch
+ event
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit fa2c3254d7cfff5f7a916ab928a562d1165f17bb ]
+
+As of commit
+
+  c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu")
+
+the following sequence becomes possible:
+
+		      p->__state = TASK_INTERRUPTIBLE;
+		      __schedule()
+			deactivate_task(p);
+  ttwu()
+    READ !p->on_rq
+    p->__state=TASK_WAKING
+			trace_sched_switch()
+			  __trace_sched_switch_state()
+			    task_state_index()
+			      return 0;
+
+TASK_WAKING isn't in TASK_REPORT, so the task appears as TASK_RUNNING in
+the trace event.
+
+Prevent this by pushing the value read from __schedule() down the trace
+event.
+
+Reported-by: Abhijeet Dharmapurikar <adharmap@quicinc.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Link: https://lore.kernel.org/r/20220120162520.570782-2-valentin.schneider@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h             | 11 ++++++++---
+ include/trace/events/sched.h      | 11 +++++++----
+ kernel/sched/core.c               |  4 ++--
+ kernel/trace/fgraph.c             |  4 +++-
+ kernel/trace/ftrace.c             |  4 +++-
+ kernel/trace/trace_events.c       |  8 ++++++--
+ kernel/trace/trace_osnoise.c      |  4 +++-
+ kernel/trace/trace_sched_switch.c |  1 +
+ kernel/trace/trace_sched_wakeup.c |  1 +
+ 9 files changed, 34 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index ee5ed8821963..084de9b70a77 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1612,10 +1612,10 @@ static inline pid_t task_pgrp_nr(struct task_struct *tsk)
+ #define TASK_REPORT_IDLE	(TASK_REPORT + 1)
+ #define TASK_REPORT_MAX		(TASK_REPORT_IDLE << 1)
+ 
+-static inline unsigned int task_state_index(struct task_struct *tsk)
++static inline unsigned int __task_state_index(unsigned int tsk_state,
++					      unsigned int tsk_exit_state)
+ {
+-	unsigned int tsk_state = READ_ONCE(tsk->__state);
+-	unsigned int state = (tsk_state | tsk->exit_state) & TASK_REPORT;
++	unsigned int state = (tsk_state | tsk_exit_state) & TASK_REPORT;
+ 
+ 	BUILD_BUG_ON_NOT_POWER_OF_2(TASK_REPORT_MAX);
+ 
+@@ -1625,6 +1625,11 @@ static inline unsigned int task_state_index(struct task_struct *tsk)
+ 	return fls(state);
+ }
+ 
++static inline unsigned int task_state_index(struct task_struct *tsk)
++{
++	return __task_state_index(READ_ONCE(tsk->__state), tsk->exit_state);
++}
++
+ static inline char task_index_to_char(unsigned int state)
+ {
+ 	static const char state_char[] = "RSDTtXZPI";
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 94640482cfe7..65e786756321 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -187,7 +187,9 @@ DEFINE_EVENT(sched_wakeup_template, sched_wakeup_new,
+ 	     TP_ARGS(p));
+ 
+ #ifdef CREATE_TRACE_POINTS
+-static inline long __trace_sched_switch_state(bool preempt, struct task_struct *p)
++static inline long __trace_sched_switch_state(bool preempt,
++					      unsigned int prev_state,
++					      struct task_struct *p)
+ {
+ 	unsigned int state;
+ 
+@@ -208,7 +210,7 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
+ 	 * it for left shift operation to get the correct task->state
+ 	 * mapping.
+ 	 */
+-	state = task_state_index(p);
++	state = __task_state_index(prev_state, p->exit_state);
+ 
+ 	return state ? (1 << (state - 1)) : state;
+ }
+@@ -220,10 +222,11 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
+ TRACE_EVENT(sched_switch,
+ 
+ 	TP_PROTO(bool preempt,
++		 unsigned int prev_state,
+ 		 struct task_struct *prev,
+ 		 struct task_struct *next),
+ 
+-	TP_ARGS(preempt, prev, next),
++	TP_ARGS(preempt, prev_state, prev, next),
+ 
+ 	TP_STRUCT__entry(
+ 		__array(	char,	prev_comm,	TASK_COMM_LEN	)
+@@ -239,7 +242,7 @@ TRACE_EVENT(sched_switch,
+ 		memcpy(__entry->next_comm, next->comm, TASK_COMM_LEN);
+ 		__entry->prev_pid	= prev->pid;
+ 		__entry->prev_prio	= prev->prio;
+-		__entry->prev_state	= __trace_sched_switch_state(preempt, prev);
++		__entry->prev_state	= __trace_sched_switch_state(preempt, prev_state, prev);
+ 		memcpy(__entry->prev_comm, prev->comm, TASK_COMM_LEN);
+ 		__entry->next_pid	= next->pid;
+ 		__entry->next_prio	= next->prio;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 0e4b8214af31..527ee363db3f 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4821,7 +4821,7 @@ static struct rq *finish_task_switch(struct task_struct *prev)
+ {
+ 	struct rq *rq = this_rq();
+ 	struct mm_struct *mm = rq->prev_mm;
+-	long prev_state;
++	unsigned int prev_state;
+ 
+ 	/*
+ 	 * The previous task will have left us with a preempt_count of 2
+@@ -6257,7 +6257,7 @@ static void __sched notrace __schedule(unsigned int sched_mode)
+ 		migrate_disable_switch(rq, prev);
+ 		psi_sched_switch(prev, next, !task_on_rq_queued(prev));
+ 
+-		trace_sched_switch(sched_mode & SM_MASK_PREEMPT, prev, next);
++		trace_sched_switch(sched_mode & SM_MASK_PREEMPT, prev_state, prev, next);
+ 
+ 		/* Also unlocks the rq: */
+ 		rq = context_switch(rq, prev, next, &rf);
+diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c
+index 22061d38fc00..19028e072cdb 100644
+--- a/kernel/trace/fgraph.c
++++ b/kernel/trace/fgraph.c
+@@ -415,7 +415,9 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+ 
+ static void
+ ftrace_graph_probe_sched_switch(void *ignore, bool preempt,
+-			struct task_struct *prev, struct task_struct *next)
++				unsigned int prev_state,
++				struct task_struct *prev,
++				struct task_struct *next)
+ {
+ 	unsigned long long timestamp;
+ 	int index;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index be5f6b32a012..bbfa4606cba6 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7317,7 +7317,9 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops)
+ 
+ static void
+ ftrace_filter_pid_sched_switch_probe(void *data, bool preempt,
+-		    struct task_struct *prev, struct task_struct *next)
++				     unsigned int prev_state,
++				     struct task_struct *prev,
++				     struct task_struct *next)
+ {
+ 	struct trace_array *tr = data;
+ 	struct trace_pid_list *pid_list;
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 92be9cb1d7d4..c097d89ca946 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -759,7 +759,9 @@ void trace_event_follow_fork(struct trace_array *tr, bool enable)
+ 
+ static void
+ event_filter_pid_sched_switch_probe_pre(void *data, bool preempt,
+-		    struct task_struct *prev, struct task_struct *next)
++					unsigned int prev_state,
++					struct task_struct *prev,
++					struct task_struct *next)
+ {
+ 	struct trace_array *tr = data;
+ 	struct trace_pid_list *no_pid_list;
+@@ -783,7 +785,9 @@ event_filter_pid_sched_switch_probe_pre(void *data, bool preempt,
+ 
+ static void
+ event_filter_pid_sched_switch_probe_post(void *data, bool preempt,
+-		    struct task_struct *prev, struct task_struct *next)
++					 unsigned int prev_state,
++					 struct task_struct *prev,
++					 struct task_struct *next)
+ {
+ 	struct trace_array *tr = data;
+ 	struct trace_pid_list *no_pid_list;
+diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
+index b6da7bd2383d..b3b8060e8bdd 100644
+--- a/kernel/trace/trace_osnoise.c
++++ b/kernel/trace/trace_osnoise.c
+@@ -1168,7 +1168,9 @@ thread_exit(struct osnoise_variables *osn_var, struct task_struct *t)
+  * used to record the beginning and to report the end of a thread noise window.
+  */
+ static void
+-trace_sched_switch_callback(void *data, bool preempt, struct task_struct *p,
++trace_sched_switch_callback(void *data, bool preempt,
++			    unsigned int prev_state,
++			    struct task_struct *p,
+ 			    struct task_struct *n)
+ {
+ 	struct osnoise_variables *osn_var = this_cpu_osn_var();
+diff --git a/kernel/trace/trace_sched_switch.c b/kernel/trace/trace_sched_switch.c
+index e304196d7c28..993b0ed10d8c 100644
+--- a/kernel/trace/trace_sched_switch.c
++++ b/kernel/trace/trace_sched_switch.c
+@@ -22,6 +22,7 @@ static DEFINE_MUTEX(sched_register_mutex);
+ 
+ static void
+ probe_sched_switch(void *ignore, bool preempt,
++		   unsigned int prev_state,
+ 		   struct task_struct *prev, struct task_struct *next)
+ {
+ 	int flags;
+diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
+index 2402de520eca..46429f9a96fa 100644
+--- a/kernel/trace/trace_sched_wakeup.c
++++ b/kernel/trace/trace_sched_wakeup.c
+@@ -426,6 +426,7 @@ tracing_sched_wakeup_trace(struct trace_array *tr,
+ 
+ static void notrace
+ probe_wakeup_sched_switch(void *ignore, bool preempt,
++			  unsigned int prev_state,
+ 			  struct task_struct *prev, struct task_struct *next)
+ {
+ 	struct trace_array_cpu *data;
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-tracing-report-task_rtlock_wait-tasks-as-task_.patch b/queue-5.16/sched-tracing-report-task_rtlock_wait-tasks-as-task_.patch
new file mode 100644
index 00000000000..fe0c4ca11ca
--- /dev/null
+++ b/queue-5.16/sched-tracing-report-task_rtlock_wait-tasks-as-task_.patch
@@ -0,0 +1,58 @@
+From 31e279a0d29875b76451f8a598ec5fa54dd2ab79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 16:25:20 +0000
+Subject: sched/tracing: Report TASK_RTLOCK_WAIT tasks as TASK_UNINTERRUPTIBLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 25795ef6299f07ce3838f3253a9cb34f64efcfae ]
+
+TASK_RTLOCK_WAIT currently isn't part of TASK_REPORT, thus a task blocking
+on an rtlock will appear as having a task state == 0, IOW TASK_RUNNING.
+
+The actual state is saved in p->saved_state, but reading it after reading
+p->__state has a few issues:
+o that could still be TASK_RUNNING in the case of e.g. rt_spin_lock
+o ttwu_state_match() might have changed that to TASK_RUNNING
+
+As pointed out by Eric, adding TASK_RTLOCK_WAIT to TASK_REPORT implies
+exposing a new state to userspace tools which way not know what to do with
+them. The only information that needs to be conveyed here is that a task is
+waiting on an rt_mutex, which matches TASK_UNINTERRUPTIBLE - there's no
+need for a new state.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Link: https://lore.kernel.org/r/20220120162520.570782-3-valentin.schneider@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 084de9b70a77..46ef8c75802f 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1622,6 +1622,14 @@ static inline unsigned int __task_state_index(unsigned int tsk_state,
+ 	if (tsk_state == TASK_IDLE)
+ 		state = TASK_REPORT_IDLE;
+ 
++	/*
++	 * We're lying here, but rather than expose a completely new task state
++	 * to userspace, we can make this appear as if the task has gone through
++	 * a regular rt_mutex_lock() call.
++	 */
++	if (tsk_state == TASK_RTLOCK_WAIT)
++		state = TASK_UNINTERRUPTIBLE;
++
+ 	return fls(state);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/sched-uclamp-fix-iowait-boost-escaping-uclamp-restri.patch b/queue-5.16/sched-uclamp-fix-iowait-boost-escaping-uclamp-restri.patch
new file mode 100644
index 00000000000..dc75aa837e0
--- /dev/null
+++ b/queue-5.16/sched-uclamp-fix-iowait-boost-escaping-uclamp-restri.patch
@@ -0,0 +1,43 @@
+From 7eb071b55b0d686d85cc4cd1348840002c6dedec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Dec 2021 22:53:20 +0000
+Subject: sched/uclamp: Fix iowait boost escaping uclamp restriction
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit d37aee9018e68b0d356195caefbb651910e0bbfa ]
+
+iowait_boost signal is applied independently of util and doesn't take
+into account uclamp settings of the rq. An io heavy task that is capped
+by uclamp_max could still request higher frequency because
+sugov_iowait_apply() doesn't clamp the boost via uclamp_rq_util_with()
+like effective_cpu_util() does.
+
+Make sure that iowait_boost honours uclamp requests by calling
+uclamp_rq_util_with() when applying the boost.
+
+Fixes: 982d9cdc22c9 ("sched/cpufreq, sched/uclamp: Add clamps for FAIR and RT tasks")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20211216225320.2957053-3-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index e7af18857371..7f6bb37d3a2f 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -289,6 +289,7 @@ static void sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time)
+ 	 * into the same scale so we can compare.
+ 	 */
+ 	boost = (sg_cpu->iowait_boost * sg_cpu->max) >> SCHED_CAPACITY_SHIFT;
++	boost = uclamp_rq_util_with(cpu_rq(sg_cpu->cpu), boost, NULL);
+ 	if (sg_cpu->util < boost)
+ 		sg_cpu->util = boost;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/scripts-dtc-call-pkg-config-posixly-correct.patch b/queue-5.16/scripts-dtc-call-pkg-config-posixly-correct.patch
new file mode 100644
index 00000000000..8e2a653becd
--- /dev/null
+++ b/queue-5.16/scripts-dtc-call-pkg-config-posixly-correct.patch
@@ -0,0 +1,38 @@
+From e4cbe1ff54246ecf557f622fe73eea0197161ff1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 12:20:28 +0100
+Subject: scripts/dtc: Call pkg-config POSIXly correct
+
+From: Thomas Bracht Laumann Jespersen <t@laumann.xyz>
+
+[ Upstream commit a8b309ce9760943486e0585285e0125588a31650 ]
+
+Running with POSIXLY_CORRECT=1 in the environment the scripts/dtc build
+fails, because pkg-config doesn't output anything when the flags come
+after the arguments.
+
+Fixes: 067c650c456e ("dtc: Use pkg-config to locate libyaml")
+Signed-off-by: Thomas Bracht Laumann Jespersen <t@laumann.xyz>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220131112028.7907-1-t@laumann.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/dtc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile
+index 95aaf7431bff..1cba78e1dce6 100644
+--- a/scripts/dtc/Makefile
++++ b/scripts/dtc/Makefile
+@@ -29,7 +29,7 @@ dtc-objs	+= yamltree.o
+ # To include <yaml.h> installed in a non-default path
+ HOSTCFLAGS_yamltree.o := $(shell pkg-config --cflags yaml-0.1)
+ # To link libyaml installed in a non-default path
+-HOSTLDLIBS_dtc	:= $(shell pkg-config yaml-0.1 --libs)
++HOSTLDLIBS_dtc	:= $(shell pkg-config --libs yaml-0.1)
+ endif
+ 
+ # Generated files need one more search path to include headers in source tree
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-fnic-fix-a-tracing-statement.patch b/queue-5.16/scsi-fnic-fix-a-tracing-statement.patch
new file mode 100644
index 00000000000..d65a4fe9796
--- /dev/null
+++ b/queue-5.16/scsi-fnic-fix-a-tracing-statement.patch
@@ -0,0 +1,40 @@
+From bda66a0c930641e73392f9d797e2d2265514cb4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 11:50:49 -0800
+Subject: scsi: fnic: Fix a tracing statement
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 3032ed77a28913203a4fe0ab8f05752331af79b3 ]
+
+Report both the command flags and command state instead of only the
+command state.
+
+Link: https://lore.kernel.org/r/20220218195117.25689-22-bvanassche@acm.org
+Fixes: 4d7007b49d52 ("[SCSI] fnic: Fnic Trace Utility")
+Cc: Hiral Patel <hiralpat@cisco.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 40a52feb315d..65047806a541 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -604,7 +604,7 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc)
+ 
+ 	FNIC_TRACE(fnic_queuecommand, sc->device->host->host_no,
+ 		  tag, sc, io_req, sg_count, cmd_trace,
+-		  (((u64)CMD_FLAGS(sc) >> 32) | CMD_STATE(sc)));
++		  (((u64)CMD_FLAGS(sc) << 32) | CMD_STATE(sc)));
+ 
+ 	/* if only we issued IO, will we have the io lock */
+ 	if (io_lock_acquired)
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch b/queue-5.16/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
new file mode 100644
index 00000000000..2bd7acce8ae
--- /dev/null
+++ b/queue-5.16/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
@@ -0,0 +1,42 @@
+From fa2a3759791750c97cc79ac5cda63d1c803f09c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 19:51:24 +0800
+Subject: scsi: hisi_sas: Change permission of parameter prot_mask
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit c4e070457a93705e56ed06b3910d9e5fe56d3be3 ]
+
+Currently the permission of parameter prot_mask is 0x0, which means that
+the member does not appear in sysfs. Change it as other module parameters
+to 0444 for world-readable.
+
+[mkp: s/v3/v2/]
+
+Link: https://lore.kernel.org/r/1645703489-87194-2-git-send-email-john.garry@huawei.com
+Fixes: d6a9000b81be ("scsi: hisi_sas: Add support for DIF feature for v2 hw")
+Reported-by: Yihang Li <liyihang6@hisilicon.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 11a44d9dd9b2..b3bdbea3c955 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -530,7 +530,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt converge enable (0-1)");
+ 
+ /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */
+ static int prot_mask;
+-module_param(prot_mask, int, 0);
++module_param(prot_mask, int, 0444);
+ MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 ");
+ 
+ static void debugfs_work_handler_v3_hw(struct work_struct *work);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-mpt3sas-fix-incorrect-4gb-boundary-check.patch b/queue-5.16/scsi-mpt3sas-fix-incorrect-4gb-boundary-check.patch
new file mode 100644
index 00000000000..f1d81b28685
--- /dev/null
+++ b/queue-5.16/scsi-mpt3sas-fix-incorrect-4gb-boundary-check.patch
@@ -0,0 +1,112 @@
+From bb52cd75e402a2f43adde106b45ff165bc1b9795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 19:32:30 +0530
+Subject: scsi: mpt3sas: Fix incorrect 4GB boundary check
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+[ Upstream commit 208cc9fe6f21112b5cc6cb87065fb8ab66e79316 ]
+
+The driver must perform its 4GB boundary check using the pool's DMA address
+instead of using the virtual address.
+
+Link: https://lore.kernel.org/r/20220303140230.13098-1-sreekanth.reddy@broadcom.com
+Fixes: d6adc251dd2f ("scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region")
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 0d37c4aca175..c38e68943205 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -5737,14 +5737,13 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+  */
+ 
+ static int
+-mpt3sas_check_same_4gb_region(long reply_pool_start_address, u32 pool_sz)
++mpt3sas_check_same_4gb_region(dma_addr_t start_address, u32 pool_sz)
+ {
+-	long reply_pool_end_address;
++	dma_addr_t end_address;
+ 
+-	reply_pool_end_address = reply_pool_start_address + pool_sz;
++	end_address = start_address + pool_sz - 1;
+ 
+-	if (upper_32_bits(reply_pool_start_address) ==
+-		upper_32_bits(reply_pool_end_address))
++	if (upper_32_bits(start_address) == upper_32_bits(end_address))
+ 		return 1;
+ 	else
+ 		return 0;
+@@ -5805,7 +5804,7 @@ _base_allocate_pcie_sgl_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
+ 		}
+ 
+ 		if (!mpt3sas_check_same_4gb_region(
+-		    (long)ioc->pcie_sg_lookup[i].pcie_sgl, sz)) {
++		    ioc->pcie_sg_lookup[i].pcie_sgl_dma, sz)) {
+ 			ioc_err(ioc, "PCIE SGLs are not in same 4G !! pcie sgl (0x%p) dma = (0x%llx)\n",
+ 			    ioc->pcie_sg_lookup[i].pcie_sgl,
+ 			    (unsigned long long)
+@@ -5860,8 +5859,8 @@ _base_allocate_chain_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
+ 			    GFP_KERNEL, &ctr->chain_buffer_dma);
+ 			if (!ctr->chain_buffer)
+ 				return -EAGAIN;
+-			if (!mpt3sas_check_same_4gb_region((long)
+-			    ctr->chain_buffer, ioc->chain_segment_sz)) {
++			if (!mpt3sas_check_same_4gb_region(
++			    ctr->chain_buffer_dma, ioc->chain_segment_sz)) {
+ 				ioc_err(ioc,
+ 				    "Chain buffers are not in same 4G !!! Chain buff (0x%p) dma = (0x%llx)\n",
+ 				    ctr->chain_buffer,
+@@ -5897,7 +5896,7 @@ _base_allocate_sense_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
+ 	    GFP_KERNEL, &ioc->sense_dma);
+ 	if (!ioc->sense)
+ 		return -EAGAIN;
+-	if (!mpt3sas_check_same_4gb_region((long)ioc->sense, sz)) {
++	if (!mpt3sas_check_same_4gb_region(ioc->sense_dma, sz)) {
+ 		dinitprintk(ioc, pr_err(
+ 		    "Bad Sense Pool! sense (0x%p) sense_dma = (0x%llx)\n",
+ 		    ioc->sense, (unsigned long long) ioc->sense_dma));
+@@ -5930,7 +5929,7 @@ _base_allocate_reply_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
+ 	    &ioc->reply_dma);
+ 	if (!ioc->reply)
+ 		return -EAGAIN;
+-	if (!mpt3sas_check_same_4gb_region((long)ioc->reply_free, sz)) {
++	if (!mpt3sas_check_same_4gb_region(ioc->reply_dma, sz)) {
+ 		dinitprintk(ioc, pr_err(
+ 		    "Bad Reply Pool! Reply (0x%p) Reply dma = (0x%llx)\n",
+ 		    ioc->reply, (unsigned long long) ioc->reply_dma));
+@@ -5965,7 +5964,7 @@ _base_allocate_reply_free_dma_pool(struct MPT3SAS_ADAPTER *ioc, u32 sz)
+ 	    GFP_KERNEL, &ioc->reply_free_dma);
+ 	if (!ioc->reply_free)
+ 		return -EAGAIN;
+-	if (!mpt3sas_check_same_4gb_region((long)ioc->reply_free, sz)) {
++	if (!mpt3sas_check_same_4gb_region(ioc->reply_free_dma, sz)) {
+ 		dinitprintk(ioc,
+ 		    pr_err("Bad Reply Free Pool! Reply Free (0x%p) Reply Free dma = (0x%llx)\n",
+ 		    ioc->reply_free, (unsigned long long) ioc->reply_free_dma));
+@@ -6004,7 +6003,7 @@ _base_allocate_reply_post_free_array(struct MPT3SAS_ADAPTER *ioc,
+ 	    GFP_KERNEL, &ioc->reply_post_free_array_dma);
+ 	if (!ioc->reply_post_free_array)
+ 		return -EAGAIN;
+-	if (!mpt3sas_check_same_4gb_region((long)ioc->reply_post_free_array,
++	if (!mpt3sas_check_same_4gb_region(ioc->reply_post_free_array_dma,
+ 	    reply_post_free_array_sz)) {
+ 		dinitprintk(ioc, pr_err(
+ 		    "Bad Reply Free Pool! Reply Free (0x%p) Reply Free dma = (0x%llx)\n",
+@@ -6069,7 +6068,7 @@ base_alloc_rdpq_dma_pool(struct MPT3SAS_ADAPTER *ioc, int sz)
+ 			 * resources and set DMA mask to 32 and allocate.
+ 			 */
+ 			if (!mpt3sas_check_same_4gb_region(
+-				(long)ioc->reply_post[i].reply_post_free, sz)) {
++				ioc->reply_post[i].reply_post_free_dma, sz)) {
+ 				dinitprintk(ioc,
+ 				    ioc_err(ioc, "bad Replypost free pool(0x%p)"
+ 				    "reply_post_free_dma = (0x%llx)\n",
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-abort-all-task-initialization.patch b/queue-5.16/scsi-pm8001-fix-abort-all-task-initialization.patch
new file mode 100644
index 00000000000..6f10e78316e
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-abort-all-task-initialization.patch
@@ -0,0 +1,97 @@
+From 7c7dcad8b015d0cb8b62b45883b5d267cfea3d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:55 +0900
+Subject: scsi: pm8001: Fix abort all task initialization
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 7f12845c8389855dbcc67baa068b6832dc4a396e ]
+
+In pm80xx_send_abort_all(), the n_elem field of the ccb used is not
+initialized to 0. This missing initialization sometimes lead to the task
+completion path seeing the ccb with a non-zero n_elem resulting in the
+execution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(),
+causing a crash such as:
+
+[  197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280
+[  197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012
+[  197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0
+[  197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0
+[  197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b
+[  197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000
+[  197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000
+[  197.741493] FS:  0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000
+[  197.749659] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0
+[  197.762656] Call Trace:
+[  197.765127]  <IRQ>
+[  197.767162]  pm8001_ccb_task_free+0x5f1/0x820 [pm80xx]
+[  197.772364]  ? do_raw_spin_unlock+0x54/0x220
+[  197.776680]  pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx]
+[  197.782406]  process_oq+0xe85/0x7890 [pm80xx]
+[  197.786817]  ? lock_acquire+0x194/0x490
+[  197.790697]  ? handle_irq_event+0x10e/0x1b0
+[  197.794920]  ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx]
+[  197.800378]  ? __wake_up_bit+0x100/0x100
+[  197.804340]  ? lock_is_held_type+0x98/0x110
+[  197.808565]  pm80xx_chip_isr+0x94/0x130 [pm80xx]
+[  197.813243]  tasklet_action_common.constprop.0+0x24b/0x2f0
+[  197.818785]  __do_softirq+0x1b5/0x82d
+[  197.822485]  ? do_raw_spin_unlock+0x54/0x220
+[  197.826799]  __irq_exit_rcu+0x17e/0x1e0
+[  197.830678]  irq_exit_rcu+0xa/0x20
+[  197.834114]  common_interrupt+0x78/0x90
+[  197.840051]  </IRQ>
+[  197.844236]  <TASK>
+[  197.848397]  asm_common_interrupt+0x1e/0x40
+
+Avoid this issue by always initializing the ccb n_elem field to 0 in
+pm8001_send_abort_all(), pm8001_send_read_log() and
+pm80xx_send_abort_all().
+
+Link: https://lore.kernel.org/r/20220220031810.738362-17-damien.lemoal@opensource.wdc.com
+Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 ++
+ drivers/scsi/pm8001/pm80xx_hwi.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 97c08afd2dcf..6332cf23bf6b 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1783,6 +1783,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 
+@@ -1844,6 +1845,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 	pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG;
+ 	pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG;
+ 
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 414cd4b67c90..48b0154211c7 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1801,6 +1801,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch b/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
new file mode 100644
index 00000000000..7cd2fb1c883
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
@@ -0,0 +1,43 @@
+From 25e2023881221718d3e047962c3fd1628a227980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:45 +0900
+Subject: scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit cd2268a180117aa8ebb23e090ba204324b2d0e93 ]
+
+The ds_ads_m field of struct ssp_ini_tm_start_req has the type __le32.
+Assigning a value to it should thus use cpu_to_le32(). This fixes the
+sparse warning:
+
+warning: incorrect type in assignment (different base types)
+   expected restricted __le32 [addressable] [assigned] [usertype] ds_ads_m
+   got int
+
+Link: https://lore.kernel.org/r/20220220031810.738362-7-damien.lemoal@opensource.wdc.com
+Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index f364495ab40e..eca1ab198314 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4637,7 +4637,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha,
+ 	memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8);
+ 	sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag);
+ 	if (pm8001_ha->chip_id != chip_8001)
+-		sspTMCmd.ds_ads_m = 0x08;
++		sspTMCmd.ds_ads_m = cpu_to_le32(0x08);
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 	ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd,
+ 			sizeof(sspTMCmd), 0);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch b/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
new file mode 100644
index 00000000000..51f18545b46
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
@@ -0,0 +1,59 @@
+From 681b7894f258cecd4829d967965f78c311fd7070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:43 +0900
+Subject: scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 1a37b6738b58d86f6b144b3fc754ace0f2e0166d ]
+
+Since the sata_cmd struct is zeroed out before its fields are initialized,
+there is no need for using "|=" to initialize the ncqtag_atap_dir_m
+field. Using a standard assignment removes the sparse warning:
+
+warning: invalid assignment: |=
+
+Also, since the ncqtag_atap_dir_m field has type __le32, use cpu_to_le32()
+to generate the assigned value.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-5-damien.lemoal@opensource.wdc.com
+Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes")
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 066290dd5756..f364495ab40e 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1860,7 +1860,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 
+ 	sata_cmd.tag = cpu_to_le32(ccb_tag);
+ 	sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+-	sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9));
++	sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9));
+ 	memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+ 
+ 	res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd,
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index ca4820d99dc7..c56a726e1873 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1881,7 +1881,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 
+ 	sata_cmd.tag = cpu_to_le32(ccb_tag);
+ 	sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+-	sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9));
++	sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9)));
+ 	memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+ 
+ 	res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd,
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch
new file mode 100644
index 00000000000..d0bc3f73d6f
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch
@@ -0,0 +1,143 @@
+From 65c0a4d78e513b88fb7c8d55eea1315fb3213874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:49 +0900
+Subject: scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 970404cc5744b1033b6ee601be4ef0e2d1fbcf72 ]
+
+Make sure that the __le32 fields of struct ssp_ini_io_start_req are
+manipulated after applying the correct endian conversion. That is, use
+cpu_to_le32() for assigning values and le32_to_cpu() for consulting a field
+value. In particular, make sure that the calculations for the 4G boundary
+check are done using CPU endianness and *not* little endian values. With
+these fixes, many sparse warnings are removed.
+
+While at it, add blank lines after variable declarations and in some other
+places to make this code more readable.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-11-damien.lemoal@opensource.wdc.com
+Fixes: 0ecdf00ba6e5 ("[SCSI] pm80xx: 4G boundary fix.")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 41 +++++++++++++++++++-------------
+ 1 file changed, 25 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index d4b11b005fe2..e2459bd817a5 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4389,13 +4389,15 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 	struct ssp_ini_io_start_req ssp_cmd;
+ 	u32 tag = ccb->ccb_tag;
+ 	int ret;
+-	u64 phys_addr, start_addr, end_addr;
++	u64 phys_addr, end_addr;
+ 	u32 end_addr_high, end_addr_low;
+ 	struct inbound_queue_table *circularQ;
+ 	u32 q_index, cpu_id;
+ 	u32 opc = OPC_INB_SSPINIIOSTART;
++
+ 	memset(&ssp_cmd, 0, sizeof(ssp_cmd));
+ 	memcpy(ssp_cmd.ssp_iu.lun, task->ssp_task.LUN, 8);
++
+ 	/* data address domain added for spcv; set to 0 by host,
+ 	 * used internally by controller
+ 	 * 0 for SAS 1.1 and SAS 2.0 compatible TLR
+@@ -4406,7 +4408,7 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 	ssp_cmd.device_id = cpu_to_le32(pm8001_dev->device_id);
+ 	ssp_cmd.tag = cpu_to_le32(tag);
+ 	if (task->ssp_task.enable_first_burst)
+-		ssp_cmd.ssp_iu.efb_prio_attr |= 0x80;
++		ssp_cmd.ssp_iu.efb_prio_attr = 0x80;
+ 	ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_prio << 3);
+ 	ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_attr & 7);
+ 	memcpy(ssp_cmd.ssp_iu.cdb, task->ssp_task.cmd->cmnd,
+@@ -4438,21 +4440,24 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 			ssp_cmd.enc_esgl = cpu_to_le32(1<<31);
+ 		} else if (task->num_scatter == 1) {
+ 			u64 dma_addr = sg_dma_address(task->scatter);
++
+ 			ssp_cmd.enc_addr_low =
+ 				cpu_to_le32(lower_32_bits(dma_addr));
+ 			ssp_cmd.enc_addr_high =
+ 				cpu_to_le32(upper_32_bits(dma_addr));
+ 			ssp_cmd.enc_len = cpu_to_le32(task->total_xfer_len);
+ 			ssp_cmd.enc_esgl = 0;
++
+ 			/* Check 4G Boundary */
+-			start_addr = cpu_to_le64(dma_addr);
+-			end_addr = (start_addr + ssp_cmd.enc_len) - 1;
+-			end_addr_low = cpu_to_le32(lower_32_bits(end_addr));
+-			end_addr_high = cpu_to_le32(upper_32_bits(end_addr));
+-			if (end_addr_high != ssp_cmd.enc_addr_high) {
++			end_addr = dma_addr + le32_to_cpu(ssp_cmd.enc_len) - 1;
++			end_addr_low = lower_32_bits(end_addr);
++			end_addr_high = upper_32_bits(end_addr);
++
++			if (end_addr_high != le32_to_cpu(ssp_cmd.enc_addr_high)) {
+ 				pm8001_dbg(pm8001_ha, FAIL,
+ 					   "The sg list address start_addr=0x%016llx data_len=0x%x end_addr_high=0x%08x end_addr_low=0x%08x has crossed 4G boundary\n",
+-					   start_addr, ssp_cmd.enc_len,
++					   dma_addr,
++					   le32_to_cpu(ssp_cmd.enc_len),
+ 					   end_addr_high, end_addr_low);
+ 				pm8001_chip_make_sg(task->scatter, 1,
+ 					ccb->buf_prd);
+@@ -4461,7 +4466,7 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 					cpu_to_le32(lower_32_bits(phys_addr));
+ 				ssp_cmd.enc_addr_high =
+ 					cpu_to_le32(upper_32_bits(phys_addr));
+-				ssp_cmd.enc_esgl = cpu_to_le32(1<<31);
++				ssp_cmd.enc_esgl = cpu_to_le32(1U<<31);
+ 			}
+ 		} else if (task->num_scatter == 0) {
+ 			ssp_cmd.enc_addr_low = 0;
+@@ -4469,8 +4474,10 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 			ssp_cmd.enc_len = cpu_to_le32(task->total_xfer_len);
+ 			ssp_cmd.enc_esgl = 0;
+ 		}
++
+ 		/* XTS mode. All other fields are 0 */
+-		ssp_cmd.key_cmode = 0x6 << 4;
++		ssp_cmd.key_cmode = cpu_to_le32(0x6 << 4);
++
+ 		/* set tweak values. Should be the start lba */
+ 		ssp_cmd.twk_val0 = cpu_to_le32((task->ssp_task.cmd->cmnd[2] << 24) |
+ 						(task->ssp_task.cmd->cmnd[3] << 16) |
+@@ -4492,20 +4499,22 @@ static int pm80xx_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+ 			ssp_cmd.esgl = cpu_to_le32(1<<31);
+ 		} else if (task->num_scatter == 1) {
+ 			u64 dma_addr = sg_dma_address(task->scatter);
++
+ 			ssp_cmd.addr_low = cpu_to_le32(lower_32_bits(dma_addr));
+ 			ssp_cmd.addr_high =
+ 				cpu_to_le32(upper_32_bits(dma_addr));
+ 			ssp_cmd.len = cpu_to_le32(task->total_xfer_len);
+ 			ssp_cmd.esgl = 0;
++
+ 			/* Check 4G Boundary */
+-			start_addr = cpu_to_le64(dma_addr);
+-			end_addr = (start_addr + ssp_cmd.len) - 1;
+-			end_addr_low = cpu_to_le32(lower_32_bits(end_addr));
+-			end_addr_high = cpu_to_le32(upper_32_bits(end_addr));
+-			if (end_addr_high != ssp_cmd.addr_high) {
++			end_addr = dma_addr + le32_to_cpu(ssp_cmd.len) - 1;
++			end_addr_low = lower_32_bits(end_addr);
++			end_addr_high = upper_32_bits(end_addr);
++			if (end_addr_high != le32_to_cpu(ssp_cmd.addr_high)) {
+ 				pm8001_dbg(pm8001_ha, FAIL,
+ 					   "The sg list address start_addr=0x%016llx data_len=0x%x end_addr_high=0x%08x end_addr_low=0x%08x has crossed 4G boundary\n",
+-					   start_addr, ssp_cmd.len,
++					   dma_addr,
++					   le32_to_cpu(ssp_cmd.len),
+ 					   end_addr_high, end_addr_low);
+ 				pm8001_chip_make_sg(task->scatter, 1,
+ 					ccb->buf_prd);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch-2702 b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch-2702
new file mode 100644
index 00000000000..e9ee6250876
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch-2702
@@ -0,0 +1,190 @@
+From 39f0fea9d61cceeb1a473a2ec6991f21ce6b8e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:50 +0900
+Subject: scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit fd6d0e376211d7ed759db96b0fbd9a1cee67d462 ]
+
+Make sure that the __le32 fields of struct sata_cmd are manipulated after
+applying the correct endian conversion. That is, use cpu_to_le32() for
+assigning values and le32_to_cpu() for consulting a field value.  In
+particular, make sure that the calculations for the 4G boundary check are
+done using CPU endianness and *not* little endian values. With these fixes,
+many sparse warnings are removed.
+
+While at it, fix some code identation and add blank lines after variable
+declarations and in some other places to make this code more readable.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-12-damien.lemoal@opensource.wdc.com
+Fixes: 0ecdf00ba6e5 ("[SCSI] pm80xx: 4G boundary fix.")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 82 ++++++++++++++++++--------------
+ 1 file changed, 45 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index e2459bd817a5..93a5af907856 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4548,7 +4548,7 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 	u32 q_index, cpu_id;
+ 	struct sata_start_req sata_cmd;
+ 	u32 hdr_tag, ncg_tag = 0;
+-	u64 phys_addr, start_addr, end_addr;
++	u64 phys_addr, end_addr;
+ 	u32 end_addr_high, end_addr_low;
+ 	u32 ATAP = 0x0;
+ 	u32 dir;
+@@ -4609,32 +4609,38 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 			pm8001_chip_make_sg(task->scatter,
+ 						ccb->n_elem, ccb->buf_prd);
+ 			phys_addr = ccb->ccb_dma_handle;
+-			sata_cmd.enc_addr_low = lower_32_bits(phys_addr);
+-			sata_cmd.enc_addr_high = upper_32_bits(phys_addr);
++			sata_cmd.enc_addr_low =
++				cpu_to_le32(lower_32_bits(phys_addr));
++			sata_cmd.enc_addr_high =
++				cpu_to_le32(upper_32_bits(phys_addr));
+ 			sata_cmd.enc_esgl = cpu_to_le32(1 << 31);
+ 		} else if (task->num_scatter == 1) {
+ 			u64 dma_addr = sg_dma_address(task->scatter);
+-			sata_cmd.enc_addr_low = lower_32_bits(dma_addr);
+-			sata_cmd.enc_addr_high = upper_32_bits(dma_addr);
++
++			sata_cmd.enc_addr_low =
++				cpu_to_le32(lower_32_bits(dma_addr));
++			sata_cmd.enc_addr_high =
++				cpu_to_le32(upper_32_bits(dma_addr));
+ 			sata_cmd.enc_len = cpu_to_le32(task->total_xfer_len);
+ 			sata_cmd.enc_esgl = 0;
++
+ 			/* Check 4G Boundary */
+-			start_addr = cpu_to_le64(dma_addr);
+-			end_addr = (start_addr + sata_cmd.enc_len) - 1;
+-			end_addr_low = cpu_to_le32(lower_32_bits(end_addr));
+-			end_addr_high = cpu_to_le32(upper_32_bits(end_addr));
+-			if (end_addr_high != sata_cmd.enc_addr_high) {
++			end_addr = dma_addr + le32_to_cpu(sata_cmd.enc_len) - 1;
++			end_addr_low = lower_32_bits(end_addr);
++			end_addr_high = upper_32_bits(end_addr);
++			if (end_addr_high != le32_to_cpu(sata_cmd.enc_addr_high)) {
+ 				pm8001_dbg(pm8001_ha, FAIL,
+ 					   "The sg list address start_addr=0x%016llx data_len=0x%x end_addr_high=0x%08x end_addr_low=0x%08x has crossed 4G boundary\n",
+-					   start_addr, sata_cmd.enc_len,
++					   dma_addr,
++					   le32_to_cpu(sata_cmd.enc_len),
+ 					   end_addr_high, end_addr_low);
+ 				pm8001_chip_make_sg(task->scatter, 1,
+ 					ccb->buf_prd);
+ 				phys_addr = ccb->ccb_dma_handle;
+ 				sata_cmd.enc_addr_low =
+-					lower_32_bits(phys_addr);
++					cpu_to_le32(lower_32_bits(phys_addr));
+ 				sata_cmd.enc_addr_high =
+-					upper_32_bits(phys_addr);
++					cpu_to_le32(upper_32_bits(phys_addr));
+ 				sata_cmd.enc_esgl =
+ 					cpu_to_le32(1 << 31);
+ 			}
+@@ -4645,7 +4651,8 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 			sata_cmd.enc_esgl = 0;
+ 		}
+ 		/* XTS mode. All other fields are 0 */
+-		sata_cmd.key_index_mode = 0x6 << 4;
++		sata_cmd.key_index_mode = cpu_to_le32(0x6 << 4);
++
+ 		/* set tweak values. Should be the start lba */
+ 		sata_cmd.twk_val0 =
+ 			cpu_to_le32((sata_cmd.sata_fis.lbal_exp << 24) |
+@@ -4671,31 +4678,31 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 			phys_addr = ccb->ccb_dma_handle;
+ 			sata_cmd.addr_low = lower_32_bits(phys_addr);
+ 			sata_cmd.addr_high = upper_32_bits(phys_addr);
+-			sata_cmd.esgl = cpu_to_le32(1 << 31);
++			sata_cmd.esgl = cpu_to_le32(1U << 31);
+ 		} else if (task->num_scatter == 1) {
+ 			u64 dma_addr = sg_dma_address(task->scatter);
++
+ 			sata_cmd.addr_low = lower_32_bits(dma_addr);
+ 			sata_cmd.addr_high = upper_32_bits(dma_addr);
+ 			sata_cmd.len = cpu_to_le32(task->total_xfer_len);
+ 			sata_cmd.esgl = 0;
++
+ 			/* Check 4G Boundary */
+-			start_addr = cpu_to_le64(dma_addr);
+-			end_addr = (start_addr + sata_cmd.len) - 1;
+-			end_addr_low = cpu_to_le32(lower_32_bits(end_addr));
+-			end_addr_high = cpu_to_le32(upper_32_bits(end_addr));
++			end_addr = dma_addr + le32_to_cpu(sata_cmd.len) - 1;
++			end_addr_low = lower_32_bits(end_addr);
++			end_addr_high = upper_32_bits(end_addr);
+ 			if (end_addr_high != sata_cmd.addr_high) {
+ 				pm8001_dbg(pm8001_ha, FAIL,
+ 					   "The sg list address start_addr=0x%016llx data_len=0x%xend_addr_high=0x%08x end_addr_low=0x%08x has crossed 4G boundary\n",
+-					   start_addr, sata_cmd.len,
++					   dma_addr,
++					   le32_to_cpu(sata_cmd.len),
+ 					   end_addr_high, end_addr_low);
+ 				pm8001_chip_make_sg(task->scatter, 1,
+ 					ccb->buf_prd);
+ 				phys_addr = ccb->ccb_dma_handle;
+-				sata_cmd.addr_low =
+-					lower_32_bits(phys_addr);
+-				sata_cmd.addr_high =
+-					upper_32_bits(phys_addr);
+-				sata_cmd.esgl = cpu_to_le32(1 << 31);
++				sata_cmd.addr_low = lower_32_bits(phys_addr);
++				sata_cmd.addr_high = upper_32_bits(phys_addr);
++				sata_cmd.esgl = cpu_to_le32(1U << 31);
+ 			}
+ 		} else if (task->num_scatter == 0) {
+ 			sata_cmd.addr_low = 0;
+@@ -4703,27 +4710,28 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 			sata_cmd.len = cpu_to_le32(task->total_xfer_len);
+ 			sata_cmd.esgl = 0;
+ 		}
++
+ 		/* scsi cdb */
+ 		sata_cmd.atapi_scsi_cdb[0] =
+ 			cpu_to_le32(((task->ata_task.atapi_packet[0]) |
+-			(task->ata_task.atapi_packet[1] << 8) |
+-			(task->ata_task.atapi_packet[2] << 16) |
+-			(task->ata_task.atapi_packet[3] << 24)));
++				     (task->ata_task.atapi_packet[1] << 8) |
++				     (task->ata_task.atapi_packet[2] << 16) |
++				     (task->ata_task.atapi_packet[3] << 24)));
+ 		sata_cmd.atapi_scsi_cdb[1] =
+ 			cpu_to_le32(((task->ata_task.atapi_packet[4]) |
+-			(task->ata_task.atapi_packet[5] << 8) |
+-			(task->ata_task.atapi_packet[6] << 16) |
+-			(task->ata_task.atapi_packet[7] << 24)));
++				     (task->ata_task.atapi_packet[5] << 8) |
++				     (task->ata_task.atapi_packet[6] << 16) |
++				     (task->ata_task.atapi_packet[7] << 24)));
+ 		sata_cmd.atapi_scsi_cdb[2] =
+ 			cpu_to_le32(((task->ata_task.atapi_packet[8]) |
+-			(task->ata_task.atapi_packet[9] << 8) |
+-			(task->ata_task.atapi_packet[10] << 16) |
+-			(task->ata_task.atapi_packet[11] << 24)));
++				     (task->ata_task.atapi_packet[9] << 8) |
++				     (task->ata_task.atapi_packet[10] << 16) |
++				     (task->ata_task.atapi_packet[11] << 24)));
+ 		sata_cmd.atapi_scsi_cdb[3] =
+ 			cpu_to_le32(((task->ata_task.atapi_packet[12]) |
+-			(task->ata_task.atapi_packet[13] << 8) |
+-			(task->ata_task.atapi_packet[14] << 16) |
+-			(task->ata_task.atapi_packet[15] << 24)));
++				     (task->ata_task.atapi_packet[13] << 8) |
++				     (task->ata_task.atapi_packet[14] << 16) |
++				     (task->ata_task.atapi_packet[15] << 24)));
+ 	}
+ 
+ 	/* Check for read log for failed drive and return */
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_set_s.patch b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_set_s.patch
new file mode 100644
index 00000000000..baaa7c7a1ba
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-le32-values-handling-in-pm80xx_set_s.patch
@@ -0,0 +1,112 @@
+From 972e1bdafc797449fcf0cf5760893c5d8ceb40dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:47 +0900
+Subject: scsi: pm8001: Fix le32 values handling in
+ pm80xx_set_sas_protocol_timer_config()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit ca374f5d92b8ae778f6a37dd3e7ed809bbf7a953 ]
+
+All fields of the SASProtocolTimerConfig structure have the __le32 type.
+As such, use cpu_to_le32() to initialize them. This change suppresses many
+sparse warnings:
+
+warning: incorrect type in assignment (different base types)
+   expected restricted __le32 [addressable] [usertype] pageCode
+   got int
+
+Note that the check to limit the value of the STP_IDLE_TMO field is removed
+as this field is initialized using the fixed (and small) value defined by
+the STP_IDLE_TIME macro.
+
+The pm8001_dbg() calls printing the values of the SASProtocolTimerConfig
+structure fileds are changed to use le32_to_cpu() to present the values in
+human readable form.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-9-damien.lemoal@opensource.wdc.com
+Fixes: a6cb3d012b98 ("[SCSI] pm80xx: thermal, sas controller config and error handling update")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 52 +++++++++++++++-----------------
+ 1 file changed, 25 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 052bd97aa22b..cda82cc1e3de 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1246,43 +1246,41 @@ pm80xx_set_sas_protocol_timer_config(struct pm8001_hba_info *pm8001_ha)
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 	payload.tag = cpu_to_le32(tag);
+ 
+-	SASConfigPage.pageCode        =  SAS_PROTOCOL_TIMER_CONFIG_PAGE;
+-	SASConfigPage.MST_MSI         =  3 << 15;
+-	SASConfigPage.STP_SSP_MCT_TMO =  (STP_MCT_TMO << 16) | SSP_MCT_TMO;
+-	SASConfigPage.STP_FRM_TMO     = (SAS_MAX_OPEN_TIME << 24) |
+-				(SMP_MAX_CONN_TIMER << 16) | STP_FRM_TIMER;
+-	SASConfigPage.STP_IDLE_TMO    =  STP_IDLE_TIME;
+-
+-	if (SASConfigPage.STP_IDLE_TMO > 0x3FFFFFF)
+-		SASConfigPage.STP_IDLE_TMO = 0x3FFFFFF;
+-
+-
+-	SASConfigPage.OPNRJT_RTRY_INTVL =         (SAS_MFD << 16) |
+-						SAS_OPNRJT_RTRY_INTVL;
+-	SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO =  (SAS_DOPNRJT_RTRY_TMO << 16)
+-						| SAS_COPNRJT_RTRY_TMO;
+-	SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR =  (SAS_DOPNRJT_RTRY_THR << 16)
+-						| SAS_COPNRJT_RTRY_THR;
+-	SASConfigPage.MAX_AIP =  SAS_MAX_AIP;
++	SASConfigPage.pageCode = cpu_to_le32(SAS_PROTOCOL_TIMER_CONFIG_PAGE);
++	SASConfigPage.MST_MSI = cpu_to_le32(3 << 15);
++	SASConfigPage.STP_SSP_MCT_TMO =
++		cpu_to_le32((STP_MCT_TMO << 16) | SSP_MCT_TMO);
++	SASConfigPage.STP_FRM_TMO =
++		cpu_to_le32((SAS_MAX_OPEN_TIME << 24) |
++			    (SMP_MAX_CONN_TIMER << 16) | STP_FRM_TIMER);
++	SASConfigPage.STP_IDLE_TMO = cpu_to_le32(STP_IDLE_TIME);
++
++	SASConfigPage.OPNRJT_RTRY_INTVL =
++		cpu_to_le32((SAS_MFD << 16) | SAS_OPNRJT_RTRY_INTVL);
++	SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO =
++		cpu_to_le32((SAS_DOPNRJT_RTRY_TMO << 16) | SAS_COPNRJT_RTRY_TMO);
++	SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR =
++		cpu_to_le32((SAS_DOPNRJT_RTRY_THR << 16) | SAS_COPNRJT_RTRY_THR);
++	SASConfigPage.MAX_AIP = cpu_to_le32(SAS_MAX_AIP);
+ 
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.pageCode 0x%08x\n",
+-		   SASConfigPage.pageCode);
++		   le32_to_cpu(SASConfigPage.pageCode));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.MST_MSI  0x%08x\n",
+-		   SASConfigPage.MST_MSI);
++		   le32_to_cpu(SASConfigPage.MST_MSI));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.STP_SSP_MCT_TMO  0x%08x\n",
+-		   SASConfigPage.STP_SSP_MCT_TMO);
++		   le32_to_cpu(SASConfigPage.STP_SSP_MCT_TMO));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.STP_FRM_TMO  0x%08x\n",
+-		   SASConfigPage.STP_FRM_TMO);
++		   le32_to_cpu(SASConfigPage.STP_FRM_TMO));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.STP_IDLE_TMO  0x%08x\n",
+-		   SASConfigPage.STP_IDLE_TMO);
++		   le32_to_cpu(SASConfigPage.STP_IDLE_TMO));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.OPNRJT_RTRY_INTVL  0x%08x\n",
+-		   SASConfigPage.OPNRJT_RTRY_INTVL);
++		   le32_to_cpu(SASConfigPage.OPNRJT_RTRY_INTVL));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO  0x%08x\n",
+-		   SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO);
++		   le32_to_cpu(SASConfigPage.Data_Cmd_OPNRJT_RTRY_TMO));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR  0x%08x\n",
+-		   SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR);
++		   le32_to_cpu(SASConfigPage.Data_Cmd_OPNRJT_RTRY_THR));
+ 	pm8001_dbg(pm8001_ha, INIT, "SASConfigPage.MAX_AIP  0x%08x\n",
+-		   SASConfigPage.MAX_AIP);
++		   le32_to_cpu(SASConfigPage.MAX_AIP));
+ 
+ 	memcpy(&payload.cfg_pg, &SASConfigPage,
+ 			 sizeof(SASProtocolTimerConfig_t));
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-completion-hand.patch b/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-completion-hand.patch
new file mode 100644
index 00000000000..4f685bb5268
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-completion-hand.patch
@@ -0,0 +1,61 @@
+From 61bccdacf1b382e1972805fb9850f465d5cbf821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:54 +0900
+Subject: scsi: pm8001: Fix NCQ NON DATA command completion handling
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 1d6736c3e162061dc811c76e605f35ef3234bffa ]
+
+NCQ NON DATA is an NCQ command with the DMA_NONE DMA direction and so a
+register-device-to-host-FIS response is expected for it.
+
+However, for an IO_SUCCESS case, mpi_sata_completion() expects a
+set-device-bits-FIS for any ata task with an use_ncq field true, which
+includes NCQ NON DATA commands.
+
+Fix this to correctly treat NCQ NON DATA commands as non-data by also
+testing for the DMA_NONE DMA direction.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-16-damien.lemoal@opensource.wdc.com
+Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 3 ++-
+ drivers/scsi/pm8001/pm80xx_hwi.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 183c72547229..97c08afd2dcf 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -2421,7 +2421,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ 				len = sizeof(struct pio_setup_fis);
+ 				pm8001_dbg(pm8001_ha, IO,
+ 					   "PIO read len = %d\n", len);
+-			} else if (t->ata_task.use_ncq) {
++			} else if (t->ata_task.use_ncq &&
++				   t->data_dir != DMA_NONE) {
+ 				len = sizeof(struct set_dev_bits_fis);
+ 				pm8001_dbg(pm8001_ha, IO, "FPDMA len = %d\n",
+ 					   len);
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 8eef2c51e432..414cd4b67c90 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -2518,7 +2518,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha,
+ 				len = sizeof(struct pio_setup_fis);
+ 				pm8001_dbg(pm8001_ha, IO,
+ 					   "PIO read len = %d\n", len);
+-			} else if (t->ata_task.use_ncq) {
++			} else if (t->ata_task.use_ncq &&
++				   t->data_dir != DMA_NONE) {
+ 				len = sizeof(struct set_dev_bits_fis);
+ 				pm8001_dbg(pm8001_ha, IO, "FPDMA len = %d\n",
+ 					   len);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-task-initializa.patch b/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-task-initializa.patch
new file mode 100644
index 00000000000..8dfa1b05361
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-ncq-non-data-command-task-initializa.patch
@@ -0,0 +1,101 @@
+From 5c945a8fa2e2234cf0ba0ba81c9acd5334876a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:53 +0900
+Subject: scsi: pm8001: Fix NCQ NON DATA command task initialization
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit aa028141ab0bc62c44a84d42f09db35d82df82a2 ]
+
+In the pm8001_chip_sata_req() and pm80xx_chip_sata_req() functions, all
+tasks with a DMA direction of DMA_NONE (no data transfer) are initialized
+using the ATAP value 0x04. However, NCQ NON DATA commands, while being
+DMA_NONE commands are NCQ commands and need to be initialized using the
+value 0x07 for ATAP, similarly to other NCQ commands.
+
+Make sure that NCQ NON DATA command tasks are initialized similarly to
+other NCQ commands by also testing the task "use_ncq" field in addition to
+the DMA direction. While at it, reorganize the code into a chain of if -
+else if - else to avoid useless affectations and debug messages.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-15-damien.lemoal@opensource.wdc.com
+Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 14 +++++++-------
+ drivers/scsi/pm8001/pm80xx_hwi.c | 13 ++++++-------
+ 2 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index eca1ab198314..183c72547229 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4282,22 +4282,22 @@ static int pm8001_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 	u32  opc = OPC_INB_SATA_HOST_OPSTART;
+ 	memset(&sata_cmd, 0, sizeof(sata_cmd));
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+-	if (task->data_dir == DMA_NONE) {
++
++	if (task->data_dir == DMA_NONE && !task->ata_task.use_ncq) {
+ 		ATAP = 0x04;  /* no data*/
+ 		pm8001_dbg(pm8001_ha, IO, "no data\n");
+ 	} else if (likely(!task->ata_task.device_control_reg_update)) {
+-		if (task->ata_task.dma_xfer) {
++		if (task->ata_task.use_ncq &&
++		    dev->sata_dev.class != ATA_DEV_ATAPI) {
++			ATAP = 0x07; /* FPDMA */
++			pm8001_dbg(pm8001_ha, IO, "FPDMA\n");
++		} else if (task->ata_task.dma_xfer) {
+ 			ATAP = 0x06; /* DMA */
+ 			pm8001_dbg(pm8001_ha, IO, "DMA\n");
+ 		} else {
+ 			ATAP = 0x05; /* PIO*/
+ 			pm8001_dbg(pm8001_ha, IO, "PIO\n");
+ 		}
+-		if (task->ata_task.use_ncq &&
+-			dev->sata_dev.class != ATA_DEV_ATAPI) {
+-			ATAP = 0x07; /* FPDMA */
+-			pm8001_dbg(pm8001_ha, IO, "FPDMA\n");
+-		}
+ 	}
+ 	if (task->ata_task.use_ncq && pm8001_get_ncq_tag(task, &hdr_tag)) {
+ 		task->ata_task.fis.sector_count |= (u8) (hdr_tag << 3);
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 93a5af907856..8eef2c51e432 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4560,22 +4560,21 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+ 	q_index = (u32) (cpu_id) % (pm8001_ha->max_q_num);
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[q_index];
+ 
+-	if (task->data_dir == DMA_NONE) {
++	if (task->data_dir == DMA_NONE && !task->ata_task.use_ncq) {
+ 		ATAP = 0x04; /* no data*/
+ 		pm8001_dbg(pm8001_ha, IO, "no data\n");
+ 	} else if (likely(!task->ata_task.device_control_reg_update)) {
+-		if (task->ata_task.dma_xfer) {
++		if (task->ata_task.use_ncq &&
++		    dev->sata_dev.class != ATA_DEV_ATAPI) {
++			ATAP = 0x07; /* FPDMA */
++			pm8001_dbg(pm8001_ha, IO, "FPDMA\n");
++		} else if (task->ata_task.dma_xfer) {
+ 			ATAP = 0x06; /* DMA */
+ 			pm8001_dbg(pm8001_ha, IO, "DMA\n");
+ 		} else {
+ 			ATAP = 0x05; /* PIO*/
+ 			pm8001_dbg(pm8001_ha, IO, "PIO\n");
+ 		}
+-		if (task->ata_task.use_ncq &&
+-		    dev->sata_dev.class != ATA_DEV_ATAPI) {
+-			ATAP = 0x07; /* FPDMA */
+-			pm8001_dbg(pm8001_ha, IO, "FPDMA\n");
+-		}
+ 	}
+ 	if (task->ata_task.use_ncq && pm8001_get_ncq_tag(task, &hdr_tag)) {
+ 		task->ata_task.fis.sector_count |= (u8) (hdr_tag << 3);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_enc.patch b/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_enc.patch
new file mode 100644
index 00000000000..1325731e352
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_enc.patch
@@ -0,0 +1,51 @@
+From 28ee5dc2073ae5a90746b7453249cd24b06434d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:48 +0900
+Subject: scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit f8b12dfb476dad38ce755aaf5e2df46f06f1822e ]
+
+All fields of the kek_mgmt_req structure have the type __le32. So make sure
+to use cpu_to_le32() to initialize them. This suppresses the sparse
+warning:
+
+warning: incorrect type in assignment (different base types)
+   expected restricted __le32 [addressable] [assigned] [usertype] new_curidx_ksop
+   got int
+
+Link: https://lore.kernel.org/r/20220220031810.738362-10-damien.lemoal@opensource.wdc.com
+Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index cda82cc1e3de..d4b11b005fe2 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1406,12 +1406,13 @@ static int pm80xx_encrypt_update(struct pm8001_hba_info *pm8001_ha)
+ 	/* Currently only one key is used. New KEK index is 1.
+ 	 * Current KEK index is 1. Store KEK to NVRAM is 1.
+ 	 */
+-	payload.new_curidx_ksop = ((1 << 24) | (1 << 16) | (1 << 8) |
+-					KEK_MGMT_SUBOP_KEYCARDUPDATE);
++	payload.new_curidx_ksop =
++		cpu_to_le32(((1 << 24) | (1 << 16) | (1 << 8) |
++			     KEK_MGMT_SUBOP_KEYCARDUPDATE));
+ 
+ 	pm8001_dbg(pm8001_ha, DEV,
+ 		   "Saving Encryption info to flash. payload 0x%x\n",
+-		   payload.new_curidx_ksop);
++		   le32_to_cpu(payload.new_curidx_ksop));
+ 
+ 	rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload,
+ 			sizeof(payload), 0);
+-- 
+2.34.1
+
diff --git a/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch b/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
new file mode 100644
index 00000000000..ffd3169e8e9
--- /dev/null
+++ b/queue-5.16/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
@@ -0,0 +1,51 @@
+From 05e9cfa3b3d6bc79b0d2707fa23246df520ff37f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:46 +0900
+Subject: scsi: pm8001: Fix payload initialization in
+ pm80xx_set_thermal_config()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit bb225b12dbcc82d53d637d10b8d70b64494f8c16 ]
+
+The fields of the set_ctrl_cfg_req structure have the __le32 type, so use
+cpu_to_le32() to assign them. This removes the sparse warnings:
+
+warning: incorrect type in assignment (different base types)
+    expected restricted __le32
+    got unsigned int
+
+Link: https://lore.kernel.org/r/20220220031810.738362-8-damien.lemoal@opensource.wdc.com
+Fixes: 842784e0d15b ("pm80xx: Update For Thermal Page Code")
+Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files")
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index c56a726e1873..052bd97aa22b 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1202,9 +1202,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha)
+ 	else
+ 		page_code = THERMAL_PAGE_CODE_8H;
+ 
+-	payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) |
+-				(THERMAL_ENABLE << 8) | page_code;
+-	payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8);
++	payload.cfg_pg[0] =
++		cpu_to_le32((THERMAL_LOG_ENABLE << 9) |
++			    (THERMAL_ENABLE << 8) | page_code);
++	payload.cfg_pg[1] =
++		cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8));
+ 
+ 	pm8001_dbg(pm8001_ha, DEV,
+ 		   "Setting up thermal config. cfg_pg 0 0x%x cfg_pg 1 0x%x\n",
+-- 
+2.34.1
+
diff --git a/queue-5.16/security-add-sctp_assoc_established-hook.patch b/queue-5.16/security-add-sctp_assoc_established-hook.patch
new file mode 100644
index 00000000000..83cf81a3db6
--- /dev/null
+++ b/queue-5.16/security-add-sctp_assoc_established-hook.patch
@@ -0,0 +1,207 @@
+From 7d849b52aa6cff0eaf43e9bdcccf6db1723dc1b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 18:59:21 +0100
+Subject: security: add sctp_assoc_established hook
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit 5e50f5d4ff31e95599d695df1f0a4e7d2d6fef99 ]
+
+security_sctp_assoc_established() is added to replace
+security_inet_conn_established() called in
+sctp_sf_do_5_1E_ca(), so that asoc can be accessed in security
+subsystem and save the peer secid to asoc->peer_secid.
+
+Fixes: 72e89f50084c ("security: Add support for SCTP security hooks")
+Reported-by: Prashanth Prahlad <pprahlad@redhat.com>
+Based-on-patch-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Tested-by: Richard Haines <richard_c_haines@btinternet.com>
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/security/SCTP.rst | 22 ++++++++++------------
+ include/linux/lsm_hook_defs.h   |  2 ++
+ include/linux/lsm_hooks.h       |  5 +++++
+ include/linux/security.h        |  8 ++++++++
+ net/sctp/sm_statefuns.c         |  8 +++++---
+ security/security.c             |  7 +++++++
+ 6 files changed, 37 insertions(+), 15 deletions(-)
+
+diff --git a/Documentation/security/SCTP.rst b/Documentation/security/SCTP.rst
+index d5fd6ccc3dcb..406cc68b8808 100644
+--- a/Documentation/security/SCTP.rst
++++ b/Documentation/security/SCTP.rst
+@@ -15,10 +15,7 @@ For security module support, three SCTP specific hooks have been implemented::
+     security_sctp_assoc_request()
+     security_sctp_bind_connect()
+     security_sctp_sk_clone()
+-
+-Also the following security hook has been utilised::
+-
+-    security_inet_conn_established()
++    security_sctp_assoc_established()
+ 
+ The usage of these hooks are described below with the SELinux implementation
+ described in the `SCTP SELinux Support`_ chapter.
+@@ -122,11 +119,12 @@ calls **sctp_peeloff**\(3).
+     @newsk - pointer to new sock structure.
+ 
+ 
+-security_inet_conn_established()
++security_sctp_assoc_established()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+-Called when a COOKIE ACK is received::
++Called when a COOKIE ACK is received, and the peer secid will be
++saved into ``@asoc->peer_secid`` for client::
+ 
+-    @sk  - pointer to sock structure.
++    @asoc - pointer to sctp association structure.
+     @skb - pointer to skbuff of the COOKIE ACK packet.
+ 
+ 
+@@ -134,7 +132,7 @@ Security Hooks used for Association Establishment
+ -------------------------------------------------
+ 
+ The following diagram shows the use of ``security_sctp_bind_connect()``,
+-``security_sctp_assoc_request()``, ``security_inet_conn_established()`` when
++``security_sctp_assoc_request()``, ``security_sctp_assoc_established()`` when
+ establishing an association.
+ ::
+ 
+@@ -172,7 +170,7 @@ establishing an association.
+           <------------------------------------------- COOKIE ACK
+           |                                               |
+     sctp_sf_do_5_1E_ca                                    |
+- Call security_inet_conn_established()                    |
++ Call security_sctp_assoc_established()                   |
+  to set the peer label.                                   |
+           |                                               |
+           |                               If SCTP_SOCKET_TCP or peeled off
+@@ -198,7 +196,7 @@ hooks with the SELinux specifics expanded below::
+     security_sctp_assoc_request()
+     security_sctp_bind_connect()
+     security_sctp_sk_clone()
+-    security_inet_conn_established()
++    security_sctp_assoc_established()
+ 
+ 
+ security_sctp_assoc_request()
+@@ -271,12 +269,12 @@ sockets sid and peer sid to that contained in the ``@asoc sid`` and
+     @newsk - pointer to new sock structure.
+ 
+ 
+-security_inet_conn_established()
++security_sctp_assoc_established()
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Called when a COOKIE ACK is received where it sets the connection's peer sid
+ to that in ``@skb``::
+ 
+-    @sk  - pointer to sock structure.
++    @asoc - pointer to sctp association structure.
+     @skb - pointer to skbuff of the COOKIE ACK packet.
+ 
+ 
+diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
+index f0c7b352340a..2e078f40195d 100644
+--- a/include/linux/lsm_hook_defs.h
++++ b/include/linux/lsm_hook_defs.h
+@@ -335,6 +335,8 @@ LSM_HOOK(int, 0, sctp_bind_connect, struct sock *sk, int optname,
+ 	 struct sockaddr *address, int addrlen)
+ LSM_HOOK(void, LSM_RET_VOID, sctp_sk_clone, struct sctp_association *asoc,
+ 	 struct sock *sk, struct sock *newsk)
++LSM_HOOK(int, 0, sctp_assoc_established, struct sctp_association *asoc,
++	 struct sk_buff *skb)
+ #endif /* CONFIG_SECURITY_NETWORK */
+ 
+ #ifdef CONFIG_SECURITY_INFINIBAND
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
+index d45b6f6e27fd..d6823214d5c1 100644
+--- a/include/linux/lsm_hooks.h
++++ b/include/linux/lsm_hooks.h
+@@ -1050,6 +1050,11 @@
+  *	@asoc pointer to current sctp association structure.
+  *	@sk pointer to current sock structure.
+  *	@newsk pointer to new sock structure.
++ * @sctp_assoc_established:
++ *	Passes the @asoc and @chunk->skb of the association COOKIE_ACK packet
++ *	to the security module.
++ *	@asoc pointer to sctp association structure.
++ *	@skb pointer to skbuff of association packet.
+  *
+  * Security hooks for Infiniband
+  *
+diff --git a/include/linux/security.h b/include/linux/security.h
+index bbf44a466832..bd059e7b4766 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -1430,6 +1430,8 @@ int security_sctp_bind_connect(struct sock *sk, int optname,
+ 			       struct sockaddr *address, int addrlen);
+ void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
+ 			    struct sock *newsk);
++int security_sctp_assoc_established(struct sctp_association *asoc,
++				    struct sk_buff *skb);
+ 
+ #else	/* CONFIG_SECURITY_NETWORK */
+ static inline int security_unix_stream_connect(struct sock *sock,
+@@ -1649,6 +1651,12 @@ static inline void security_sctp_sk_clone(struct sctp_association *asoc,
+ 					  struct sock *newsk)
+ {
+ }
++
++static inline int security_sctp_assoc_established(struct sctp_association *asoc,
++						  struct sk_buff *skb)
++{
++	return 0;
++}
+ #endif	/* CONFIG_SECURITY_NETWORK */
+ 
+ #ifdef CONFIG_SECURITY_INFINIBAND
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 354c1c4de19b..5633fbb1ba3c 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -930,6 +930,11 @@ enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
+ 	if (!sctp_vtag_verify(chunk, asoc))
+ 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ 
++	/* Set peer label for connection. */
++	if (security_sctp_assoc_established((struct sctp_association *)asoc,
++					    chunk->skb))
++		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ 	/* Verify that the chunk length for the COOKIE-ACK is OK.
+ 	 * If we don't do this, any bundled chunks may be junked.
+ 	 */
+@@ -945,9 +950,6 @@ enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
+ 	 */
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
+ 
+-	/* Set peer label for connection. */
+-	security_inet_conn_established(ep->base.sk, chunk->skb);
+-
+ 	/* RFC 2960 5.1 Normal Establishment of an Association
+ 	 *
+ 	 * E) Upon reception of the COOKIE ACK, endpoint "A" will move
+diff --git a/security/security.c b/security/security.c
+index 64abdfb20bc2..cf6615b5e820 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -2399,6 +2399,13 @@ void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
+ }
+ EXPORT_SYMBOL(security_sctp_sk_clone);
+ 
++int security_sctp_assoc_established(struct sctp_association *asoc,
++				    struct sk_buff *skb)
++{
++	return call_int_hook(sctp_assoc_established, 0, asoc, skb);
++}
++EXPORT_SYMBOL(security_sctp_assoc_established);
++
+ #endif	/* CONFIG_SECURITY_NETWORK */
+ 
+ #ifdef CONFIG_SECURITY_INFINIBAND
+-- 
+2.34.1
+
diff --git a/queue-5.16/security-implement-sctp_assoc_established-hook-in-se.patch b/queue-5.16/security-implement-sctp_assoc_established-hook-in-se.patch
new file mode 100644
index 00000000000..dd9553a1ba5
--- /dev/null
+++ b/queue-5.16/security-implement-sctp_assoc_established-hook-in-se.patch
@@ -0,0 +1,217 @@
+From e7aa1a6cd798323f8e1ac15f656b91eaa892092a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 18:59:22 +0100
+Subject: security: implement sctp_assoc_established hook in selinux
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit 3eb8eaf2ca3e98d4f6e52bed6148ee8fe3069a3d ]
+
+Do this by extracting the peer labeling per-association logic from
+selinux_sctp_assoc_request() into a new helper
+selinux_sctp_process_new_assoc() and use this helper in both
+selinux_sctp_assoc_request() and selinux_sctp_assoc_established(). This
+ensures that the peer labeling behavior as documented in
+Documentation/security/SCTP.rst is applied both on the client and server
+side:
+"""
+An SCTP socket will only have one peer label assigned to it. This will be
+assigned during the establishment of the first association. Any further
+associations on this socket will have their packet peer label compared to
+the sockets peer label, and only if they are different will the
+``association`` permission be validated. This is validated by checking the
+socket peer sid against the received packets peer sid to determine whether
+the association should be allowed or denied.
+"""
+
+At the same time, it also ensures that the peer label of the association
+is set to the correct value, such that if it is peeled off into a new
+socket, the socket's peer label  will then be set to the association's
+peer label, same as it already works on the server side.
+
+While selinux_inet_conn_established() (which we are replacing by
+selinux_sctp_assoc_established() for SCTP) only deals with assigning a
+peer label to the connection (socket), in case of SCTP we need to also
+copy the (local) socket label to the association, so that
+selinux_sctp_sk_clone() can then pick it up for the new socket in case
+of SCTP peeloff.
+
+Careful readers will notice that the selinux_sctp_process_new_assoc()
+helper also includes the "IPv4 packet received over an IPv6 socket"
+check, even though it hadn't been in selinux_sctp_assoc_request()
+before. While such check is not necessary in
+selinux_inet_conn_request() (because struct request_sock's family field
+is already set according to the skb's family), here it is needed, as we
+don't have request_sock and we take the initial family from the socket.
+In selinux_sctp_assoc_established() it is similarly needed as well (and
+also selinux_inet_conn_established() already has it).
+
+Fixes: 72e89f50084c ("security: Add support for SCTP security hooks")
+Reported-by: Prashanth Prahlad <pprahlad@redhat.com>
+Based-on-patch-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Tested-by: Richard Haines <richard_c_haines@btinternet.com>
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 90 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 66 insertions(+), 24 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 30f08fc1ac09..93eac9464c5f 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5355,37 +5355,38 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent)
+ 	sksec->sclass = isec->sclass;
+ }
+ 
+-/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
+- * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
+- * already present).
++/*
++ * Determines peer_secid for the asoc and updates socket's peer label
++ * if it's the first association on the socket.
+  */
+-static int selinux_sctp_assoc_request(struct sctp_association *asoc,
+-				      struct sk_buff *skb)
++static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
++					  struct sk_buff *skb)
+ {
+-	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
++	struct sock *sk = asoc->base.sk;
++	u16 family = sk->sk_family;
++	struct sk_security_struct *sksec = sk->sk_security;
+ 	struct common_audit_data ad;
+ 	struct lsm_network_audit net = {0,};
+-	u8 peerlbl_active;
+-	u32 peer_sid = SECINITSID_UNLABELED;
+-	u32 conn_sid;
+-	int err = 0;
++	int err;
+ 
+-	if (!selinux_policycap_extsockclass())
+-		return 0;
++	/* handle mapped IPv4 packets arriving via IPv6 sockets */
++	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
++		family = PF_INET;
+ 
+-	peerlbl_active = selinux_peerlbl_enabled();
++	if (selinux_peerlbl_enabled()) {
++		asoc->peer_secid = SECSID_NULL;
+ 
+-	if (peerlbl_active) {
+ 		/* This will return peer_sid = SECSID_NULL if there are
+ 		 * no peer labels, see security_net_peersid_resolve().
+ 		 */
+-		err = selinux_skb_peerlbl_sid(skb, asoc->base.sk->sk_family,
+-					      &peer_sid);
++		err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
+ 		if (err)
+ 			return err;
+ 
+-		if (peer_sid == SECSID_NULL)
+-			peer_sid = SECINITSID_UNLABELED;
++		if (asoc->peer_secid == SECSID_NULL)
++			asoc->peer_secid = SECINITSID_UNLABELED;
++	} else {
++		asoc->peer_secid = SECINITSID_UNLABELED;
+ 	}
+ 
+ 	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
+@@ -5396,8 +5397,8 @@ static int selinux_sctp_assoc_request(struct sctp_association *asoc,
+ 		 * then it is approved by policy and used as the primary
+ 		 * peer SID for getpeercon(3).
+ 		 */
+-		sksec->peer_sid = peer_sid;
+-	} else if  (sksec->peer_sid != peer_sid) {
++		sksec->peer_sid = asoc->peer_secid;
++	} else if (sksec->peer_sid != asoc->peer_secid) {
+ 		/* Other association peer SIDs are checked to enforce
+ 		 * consistency among the peer SIDs.
+ 		 */
+@@ -5405,11 +5406,32 @@ static int selinux_sctp_assoc_request(struct sctp_association *asoc,
+ 		ad.u.net = &net;
+ 		ad.u.net->sk = asoc->base.sk;
+ 		err = avc_has_perm(&selinux_state,
+-				   sksec->peer_sid, peer_sid, sksec->sclass,
+-				   SCTP_SOCKET__ASSOCIATION, &ad);
++				   sksec->peer_sid, asoc->peer_secid,
++				   sksec->sclass, SCTP_SOCKET__ASSOCIATION,
++				   &ad);
+ 		if (err)
+ 			return err;
+ 	}
++	return 0;
++}
++
++/* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
++ * happens on an incoming connect(2), sctp_connectx(3) or
++ * sctp_sendmsg(3) (with no association already present).
++ */
++static int selinux_sctp_assoc_request(struct sctp_association *asoc,
++				      struct sk_buff *skb)
++{
++	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
++	u32 conn_sid;
++	int err;
++
++	if (!selinux_policycap_extsockclass())
++		return 0;
++
++	err = selinux_sctp_process_new_assoc(asoc, skb);
++	if (err)
++		return err;
+ 
+ 	/* Compute the MLS component for the connection and store
+ 	 * the information in asoc. This will be used by SCTP TCP type
+@@ -5417,17 +5439,36 @@ static int selinux_sctp_assoc_request(struct sctp_association *asoc,
+ 	 * socket to be generated. selinux_sctp_sk_clone() will then
+ 	 * plug this into the new socket.
+ 	 */
+-	err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
++	err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
+ 	if (err)
+ 		return err;
+ 
+ 	asoc->secid = conn_sid;
+-	asoc->peer_secid = peer_sid;
+ 
+ 	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
+ 	return selinux_netlbl_sctp_assoc_request(asoc, skb);
+ }
+ 
++/* Called when SCTP receives a COOKIE ACK chunk as the final
++ * response to an association request (initited by us).
++ */
++static int selinux_sctp_assoc_established(struct sctp_association *asoc,
++					  struct sk_buff *skb)
++{
++	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
++
++	if (!selinux_policycap_extsockclass())
++		return 0;
++
++	/* Inherit secid from the parent socket - this will be picked up
++	 * by selinux_sctp_sk_clone() if the association gets peeled off
++	 * into a new socket.
++	 */
++	asoc->secid = sksec->sid;
++
++	return selinux_sctp_process_new_assoc(asoc, skb);
++}
++
+ /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
+  * based on their @optname.
+  */
+@@ -7248,6 +7289,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
+ 	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
+ 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
+ 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
++	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
+ 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
+ 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
+ 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-extract-syscall-wrapper.patch b/queue-5.16/selftests-bpf-extract-syscall-wrapper.patch
new file mode 100644
index 00000000000..bc36075a743
--- /dev/null
+++ b/queue-5.16/selftests-bpf-extract-syscall-wrapper.patch
@@ -0,0 +1,77 @@
+From fab64306a76d8c998c466f83099a4e64dfba00c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 23:16:20 +0900
+Subject: selftests/bpf: Extract syscall wrapper
+
+From: Kenta Tada <Kenta.Tada@sony.com>
+
+[ Upstream commit 78a2054156dd6265619b230cc5372b74f9ba5233 ]
+
+Extract the helper to set up SYS_PREFIX for fentry and kprobe selftests
+that use __x86_sys_* attach functions.
+
+Suggested-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220124141622.4378-2-Kenta.Tada@sony.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/bpf_misc.h  | 19 +++++++++++++++++++
+ .../selftests/bpf/progs/test_probe_user.c     | 15 +--------------
+ 2 files changed, 20 insertions(+), 14 deletions(-)
+ create mode 100644 tools/testing/selftests/bpf/progs/bpf_misc.h
+
+diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h
+new file mode 100644
+index 000000000000..0b78bc9b1b4c
+--- /dev/null
++++ b/tools/testing/selftests/bpf/progs/bpf_misc.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __BPF_MISC_H__
++#define __BPF_MISC_H__
++
++#if defined(__TARGET_ARCH_x86)
++#define SYSCALL_WRAPPER 1
++#define SYS_PREFIX "__x64_"
++#elif defined(__TARGET_ARCH_s390)
++#define SYSCALL_WRAPPER 1
++#define SYS_PREFIX "__s390x_"
++#elif defined(__TARGET_ARCH_arm64)
++#define SYSCALL_WRAPPER 1
++#define SYS_PREFIX "__arm64_"
++#else
++#define SYSCALL_WRAPPER 0
++#define SYS_PREFIX ""
++#endif
++
++#endif
+diff --git a/tools/testing/selftests/bpf/progs/test_probe_user.c b/tools/testing/selftests/bpf/progs/test_probe_user.c
+index 8812a90da4eb..702578a5e496 100644
+--- a/tools/testing/selftests/bpf/progs/test_probe_user.c
++++ b/tools/testing/selftests/bpf/progs/test_probe_user.c
+@@ -7,20 +7,7 @@
+ 
+ #include <bpf/bpf_helpers.h>
+ #include <bpf/bpf_tracing.h>
+-
+-#if defined(__TARGET_ARCH_x86)
+-#define SYSCALL_WRAPPER 1
+-#define SYS_PREFIX "__x64_"
+-#elif defined(__TARGET_ARCH_s390)
+-#define SYSCALL_WRAPPER 1
+-#define SYS_PREFIX "__s390x_"
+-#elif defined(__TARGET_ARCH_arm64)
+-#define SYSCALL_WRAPPER 1
+-#define SYS_PREFIX "__arm64_"
+-#else
+-#define SYSCALL_WRAPPER 0
+-#define SYS_PREFIX ""
+-#endif
++#include "bpf_misc.h"
+ 
+ static struct sockaddr_in old;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-fix-bind-on-used-port.patch b/queue-5.16/selftests-bpf-fix-bind-on-used-port.patch
new file mode 100644
index 00000000000..a1d9fe7b581
--- /dev/null
+++ b/queue-5.16/selftests-bpf-fix-bind-on-used-port.patch
@@ -0,0 +1,73 @@
+From b6de27338f5d3ea7f327f0307938bc6416eded53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 16:11:56 +0100
+Subject: selftests: bpf: Fix bind on used port
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+[ Upstream commit 8c0be0631d81e48f77d0ebf0534c86e32bef5f89 ]
+
+The bind_perm BPF selftest failed when port 111/tcp was already in use
+during the test. To fix this, the test now runs in its own network name
+space.
+
+To use unshare, it is necessary to reorder the includes. The style of
+the includes is adapted to be consistent with the other prog_tests.
+
+v2: Replace deprecated CHECK macro with ASSERT_OK
+
+Fixes: 8259fdeb30326 ("selftests/bpf: Verify that rebinding to port < 1024 from BPF works")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/551ee65533bb987a43f93d88eaf2368b416ccd32.1642518457.git.fmaurer@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/bind_perm.c      | 20 ++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bind_perm.c b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
+index d0f06e40c16d..eac71fbb24ce 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bind_perm.c
++++ b/tools/testing/selftests/bpf/prog_tests/bind_perm.c
+@@ -1,13 +1,24 @@
+ // SPDX-License-Identifier: GPL-2.0
+-#include <test_progs.h>
+-#include "bind_perm.skel.h"
+-
++#define _GNU_SOURCE
++#include <sched.h>
++#include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <sys/capability.h>
+ 
++#include "test_progs.h"
++#include "bind_perm.skel.h"
++
+ static int duration;
+ 
++static int create_netns(void)
++{
++	if (!ASSERT_OK(unshare(CLONE_NEWNET), "create netns"))
++		return -1;
++
++	return 0;
++}
++
+ void try_bind(int family, int port, int expected_errno)
+ {
+ 	struct sockaddr_storage addr = {};
+@@ -75,6 +86,9 @@ void test_bind_perm(void)
+ 	struct bind_perm *skel;
+ 	int cgroup_fd;
+ 
++	if (create_netns())
++		return;
++
+ 	cgroup_fd = test__join_cgroup("/bind_perm");
+ 	if (CHECK(cgroup_fd < 0, "cg-join", "errno %d", errno))
+ 		return;
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-fix-error-reporting-from-sock_fields-p.patch b/queue-5.16/selftests-bpf-fix-error-reporting-from-sock_fields-p.patch
new file mode 100644
index 00000000000..8ed467c0d8a
--- /dev/null
+++ b/queue-5.16/selftests-bpf-fix-error-reporting-from-sock_fields-p.patch
@@ -0,0 +1,46 @@
+From 793973af7dec4bffdada4dab0a4108df7fd4fd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 12:39:17 +0100
+Subject: selftests/bpf: Fix error reporting from sock_fields programs
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit a4c9fe0ed4a13e25e43fcd44d9f89bc19ba8fbb7 ]
+
+The helper macro that records an error in BPF programs that exercise sock
+fields access has been inadvertently broken by adaptation work that
+happened in commit b18c1f0aa477 ("bpf: selftest: Adapt sock_fields test to
+use skel and global variables").
+
+BPF_NOEXIST flag cannot be used to update BPF_MAP_TYPE_ARRAY. The operation
+always fails with -EEXIST, which in turn means the error never gets
+recorded, and the checks for errors always pass.
+
+Revert the change in update flags.
+
+Fixes: b18c1f0aa477 ("bpf: selftest: Adapt sock_fields test to use skel and global variables")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20220317113920.1068535-2-jakub@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/test_sock_fields.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_sock_fields.c b/tools/testing/selftests/bpf/progs/test_sock_fields.c
+index 81b57b9aaaea..7967348b11af 100644
+--- a/tools/testing/selftests/bpf/progs/test_sock_fields.c
++++ b/tools/testing/selftests/bpf/progs/test_sock_fields.c
+@@ -113,7 +113,7 @@ static void tpcpy(struct bpf_tcp_sock *dst,
+ 
+ #define RET_LOG() ({						\
+ 	linum = __LINE__;					\
+-	bpf_map_update_elem(&linum_map, &linum_idx, &linum, BPF_NOEXIST);	\
++	bpf_map_update_elem(&linum_map, &linum_idx, &linum, BPF_ANY);	\
+ 	return CG_OK;						\
+ })
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch b/queue-5.16/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
new file mode 100644
index 00000000000..248a347ba0d
--- /dev/null
+++ b/queue-5.16/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
@@ -0,0 +1,75 @@
+From 7d92ee298122b174db24f084d5027aa8813d7edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 12:15:26 +0100
+Subject: selftests/bpf: Make test_lwt_ip_encap more stable and faster
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+[ Upstream commit d23a8720327d33616f584d76c80824bfa4699be6 ]
+
+In test_lwt_ip_encap, the ingress IPv6 encap test failed from time to
+time. The failure occured when an IPv4 ping through the IPv6 GRE
+encapsulation did not receive a reply within the timeout. The IPv4 ping
+and the IPv6 ping in the test used different timeouts (1 sec for IPv4
+and 6 sec for IPv6), probably taking into account that IPv6 might need
+longer to successfully complete. However, when IPv4 pings (with the
+short timeout) are encapsulated into the IPv6 tunnel, the delays of IPv6
+apply.
+
+The actual reason for the long delays with IPv6 was that the IPv6
+neighbor discovery sometimes did not complete in time. This was caused
+by the outgoing interface only having a tentative link local address,
+i.e., not having completed DAD for that lladdr. The ND was successfully
+retried after 1 sec but that was too late for the ping timeout.
+
+The IPv6 addresses for the test were already added with nodad. However,
+for the lladdrs, DAD was still performed. We now disable DAD in the test
+netns completely and just assume that the two lladdrs on each veth pair
+do not collide. This removes all the delays for IPv6 traffic in the
+test.
+
+Without the delays, we can now also reduce the delay of the IPv6 ping to
+1 sec. This makes the whole test complete faster because we don't need
+to wait for the excessive timeout for each IPv6 ping that is supposed
+to fail.
+
+Fixes: 0fde56e4385b0 ("selftests: bpf: add test_lwt_ip_encap selftest")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/4987d549d48b4e316cd5b3936de69c8d4bc75a4f.1646305899.git.fmaurer@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+index b497bb85b667..6c69c42b1d60 100755
+--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
++++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+@@ -120,6 +120,14 @@ setup()
+ 	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0
+ 	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0
+ 
++	# disable IPv6 DAD because it sometimes takes too long and fails tests
++	ip netns exec ${NS1} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS2} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS3} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS1} sysctl -wq net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${NS2} sysctl -wq net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${NS3} sysctl -wq net.ipv6.conf.default.accept_dad=0
++
+ 	ip link add veth1 type veth peer name veth2
+ 	ip link add veth3 type veth peer name veth4
+ 	ip link add veth5 type veth peer name veth6
+@@ -289,7 +297,7 @@ test_ping()
+ 		ip netns exec ${NS1} ping  -c 1 -W 1 -I veth1 ${IPv4_DST} 2>&1 > /dev/null
+ 		RET=$?
+ 	elif [ "${PROTO}" == "IPv6" ] ; then
+-		ip netns exec ${NS1} ping6 -c 1 -W 6 -I veth1 ${IPv6_DST} 2>&1 > /dev/null
++		ip netns exec ${NS1} ping6 -c 1 -W 1 -I veth1 ${IPv6_DST} 2>&1 > /dev/null
+ 		RET=$?
+ 	else
+ 		echo "    test_ping: unknown PROTO: ${PROTO}"
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch b/queue-5.16/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
new file mode 100644
index 00000000000..9d71d8ce94c
--- /dev/null
+++ b/queue-5.16/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
@@ -0,0 +1,55 @@
+From ee25e74d79bb9f6ee6f49753c37a57129ea0d30b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 10:41:49 +0800
+Subject: selftests/bpf/test_lirc_mode2.sh: Exit with proper code
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit ec80906b0fbd7be11e3e960813b977b1ffe5f8fe ]
+
+When test_lirc_mode2_user exec failed, the test report failed but still
+exit with 0. Fix it by exiting with an error code.
+
+Another issue is for the LIRCDEV checking. With bash -n, we need to quote
+the variable, or it will always be true. So if test_lirc_mode2_user was
+not run, just exit with skip code.
+
+Fixes: 6bdd533cee9a ("bpf: add selftest for lirc_mode2 type program")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220321024149.157861-1-liuhangbin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+index ec4e15948e40..5252b91f48a1 100755
+--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh
++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+@@ -3,6 +3,7 @@
+ 
+ # Kselftest framework requirement - SKIP code is 4.
+ ksft_skip=4
++ret=$ksft_skip
+ 
+ msg="skip all tests:"
+ if [ $UID != 0 ]; then
+@@ -25,7 +26,7 @@ do
+ 	fi
+ done
+ 
+-if [ -n $LIRCDEV ];
++if [ -n "$LIRCDEV" ];
+ then
+ 	TYPE=lirc_mode2
+ 	./test_lirc_mode2_user $LIRCDEV $INPUTDEV
+@@ -36,3 +37,5 @@ then
+ 		echo -e ${GREEN}"PASS: $TYPE"${NC}
+ 	fi
+ fi
++
++exit $ret
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-test_xdp_redirect_multi-use-temp-netns.patch b/queue-5.16/selftests-bpf-test_xdp_redirect_multi-use-temp-netns.patch
new file mode 100644
index 00000000000..c43452e7821
--- /dev/null
+++ b/queue-5.16/selftests-bpf-test_xdp_redirect_multi-use-temp-netns.patch
@@ -0,0 +1,159 @@
+From eb364df8fae24890ada15d3f7c1699900b41ef01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 16:17:11 +0800
+Subject: selftests/bpf/test_xdp_redirect_multi: use temp netns for testing
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit cec74489a8dee93053340ec88ea938ff4008c3c0 ]
+
+Use temp netns instead of hard code name for testing in case the netns
+already exists.
+
+Remove the hard code interface index when creating the veth interfaces.
+Because when the system loads some virtual interface modules, e.g. tunnels.
+the ifindex of 2 will be used and the cmd will fail.
+
+As the netns has not created if checking environment failed. Trap the
+clean up function after checking env.
+
+Fixes: 8955c1a32987 ("selftests/bpf/xdp_redirect_multi: Limit the tests in netns")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: William Tu <u9012063@gmail.com>
+Link: https://lore.kernel.org/r/20220125081717.1260849-2-liuhangbin@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/test_xdp_redirect_multi.sh  | 60 ++++++++++---------
+ 1 file changed, 31 insertions(+), 29 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_xdp_redirect_multi.sh b/tools/testing/selftests/bpf/test_xdp_redirect_multi.sh
+index 05f872740999..cc57cb87e65f 100755
+--- a/tools/testing/selftests/bpf/test_xdp_redirect_multi.sh
++++ b/tools/testing/selftests/bpf/test_xdp_redirect_multi.sh
+@@ -32,6 +32,11 @@ DRV_MODE="xdpgeneric xdpdrv xdpegress"
+ PASS=0
+ FAIL=0
+ LOG_DIR=$(mktemp -d)
++declare -a NS
++NS[0]="ns0-$(mktemp -u XXXXXX)"
++NS[1]="ns1-$(mktemp -u XXXXXX)"
++NS[2]="ns2-$(mktemp -u XXXXXX)"
++NS[3]="ns3-$(mktemp -u XXXXXX)"
+ 
+ test_pass()
+ {
+@@ -47,11 +52,9 @@ test_fail()
+ 
+ clean_up()
+ {
+-	for i in $(seq $NUM); do
+-		ip link del veth$i 2> /dev/null
+-		ip netns del ns$i 2> /dev/null
++	for i in $(seq 0 $NUM); do
++		ip netns del ${NS[$i]} 2> /dev/null
+ 	done
+-	ip netns del ns0 2> /dev/null
+ }
+ 
+ # Kselftest framework requirement - SKIP code is 4.
+@@ -79,23 +82,22 @@ setup_ns()
+ 		mode="xdpdrv"
+ 	fi
+ 
+-	ip netns add ns0
++	ip netns add ${NS[0]}
+ 	for i in $(seq $NUM); do
+-	        ip netns add ns$i
+-		ip -n ns$i link add veth0 index 2 type veth \
+-			peer name veth$i netns ns0 index $((1 + $i))
+-		ip -n ns0 link set veth$i up
+-		ip -n ns$i link set veth0 up
+-
+-		ip -n ns$i addr add 192.0.2.$i/24 dev veth0
+-		ip -n ns$i addr add 2001:db8::$i/64 dev veth0
++	        ip netns add ${NS[$i]}
++		ip -n ${NS[$i]} link add veth0 type veth peer name veth$i netns ${NS[0]}
++		ip -n ${NS[$i]} link set veth0 up
++		ip -n ${NS[0]} link set veth$i up
++
++		ip -n ${NS[$i]} addr add 192.0.2.$i/24 dev veth0
++		ip -n ${NS[$i]} addr add 2001:db8::$i/64 dev veth0
+ 		# Add a neigh entry for IPv4 ping test
+-		ip -n ns$i neigh add 192.0.2.253 lladdr 00:00:00:00:00:01 dev veth0
+-		ip -n ns$i link set veth0 $mode obj \
++		ip -n ${NS[$i]} neigh add 192.0.2.253 lladdr 00:00:00:00:00:01 dev veth0
++		ip -n ${NS[$i]} link set veth0 $mode obj \
+ 			xdp_dummy.o sec xdp &> /dev/null || \
+ 			{ test_fail "Unable to load dummy xdp" && exit 1; }
+ 		IFACES="$IFACES veth$i"
+-		veth_mac[$i]=$(ip -n ns0 link show veth$i | awk '/link\/ether/ {print $2}')
++		veth_mac[$i]=$(ip -n ${NS[0]} link show veth$i | awk '/link\/ether/ {print $2}')
+ 	done
+ }
+ 
+@@ -104,10 +106,10 @@ do_egress_tests()
+ 	local mode=$1
+ 
+ 	# mac test
+-	ip netns exec ns2 tcpdump -e -i veth0 -nn -l -e &> ${LOG_DIR}/mac_ns1-2_${mode}.log &
+-	ip netns exec ns3 tcpdump -e -i veth0 -nn -l -e &> ${LOG_DIR}/mac_ns1-3_${mode}.log &
++	ip netns exec ${NS[2]} tcpdump -e -i veth0 -nn -l -e &> ${LOG_DIR}/mac_ns1-2_${mode}.log &
++	ip netns exec ${NS[3]} tcpdump -e -i veth0 -nn -l -e &> ${LOG_DIR}/mac_ns1-3_${mode}.log &
+ 	sleep 0.5
+-	ip netns exec ns1 ping 192.0.2.254 -i 0.1 -c 4 &> /dev/null
++	ip netns exec ${NS[1]} ping 192.0.2.254 -i 0.1 -c 4 &> /dev/null
+ 	sleep 0.5
+ 	pkill tcpdump
+ 
+@@ -123,18 +125,18 @@ do_ping_tests()
+ 	local mode=$1
+ 
+ 	# ping6 test: echo request should be redirect back to itself, not others
+-	ip netns exec ns1 ip neigh add 2001:db8::2 dev veth0 lladdr 00:00:00:00:00:02
++	ip netns exec ${NS[1]} ip neigh add 2001:db8::2 dev veth0 lladdr 00:00:00:00:00:02
+ 
+-	ip netns exec ns1 tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-1_${mode}.log &
+-	ip netns exec ns2 tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-2_${mode}.log &
+-	ip netns exec ns3 tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-3_${mode}.log &
++	ip netns exec ${NS[1]} tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-1_${mode}.log &
++	ip netns exec ${NS[2]} tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-2_${mode}.log &
++	ip netns exec ${NS[3]} tcpdump -i veth0 -nn -l -e &> ${LOG_DIR}/ns1-3_${mode}.log &
+ 	sleep 0.5
+ 	# ARP test
+-	ip netns exec ns1 arping -q -c 2 -I veth0 192.0.2.254
++	ip netns exec ${NS[1]} arping -q -c 2 -I veth0 192.0.2.254
+ 	# IPv4 test
+-	ip netns exec ns1 ping 192.0.2.253 -i 0.1 -c 4 &> /dev/null
++	ip netns exec ${NS[1]} ping 192.0.2.253 -i 0.1 -c 4 &> /dev/null
+ 	# IPv6 test
+-	ip netns exec ns1 ping6 2001:db8::2 -i 0.1 -c 2 &> /dev/null
++	ip netns exec ${NS[1]} ping6 2001:db8::2 -i 0.1 -c 2 &> /dev/null
+ 	sleep 0.5
+ 	pkill tcpdump
+ 
+@@ -180,7 +182,7 @@ do_tests()
+ 		xdpgeneric) drv_p="-S";;
+ 	esac
+ 
+-	ip netns exec ns0 ./xdp_redirect_multi $drv_p $IFACES &> ${LOG_DIR}/xdp_redirect_${mode}.log &
++	ip netns exec ${NS[0]} ./xdp_redirect_multi $drv_p $IFACES &> ${LOG_DIR}/xdp_redirect_${mode}.log &
+ 	xdp_pid=$!
+ 	sleep 1
+ 	if ! ps -p $xdp_pid > /dev/null; then
+@@ -197,10 +199,10 @@ do_tests()
+ 	kill $xdp_pid
+ }
+ 
+-trap clean_up EXIT
+-
+ check_env
+ 
++trap clean_up EXIT
++
+ for mode in ${DRV_MODE}; do
+ 	setup_ns $mode
+ 	do_tests $mode
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-bpf-use-__se_-prefix-on-architectures-with.patch b/queue-5.16/selftests-bpf-use-__se_-prefix-on-architectures-with.patch
new file mode 100644
index 00000000000..cd38521c3a1
--- /dev/null
+++ b/queue-5.16/selftests-bpf-use-__se_-prefix-on-architectures-with.patch
@@ -0,0 +1,41 @@
+From 7e2b661f084bdd38575960046d3f8692cad97850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Feb 2022 17:05:19 +0530
+Subject: selftests/bpf: Use "__se_" prefix on architectures without syscall
+ wrapper
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 046b841ea7c528931e7d2e74d5e668aa6c94c1fc ]
+
+On architectures that don't use a syscall wrapper, sys_* function names
+are set as an alias of __se_sys_* functions. Due to this, there is no
+BTF associated with sys_* function names. This results in some of the
+test progs failing to load. Set the SYS_PREFIX to "__se_" to fix this
+issue.
+
+Fixes: 38261f369fb905 ("selftests/bpf: Fix probe_user test failure with clang build kernel")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/013d632aacd3e41290445c0025db6a7055ec6e18.1643973917.git.naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/bpf_misc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h
+index 0b78bc9b1b4c..5bb11fe595a4 100644
+--- a/tools/testing/selftests/bpf/progs/bpf_misc.h
++++ b/tools/testing/selftests/bpf/progs/bpf_misc.h
+@@ -13,7 +13,7 @@
+ #define SYS_PREFIX "__arm64_"
+ #else
+ #define SYSCALL_WRAPPER 0
+-#define SYS_PREFIX ""
++#define SYS_PREFIX "__se_"
+ #endif
+ 
+ #endif
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-lkdtm-add-ubsan-config.patch b/queue-5.16/selftests-lkdtm-add-ubsan-config.patch
new file mode 100644
index 00000000000..28c99ed85bf
--- /dev/null
+++ b/queue-5.16/selftests-lkdtm-add-ubsan-config.patch
@@ -0,0 +1,48 @@
+From 392b4f6f7ec9db35f25cb2c2ded4fadef69ef32a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jan 2022 19:51:53 +0500
+Subject: selftests/lkdtm: Add UBSAN config
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit 1900be289b598b2c553b3add13e491c0bb8a8550 ]
+
+UBSAN_BOUNDS and UBSAN_TRAP depend on UBSAN config option.
+merge_config.sh script generates following warnings if parent config
+doesn't have UBSAN config already enabled and UBSAN_BOUNDS/UBSAN_TRAP
+config options don't get added to the parent config.
+
+Value requested for CONFIG_UBSAN_BOUNDS not in final .config
+Requested value:  CONFIG_UBSAN_BOUNDS=y
+Actual value:
+
+Value requested for CONFIG_UBSAN_TRAP not in final .config
+Requested value:  CONFIG_UBSAN_TRAP=y
+Actual value:
+
+Fix this by including UBSAN config.
+
+Fixes: c75be56e35b2 ("lkdtm/bugs: Add ARRAY_BOUNDS to selftests")
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lkdtm/config | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/lkdtm/config b/tools/testing/selftests/lkdtm/config
+index a26a3fa9e925..8bd847f0463c 100644
+--- a/tools/testing/selftests/lkdtm/config
++++ b/tools/testing/selftests/lkdtm/config
+@@ -6,6 +6,7 @@ CONFIG_HARDENED_USERCOPY=y
+ # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
+ CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
+ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
++CONFIG_UBSAN=y
+ CONFIG_UBSAN_BOUNDS=y
+ CONFIG_UBSAN_TRAP=y
+ CONFIG_STACKPROTECTOR_STRONG=y
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-mptcp-add-csum-mib-check-for-mptcp_connect.patch b/queue-5.16/selftests-mptcp-add-csum-mib-check-for-mptcp_connect.patch
new file mode 100644
index 00000000000..0ae89dddec4
--- /dev/null
+++ b/queue-5.16/selftests-mptcp-add-csum-mib-check-for-mptcp_connect.patch
@@ -0,0 +1,72 @@
+From c34315690d84213d88eac340dd9675ba09be9ce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 19:03:11 -0800
+Subject: selftests: mptcp: add csum mib check for mptcp_connect
+
+From: Geliang Tang <geliang.tang@suse.com>
+
+[ Upstream commit 24720d7452df2dff2e539d9dff28904e25bb1c6d ]
+
+This patch added the data checksum error mib counters check for the
+script mptcp_connect.sh when the data checksum is enabled.
+
+In do_transfer(), got the mib counters twice, before and after running
+the mptcp_connect commands. The latter minus the former is the actual
+number of the data checksum mib counter.
+
+The output looks like this:
+
+ns1 MPTCP -> ns2 (dead:beef:1::2:10007) MPTCP   (duration    86ms) [ OK ]
+ns1 MPTCP -> ns2 (10.0.2.1:10008      ) MPTCP   (duration    66ms) [ FAIL ]
+server got 1 data checksum error[s]
+
+Fixes: 94d66ba1d8e48 ("selftests: mptcp: enable checksum in mptcp_connect.sh")
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/255
+Signed-off-by: Geliang Tang <geliang.tang@suse.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/mptcp/mptcp_connect.sh      | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+index 559173a8e387..d75fa97609c1 100755
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+@@ -445,6 +445,8 @@ do_transfer()
+ 	local stat_ackrx_last_l=$(get_mib_counter "${listener_ns}" "MPTcpExtMPCapableACKRX")
+ 	local stat_cookietx_last=$(get_mib_counter "${listener_ns}" "TcpExtSyncookiesSent")
+ 	local stat_cookierx_last=$(get_mib_counter "${listener_ns}" "TcpExtSyncookiesRecv")
++	local stat_csum_err_s=$(get_mib_counter "${listener_ns}" "MPTcpExtDataCsumErr")
++	local stat_csum_err_c=$(get_mib_counter "${connector_ns}" "MPTcpExtDataCsumErr")
+ 
+ 	timeout ${timeout_test} \
+ 		ip netns exec ${listener_ns} \
+@@ -537,6 +539,23 @@ do_transfer()
+ 		fi
+ 	fi
+ 
++	if $checksum; then
++		local csum_err_s=$(get_mib_counter "${listener_ns}" "MPTcpExtDataCsumErr")
++		local csum_err_c=$(get_mib_counter "${connector_ns}" "MPTcpExtDataCsumErr")
++
++		local csum_err_s_nr=$((csum_err_s - stat_csum_err_s))
++		if [ $csum_err_s_nr -gt 0 ]; then
++			printf "[ FAIL ]\nserver got $csum_err_s_nr data checksum error[s]"
++			rets=1
++		fi
++
++		local csum_err_c_nr=$((csum_err_c - stat_csum_err_c))
++		if [ $csum_err_c_nr -gt 0 ]; then
++			printf "[ FAIL ]\nclient got $csum_err_c_nr data checksum error[s]"
++			retc=1
++		fi
++	fi
++
+ 	if [ $retc -eq 0 ] && [ $rets -eq 0 ]; then
+ 		printf "[ OK ]"
+ 	fi
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-net-timestamping-fix-bind_phc-check.patch b/queue-5.16/selftests-net-timestamping-fix-bind_phc-check.patch
new file mode 100644
index 00000000000..3006d926861
--- /dev/null
+++ b/queue-5.16/selftests-net-timestamping-fix-bind_phc-check.patch
@@ -0,0 +1,49 @@
+From eac29bb367dfa9291a6a7b165c96983a3d4d53f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jan 2022 10:54:22 +0100
+Subject: selftests/net: timestamping: Fix bind_phc check
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit 678dfd5280341d877ca646499bfdc82a3d8b4356 ]
+
+timestamping checks socket options during initialisation. For the field
+bind_phc of the socket option SO_TIMESTAMPING it expects the value -1 if
+PHC is not bound. Actually the value of bind_phc is 0 if PHC is not
+bound. This results in the following output:
+
+SIOCSHWTSTAMP: tx_type 0 requested, got 0; rx_filter 0 requested, got 0
+SO_TIMESTAMP 0
+SO_TIMESTAMPNS 0
+SO_TIMESTAMPING flags 0, bind phc 0
+   not expected, flags 0, bind phc -1
+
+This is fixed by setting default value and expected value of bind_phc to
+0.
+
+Fixes: 2214d7032479 ("selftests/net: timestamping: support binding PHC")
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/timestamping.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/timestamping.c b/tools/testing/selftests/net/timestamping.c
+index aee631c5284e..044bc0e9ed81 100644
+--- a/tools/testing/selftests/net/timestamping.c
++++ b/tools/testing/selftests/net/timestamping.c
+@@ -325,8 +325,8 @@ int main(int argc, char **argv)
+ 	struct ifreq device;
+ 	struct ifreq hwtstamp;
+ 	struct hwtstamp_config hwconfig, hwconfig_requested;
+-	struct so_timestamping so_timestamping_get = { 0, -1 };
+-	struct so_timestamping so_timestamping = { 0, -1 };
++	struct so_timestamping so_timestamping_get = { 0, 0 };
++	struct so_timestamping so_timestamping = { 0, 0 };
+ 	struct sockaddr_in addr;
+ 	struct ip_mreq imr;
+ 	struct in_addr iaddr;
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-sgx-treat-cc-as-one-argument.patch b/queue-5.16/selftests-sgx-treat-cc-as-one-argument.patch
new file mode 100644
index 00000000000..320d7218a66
--- /dev/null
+++ b/queue-5.16/selftests-sgx-treat-cc-as-one-argument.patch
@@ -0,0 +1,39 @@
+From 740b19e744e4c7aa3cd578a37e2ee2abb25b38b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 23:41:09 +0500
+Subject: selftests/sgx: Treat CC as one argument
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit 6170abb21e2380477080b25145da9747ad467d3d ]
+
+CC can have multiple sub-strings like "ccache gcc". For check_cc.sh,
+CC needs to be treated like one argument. Put double quotes around it to
+make CC one string and hence one argument.
+
+Fixes: 2adcba79e69d ("selftests/x86: Add a selftest for SGX")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20220214184109.3739179-3-usama.anjum@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/sgx/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/sgx/Makefile b/tools/testing/selftests/sgx/Makefile
+index 7f12d55b97f8..472b27ccd7dc 100644
+--- a/tools/testing/selftests/sgx/Makefile
++++ b/tools/testing/selftests/sgx/Makefile
+@@ -4,7 +4,7 @@ include ../lib.mk
+ 
+ .PHONY: all clean
+ 
+-CAN_BUILD_X86_64 := $(shell ../x86/check_cc.sh $(CC) \
++CAN_BUILD_X86_64 := $(shell ../x86/check_cc.sh "$(CC)" \
+ 			    ../x86/trivial_64bit_program.c)
+ 
+ ifndef OBJCOPY
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch b/queue-5.16/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
new file mode 100644
index 00000000000..b43081c914c
--- /dev/null
+++ b/queue-5.16/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
@@ -0,0 +1,69 @@
+From 698510226caf1e39d8643c1f7d4f462770279e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 22:05:14 +0200
+Subject: selftests: test_vxlan_under_vrf: Fix broken test case
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit b50d3b46f84282d795ae3076111acb75ae1031f3 ]
+
+The purpose of the last test case is to test VXLAN encapsulation and
+decapsulation when the underlay lookup takes place in a non-default VRF.
+This is achieved by enslaving the physical device of the tunnel to a
+VRF.
+
+The binding of the VXLAN UDP socket to the VRF happens when the VXLAN
+device itself is opened, not when its physical device is opened. This
+was also mentioned in the cited commit ("tests that moving the underlay
+from a VRF to another works when down/up the VXLAN interface"), but the
+test did something else.
+
+Fix it by reopening the VXLAN device instead of its physical device.
+
+Before:
+
+ # ./test_vxlan_under_vrf.sh
+ Checking HV connectivity                                           [ OK ]
+ Check VM connectivity through VXLAN (underlay in the default VRF)  [ OK ]
+ Check VM connectivity through VXLAN (underlay in a VRF)            [FAIL]
+
+After:
+
+ # ./test_vxlan_under_vrf.sh
+ Checking HV connectivity                                           [ OK ]
+ Check VM connectivity through VXLAN (underlay in the default VRF)  [ OK ]
+ Check VM connectivity through VXLAN (underlay in a VRF)            [ OK ]
+
+Fixes: 03f1c26b1c56 ("test/net: Add script for VXLAN underlay in a VRF")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20220324200514.1638326-1-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/test_vxlan_under_vrf.sh | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/net/test_vxlan_under_vrf.sh b/tools/testing/selftests/net/test_vxlan_under_vrf.sh
+index ea5a7a808f12..1fd1250ebc66 100755
+--- a/tools/testing/selftests/net/test_vxlan_under_vrf.sh
++++ b/tools/testing/selftests/net/test_vxlan_under_vrf.sh
+@@ -120,11 +120,11 @@ echo "[ OK ]"
+ 
+ # Move the underlay to a non-default VRF
+ ip -netns hv-1 link set veth0 vrf vrf-underlay
+-ip -netns hv-1 link set veth0 down
+-ip -netns hv-1 link set veth0 up
++ip -netns hv-1 link set vxlan0 down
++ip -netns hv-1 link set vxlan0 up
+ ip -netns hv-2 link set veth0 vrf vrf-underlay
+-ip -netns hv-2 link set veth0 down
+-ip -netns hv-2 link set veth0 up
++ip -netns hv-2 link set vxlan0 down
++ip -netns hv-2 link set vxlan0 up
+ 
+ echo -n "Check VM connectivity through VXLAN (underlay in a VRF)            "
+ ip netns exec vm-1 ping -c 1 -W 1 10.0.0.2 &> /dev/null || (echo "[FAIL]"; false)
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-tls-skip-cmsg_to_pipe-tests-with-tls-n.patch b/queue-5.16/selftests-tls-skip-cmsg_to_pipe-tests-with-tls-n.patch
new file mode 100644
index 00000000000..d0458d63078
--- /dev/null
+++ b/queue-5.16/selftests-tls-skip-cmsg_to_pipe-tests-with-tls-n.patch
@@ -0,0 +1,50 @@
+From 2adc9e5ff8be9206857e6e196212da3091084f60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 16:27:09 -0700
+Subject: selftests: tls: skip cmsg_to_pipe tests with TLS=n
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 5c7e49be96ea24776a5b5a07c732c477294add00 ]
+
+These are negative tests, testing TLS code rejects certain
+operations. They won't pass without TLS enabled, pure TCP
+accepts those operations.
+
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Fixes: d87d67fd61ef ("selftests: tls: test splicing cmsgs")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/tls.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
+index 6e468e0f42f7..5d70b04c482c 100644
+--- a/tools/testing/selftests/net/tls.c
++++ b/tools/testing/selftests/net/tls.c
+@@ -683,6 +683,9 @@ TEST_F(tls, splice_cmsg_to_pipe)
+ 	char buf[10];
+ 	int p[2];
+ 
++	if (self->notls)
++		SKIP(return, "no TLS support");
++
+ 	ASSERT_GE(pipe(p), 0);
+ 	EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
+ 	EXPECT_EQ(splice(self->cfd, NULL, p[1], NULL, send_len, 0), -1);
+@@ -703,6 +706,9 @@ TEST_F(tls, splice_dec_cmsg_to_pipe)
+ 	char buf[10];
+ 	int p[2];
+ 
++	if (self->notls)
++		SKIP(return, "no TLS support");
++
+ 	ASSERT_GE(pipe(p), 0);
+ 	EXPECT_EQ(tls_send_cmsg(self->fd, 100, test_str, send_len, 0), 10);
+ 	EXPECT_EQ(recv(self->cfd, buf, send_len, 0), -1);
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-x86-add-validity-check-and-allow-field-spl.patch b/queue-5.16/selftests-x86-add-validity-check-and-allow-field-spl.patch
new file mode 100644
index 00000000000..9111bf8fa72
--- /dev/null
+++ b/queue-5.16/selftests-x86-add-validity-check-and-allow-field-spl.patch
@@ -0,0 +1,40 @@
+From 0efcb7d4670b3d417d8b2460e66a58f643e9be21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 23:41:08 +0500
+Subject: selftests/x86: Add validity check and allow field splitting
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit b06e15ebd5bfb670f93c7f11a29b8299c1178bc6 ]
+
+Add check to test if CC has a string. CC can have multiple sub-strings
+like "ccache gcc". Erorr pops up if it is treated as single string and
+double quotes are used around it. This can be fixed by removing the
+quotes and not treating CC as a single string.
+
+Fixes: e9886ace222e ("selftests, x86: Rework x86 target architecture detection")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20220214184109.3739179-2-usama.anjum@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/x86/check_cc.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh
+index 3e2089c8cf54..8c669c0d662e 100755
+--- a/tools/testing/selftests/x86/check_cc.sh
++++ b/tools/testing/selftests/x86/check_cc.sh
+@@ -7,7 +7,7 @@ CC="$1"
+ TESTPROG="$2"
+ shift 2
+ 
+-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
+     echo 1
+ else
+     echo 0
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-x86-fix-how-check_cc.sh-is-being-invoked.patch b/queue-5.16/selftests-x86-fix-how-check_cc.sh-is-being-invoked.patch
new file mode 100644
index 00000000000..4cae26e4221
--- /dev/null
+++ b/queue-5.16/selftests-x86-fix-how-check_cc.sh-is-being-invoked.patch
@@ -0,0 +1,73 @@
+From fe7699c67f2827f77612e8ec36c92308e05995bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:41:44 -0700
+Subject: selftests, x86: fix how check_cc.sh is being invoked
+
+From: Guillaume Tucker <guillaume.tucker@collabora.com>
+
+[ Upstream commit ef696f93ed9778d570bd5ac58414421cdd4f1aab ]
+
+The $(CC) variable used in Makefiles could contain several arguments
+such as "ccache gcc".  These need to be passed as a single string to
+check_cc.sh, otherwise only the first argument will be used as the
+compiler command.  Without quotes, the $(CC) variable is passed as
+distinct arguments which causes the script to fail to build trivial
+programs.
+
+Fix this by adding quotes around $(CC) when calling check_cc.sh to pass
+the whole string as a single argument to the script even if it has
+several words such as "ccache gcc".
+
+Link: https://lkml.kernel.org/r/d0d460d7be0107a69e3c52477761a6fe694c1840.1646991629.git.guillaume.tucker@collabora.com
+Fixes: e9886ace222e ("selftests, x86: Rework x86 target architecture detection")
+Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
+Tested-by: "kernelci.org bot" <bot@kernelci.org>
+Reviewed-by: Guenter Roeck <groeck@google.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/Makefile  | 6 +++---
+ tools/testing/selftests/x86/Makefile | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
+index a14b5b800897..1530c3e0242e 100644
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -51,9 +51,9 @@ TEST_GEN_FILES += split_huge_page_test
+ TEST_GEN_FILES += ksm_tests
+ 
+ ifeq ($(MACHINE),x86_64)
+-CAN_BUILD_I386 := $(shell ./../x86/check_cc.sh $(CC) ../x86/trivial_32bit_program.c -m32)
+-CAN_BUILD_X86_64 := $(shell ./../x86/check_cc.sh $(CC) ../x86/trivial_64bit_program.c)
+-CAN_BUILD_WITH_NOPIE := $(shell ./../x86/check_cc.sh $(CC) ../x86/trivial_program.c -no-pie)
++CAN_BUILD_I386 := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_32bit_program.c -m32)
++CAN_BUILD_X86_64 := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_64bit_program.c)
++CAN_BUILD_WITH_NOPIE := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_program.c -no-pie)
+ 
+ TARGETS := protection_keys
+ BINARIES_32 := $(TARGETS:%=%_32)
+diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
+index 8a1f62ab3c8e..53df7d3893d3 100644
+--- a/tools/testing/selftests/x86/Makefile
++++ b/tools/testing/selftests/x86/Makefile
+@@ -6,9 +6,9 @@ include ../lib.mk
+ .PHONY: all all_32 all_64 warn_32bit_failure clean
+ 
+ UNAME_M := $(shell uname -m)
+-CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
+-CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
+-CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie)
++CAN_BUILD_I386 := $(shell ./check_cc.sh "$(CC)" trivial_32bit_program.c -m32)
++CAN_BUILD_X86_64 := $(shell ./check_cc.sh "$(CC)" trivial_64bit_program.c)
++CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh "$(CC)" trivial_program.c -no-pie)
+ 
+ TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
+ 			check_initial_reg_state sigreturn iopl ioperm \
+-- 
+2.34.1
+
diff --git a/queue-5.16/selftests-xsk-fix-rx_full-stats-test.patch b/queue-5.16/selftests-xsk-fix-rx_full-stats-test.patch
new file mode 100644
index 00000000000..6203505bc6f
--- /dev/null
+++ b/queue-5.16/selftests-xsk-fix-rx_full-stats-test.patch
@@ -0,0 +1,42 @@
+From 197019045b26f85430f7ffeaa1e5ca7daf07cf30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jan 2022 13:35:08 +0100
+Subject: selftests, xsk: Fix rx_full stats test
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit b4ec6a19231224f6b08dc54ea07da4c4090e8ee3 ]
+
+Fix the rx_full stats test so that it correctly reports pass even when
+the fill ring is not full of buffers.
+
+Fixes: 872a1184dbf2 ("selftests: xsk: Put the same buffer only once in the fill ring")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Link: https://lore.kernel.org/bpf/20220121123508.12759-1-magnus.karlsson@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xdpxceiver.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/xdpxceiver.c b/tools/testing/selftests/bpf/xdpxceiver.c
+index 621342ec30c4..37d4873d9a2e 100644
+--- a/tools/testing/selftests/bpf/xdpxceiver.c
++++ b/tools/testing/selftests/bpf/xdpxceiver.c
+@@ -902,7 +902,10 @@ static bool rx_stats_are_valid(struct ifobject *ifobject)
+ 			return true;
+ 		case STAT_TEST_RX_FULL:
+ 			xsk_stat = stats.rx_ring_full;
+-			expected_stat -= RX_FULL_RXQSIZE;
++			if (ifobject->umem->num_frames < XSK_RING_PROD__DEFAULT_NUM_DESCS)
++				expected_stat = ifobject->umem->num_frames - RX_FULL_RXQSIZE;
++			else
++				expected_stat = XSK_RING_PROD__DEFAULT_NUM_DESCS - RX_FULL_RXQSIZE;
+ 			break;
+ 		case STAT_TEST_RX_FILL_EMPTY:
+ 			xsk_stat = stats.rx_fill_ring_empty_descs;
+-- 
+2.34.1
+
diff --git a/queue-5.16/selinux-access-superblock_security_struct-in-lsm-blo.patch b/queue-5.16/selinux-access-superblock_security_struct-in-lsm-blo.patch
new file mode 100644
index 00000000000..4c9e6e2d1ec
--- /dev/null
+++ b/queue-5.16/selinux-access-superblock_security_struct-in-lsm-blo.patch
@@ -0,0 +1,48 @@
+From 2e2c86c1a4dcf5c8033a237b59665ce5597c1bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 15:11:33 +0800
+Subject: selinux: access superblock_security_struct in LSM blob way
+
+From: GONG, Ruiqi <gongruiqi1@huawei.com>
+
+[ Upstream commit 0266c25e7c2821181b610595df42cbca6bc93cb8 ]
+
+LSM blob has been involved for superblock's security struct. So fix the
+remaining direct access to sb->s_security by using the LSM blob
+mechanism.
+
+Fixes: 08abe46b2cfc ("selinux: fall back to SECURITY_FS_USE_GENFS if no xattr support")
+Fixes: 69c4a42d72eb ("lsm,selinux: add new hook to compare new mount to an existing mount")
+Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>
+Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 49b4f59db35e..5b4b738a3be4 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -492,7 +492,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
+ 
+ static int sb_check_xattr_support(struct super_block *sb)
+ {
+-	struct superblock_security_struct *sbsec = sb->s_security;
++	struct superblock_security_struct *sbsec = selinux_superblock(sb);
+ 	struct dentry *root = sb->s_root;
+ 	struct inode *root_inode = d_backing_inode(root);
+ 	u32 sid;
+@@ -2696,7 +2696,7 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
+ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
+ {
+ 	struct selinux_mnt_opts *opts = mnt_opts;
+-	struct superblock_security_struct *sbsec = sb->s_security;
++	struct superblock_security_struct *sbsec = selinux_superblock(sb);
+ 	u32 sid;
+ 	int rc;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/selinux-allow-fioclex-and-fionclex-with-policy-capab.patch b/queue-5.16/selinux-allow-fioclex-and-fionclex-with-policy-capab.patch
new file mode 100644
index 00000000000..bb808e0ab73
--- /dev/null
+++ b/queue-5.16/selinux-allow-fioclex-and-fionclex-with-policy-capab.patch
@@ -0,0 +1,92 @@
+From 71460958d071a21c24f9061141d2a3893956ef33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 17:54:38 +0000
+Subject: selinux: allow FIOCLEX and FIONCLEX with policy capability
+
+From: Richard Haines <richard_c_haines@btinternet.com>
+
+[ Upstream commit 65881e1db4e948614d9eb195b8e1197339822949 ]
+
+These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux
+always allows too.  Furthermore, a failed FIOCLEX could result in a file
+descriptor being leaked to a process that should not have access to it.
+
+As this patch removes access controls, a policy capability needs to be
+enabled in policy to always allow these ioctls.
+
+Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com>
+Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
+[PM: subject line tweak]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c                   | 6 ++++++
+ security/selinux/include/policycap.h       | 1 +
+ security/selinux/include/policycap_names.h | 3 ++-
+ security/selinux/include/security.h        | 7 +++++++
+ 4 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 69b0709bd156..94ef617de9d0 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3800,6 +3800,12 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
+ 					    CAP_OPT_NONE, true);
+ 		break;
+ 
++	case FIOCLEX:
++	case FIONCLEX:
++		if (!selinux_policycap_ioctl_skip_cloexec())
++			error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
++		break;
++
+ 	/* default case assumes that the command will go
+ 	 * to the file's ioctl() function.
+ 	 */
+diff --git a/security/selinux/include/policycap.h b/security/selinux/include/policycap.h
+index 2ec038efbb03..a9e572ca4fd9 100644
+--- a/security/selinux/include/policycap.h
++++ b/security/selinux/include/policycap.h
+@@ -11,6 +11,7 @@ enum {
+ 	POLICYDB_CAPABILITY_CGROUPSECLABEL,
+ 	POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
+ 	POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
++	POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC,
+ 	__POLICYDB_CAPABILITY_MAX
+ };
+ #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
+diff --git a/security/selinux/include/policycap_names.h b/security/selinux/include/policycap_names.h
+index b89289f092c9..ebd64afe1def 100644
+--- a/security/selinux/include/policycap_names.h
++++ b/security/selinux/include/policycap_names.h
+@@ -12,7 +12,8 @@ const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
+ 	"always_check_network",
+ 	"cgroup_seclabel",
+ 	"nnp_nosuid_transition",
+-	"genfs_seclabel_symlinks"
++	"genfs_seclabel_symlinks",
++	"ioctl_skip_cloexec"
+ };
+ 
+ #endif /* _SELINUX_POLICYCAP_NAMES_H_ */
+diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
+index ac0ece01305a..c0d966020ebd 100644
+--- a/security/selinux/include/security.h
++++ b/security/selinux/include/security.h
+@@ -219,6 +219,13 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void)
+ 	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]);
+ }
+ 
++static inline bool selinux_policycap_ioctl_skip_cloexec(void)
++{
++	struct selinux_state *state = &selinux_state;
++
++	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC]);
++}
++
+ struct selinux_policy_convert_data;
+ 
+ struct selinux_load_state {
+-- 
+2.34.1
+
diff --git a/queue-5.16/selinux-check-return-value-of-sel_make_avc_files.patch b/queue-5.16/selinux-check-return-value-of-sel_make_avc_files.patch
new file mode 100644
index 00000000000..ed3dccc7f06
--- /dev/null
+++ b/queue-5.16/selinux-check-return-value-of-sel_make_avc_files.patch
@@ -0,0 +1,49 @@
+From 425c2c8232da80dda086a7eee84ffd21413a483d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 15:14:20 +0100
+Subject: selinux: check return value of sel_make_avc_files
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Göttsche <cgzones@googlemail.com>
+
+[ Upstream commit bcb62828e3e8c813b6613db6eb7fd9657db248fc ]
+
+sel_make_avc_files() might fail and return a negative errno value on
+memory allocation failures. Re-add the check of the return value,
+dropped in 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table").
+
+Reported by clang-analyzer:
+
+    security/selinux/selinuxfs.c:2129:2: warning: Value stored to
+      'ret' is never read [deadcode.DeadStores]
+            ret = sel_make_avc_files(dentry);
+            ^     ~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table")
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+[PM: description line wrapping, added proper commit ref]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/selinuxfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index e4cd7cb856f3..f2f6203e0fff 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -2127,6 +2127,8 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
+ 	}
+ 
+ 	ret = sel_make_avc_files(dentry);
++	if (ret)
++		goto err;
+ 
+ 	dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino);
+ 	if (IS_ERR(dentry)) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/selinux-fix-selinux_sb_mnt_opts_compat.patch b/queue-5.16/selinux-fix-selinux_sb_mnt_opts_compat.patch
new file mode 100644
index 00000000000..38c1138858c
--- /dev/null
+++ b/queue-5.16/selinux-fix-selinux_sb_mnt_opts_compat.patch
@@ -0,0 +1,226 @@
+From f7e592657bceadb7441341593410e794db4c5a0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 13:57:36 -0500
+Subject: selinux: Fix selinux_sb_mnt_opts_compat()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit b8b87fd954b4b1bdd2d739c8f50bf685351a1a94 ]
+
+selinux_sb_mnt_opts_compat() is called under the sb_lock spinlock and
+shouldn't be performing any memory allocations.  Fix this by parsing the
+sids at the same time we're chopping up the security mount options
+string and then using the pre-parsed sids when doing the comparison.
+
+Fixes: cc274ae7763d ("selinux: fix sleeping function called from invalid context")
+Fixes: 69c4a42d72eb ("lsm,selinux: add new hook to compare new mount to an existing mount")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 75 ++++++++++++++++++++++------------------
+ 1 file changed, 41 insertions(+), 34 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 5b4b738a3be4..30f08fc1ac09 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -355,6 +355,10 @@ static void inode_free_security(struct inode *inode)
+ 
+ struct selinux_mnt_opts {
+ 	const char *fscontext, *context, *rootcontext, *defcontext;
++	u32 fscontext_sid;
++	u32 context_sid;
++	u32 rootcontext_sid;
++	u32 defcontext_sid;
+ };
+ 
+ static void selinux_free_mnt_opts(void *mnt_opts)
+@@ -611,15 +615,14 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
+ 	return 0;
+ }
+ 
+-static int parse_sid(struct super_block *sb, const char *s, u32 *sid,
+-		     gfp_t gfp)
++static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
+ {
+ 	int rc = security_context_str_to_sid(&selinux_state, s,
+-					     sid, gfp);
++					     sid, GFP_KERNEL);
+ 	if (rc)
+ 		pr_warn("SELinux: security_context_str_to_sid"
+ 		       "(%s) failed for (dev %s, type %s) errno=%d\n",
+-		       s, sb->s_id, sb->s_type->name, rc);
++		       s, sb ? sb->s_id : "?", sb ? sb->s_type->name : "?", rc);
+ 	return rc;
+ }
+ 
+@@ -686,8 +689,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 	 */
+ 	if (opts) {
+ 		if (opts->fscontext) {
+-			rc = parse_sid(sb, opts->fscontext, &fscontext_sid,
+-					GFP_KERNEL);
++			rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
+@@ -696,8 +698,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= FSCONTEXT_MNT;
+ 		}
+ 		if (opts->context) {
+-			rc = parse_sid(sb, opts->context, &context_sid,
+-					GFP_KERNEL);
++			rc = parse_sid(sb, opts->context, &context_sid);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
+@@ -706,8 +707,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= CONTEXT_MNT;
+ 		}
+ 		if (opts->rootcontext) {
+-			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid,
+-					GFP_KERNEL);
++			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
+@@ -716,8 +716,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= ROOTCONTEXT_MNT;
+ 		}
+ 		if (opts->defcontext) {
+-			rc = parse_sid(sb, opts->defcontext, &defcontext_sid,
+-					GFP_KERNEL);
++			rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
+@@ -1009,21 +1008,29 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
+ 		if (opts->context || opts->defcontext)
+ 			goto Einval;
+ 		opts->context = s;
++		if (selinux_initialized(&selinux_state))
++			parse_sid(NULL, s, &opts->context_sid);
+ 		break;
+ 	case Opt_fscontext:
+ 		if (opts->fscontext)
+ 			goto Einval;
+ 		opts->fscontext = s;
++		if (selinux_initialized(&selinux_state))
++			parse_sid(NULL, s, &opts->fscontext_sid);
+ 		break;
+ 	case Opt_rootcontext:
+ 		if (opts->rootcontext)
+ 			goto Einval;
+ 		opts->rootcontext = s;
++		if (selinux_initialized(&selinux_state))
++			parse_sid(NULL, s, &opts->rootcontext_sid);
+ 		break;
+ 	case Opt_defcontext:
+ 		if (opts->context || opts->defcontext)
+ 			goto Einval;
+ 		opts->defcontext = s;
++		if (selinux_initialized(&selinux_state))
++			parse_sid(NULL, s, &opts->defcontext_sid);
+ 		break;
+ 	}
+ 	return 0;
+@@ -2697,8 +2704,6 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
+ {
+ 	struct selinux_mnt_opts *opts = mnt_opts;
+ 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
+-	u32 sid;
+-	int rc;
+ 
+ 	/*
+ 	 * Superblock not initialized (i.e. no options) - reject if any
+@@ -2715,34 +2720,36 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
+ 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
+ 
+ 	if (opts->fscontext) {
+-		rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT);
+-		if (rc)
++		if (opts->fscontext_sid == SECSID_NULL)
+ 			return 1;
+-		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
++		else if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
++				       opts->fscontext_sid))
+ 			return 1;
+ 	}
+ 	if (opts->context) {
+-		rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT);
+-		if (rc)
++		if (opts->context_sid == SECSID_NULL)
+ 			return 1;
+-		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
++		else if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
++				       opts->context_sid))
+ 			return 1;
+ 	}
+ 	if (opts->rootcontext) {
+-		struct inode_security_struct *root_isec;
+-
+-		root_isec = backing_inode_security(sb->s_root);
+-		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT);
+-		if (rc)
+-			return 1;
+-		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
++		if (opts->rootcontext_sid == SECSID_NULL)
+ 			return 1;
++		else {
++			struct inode_security_struct *root_isec;
++
++			root_isec = backing_inode_security(sb->s_root);
++			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
++				       opts->rootcontext_sid))
++				return 1;
++		}
+ 	}
+ 	if (opts->defcontext) {
+-		rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT);
+-		if (rc)
++		if (opts->defcontext_sid == SECSID_NULL)
+ 			return 1;
+-		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
++		else if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
++				       opts->defcontext_sid))
+ 			return 1;
+ 	}
+ 	return 0;
+@@ -2762,14 +2769,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
+ 		return 0;
+ 
+ 	if (opts->fscontext) {
+-		rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL);
++		rc = parse_sid(sb, opts->fscontext, &sid);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+ 			goto out_bad_option;
+ 	}
+ 	if (opts->context) {
+-		rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL);
++		rc = parse_sid(sb, opts->context, &sid);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+@@ -2778,14 +2785,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
+ 	if (opts->rootcontext) {
+ 		struct inode_security_struct *root_isec;
+ 		root_isec = backing_inode_security(sb->s_root);
+-		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL);
++		rc = parse_sid(sb, opts->rootcontext, &sid);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+ 			goto out_bad_option;
+ 	}
+ 	if (opts->defcontext) {
+-		rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL);
++		rc = parse_sid(sb, opts->defcontext, &sid);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+-- 
+2.34.1
+
diff --git a/queue-5.16/selinux-use-correct-type-for-context-length.patch b/queue-5.16/selinux-use-correct-type-for-context-length.patch
new file mode 100644
index 00000000000..9a0a4ecf9b1
--- /dev/null
+++ b/queue-5.16/selinux-use-correct-type-for-context-length.patch
@@ -0,0 +1,47 @@
+From 9ba45de62721fb896ab550b548af799291616b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 15:21:25 +0100
+Subject: selinux: use correct type for context length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Göttsche <cgzones@googlemail.com>
+
+[ Upstream commit b97df7c098c531010e445da88d02b7bf7bf59ef6 ]
+
+security_sid_to_context() expects a pointer to an u32 as the address
+where to store the length of the computed context.
+
+Reported by sparse:
+
+    security/selinux/xfrm.c:359:39: warning: incorrect type in arg 4
+                                    (different signedness)
+    security/selinux/xfrm.c:359:39:    expected unsigned int
+                                       [usertype] *scontext_len
+    security/selinux/xfrm.c:359:39:    got int *
+
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+[PM: wrapped commit description]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/xfrm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
+index be83e5ce4469..debe15207d2b 100644
+--- a/security/selinux/xfrm.c
++++ b/security/selinux/xfrm.c
+@@ -347,7 +347,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
+ 	int rc;
+ 	struct xfrm_sec_ctx *ctx;
+ 	char *ctx_str = NULL;
+-	int str_len;
++	u32 str_len;
+ 
+ 	if (!polsec)
+ 		return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.16/serial-8250-fix-race-condition-in-rts-after-send-han.patch b/queue-5.16/serial-8250-fix-race-condition-in-rts-after-send-han.patch
new file mode 100644
index 00000000000..ae47e960cb4
--- /dev/null
+++ b/queue-5.16/serial-8250-fix-race-condition-in-rts-after-send-han.patch
@@ -0,0 +1,63 @@
+From 9e5bdd226dc76a4bc0de3a7c77adc1e6ce92bd36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 17:02:36 +0100
+Subject: serial: 8250: Fix race condition in RTS-after-send handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit dedab69fd650ea74710b2e626e63fd35584ef773 ]
+
+Set em485->active_timer = NULL isn't always enough to take out the stop
+timer. While there is a check that it acts in the right state (i.e.
+waiting for RTS-after-send to pass after sending some chars) but the
+following might happen:
+
+ - CPU1: some chars send, shifter becomes empty, stop tx timer armed
+ - CPU0: more chars send before RTS-after-send expired
+ - CPU0: shifter empty irq, port lock taken
+ - CPU1: tx timer triggers, waits for port lock
+ - CPU0: em485->active_timer = &em485->stop_tx_timer, hrtimer_start(),
+   releases lock()
+ - CPU1: get lock, see em485->active_timer == &em485->stop_tx_timer,
+   tear down RTS too early
+
+This fix bases on research done by Steffen Trumtrar.
+
+Fixes: b86f86e8e7c5 ("serial: 8250: fix potential deadlock in rs485-mode")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20220215160236.344236-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index b34e84695c8c..344fbe7426f6 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1623,6 +1623,18 @@ static inline void start_tx_rs485(struct uart_port *port)
+ 	struct uart_8250_port *up = up_to_u8250p(port);
+ 	struct uart_8250_em485 *em485 = up->em485;
+ 
++	/*
++	 * While serial8250_em485_handle_stop_tx() is a noop if
++	 * em485->active_timer != &em485->stop_tx_timer, it might happen that
++	 * the timer is still armed and triggers only after the current bunch of
++	 * chars is send and em485->active_timer == &em485->stop_tx_timer again.
++	 * So cancel the timer. There is still a theoretical race condition if
++	 * the timer is already running and only comes around to check for
++	 * em485->active_timer when &em485->stop_tx_timer is armed again.
++	 */
++	if (em485->active_timer == &em485->stop_tx_timer)
++		hrtimer_try_to_cancel(&em485->stop_tx_timer);
++
+ 	em485->active_timer = NULL;
+ 
+ 	if (em485->tx_stopped) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/serial-8250-fix-xoff-xon-sending-when-dma-is-used.patch b/queue-5.16/serial-8250-fix-xoff-xon-sending-when-dma-is-used.patch
new file mode 100644
index 00000000000..c421b774c97
--- /dev/null
+++ b/queue-5.16/serial-8250-fix-xoff-xon-sending-when-dma-is-used.patch
@@ -0,0 +1,125 @@
+From 345757fc3b661274be27910befdb5db1335feafd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Mar 2022 11:14:32 +0200
+Subject: serial: 8250: fix XOFF/XON sending when DMA is used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit f58c252e30cf74f68b0054293adc03b5923b9f0e ]
+
+When 8250 UART is using DMA, x_char (XON/XOFF) is never sent
+to the wire. After this change, x_char is injected correctly.
+
+Create uart_xchar_out() helper for sending the x_char out and
+accounting related to it. It seems that almost every driver
+does these same steps with x_char. Except for 8250, however,
+almost all currently lack .serial_out so they cannot immediately
+take advantage of this new helper.
+
+The downside of this patch is that it might reintroduce
+the problems some devices faced with mixed DMA/non-DMA transfer
+which caused revert f967fc8f165f (Revert "serial: 8250_dma:
+don't bother DMA with small transfers"). However, the impact
+should be limited to cases with XON/XOFF (that didn't work
+with DMA capable devices to begin with so this problem is not
+very likely to cause a major issue, if any at all).
+
+Fixes: 9ee4b83e51f74 ("serial: 8250: Add support for dmaengine")
+Reported-by: Gilles Buloz <gilles.buloz@kontron.com>
+Tested-by: Gilles Buloz <gilles.buloz@kontron.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20220314091432.4288-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_dma.c  | 11 ++++++++++-
+ drivers/tty/serial/8250/8250_port.c |  4 +---
+ drivers/tty/serial/serial_core.c    | 14 ++++++++++++++
+ include/linux/serial_core.h         |  2 ++
+ 4 files changed, 27 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
+index 890fa7ddaa7f..b3c3f7e5851a 100644
+--- a/drivers/tty/serial/8250/8250_dma.c
++++ b/drivers/tty/serial/8250/8250_dma.c
+@@ -64,10 +64,19 @@ int serial8250_tx_dma(struct uart_8250_port *p)
+ 	struct uart_8250_dma		*dma = p->dma;
+ 	struct circ_buf			*xmit = &p->port.state->xmit;
+ 	struct dma_async_tx_descriptor	*desc;
++	struct uart_port		*up = &p->port;
+ 	int ret;
+ 
+-	if (dma->tx_running)
++	if (dma->tx_running) {
++		if (up->x_char) {
++			dmaengine_pause(dma->txchan);
++			uart_xchar_out(up, UART_TX);
++			dmaengine_resume(dma->txchan);
++		}
+ 		return 0;
++	} else if (up->x_char) {
++		uart_xchar_out(up, UART_TX);
++	}
+ 
+ 	if (uart_tx_stopped(&p->port) || uart_circ_empty(xmit)) {
+ 		/* We have been called from __dma_tx_complete() */
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 344fbe7426f6..1e1750a9614e 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1819,9 +1819,7 @@ void serial8250_tx_chars(struct uart_8250_port *up)
+ 	int count;
+ 
+ 	if (port->x_char) {
+-		serial_out(up, UART_TX, port->x_char);
+-		port->icount.tx++;
+-		port->x_char = 0;
++		uart_xchar_out(port, UART_TX);
+ 		return;
+ 	}
+ 	if (uart_tx_stopped(port)) {
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index dc6129ddef85..eb15423f935a 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -652,6 +652,20 @@ static void uart_flush_buffer(struct tty_struct *tty)
+ 	tty_port_tty_wakeup(&state->port);
+ }
+ 
++/*
++ * This function performs low-level write of high-priority XON/XOFF
++ * character and accounting for it.
++ *
++ * Requires uart_port to implement .serial_out().
++ */
++void uart_xchar_out(struct uart_port *uport, int offset)
++{
++	serial_port_out(uport, offset, uport->x_char);
++	uport->icount.tx++;
++	uport->x_char = 0;
++}
++EXPORT_SYMBOL_GPL(uart_xchar_out);
++
+ /*
+  * This function is used to send a high-priority XON/XOFF character to
+  * the device
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index c58cc142d23f..8c32935e1059 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -458,6 +458,8 @@ extern void uart_handle_cts_change(struct uart_port *uport,
+ extern void uart_insert_char(struct uart_port *port, unsigned int status,
+ 		 unsigned int overrun, unsigned int ch, unsigned int flag);
+ 
++void uart_xchar_out(struct uart_port *uport, int offset);
++
+ #ifdef CONFIG_MAGIC_SYSRQ_SERIAL
+ #define SYSRQ_TIMEOUT	(HZ * 5)
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/serial-8250_aspeed_vuart-add-port_aspeed_vuart-port-.patch b/queue-5.16/serial-8250_aspeed_vuart-add-port_aspeed_vuart-port-.patch
new file mode 100644
index 00000000000..c0fb0b4cb0f
--- /dev/null
+++ b/queue-5.16/serial-8250_aspeed_vuart-add-port_aspeed_vuart-port-.patch
@@ -0,0 +1,90 @@
+From 6ec4c42d7ae97a49af37d4cce9d23bc56dee387a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 16:42:03 -0800
+Subject: serial: 8250_aspeed_vuart: add PORT_ASPEED_VUART port type
+
+From: Zev Weiss <zev@bewilderbeest.net>
+
+[ Upstream commit a603ca60cebff8589882427a67f870ed946b3fc8 ]
+
+Commit 54da3e381c2b ("serial: 8250_aspeed_vuart: use UPF_IOREMAP to
+set up register mapping") fixed a bug that had, as a side-effect,
+prevented the 8250_aspeed_vuart driver from enabling the VUART's
+FIFOs.  However, fixing that (and hence enabling the FIFOs) has in
+turn revealed what appears to be a hardware bug in the ASPEED VUART in
+which the host-side THRE bit doesn't get if the BMC-side receive FIFO
+trigger level is set to anything but one byte.  This causes problems
+for polled-mode writes from the host -- for example, Linux kernel
+console writes proceed at a glacial pace (less than 100 bytes per
+second) because the write path waits for a 10ms timeout to expire
+after every character instead of being able to continue on to the next
+character upon seeing THRE asserted.  (GRUB behaves similarly.)
+
+As a workaround, introduce a new port type for the ASPEED VUART that's
+identical to PORT_16550A as it had previously been using, but with
+UART_FCR_R_TRIG_00 instead to set the receive FIFO trigger level to
+one byte, which (experimentally) seems to avoid the problematic THRE
+behavior.
+
+Fixes: 54da3e381c2b ("serial: 8250_aspeed_vuart: use UPF_IOREMAP to set up register mapping")
+Tested-by: Konstantin Aladyshev <aladyshev22@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
+Link: https://lore.kernel.org/r/20220211004203.14915-1-zev@bewilderbeest.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_aspeed_vuart.c | 2 +-
+ drivers/tty/serial/8250/8250_port.c         | 8 ++++++++
+ include/uapi/linux/serial_core.h            | 3 +++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_aspeed_vuart.c b/drivers/tty/serial/8250/8250_aspeed_vuart.c
+index 2350fb3bb5e4..c2cecc6f47db 100644
+--- a/drivers/tty/serial/8250/8250_aspeed_vuart.c
++++ b/drivers/tty/serial/8250/8250_aspeed_vuart.c
+@@ -487,7 +487,7 @@ static int aspeed_vuart_probe(struct platform_device *pdev)
+ 	port.port.irq = irq_of_parse_and_map(np, 0);
+ 	port.port.handle_irq = aspeed_vuart_handle_irq;
+ 	port.port.iotype = UPIO_MEM;
+-	port.port.type = PORT_16550A;
++	port.port.type = PORT_ASPEED_VUART;
+ 	port.port.uartclk = clk;
+ 	port.port.flags = UPF_SHARE_IRQ | UPF_BOOT_AUTOCONF | UPF_IOREMAP
+ 		| UPF_FIXED_PORT | UPF_FIXED_TYPE | UPF_NO_THRE_TEST;
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 46e2079ad1aa..b34e84695c8c 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -307,6 +307,14 @@ static const struct serial8250_config uart_config[] = {
+ 		.rxtrig_bytes	= {1, 32, 64, 112},
+ 		.flags		= UART_CAP_FIFO | UART_CAP_SLEEP,
+ 	},
++	[PORT_ASPEED_VUART] = {
++		.name		= "ASPEED VUART",
++		.fifo_size	= 16,
++		.tx_loadsz	= 16,
++		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_00,
++		.rxtrig_bytes	= {1, 4, 8, 14},
++		.flags		= UART_CAP_FIFO,
++	},
+ };
+ 
+ /* Uart divisor latch read */
+diff --git a/include/uapi/linux/serial_core.h b/include/uapi/linux/serial_core.h
+index c4042dcfdc0c..8885e69178bd 100644
+--- a/include/uapi/linux/serial_core.h
++++ b/include/uapi/linux/serial_core.h
+@@ -68,6 +68,9 @@
+ /* NVIDIA Tegra Combined UART */
+ #define PORT_TEGRA_TCU	41
+ 
++/* ASPEED AST2x00 virtual UART */
++#define PORT_ASPEED_VUART	42
++
+ /* Intel EG20 */
+ #define PORT_PCH_8LINE	44
+ #define PORT_PCH_2LINE	45
+-- 
+2.34.1
+
diff --git a/queue-5.16/serial-8250_lpss-balance-reference-count-for-pci-dma.patch b/queue-5.16/serial-8250_lpss-balance-reference-count-for-pci-dma.patch
new file mode 100644
index 00000000000..7d61de039a5
--- /dev/null
+++ b/queue-5.16/serial-8250_lpss-balance-reference-count-for-pci-dma.patch
@@ -0,0 +1,113 @@
+From 9708b0ca36f5307fd8f7e67db04ef687bc36b2b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 17:12:40 +0200
+Subject: serial: 8250_lpss: Balance reference count for PCI DMA device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5318f70da7e82649d794fc27d8a127c22aa3566e ]
+
+The pci_get_slot() increases its reference count, the caller
+must decrement the reference count by calling pci_dev_put().
+
+Fixes: 9a1870ce812e ("serial: 8250: don't use slave_id of dma_slave_config")
+Depends-on: a13e19cf3dc1 ("serial: 8250_lpss: split LPSS driver to separate module")
+Reported-by: Qing Wang <wangqing@vivo.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20220223151240.70248-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_lpss.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
+index d3bafec7619d..0f5af061e0b4 100644
+--- a/drivers/tty/serial/8250/8250_lpss.c
++++ b/drivers/tty/serial/8250/8250_lpss.c
+@@ -117,8 +117,7 @@ static int byt_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
+ {
+ 	struct dw_dma_slave *param = &lpss->dma_param;
+ 	struct pci_dev *pdev = to_pci_dev(port->dev);
+-	unsigned int dma_devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
+-	struct pci_dev *dma_dev = pci_get_slot(pdev->bus, dma_devfn);
++	struct pci_dev *dma_dev;
+ 
+ 	switch (pdev->device) {
+ 	case PCI_DEVICE_ID_INTEL_BYT_UART1:
+@@ -137,6 +136,8 @@ static int byt_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
+ 		return -EINVAL;
+ 	}
+ 
++	dma_dev = pci_get_slot(pdev->bus, PCI_DEVFN(PCI_SLOT(pdev->devfn), 0));
++
+ 	param->dma_dev = &dma_dev->dev;
+ 	param->m_master = 0;
+ 	param->p_master = 1;
+@@ -152,6 +153,14 @@ static int byt_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
+ 	return 0;
+ }
+ 
++static void byt_serial_exit(struct lpss8250 *lpss)
++{
++	struct dw_dma_slave *param = &lpss->dma_param;
++
++	/* Paired with pci_get_slot() in the byt_serial_setup() above */
++	put_device(param->dma_dev);
++}
++
+ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
+ {
+ 	struct uart_8250_dma *dma = &lpss->data.dma;
+@@ -170,6 +179,13 @@ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port)
+ 	return 0;
+ }
+ 
++static void ehl_serial_exit(struct lpss8250 *lpss)
++{
++	struct uart_8250_port *up = serial8250_get_port(lpss->data.line);
++
++	up->dma = NULL;
++}
++
+ #ifdef CONFIG_SERIAL_8250_DMA
+ static const struct dw_dma_platform_data qrk_serial_dma_pdata = {
+ 	.nr_channels = 2,
+@@ -344,8 +360,7 @@ static int lpss8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	return 0;
+ 
+ err_exit:
+-	if (lpss->board->exit)
+-		lpss->board->exit(lpss);
++	lpss->board->exit(lpss);
+ 	pci_free_irq_vectors(pdev);
+ 	return ret;
+ }
+@@ -356,8 +371,7 @@ static void lpss8250_remove(struct pci_dev *pdev)
+ 
+ 	serial8250_unregister_port(lpss->data.line);
+ 
+-	if (lpss->board->exit)
+-		lpss->board->exit(lpss);
++	lpss->board->exit(lpss);
+ 	pci_free_irq_vectors(pdev);
+ }
+ 
+@@ -365,12 +379,14 @@ static const struct lpss8250_board byt_board = {
+ 	.freq = 100000000,
+ 	.base_baud = 2764800,
+ 	.setup = byt_serial_setup,
++	.exit = byt_serial_exit,
+ };
+ 
+ static const struct lpss8250_board ehl_board = {
+ 	.freq = 200000000,
+ 	.base_baud = 12500000,
+ 	.setup = ehl_serial_setup,
++	.exit = ehl_serial_exit,
+ };
+ 
+ static const struct lpss8250_board qrk_board = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/serial-8250_mid-balance-reference-count-for-pci-dma-.patch b/queue-5.16/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
new file mode 100644
index 00000000000..9770d67acd7
--- /dev/null
+++ b/queue-5.16/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
@@ -0,0 +1,93 @@
+From 29ad30f83a603250508b7d9713520232bde88a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 12:09:20 +0200
+Subject: serial: 8250_mid: Balance reference count for PCI DMA device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 67ec6dd0b257bd81b4e9fcac89b29da72f6265e5 ]
+
+The pci_get_slot() increases its reference count, the caller
+must decrement the reference count by calling pci_dev_put().
+
+Fixes: 90b9aacf912a ("serial: 8250_pci: add Intel Tangier support")
+Fixes: f549e94effa1 ("serial: 8250_pci: add Intel Penwell ports")
+Reported-by: Qing Wang <wangqing@vivo.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Depends-on: d9eda9bab237 ("serial: 8250_pci: Intel MID UART support to its own driver")
+Link: https://lore.kernel.org/r/20220215100920.41984-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_mid.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
+index efa0515139f8..e6c1791609dd 100644
+--- a/drivers/tty/serial/8250/8250_mid.c
++++ b/drivers/tty/serial/8250/8250_mid.c
+@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p)
+ 	return 0;
+ }
+ 
++static void pnw_exit(struct mid8250 *mid)
++{
++	pci_dev_put(mid->dma_dev);
++}
++
+ static int tng_handle_irq(struct uart_port *p)
+ {
+ 	struct mid8250 *mid = p->private_data;
+@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p)
+ 	return 0;
+ }
+ 
++static void tng_exit(struct mid8250 *mid)
++{
++	pci_dev_put(mid->dma_dev);
++}
++
+ static int dnv_handle_irq(struct uart_port *p)
+ {
+ 	struct mid8250 *mid = p->private_data;
+@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	pci_set_drvdata(pdev, mid);
+ 	return 0;
++
+ err:
+-	if (mid->board->exit)
+-		mid->board->exit(mid);
++	mid->board->exit(mid);
+ 	return ret;
+ }
+ 
+@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev)
+ 
+ 	serial8250_unregister_port(mid->line);
+ 
+-	if (mid->board->exit)
+-		mid->board->exit(mid);
++	mid->board->exit(mid);
+ }
+ 
+ static const struct mid8250_board pnw_board = {
+@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = {
+ 	.freq = 50000000,
+ 	.base_baud = 115200,
+ 	.setup = pnw_setup,
++	.exit = pnw_exit,
+ };
+ 
+ static const struct mid8250_board tng_board = {
+@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = {
+ 	.freq = 38400000,
+ 	.base_baud = 1843200,
+ 	.setup = tng_setup,
++	.exit = tng_exit,
+ };
+ 
+ static const struct mid8250_board dnv_board = {
+-- 
+2.34.1
+
diff --git a/queue-5.16/series b/queue-5.16/series
index c311af4be63..d9509ae0fdd 100644
--- a/queue-5.16/series
+++ b/queue-5.16/series
@@ -146,3 +146,664 @@ btrfs-zoned-put-block-group-after-final-usage.patch
 block-fix-rq-qos-breakage-from-skipping-rq_qos_done_bio.patch
 block-limit-request-dispatch-loop-duration.patch
 block-don-t-merge-across-cgroup-boundaries-if-blkcg-is-enabled.patch
+regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
+selinux-access-superblock_security_struct-in-lsm-blo.patch
+selinux-check-return-value-of-sel_make_avc_files.patch
+crypto-ccp-ensure-psp_ret-is-always-init-d-in-__sev_.patch
+hwrng-cavium-check-health-status-while-reading-rando.patch
+hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch
+crypto-sun8i-ss-really-disable-hash-on-a80.patch
+crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
+crypto-mxs-dcp-fix-scatterlist-processing.patch
+selinux-fix-selinux_sb_mnt_opts_compat.patch
+thermal-int340x-check-for-null-after-calling-kmemdup.patch
+crypto-octeontx2-remove-config_dm_crypt-check.patch
+spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
+spi-tegra210-quad-fix-missin-irq-check-in-tegra_qspi.patch
+stack-constrain-and-fix-stack-offset-randomization-w.patch
+arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch
+security-add-sctp_assoc_established-hook.patch
+security-implement-sctp_assoc_established-hook-in-se.patch
+blk-cgroup-set-blkg-iostat-after-percpu-stat-aggrega.patch
+selftests-x86-add-validity-check-and-allow-field-spl.patch
+selftests-sgx-treat-cc-as-one-argument.patch
+crypto-rockchip-ecb-does-not-need-iv.patch
+audit-log-audit_time_-records-only-from-rules.patch
+evm-fix-the-evm-__setup-handler-return-value.patch
+crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
+crypto-hisilicon-sec-fix-the-aead-software-fallback-.patch
+spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
+hwmon-pmbus-add-mutex-to-regulator-ops.patch
+hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
+nvme-cleanup-__nvme_check_ids.patch
+nvme-fix-the-check-for-duplicate-unique-identifiers.patch
+block-don-t-delete-queue-kobject-before-its-children.patch
+pm-hibernate-fix-__setup-handler-error-handling.patch
+pm-suspend-fix-return-value-of-__setup-handler.patch
+spi-spi-zynqmp-gqspi-handle-error-for-dma_set_mask.patch
+hwrng-atmel-disable-trng-on-failure-path.patch
+crypto-sun8i-ss-call-finalize-with-bh-disabled.patch
+crypto-sun8i-ce-call-finalize-with-bh-disabled.patch
+crypto-amlogic-call-finalize-with-bh-disabled.patch
+crypto-gemini-call-finalize-with-bh-disabled.patch
+crypto-vmx-add-missing-dependencies.patch
+clocksource-drivers-timer-ti-dm-fix-regression-from-.patch
+clocksource-drivers-exynos_mct-refactor-resources-al.patch
+clocksource-drivers-exynos_mct-handle-dts-with-highe.patch
+clocksource-drivers-timer-microchip-pit64b-use-notra.patch
+clocksource-drivers-timer-of-check-return-value-of-o.patch
+arm64-prevent-instrumentation-of-bp-hardening-callba.patch
+keys-trusted-fix-trusted-key-backends-when-building-.patch
+keys-trusted-avoid-calling-null-function-trusted_key.patch
+acpi-apei-fix-return-value-of-__setup-handlers.patch
+crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
+crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch
+hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch
+virtio_blk-eliminate-anonymous-module_init-module_ex.patch
+hwmon-pmbus-add-vin-unit-off-handling.patch
+clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
+io_uring-don-t-check-unrelated-req-open.how-in-accep.patch
+io_uring-terminate-manual-loop-iterator-loop-correct.patch
+watch_queue-fix-null-dereference-in-error-cleanup.patch
+watch_queue-actually-free-the-watch.patch
+f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch
+sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
+sched-core-export-pelt_thermal_tp.patch
+sched-uclamp-fix-iowait-boost-escaping-uclamp-restri.patch
+rseq-remove-broken-uapi-field-layout-on-32-bit-littl.patch
+perf-core-fix-address-filter-parser-for-multiple-fil.patch
+perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
+sched-fair-improve-consistency-of-allowed-numa-balan.patch
+f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
+nfsd-more-robust-allocation-failure-handling-in-nfsd.patch
+sched-cpuacct-fix-charge-percpu-cpuusage.patch
+sched-rt-plug-rt_mutex_setprio-vs-push_rt_task-race.patch
+f2fs-fix-to-avoid-potential-deadlock.patch
+btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch
+f2fs-fix-compressed-file-start-atomic-write-may-caus.patch
+selftests-x86-fix-how-check_cc.sh-is-being-invoked.patch
+drivers-base-memory-add-memory-block-to-memory-group.patch
+kunit-make-kunit_test_timeout-compatible-with-commen.patch
+pinctrl-samsung-remove-eint-handler-for-exynos850-al.patch
+media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch
+media-camss-csid-170-fix-non-10bit-formats.patch
+media-camss-csid-170-don-t-enable-unused-irqs.patch
+media-camss-csid-170-set-the-right-halt_cmd-when-dis.patch
+media-camss-vfe-170-fix-vfe-halt-timeout-error.patch
+media-staging-media-imx-imx7-mipi-csis-make-subdev-n.patch
+media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch
+media-mtk-vcodec-potential-dereference-of-null-point.patch
+media-imx-imx8mq-mipi-csi2-remove-wrong-irq-config-w.patch
+media-imx-imx8mq-mipi_csi2-fix-system-resume.patch
+media-bttv-fix-warning-regression-on-tunerless-devic.patch
+media-atmel-atmel-sama7g5-isc-fix-ispck-leftover.patch
+asoc-sh-rz-ssi-drop-calling-rz_ssi_pio_recv-recursiv.patch
+asoc-codecs-check-for-error-pointer-after-calling-de.patch
+asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch
+asoc-simple-card-utils-set-sysclk-on-all-components.patch
+memory-tegra20-emc-correct-memory-device-mask.patch
+media-coda-fix-missing-put_device-call-in-coda_get_v.patch
+media-meson-vdec-potential-dereference-of-null-point.patch
+media-hantro-fix-overfill-bottom-register-field-name.patch
+media-ov6650-fix-set-format-try-processing-path.patch
+media-v4l-avoid-unaligned-access-warnings-when-print.patch
+media-ov5648-don-t-pack-controls-struct.patch
+media-aspeed-correct-value-for-h-total-pixels.patch
+video-fbdev-matroxfb-set-maxvram-of-vbg200ew-to-the-.patch
+video-fbdev-controlfb-fix-compile_test-build.patch
+video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
+video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
+video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
+arm-dts-fix-openbmc-flash-layout-label-addresses.patch
+asoc-max98927-add-missing-header-file.patch
+arm64-dts-qcom-sc7280-fix-gmu-unit-address.patch
+firmware-qcom-scm-remove-reassignment-to-desc-follow.patch
+arm-dts-qcom-ipq4019-fix-sleep-clock.patch
+soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
+soc-qcom-ocmem-fix-missing-put_device-call-in-of_get.patch
+soc-qcom-aoss-fix-missing-put_device-call-in-qmp_get.patch
+soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
+arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch
+arm64-dts-qcom-sm8250-fix-pcie-bindings-to-follow-sc.patch
+arm64-dts-broadcom-bcm4908-use-proper-twd-binding.patch
+arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
+arm64-dts-qcom-sm8350-correct-tcs-configuration-for-.patch
+arm64-dts-qcom-msm8994-provide-missing-xo_board-and-.patch
+arm64-dts-qcom-ipq6018-fix-usb-reference-period.patch
+firmware-ti_sci-fix-compilation-failure-when-config_.patch
+soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
+cpuidle-qcom-spm-check-if-any-cpu-is-managed-by-spm.patch
+arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch
+arm-dts-stm32-fix-av96-board-sai2-pin-muxing-on-stm3.patch
+arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
+vsprintf-fix-potential-unaligned-access.patch
+arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
+media-mexon-ge2d-fixup-frames-size-in-registers.patch
+media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
+media-ti-vpe-cal-fix-a-null-pointer-dereference-in-c.patch
+media-em28xx-initialize-refcount-before-kref_get.patch
+media-usb-go7007-s2250-board-fix-leak-in-probe.patch
+media-cedrus-h265-fix-neighbour-info-buffer-size.patch
+media-cedrus-h264-fix-neighbour-info-buffer-size.patch
+asoc-codecs-rx-macro-fix-accessing-compander-for-aux.patch
+asoc-codecs-rx-macro-fix-accessing-array-out-of-boun.patch
+asoc-codecs-va-macro-fix-accessing-array-out-of-boun.patch
+asoc-codecs-wc938x-fix-accessing-array-out-of-bounds.patch
+asoc-codecs-wcd938x-fix-kcontrol-max-values.patch
+asoc-codecs-wcd934x-fix-kcontrol-max-values.patch
+asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch
+media-v4l2-core-initialize-h264-scaling-matrix.patch
+media-ov5640-fix-set-format-v4l2_mbus_pixelcode-not-.patch
+selftests-lkdtm-add-ubsan-config.patch
+vsprintf-fix-pk-with-kptr_restrict-0.patch
+uaccess-fix-nios2-and-microblaze-get_user_8.patch
+asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
+asoc-acp-check-the-return-value-of-devm_kzalloc-in-a.patch
+soc-mediatek-pm-domains-add-wakeup-capacity-support-.patch
+mmc-sdhci_am654-fix-the-driver-data-of-am64-soc.patch
+asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
+alsa-spi-add-check-for-clk_enable.patch
+arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
+arm64-dts-broadcom-fix-sata-nodename.patch
+printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
+asoc-mxs-saif-handle-errors-for-clk_enable.patch
+asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
+asoc-dwc-i2s-handle-errors-for-clk_enable.patch
+asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
+memory-emif-add-check-for-setup_interrupts.patch
+memory-emif-check-the-pointer-temp-in-get_device_det.patch
+alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
+arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
+m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch
+media-stk1160-if-start-stream-fails-return-buffers-w.patch
+media-vidtv-check-for-null-return-of-vzalloc.patch
+asoc-cs35l41-fix-gpio2-configuration.patch
+asoc-cs35l41-fix-max-number-of-tx-channels.patch
+asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
+asoc-wm8350-handle-error-for-wm8350_register_irq.patch
+asoc-fsi-add-check-for-clk_enable.patch
+video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
+media-saa7134-fix-incorrect-use-to-determine-if-list.patch
+ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
+asoc-atmel-fix-error-handling-in-snd_proto_probe.patch
+asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch
+asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch
+asoc-mediatek-use-of_device_get_match_data.patch
+asoc-mediatek-mt8192-mt6359-fix-error-handling-in-mt.patch
+asoc-rk817-fix-missing-clk_disable_unprepare-in-rk81.patch
+asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
+asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
+asoc-fsl_spdif-disable-tx-clock-when-stop.patch
+asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
+asoc-sof-intel-enable-dmi-l1-for-playback-streams.patch
+asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
+mmc-davinci_mmc-handle-error-for-clk_enable.patch
+asoc-rockchip-fix-pm-usage-reference-of-rockchip_i2s.patch
+asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch
+asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
+asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch
+asoc-amd-fix-reference-to-pcm-buffer-address.patch
+arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch
+arm-configs-multi_v5_defconfig-re-enable-drm_panel-a.patch
+drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch
+drm-meson-split-out-encoder-from-meson_dw_hdmi.patch
+drm-meson-fix-error-handling-when-afbcd.ops-init-fai.patch
+drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
+drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
+drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch
+drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch
+ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
+drm-v3d-v3d_drv-check-for-error-num-after-setting-ma.patch
+drm-panfrost-check-for-error-num-after-setting-mask.patch
+bpftool-fix-error-check-when-calling-hashmap__new.patch
+libbpf-fix-possible-null-pointer-dereference-when-de.patch
+bpftool-only-set-obj-skeleton-on-complete-success.patch
+udmabuf-validate-ubuf-pagecount.patch
+bpf-fix-uaf-due-to-race-between-btf_try_get_module-a.patch
+drm-selftests-test-drm_dp_mst_helper-fix-memory-leak.patch
+drm-locking-fix-drm_modeset_acquire_ctx-kernel-doc.patch
+selftests-bpf-fix-bind-on-used-port.patch
+bluetooth-btintel-fix-wbs-setting-for-intel-legacy-r.patch
+bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
+mtd-onenand-check-for-error-irq.patch
+mtd-rawnand-gpmi-fix-controller-timings-setting.patch
+selftests-xsk-fix-rx_full-stats-test.patch
+drm-edid-don-t-clear-formats-if-using-deep-color.patch
+drm-edid-split-deep-color-modes-between-rgb-and-yuv4.patch
+ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch
+ionic-start-watchdog-after-all-is-setup.patch
+ionic-don-t-send-reset-commands-if-fw-isn-t-running.patch
+ionic-fix-up-printing-of-timeout-error.patch
+ionic-correctly-print-aq-errors-if-completions-aren-.patch
+drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch
+drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
+drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch
+net-phy-at803x-move-page-selection-fix-to-config_ini.patch
+selftests-bpf-test_xdp_redirect_multi-use-temp-netns.patch
+ath9k_htc-fix-uninit-value-bugs.patch
+ath11k-set-wmi_peer_40mhz-while-peer-assoc-for-6-ghz.patch
+rdma-core-set-mr-type-in-ib_reg_user_mr.patch
+kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
+selftests-net-timestamping-fix-bind_phc-check.patch
+i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
+i40e-respect-metadata-on-xsk-rx-to-skb.patch
+ice-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
+ice-respect-metadata-on-xsk-rx-to-skb.patch
+igc-don-t-reserve-excessive-xdp_packet_headroom-on-x.patch
+ixgbe-pass-bi-xdp-to-ixgbe_construct_skb_zc-directly.patch
+ixgbe-don-t-reserve-excessive-xdp_packet_headroom-on.patch
+ixgbe-respect-metadata-on-xsk-rx-to-skb.patch
+power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
+ray_cs-check-ioremap-return-value.patch
+powerpc-dts-t1040rdb-fix-ports-names-for-seville-eth.patch
+kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch
+powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
+mt76-connac-fix-sta_rec_wtbl-tag-len.patch
+mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch
+mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch
+mt76-mt76_connac-fix-mcu_ce_cmd_set_roc-definition-e.patch
+mt76-mt7921-set-edca-parameters-with-the-mcu-ce-comm.patch
+mt76-mt7921-do-not-always-disable-fw-runtime-pm.patch
+mt76-mt7921-fix-a-leftover-race-in-runtime-pm.patch
+mt76-mt7615-fix-a-leftover-race-in-runtime-pm.patch
+mt76-mt7915-fix-ht-mcs-in-mt7915_mac_add_txs_skb.patch
+mt76-mt7921-fix-ht-mcs-in-mt7921_mac_add_txs_skb.patch
+mt76-mt7921s-fix-mt7921s_mcu_-fw-drv-_pmctrl.patch
+mt76-mt7921e-fix-possible-probe-failure-after-reboot.patch
+mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
+mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
+mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch
+mt76-mt7915-fix-mcs_map-in-mt7915_mcu_set_sta_he_mcs.patch
+mt76-mt7915-fix-the-nss-setting-in-bitrates.patch
+ptp-unregister-virtual-clocks-when-unregistering-phy.patch
+net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
+bpf-fix-a-btf-decl_tag-bug-when-tagging-a-function.patch
+mac80211-remove-a-couple-of-obsolete-todo.patch
+mac80211-limit-bandwidth-in-he-capabilities.patch
+scripts-dtc-call-pkg-config-posixly-correct.patch
+livepatch-fix-build-failure-on-32-bits-processors.patch
+net-asix-add-proper-error-handling-of-usb-read-error.patch
+i2c-bcm2835-use-platform_get_irq-to-get-the-interrup.patch
+i2c-bcm2835-fix-the-error-handling-in-bcm2835_i2c_pr.patch
+mtd-mchp23k256-add-spi-id-table.patch
+mtd-mchp48l640-add-spi-id-table.patch
+selftests-bpf-extract-syscall-wrapper.patch
+selftests-bpf-use-__se_-prefix-on-architectures-with.patch
+igc-avoid-kernel-warning-when-changing-rx-ring-param.patch
+igb-refactor-xdp-registration.patch
+pci-aardvark-fix-reading-msi-interrupt-number.patch
+pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
+rdma-rxe-check-the-last-packet-by-rxe_end_mask.patch
+libbpf-fix-signedness-bug-in-btf_dump_array_data.patch
+cxl-core-fix-cxl_probe_component_regs-error-message.patch
+tools-testing-cxl-fix-root-port-to-host-bridge-assig.patch
+cxl-regs-fix-size-of-cxl-capability-header-register.patch
+net-enetc-allocate-cbd-ring-data-memory-using-dma-co.patch
+libbpf-fix-compilation-warning-due-to-mismatched-pri.patch
+drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch
+libbpf-use-dynamically-allocated-buffer-when-receivi.patch
+power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
+hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
+iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
+drm-bridge-anx7625-fix-overflow-issue-on-reading-edi.patch
+i2c-pasemi-drop-i2c-classes-from-platform-driver-var.patch
+bpftool-fix-the-error-when-lookup-in-no-btf-maps.patch
+drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch
+drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
+libbpf-fix-memleak-in-libbpf_netlink_recv.patch
+ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
+cxl-port-hold-port-reference-until-decoder-release.patch
+dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
+selftests-mptcp-add-csum-mib-check-for-mptcp_connect.patch
+iwlwifi-mvm-don-t-call-iwl_mvm_sta_from_mac80211-wit.patch
+iwlwifi-mvm-don-t-iterate-unadded-vifs-when-handling.patch
+iwlwifi-mvm-align-locking-in-d3-test-debugfs.patch
+iwlwifi-yoyo-remove-dbgi_sram-address-reset-writing.patch
+iwlwifi-yoyo-avoid-using-dram-data-if-allocation-fai.patch
+iwlwifi-fix-eio-error-code-that-is-never-returned.patch
+iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
+mtd-rawnand-pl353-set-the-nand-chip-node-as-the-flas.patch
+drm-msm-dp-populate-connector-of-struct-dp_panel.patch
+drm-msm-dp-stop-link-training-after-link-training-2-.patch
+drm-msm-dp-always-add-fail-safe-mode-into-connector-.patch
+drm-msm-dsi-use-ref-fw-clock-instead-of-global-name-.patch
+drm-msm-dsi-phy-fix-7nm-v4.0-settings-for-c-phy-mode.patch
+drm-msm-dpu-add-dspp-blocks-teardown.patch
+drm-msm-dpu-fix-dp-audio-condition.patch
+i40e-remove-dead-stores-on-xsk-hotpath.patch
+ath11k-avoid-active-pdev-check-for-each-msdu.patch
+ath11k-invalidate-cached-reo-ring-entry-before-acces.patch
+dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
+vfio-pci-fix-memory-leak-during-d3hot-to-d0-transiti.patch
+vfio-pci-wake-up-devices-around-reset-functions.patch
+scsi-fnic-fix-a-tracing-statement.patch
+scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
+scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
+scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
+scsi-pm8001-fix-le32-values-handling-in-pm80xx_set_s.patch
+scsi-pm8001-fix-payload-initialization-in-pm80xx_enc.patch
+scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch
+scsi-pm8001-fix-le32-values-handling-in-pm80xx_chip_.patch-2702
+scsi-pm8001-fix-ncq-non-data-command-task-initializa.patch
+scsi-pm8001-fix-ncq-non-data-command-completion-hand.patch
+scsi-pm8001-fix-abort-all-task-initialization.patch
+mt76-mt7921s-fix-missing-fc-type-sub-type-for-802.11.patch
+net-dsa-realtek-smi-fix-kdoc-warnings.patch
+net-dsa-realtek-smi-move-to-subdirectory.patch
+rdma-mlx5-fix-the-flow-of-a-miss-in-the-allocation-o.patch
+drm-amd-display-remove-vupdate_int_entry-definition.patch
+tomoyo-fix-__setup-handlers-return-values.patch
+power-supply-sbs-charger-don-t-cancel-work-that-is-n.patch
+mt76-mt7915-fix-the-muru-tlv-issue.patch
+ext2-correct-max-file-size-computing.patch
+drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
+power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
+scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
+drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
+bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
+bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
+xsk-fix-race-at-socket-teardown.patch
+rdma-irdma-fix-netdev-notifications-for-vlan-s.patch
+rdma-irdma-fix-passthrough-mode-in-vm.patch
+rdma-irdma-remove-incorrect-masking-of-pd.patch
+gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch
+libbpf-skip-forward-declaration-when-counting-duplic.patch
+powerpc-mm-numa-skip-numa_no_node-onlining-in-parse_.patch
+powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
+kvm-x86-fix-emulation-in-writing-cr8.patch
+kvm-x86-emulator-defer-not-present-segment-check-in-.patch
+kvm-svm-exit-to-userspace-on-enomem-efault-ghcb-erro.patch
+hv_balloon-rate-limit-unhandled-message-warning.patch
+kvm-arm64-enable-cortex-a510-erratum-2077057-by-defa.patch
+i2c-xiic-make-bus-names-unique.patch
+net-phy-micrel-fix-concurrent-register-access.patch
+power-supply-wm8350-power-handle-error-for-wm8350_re.patch
+power-supply-wm8350-power-add-missing-free-in-free_c.patch
+ib-hfi1-allow-larger-mtu-without-aip.patch
+rdma-core-fix-ib_qp_usecnt_dec-called-when-error.patch
+pci-reduce-warnings-on-possible-rw1c-corruption.patch
+net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch
+drm-msm-a6xx-fix-missing-array_size-check.patch
+mips-dec-honor-config_mips_fp_support-n.patch
+mips-sanitise-cavium-switch-cases-in-tlb-handler-syn.patch
+powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
+powerpc-64s-don-t-use-dsisr-for-slb-faults.patch
+mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
+libbpf-unmap-rings-when-umem-deleted.patch
+selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
+platform-x86-huawei-wmi-check-the-return-value-of-de.patch
+scsi-mpt3sas-fix-incorrect-4gb-boundary-check.patch
+powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
+xtensa-add-missing-xchal_have_windowed-check.patch
+iwlwifi-pcie-fix-sw-error-msi-x-mapping.patch
+vxcan-enable-local-echo-for-sent-can-frames.patch
+ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch
+mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch
+mips-rb532-fix-return-value-of-__setup-handler.patch
+mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch
+mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
+power-ab8500_chargalg-use-clock_monotonic.patch
+rdma-irdma-prevent-some-integer-underflows.patch
+revert-rdma-core-fix-ib_qp_usecnt_dec-called-when-er.patch
+rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
+bpf-sockmap-fix-memleak-in-sk_psock_queue_msg.patch
+bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
+bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
+bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
+samples-bpf-xdpsock-fix-race-when-running-for-fix-du.patch
+usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
+rdma-rxe-change-variable-and-function-argument-to-pr.patch
+rdma-rxe-fix-ref-error-in-rxe_av.c.patch
+drm-i915-display-fix-hpd-short-pulse-handling-for-ed.patch
+drm-i915-display-do-not-re-enable-psr-after-it-was-m.patch
+netfilter-flowtable-fix-qinq-and-pppoe-support-for-i.patch
+mt76-mt7921-fix-mt7921_queues_acq-implementation.patch
+can-isotp-return-eaddrnotavail-when-reading-from-unb.patch
+can-isotp-support-msg_trunc-flag-when-reading-from-s.patch
+bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch
+usb-usbip-eliminate-anonymous-module_init-module_exi.patch
+usb-gadget-eliminate-anonymous-module_init-module_ex.patch
+ibmvnic-fix-race-between-xmit-and-reset.patch
+af_unix-fix-some-data-races-around-unix_sk-sk-oob_sk.patch
+selftests-bpf-fix-error-reporting-from-sock_fields-p.patch
+bluetooth-hci_uart-add-missing-null-check-in-h5_enqu.patch
+bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch
+bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
+rdma-nldev-prevent-underflow-in-nldev_stat_set_count.patch
+ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch
+mptcp-fix-crash-due-to-tcp_tsorted_anchor-was-initia.patch
+af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
+i2c-meson-fix-wrong-speed-use-from-probe.patch
+netfilter-conntrack-add-and-use-nf_ct_set_auto_assig.patch
+netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
+i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
+powerpc-pseries-fix-use-after-free-in-remove_phb_dyn.patch
+selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
+bpftool-fix-print-error-when-show-bpf-map.patch
+pci-avoid-broken-msi-on-sb600-usb-devices.patch
+net-bcmgenet-use-stronger-register-read-writes-to-as.patch
+tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
+openvswitch-always-update-flow-key-after-nat.patch
+net-dsa-fix-panic-on-shutdown-if-multi-chip-tree-fai.patch
+tipc-fix-the-timer-expires-after-interval-100ms.patch
+mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
+ice-fix-scheduling-while-atomic-on-aux-critical-err-.patch
+ice-don-t-allow-to-run-ice_send_event_to_aux-in-atom.patch
+drivers-ethernet-cpsw-fix-panic-when-interrupt-coale.patch
+kernel-resource-fix-kfree-of-bootmem-memory-again.patch
+clk-renesas-r9a07g044-update-multiplier-and-divider-.patch
+staging-r8188eu-convert-dbg_88e_level-call-in-hal-rt.patch
+staging-r8188eu-release_firmware-is-not-called-if-al.patch
+mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
+fsi-scom-fix-error-handling.patch
+fsi-scom-remove-retries-in-indirect-scoms.patch
+pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
+pps-clients-gpio-propagate-return-value-from-pps_gpi.patch
+fsi-aspeed-fix-a-potential-double-free.patch
+misc-alcor_pci-fix-an-error-handling-path.patch
+cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch
+soundwire-intel-fix-wrong-register-name-in-intel_shi.patch
+clk-qcom-ipq8074-fix-pci-e-clock-oops.patch
+dmaengine-idxd-change-bandwidth-token-to-read-buffer.patch
+dmaengine-idxd-restore-traffic-class-defaults-after-.patch
+iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch
+staging-qlge-add-unregister_netdev-in-qlge_probe.patch
+serial-8250_aspeed_vuart-add-port_aspeed_vuart-port-.patch
+staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
+pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
+pinctrl-renesas-checker-fix-miscalculation-of-number.patch
+clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
+phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
+phy-phy-brcm-usb-fixup-bcm4908-support.patch
+serial-8250_mid-balance-reference-count-for-pci-dma-.patch
+serial-8250_lpss-balance-reference-count-for-pci-dma.patch
+nfs-use-of-mapping_set_error-results-in-spurious-err.patch
+serial-8250-fix-race-condition-in-rts-after-send-han.patch
+iio-adc-add-check-for-devm_request_threaded_irq.patch
+habanalabs-add-check-for-pci_enable_device.patch
+nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
+staging-r8188eu-fix-endless-loop-in-recv_func.patch
+dma-debug-fix-return-value-of-__setup-handlers.patch
+clk-imx7d-remove-audio_mclk_root_clk.patch
+clk-imx-off-by-one-in-imx_lpcg_parse_clks_from_dt.patch
+clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch
+clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
+clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
+dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch
+remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
+remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
+remoteproc-qcom_q6v5_mss-fix-some-leaks-in-q6v5_allo.patch
+nvdimm-region-fix-default-alignment-for-small-region.patch
+clk-actions-terminate-clk_div_table-with-sentinel-el.patch
+clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
+clk-hisilicon-terminate-clk_div_table-with-sentinel-.patch
+clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
+clk-fix-clk_hw_get_clk-when-dev-is-null.patch
+clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
+mailbox-imx-fix-crash-in-resume-on-i.mx8ulp.patch
+nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
+staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
+staging-mt7621-dts-fix-formatting.patch
+staging-mt7621-dts-fix-pinctrl-properties-for-ethern.patch
+staging-mt7621-dts-fix-gb-pc2-devicetree.patch
+pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
+pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch
+pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
+pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
+pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch
+pinctrl-microchip-sgpio-lock-rmw-access.patch
+pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
+pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
+tty-hvc-fix-return-value-of-__setup-handler.patch
+kgdboc-fix-return-value-of-__setup-handler.patch
+serial-8250-fix-xoff-xon-sending-when-dma-is-used.patch
+virt-acrn-obtain-pa-from-vma-with-pfnmap-flag.patch
+virt-acrn-fix-a-memory-leak-in-acrn_dev_ioctl.patch
+kgdbts-fix-return-value-of-__setup-handler.patch
+firmware-google-properly-state-iomem-dependency.patch
+driver-core-dd-fix-return-value-of-__setup-handler.patch
+jfs-fix-divide-error-in-dbnextag.patch
+sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch
+sunrpc-improve-swap-handling-scheduling-and-pf_memal.patch
+sunrpc-don-t-call-connect-more-than-once-on-a-tcp-so.patch
+netfilter-egress-report-interface-as-outgoing.patch
+netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
+sunrpc-don-t-resend-a-task-on-an-offlined-transport.patch
+nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
+kdb-fix-the-putarea-helper-function.patch
+perf-stat-fix-forked-applications-enablement-of-coun.patch
+clk-qcom-gcc-msm8994-fix-gpll4-width.patch
+vsock-virtio-initialize-vdev-priv-before-using-vqs.patch
+vsock-virtio-read-the-negotiated-features-before-usi.patch
+vsock-virtio-enable-vqs-early-on-probe.patch
+clk-initialize-orphan-req_rate.patch
+xen-fix-is_xen_pmu.patch
+net-enetc-report-software-timestamping-via-so_timest.patch
+net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch
+net-hns3-fix-port-base-vlan-add-fail-when-concurrent.patch
+net-hns3-add-vlan-list-lock-to-protect-vlan-list.patch
+net-hns3-format-the-output-of-the-mac-address.patch
+net-hns3-refine-the-process-when-pf-set-vf-vlan.patch
+net-phy-broadcom-fix-brcm_fet_config_init.patch
+selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
+nfs-don-t-loop-forever-in-nfs_do_recoalesce.patch
+net-hns3-clean-residual-vf-config-after-disable-srio.patch
+net-sparx5-depends-on-ptp_1588_clock_optional.patch
+qlcnic-dcb-default-to-returning-eopnotsupp.patch
+net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
+net-sparx5-switchdev-fix-possible-null-pointer-deref.patch
+octeontx2-af-initialize-action-variable.patch
+selftests-tls-skip-cmsg_to_pipe-tests-with-tls-n.patch
+net-prefer-nf_ct_put-instead-of-nf_conntrack_put.patch
+net-sched-act_ct-fix-ref-leak-when-switching-zones.patch
+nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
+net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
+fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch
+lib-test-use-after-free-in-register_test_dev_kmod.patch
+fs-fix-fd-table-size-alignment-properly.patch
+lsm-general-protection-fault-in-legacy_parse_param.patch
+regulator-rpi-panel-handle-i2c-errors-timing-to-the-.patch
+crypto-hisilicon-qm-cleanup-warning-in-qm_vf_read_qo.patch
+gcc-plugins-stackleak-exactly-match-strings-instead-.patch
+rcu-kill-rnp-ofl_seq-and-use-only-rcu_state.ofl_lock.patch
+pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
+rcu-mark-writes-to-the-rcu_segcblist-structure-s-fla.patch
+block-throttle-split-bio-in-case-of-iops-limit.patch
+memstick-mspro_block-fix-handling-of-read-only-devic.patch
+block-bfq_wf2q-correct-weight-to-ioprio.patch
+crypto-xts-add-softdep-on-ecb.patch
+crypto-hisilicon-sec-not-need-to-enable-sm4-extra-mo.patch
+block-bfq-don-t-move-oom_bfqq.patch
+selinux-use-correct-type-for-context-length.patch
+powercap-dtpm_cpu-reset-per_cpu-variable-in-the-rele.patch
+arm64-module-remove-noload-from-linker-script.patch
+selinux-allow-fioclex-and-fionclex-with-policy-capab.patch
+loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
+fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
+irqchip-qcom-pdc-fix-broken-locking.patch
+irqchip-nvic-release-nvic_base-upon-failure.patch
+fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch
+bfq-fix-use-after-free-in-bfq_dispatch_request.patch
+acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
+lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
+revert-revert-block-bfq-honor-already-setup-queue-me.patch
+acpi-apei-limit-printable-size-of-bert-table-data.patch
+pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
+parisc-fix-non-access-data-tlb-cache-flush-faults.patch
+parisc-fix-handling-off-probe-non-access-faults.patch
+nvme-tcp-lockdep-annotate-in-kernel-sockets.patch
+spi-tegra20-use-of_device_get_match_data.patch
+spi-fsi-implement-a-timeout-for-polling-status.patch
+atomics-fix-atomic64_-read_acquire-set_release-fallb.patch
+locking-lockdep-iterate-lock_classes-directly-when-r.patch
+ext4-correct-cluster-len-and-clusters-changed-accoun.patch
+ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch
+sched-tracing-don-t-re-read-p-state-when-emitting-sc.patch
+sched-tracing-report-task_rtlock_wait-tasks-as-task_.patch
+ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
+f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch
+nfsd-fix-nfsd_breaker_owns_lease-return-values.patch
+f2fs-don-t-get-freeze-lock-in-f2fs_evict_inode-in-fr.patch
+btrfs-harden-identification-of-a-stale-device.patch
+btrfs-make-search_csum_tree-return-0-if-we-get-efbig.patch
+btrfs-handle-csum-lookup-errors-properly-on-reads.patch
+btrfs-do-not-double-complete-bio-on-errors-during-co.patch
+btrfs-do-not-clean-up-repair-bio-if-submit-fails.patch
+f2fs-use-spin_lock-to-avoid-hang.patch
+f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch
+adjust-cifssb-maximum-read-size.patch
+ntfs-add-sanity-check-on-allocation-size.patch
+media-staging-media-zoran-move-videodev-alloc.patch
+media-staging-media-zoran-calculate-the-right-buffer.patch
+media-staging-media-zoran-fix-various-v4l2-complianc.patch
+media-atmel-atmel-isc-base-report-frame-sizes-as-ful.patch
+media-ir_toy-free-before-error-exiting.patch
+asoc-sh-rz-ssi-make-the-data-structures-available-be.patch
+asoc-cs42l42-report-full-jack-status-when-plug-is-de.patch
+asoc-sof-intel-match-sdw-version-on-link_slaves_foun.patch
+media-imx-jpeg-prevent-decoding-nv12m-jpegs-into-sin.patch
+asoc-sof-intel-hda-remove-link-assignment-limitation.patch
+media-iommu-mediatek-v1-free-the-existed-fwspec-if-t.patch
+media-iommu-mediatek-return-enodev-if-the-device-is-.patch
+media-iommu-mediatek-add-device_link-between-the-con.patch
+video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
+video-fbdev-w100fb-reset-global-state.patch
+video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
+video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
+arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
+arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
+asoc-madera-add-dependencies-on-mfd.patch
+media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch
+media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch
+arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
+alsa-hda-fix-driver-index-handling-at-re-binding.patch
+arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch
+arm64-defconfig-build-imx-sdma-as-a-module.patch
+video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
+video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
+video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
+arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch
+asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
+asoc-intel-sof_es8336-add-quirk-for-huawei-d15-2021.patch
+media-imx-jpeg-fix-a-bug-of-accessing-array-out-of-b.patch
+media-cx88-mpeg-clear-interrupt-status-register-befo.patch
+asoc-rt5682s-fix-the-wrong-jack-type-detected.patch
+uaccess-fix-type-mismatch-warnings-from-access_ok.patch
+lib-test_lockup-fix-kernel-pointer-check-for-separat.patch
+arm-tegra-tamonten-fix-i2c3-pad-setting.patch
+arm-mmp-fix-failure-to-remove-sram-device.patch
+asoc-amd-vg-fix-for-pm-resume-callback-sequence.patch
+asoc-amd-vangogh-fix-uninitialized-symbol-warning-in.patch
+video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
+media-i2c-ov5648-fix-lockdep-error.patch
+media-revert-media-em28xx-add-missing-em28xx_close_e.patch
+media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
+asoc-intel-sof_sdw-fix-quirks-for-2022-hp-spectre-x3.patch
+asoc-intel-soc-acpi-add-more-acpi-hids-for-es83x6-de.patch
+asoc-intel-revert-asoc-intel-sof_es8336-add-quirk-fo.patch
+asoc-intel-sof_es8336-use-nhlt-information-to-set-dm.patch
+asoc-intel-sof_es8336-log-all-quirks.patch
+tracing-have-trace_define_enum-affect-trace-event-ty.patch
+mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
+media-atomisp-fix-bad-usage-at-error-handling-logic.patch
+alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
diff --git a/queue-5.16/soc-mediatek-pm-domains-add-wakeup-capacity-support-.patch b/queue-5.16/soc-mediatek-pm-domains-add-wakeup-capacity-support-.patch
new file mode 100644
index 00000000000..07f3ceb6ad5
--- /dev/null
+++ b/queue-5.16/soc-mediatek-pm-domains-add-wakeup-capacity-support-.patch
@@ -0,0 +1,41 @@
+From ca679e27842845e456a664293ea3c557a6420a7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jan 2022 09:21:01 +0800
+Subject: soc: mediatek: pm-domains: Add wakeup capacity support in power
+ domain
+
+From: Chun-Jie Chen <chun-jie.chen@mediatek.com>
+
+[ Upstream commit ac0ca395543af061f7ad77afcda0afb323d82468 ]
+
+Due to some power domain needs to keep on for wakeup in system suspend,
+so add GENPD_FLAG_ACTIVE_WAKEUP support in Mediatek power domain driver.
+
+Fixes: 59b644b01cf4 ("soc: mediatek: Add MediaTek SCPSYS power domains")
+Signed-off-by: Chun-Jie Chen <chun-jie.chen@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220130012104.5292-3-chun-jie.chen@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-pm-domains.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-pm-domains.c b/drivers/soc/mediatek/mtk-pm-domains.c
+index b762bc40f56b..afd2fd74802d 100644
+--- a/drivers/soc/mediatek/mtk-pm-domains.c
++++ b/drivers/soc/mediatek/mtk-pm-domains.c
+@@ -443,6 +443,9 @@ generic_pm_domain *scpsys_add_one_domain(struct scpsys *scpsys, struct device_no
+ 	pd->genpd.power_off = scpsys_power_off;
+ 	pd->genpd.power_on = scpsys_power_on;
+ 
++	if (MTK_SCPD_CAPS(pd, MTK_SCPD_ACTIVE_WAKEUP))
++		pd->genpd.flags |= GENPD_FLAG_ACTIVE_WAKEUP;
++
+ 	if (MTK_SCPD_CAPS(pd, MTK_SCPD_KEEP_DEFAULT_OFF))
+ 		pm_genpd_init(&pd->genpd, NULL, true);
+ 	else
+-- 
+2.34.1
+
diff --git a/queue-5.16/soc-qcom-aoss-fix-missing-put_device-call-in-qmp_get.patch b/queue-5.16/soc-qcom-aoss-fix-missing-put_device-call-in-qmp_get.patch
new file mode 100644
index 00000000000..2dbc1026832
--- /dev/null
+++ b/queue-5.16/soc-qcom-aoss-fix-missing-put_device-call-in-qmp_get.patch
@@ -0,0 +1,43 @@
+From badaa7137ee0082179e48bdc70e85141e9485d41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 09:59:31 +0000
+Subject: soc: qcom: aoss: Fix missing put_device call in qmp_get
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 4b41a9d0fe3db5f91078a380f62f0572c3ecf2dd ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling paths.
+
+Fixes: 8c75d585b931 ("soc: qcom: aoss: Expose send for generic usecase")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220108095931.21527-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom_aoss.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c
+index 34acf58bbb0d..e234d78b33e7 100644
+--- a/drivers/soc/qcom/qcom_aoss.c
++++ b/drivers/soc/qcom/qcom_aoss.c
+@@ -451,7 +451,11 @@ struct qmp *qmp_get(struct device *dev)
+ 
+ 	qmp = platform_get_drvdata(pdev);
+ 
+-	return qmp ? qmp : ERR_PTR(-EPROBE_DEFER);
++	if (!qmp) {
++		put_device(&pdev->dev);
++		return ERR_PTR(-EPROBE_DEFER);
++	}
++	return qmp;
+ }
+ EXPORT_SYMBOL(qmp_get);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch b/queue-5.16/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
new file mode 100644
index 00000000000..27dd43b5e3d
--- /dev/null
+++ b/queue-5.16/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
@@ -0,0 +1,50 @@
+From 5c85a9f91db780249f1d83feb76dbca2e7538e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 17:35:54 +0000
+Subject: soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 8030cb9a55688c1339edd284d9d6ce5f9fc75160 ]
+
+Quoting the header comments, IRQF_ONESHOT is "Used by threaded interrupts
+which need to keep the irq line disabled until the threaded handler has
+been run.". When applied to an interrupt that doesn't request a threaded
+irq then IRQF_ONESHOT has a lesser known (undocumented?) side effect,
+which it to disable the forced threading of the irq. For "normal" kernels
+(without forced threading) then, if there is no thread_fn, then
+IRQF_ONESHOT is a nop.
+
+In this case disabling forced threading is not appropriate for this driver
+because it calls wake_up_all() and this API cannot be called from
+no-thread interrupt handlers on PREEMPT_RT systems (deadlock risk, triggers
+sleeping-while-atomic warnings).
+
+Fix this by removing IRQF_ONESHOT.
+
+Fixes: 2209481409b7 ("soc: qcom: Add AOSS QMP driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+[bjorn: Added Fixes tag]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220127173554.158111-1-daniel.thompson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom_aoss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c
+index e234d78b33e7..55c156aaf68a 100644
+--- a/drivers/soc/qcom/qcom_aoss.c
++++ b/drivers/soc/qcom/qcom_aoss.c
+@@ -501,7 +501,7 @@ static int qmp_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	ret = devm_request_irq(&pdev->dev, irq, qmp_intr, IRQF_ONESHOT,
++	ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0,
+ 			       "aoss-qmp", qmp);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to request interrupt\n");
+-- 
+2.34.1
+
diff --git a/queue-5.16/soc-qcom-ocmem-fix-missing-put_device-call-in-of_get.patch b/queue-5.16/soc-qcom-ocmem-fix-missing-put_device-call-in-of_get.patch
new file mode 100644
index 00000000000..dde9cb7ad14
--- /dev/null
+++ b/queue-5.16/soc-qcom-ocmem-fix-missing-put_device-call-in-of_get.patch
@@ -0,0 +1,37 @@
+From 461b72dcbd4bc30c3282fc3f3514f99eb3169b91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 07:31:26 +0000
+Subject: soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 0ff027027e05a866491bbb53494f0e2a61354c85 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling path.
+
+Fixes: 01f937ffc468 ("soc: qcom: ocmem: don't return NULL in of_get_ocmem")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220107073126.2335-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/ocmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c
+index d2dacbbaafbd..97fd24c178f8 100644
+--- a/drivers/soc/qcom/ocmem.c
++++ b/drivers/soc/qcom/ocmem.c
+@@ -206,6 +206,7 @@ struct ocmem *of_get_ocmem(struct device *dev)
+ 	ocmem = platform_get_drvdata(pdev);
+ 	if (!ocmem) {
+ 		dev_err(dev, "Cannot get ocmem\n");
++		put_device(&pdev->dev);
+ 		return ERR_PTR(-ENODEV);
+ 	}
+ 	return ocmem;
+-- 
+2.34.1
+
diff --git a/queue-5.16/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch b/queue-5.16/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
new file mode 100644
index 00000000000..d266eb758ae
--- /dev/null
+++ b/queue-5.16/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
@@ -0,0 +1,43 @@
+From d89afbfef1fca907acd4b974a14ecff5115d0478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Dec 2021 17:44:19 +0800
+Subject: soc: qcom: rpmpd: Check for null return of devm_kcalloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 5a811126d38f9767a20cc271b34db7c8efc5a46c ]
+
+Because of the possible failure of the allocation, data->domains might
+be NULL pointer and will cause the dereference of the NULL pointer
+later.
+Therefore, it might be better to check it and directly return -ENOMEM
+without releasing data manually if fails, because the comment of the
+devm_kmalloc() says "Memory allocated with this function is
+automatically freed on driver detach.".
+
+Fixes: bbe3a66c3f5a ("soc: qcom: rpmpd: Add a Power domain driver to model corners")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211231094419.1941054-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmpd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/soc/qcom/rpmpd.c b/drivers/soc/qcom/rpmpd.c
+index 4f69fb9b2e0e..69b587822e39 100644
+--- a/drivers/soc/qcom/rpmpd.c
++++ b/drivers/soc/qcom/rpmpd.c
+@@ -570,6 +570,9 @@ static int rpmpd_probe(struct platform_device *pdev)
+ 
+ 	data->domains = devm_kcalloc(&pdev->dev, num, sizeof(*data->domains),
+ 				     GFP_KERNEL);
++	if (!data->domains)
++		return -ENOMEM;
++
+ 	data->num_domains = num;
+ 
+ 	for (i = 0; i < num; i++) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch b/queue-5.16/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
new file mode 100644
index 00000000000..152154e7106
--- /dev/null
+++ b/queue-5.16/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
@@ -0,0 +1,47 @@
+From 34a92ce3d7111fb3e4906a7c56f87bf958e8022e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 06:28:40 +0000
+Subject: soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c3d66a164c726cc3b072232d3b6d87575d194084 ]
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+    int irq = platform_get_irq(pdev, 0);
+    if (irq < 0)
+        return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: cdd5de500b2c ("soc: ti: Add wkup_m3_ipc driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Acked-by: Dave Gerlach <d-gerlach@ti.com>
+Link: https://lore.kernel.org/r/20220114062840.16620-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/wkup_m3_ipc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index 72386bd393fe..2f03ced0f411 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -450,9 +450,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ 		return PTR_ERR(m3_ipc->ipc_mem_base);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
++	if (irq < 0) {
+ 		dev_err(&pdev->dev, "no irq resource\n");
+-		return -ENXIO;
++		return irq;
+ 	}
+ 
+ 	ret = devm_request_irq(dev, irq, wkup_m3_txev_handler,
+-- 
+2.34.1
+
diff --git a/queue-5.16/soundwire-intel-fix-wrong-register-name-in-intel_shi.patch b/queue-5.16/soundwire-intel-fix-wrong-register-name-in-intel_shi.patch
new file mode 100644
index 00000000000..dc09f27190e
--- /dev/null
+++ b/queue-5.16/soundwire-intel-fix-wrong-register-name-in-intel_shi.patch
@@ -0,0 +1,41 @@
+From 1db0698b2393241dfed54c3c5725108f401b6edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jan 2022 09:14:51 +0800
+Subject: soundwire: intel: fix wrong register name in intel_shim_wake
+
+From: Libin Yang <libin.yang@intel.com>
+
+[ Upstream commit 3957db3ae3dae6f8b8168791f154567fe49e1fd7 ]
+
+When clearing the sdw wakests status, we should use SDW_SHIM_WAKESTS.
+
+Fixes: 4a17c441c7cb ("soundwire: intel: revisit SHIM programming sequences.")
+Signed-off-by: Libin Yang <libin.yang@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20220126011451.27853-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 78037ffdb09b..f72d36654ac2 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -448,8 +448,8 @@ static void intel_shim_wake(struct sdw_intel *sdw, bool wake_enable)
+ 
+ 		/* Clear wake status */
+ 		wake_sts = intel_readw(shim, SDW_SHIM_WAKESTS);
+-		wake_sts |= (SDW_SHIM_WAKEEN_ENABLE << link_id);
+-		intel_writew(shim, SDW_SHIM_WAKESTS_STATUS, wake_sts);
++		wake_sts |= (SDW_SHIM_WAKESTS_STATUS << link_id);
++		intel_writew(shim, SDW_SHIM_WAKESTS, wake_sts);
+ 	}
+ 	mutex_unlock(sdw->link_res->shim_lock);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-fsi-implement-a-timeout-for-polling-status.patch b/queue-5.16/spi-fsi-implement-a-timeout-for-polling-status.patch
new file mode 100644
index 00000000000..5fbd390bbe4
--- /dev/null
+++ b/queue-5.16/spi-fsi-implement-a-timeout-for-polling-status.patch
@@ -0,0 +1,75 @@
+From 93ce1b3030224669d110560ae4bc5620dd439e07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 16:14:26 -0500
+Subject: spi: fsi: Implement a timeout for polling status
+
+From: Eddie James <eajames@linux.ibm.com>
+
+[ Upstream commit 89b35e3f28514087d3f1e28e8f5634fbfd07c554 ]
+
+The data transfer routines must poll the status register to
+determine when more data can be shifted in or out. If the hardware
+gets into a bad state, these polling loops may never exit. Prevent
+this by returning an error if a timeout is exceeded.
+
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220317211426.38940-1-eajames@linux.ibm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c
+index b6c7467f0b59..d403a7a3021d 100644
+--- a/drivers/spi/spi-fsi.c
++++ b/drivers/spi/spi-fsi.c
+@@ -25,6 +25,7 @@
+ 
+ #define SPI_FSI_BASE			0x70000
+ #define SPI_FSI_INIT_TIMEOUT_MS		1000
++#define SPI_FSI_STATUS_TIMEOUT_MS	100
+ #define SPI_FSI_MAX_RX_SIZE		8
+ #define SPI_FSI_MAX_TX_SIZE		40
+ 
+@@ -299,6 +300,7 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,
+ 				 struct spi_transfer *transfer)
+ {
+ 	int rc = 0;
++	unsigned long end;
+ 	u64 status = 0ULL;
+ 
+ 	if (transfer->tx_buf) {
+@@ -315,10 +317,14 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,
+ 			if (rc)
+ 				return rc;
+ 
++			end = jiffies + msecs_to_jiffies(SPI_FSI_STATUS_TIMEOUT_MS);
+ 			do {
+ 				rc = fsi_spi_status(ctx, &status, "TX");
+ 				if (rc)
+ 					return rc;
++
++				if (time_after(jiffies, end))
++					return -ETIMEDOUT;
+ 			} while (status & SPI_FSI_STATUS_TDR_FULL);
+ 
+ 			sent += nb;
+@@ -329,10 +335,14 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,
+ 		u8 *rx = transfer->rx_buf;
+ 
+ 		while (transfer->len > recv) {
++			end = jiffies + msecs_to_jiffies(SPI_FSI_STATUS_TIMEOUT_MS);
+ 			do {
+ 				rc = fsi_spi_status(ctx, &status, "RX");
+ 				if (rc)
+ 					return rc;
++
++				if (time_after(jiffies, end))
++					return -ETIMEDOUT;
+ 			} while (!(status & SPI_FSI_STATUS_RDR_FULL));
+ 
+ 			rc = fsi_spi_read_reg(ctx, SPI_FSI_DATA_RX, &in);
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch b/queue-5.16/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
new file mode 100644
index 00000000000..b14b7ba3374
--- /dev/null
+++ b/queue-5.16/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
@@ -0,0 +1,77 @@
+From e357fb2d4ef2dcb0e8be3459ff9559d971e7565e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 21:16:37 +0200
+Subject: spi: pxa2xx-pci: Balance reference count for PCI DMA device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 609d7ffdc42199a0ec949db057e3b4be6745d6c5 ]
+
+The pci_get_slot() increases its reference count, the caller
+must decrement the reference count by calling pci_dev_put().
+
+Fixes: 743485ea3bee ("spi: pxa2xx-pci: Do a specific setup in a separate function")
+Fixes: 25014521603f ("spi: pxa2xx-pci: Enable DMA for Intel Merrifield")
+Reported-by: Wang Qing <wangqing@vivo.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20220223191637.31147-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx-pci.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index 2e134eb4bd2c..6502fda6243e 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -76,14 +76,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ 	return true;
+ }
+ 
++static void lpss_dma_put_device(void *dma_dev)
++{
++	pci_dev_put(dma_dev);
++}
++
+ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+ 	struct pci_dev *dma_dev;
++	int ret;
+ 
+ 	c->num_chipselect = 1;
+ 	c->max_clk_rate = 50000000;
+ 
+ 	dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++	ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++	if (ret)
++		return ret;
+ 
+ 	if (c->tx_param) {
+ 		struct dw_dma_slave *slave = c->tx_param;
+@@ -107,8 +116,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ 
+ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+-	struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
+ 	struct dw_dma_slave *tx, *rx;
++	struct pci_dev *dma_dev;
++	int ret;
+ 
+ 	switch (PCI_FUNC(dev->devfn)) {
+ 	case 0:
+@@ -133,6 +143,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ 		return -ENODEV;
+ 	}
+ 
++	dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
++	ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++	if (ret)
++		return ret;
++
+ 	tx = c->tx_param;
+ 	tx->dma_dev = &dma_dev->dev;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-spi-zynqmp-gqspi-handle-error-for-dma_set_mask.patch b/queue-5.16/spi-spi-zynqmp-gqspi-handle-error-for-dma_set_mask.patch
new file mode 100644
index 00000000000..6812f2a4a4d
--- /dev/null
+++ b/queue-5.16/spi-spi-zynqmp-gqspi-handle-error-for-dma_set_mask.patch
@@ -0,0 +1,41 @@
+From 9d53a7b4f22d7be93264ed2824df3054bfc0e0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 17:20:51 +0800
+Subject: spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 13262fc26c1837c51a5131dbbdd67a2387f8bfc7 ]
+
+As the potential failure of the dma_set_mask(),
+it should be better to check it and return error
+if fails.
+
+Fixes: 126bdb606fd2 ("spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220302092051.121343-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 328b6559bb19..2b5afae8ff7f 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -1172,7 +1172,10 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ 		goto clk_dis_all;
+ 	}
+ 
+-	dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
++	ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
++	if (ret)
++		goto clk_dis_all;
++
+ 	ctlr->bits_per_word_mask = SPI_BPW_MASK(8);
+ 	ctlr->num_chipselect = GQSPI_DEFAULT_NUM_CS;
+ 	ctlr->mem_ops = &zynqmp_qspi_mem_ops;
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch b/queue-5.16/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
new file mode 100644
index 00000000000..e6c83a94a98
--- /dev/null
+++ b/queue-5.16/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
@@ -0,0 +1,41 @@
+From f42f1615527a97c9934a5d69437f4e7f3d1e5bfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 16:52:38 +0000
+Subject: spi: tegra114: Add missing IRQ check in tegra_spi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 4f92724d4b92c024e721063f520d66e11ca4b54b ]
+
+This func misses checking for platform_get_irq()'s call and may passes the
+negative error codes to request_threaded_irq(), which takes unsigned IRQ #,
+causing it to fail with -EINVAL, overriding an original error code.
+Stop calling request_threaded_irq() with invalid IRQ #s.
+
+Fixes: f333a331adfa ("spi/tegra114: add spi driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220128165238.25615-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index e9de1d958bbd..8f345247a8c3 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -1352,6 +1352,10 @@ static int tegra_spi_probe(struct platform_device *pdev)
+ 	tspi->phys = r->start;
+ 
+ 	spi_irq = platform_get_irq(pdev, 0);
++	if (spi_irq < 0) {
++		ret = spi_irq;
++		goto exit_free_master;
++	}
+ 	tspi->irq = spi_irq;
+ 
+ 	tspi->clk = devm_clk_get(&pdev->dev, "spi");
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-tegra20-use-of_device_get_match_data.patch b/queue-5.16/spi-tegra20-use-of_device_get_match_data.patch
new file mode 100644
index 00000000000..0257e3ddeff
--- /dev/null
+++ b/queue-5.16/spi-tegra20-use-of_device_get_match_data.patch
@@ -0,0 +1,43 @@
+From 33c14103c18df640a1f76c8ad76dc7d33b40b344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 02:31:38 +0000
+Subject: spi: tegra20: Use of_device_get_match_data()
+
+From: Minghao Chi <chi.minghao@zte.com.cn>
+
+[ Upstream commit c9839acfcbe20ce43d363c2a9d0772472d9921c0 ]
+
+Use of_device_get_match_data() to simplify the code.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
+Link: https://lore.kernel.org/r/20220315023138.2118293-1-chi.minghao@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index e8204e155484..746bbafa1378 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1003,14 +1003,8 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ 	struct resource		*r;
+ 	int ret, spi_irq;
+ 	const struct tegra_slink_chip_data *cdata = NULL;
+-	const struct of_device_id *match;
+ 
+-	match = of_match_device(tegra_slink_of_match, &pdev->dev);
+-	if (!match) {
+-		dev_err(&pdev->dev, "Error: No device match found\n");
+-		return -ENODEV;
+-	}
+-	cdata = match->data;
++	cdata = of_device_get_match_data(&pdev->dev);
+ 
+ 	master = spi_alloc_master(&pdev->dev, sizeof(*tspi));
+ 	if (!master) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/spi-tegra210-quad-fix-missin-irq-check-in-tegra_qspi.patch b/queue-5.16/spi-tegra210-quad-fix-missin-irq-check-in-tegra_qspi.patch
new file mode 100644
index 00000000000..12ead0e133c
--- /dev/null
+++ b/queue-5.16/spi-tegra210-quad-fix-missin-irq-check-in-tegra_qspi.patch
@@ -0,0 +1,39 @@
+From 281332e8eb6b655483b953e4d727a6fc0630843d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 16:59:56 +0000
+Subject: spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 47c3e06ed95aa9b74932dbc6b23b544f644faf84 ]
+
+This func misses checking for platform_get_irq()'s call and may passes the
+negative error codes to request_threaded_irq(), which takes unsigned IRQ #,
+causing it to fail with -EINVAL, overriding an original error code.
+Stop calling request_threaded_irq() with invalid IRQ #s.
+
+Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220128165956.27821-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra210-quad.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c
+index c0f9a75b44b5..27e6ce4fbd35 100644
+--- a/drivers/spi/spi-tegra210-quad.c
++++ b/drivers/spi/spi-tegra210-quad.c
+@@ -1249,6 +1249,8 @@ static int tegra_qspi_probe(struct platform_device *pdev)
+ 
+ 	tqspi->phys = r->start;
+ 	qspi_irq = platform_get_irq(pdev, 0);
++	if (qspi_irq < 0)
++		return qspi_irq;
+ 	tqspi->irq = qspi_irq;
+ 
+ 	tqspi->clk = devm_clk_get(&pdev->dev, "qspi");
+-- 
+2.34.1
+
diff --git a/queue-5.16/stack-constrain-and-fix-stack-offset-randomization-w.patch b/queue-5.16/stack-constrain-and-fix-stack-offset-randomization-w.patch
new file mode 100644
index 00000000000..80d26d57e65
--- /dev/null
+++ b/queue-5.16/stack-constrain-and-fix-stack-offset-randomization-w.patch
@@ -0,0 +1,106 @@
+From 2cd71de6942ac99bc55dac855fab4772a8216241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 10:05:21 +0100
+Subject: stack: Constrain and fix stack offset randomization with Clang builds
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit efa90c11f62e6b7252fb75efe2787056872a627c ]
+
+All supported versions of Clang perform auto-init of __builtin_alloca()
+when stack auto-init is on (CONFIG_INIT_STACK_ALL_{ZERO,PATTERN}).
+
+add_random_kstack_offset() uses __builtin_alloca() to add a stack
+offset. This means, when CONFIG_INIT_STACK_ALL_{ZERO,PATTERN} is
+enabled, add_random_kstack_offset() will auto-init that unused portion
+of the stack used to add an offset.
+
+There are several problems with this:
+
+	1. These offsets can be as large as 1023 bytes. Performing
+	   memset() on them isn't exactly cheap, and this is done on
+	   every syscall entry.
+
+	2. Architectures adding add_random_kstack_offset() to syscall
+	   entry implemented in C require them to be 'noinstr' (e.g. see
+	   x86 and s390). The potential problem here is that a call to
+	   memset may occur, which is not noinstr.
+
+A x86_64 defconfig kernel with Clang 11 and CONFIG_VMLINUX_VALIDATION shows:
+
+ | vmlinux.o: warning: objtool: do_syscall_64()+0x9d: call to memset() leaves .noinstr.text section
+ | vmlinux.o: warning: objtool: do_int80_syscall_32()+0xab: call to memset() leaves .noinstr.text section
+ | vmlinux.o: warning: objtool: __do_fast_syscall_32()+0xe2: call to memset() leaves .noinstr.text section
+ | vmlinux.o: warning: objtool: fixup_bad_iret()+0x2f: call to memset() leaves .noinstr.text section
+
+Clang 14 (unreleased) will introduce a way to skip alloca initialization
+via __builtin_alloca_uninitialized() (https://reviews.llvm.org/D115440).
+
+Constrain RANDOMIZE_KSTACK_OFFSET to only be enabled if no stack
+auto-init is enabled, the compiler is GCC, or Clang is version 14+. Use
+__builtin_alloca_uninitialized() if the compiler provides it, as is done
+by Clang 14.
+
+Link: https://lkml.kernel.org/r/YbHTKUjEejZCLyhX@elver.google.com
+Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall")
+Signed-off-by: Marco Elver <elver@google.com>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20220131090521.1947110-2-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/Kconfig                     |  1 +
+ include/linux/randomize_kstack.h | 16 ++++++++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index d3c4ab249e9c..a825f8251f3d 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -1159,6 +1159,7 @@ config HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET
+ config RANDOMIZE_KSTACK_OFFSET_DEFAULT
+ 	bool "Randomize kernel stack offset on syscall entry"
+ 	depends on HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET
++	depends on INIT_STACK_NONE || !CC_IS_CLANG || CLANG_VERSION >= 140000
+ 	help
+ 	  The kernel stack offset can be randomized (after pt_regs) by
+ 	  roughly 5 bits of entropy, frustrating memory corruption
+diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h
+index bebc911161b6..d373f1bcbf7c 100644
+--- a/include/linux/randomize_kstack.h
++++ b/include/linux/randomize_kstack.h
+@@ -16,8 +16,20 @@ DECLARE_PER_CPU(u32, kstack_offset);
+  * alignment. Also, since this use is being explicitly masked to a max of
+  * 10 bits, stack-clash style attacks are unlikely. For more details see
+  * "VLAs" in Documentation/process/deprecated.rst
++ *
++ * The normal __builtin_alloca() is initialized with INIT_STACK_ALL (currently
++ * only with Clang and not GCC). Initializing the unused area on each syscall
++ * entry is expensive, and generating an implicit call to memset() may also be
++ * problematic (such as in noinstr functions). Therefore, if the compiler
++ * supports it (which it should if it initializes allocas), always use the
++ * "uninitialized" variant of the builtin.
+  */
+-void *__builtin_alloca(size_t size);
++#if __has_builtin(__builtin_alloca_uninitialized)
++#define __kstack_alloca __builtin_alloca_uninitialized
++#else
++#define __kstack_alloca __builtin_alloca
++#endif
++
+ /*
+  * Use, at most, 10 bits of entropy. We explicitly cap this to keep the
+  * "VLA" from being unbounded (see above). 10 bits leaves enough room for
+@@ -36,7 +48,7 @@ void *__builtin_alloca(size_t size);
+ 	if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT,	\
+ 				&randomize_kstack_offset)) {		\
+ 		u32 offset = raw_cpu_read(kstack_offset);		\
+-		u8 *ptr = __builtin_alloca(KSTACK_OFFSET_MAX(offset));	\
++		u8 *ptr = __kstack_alloca(KSTACK_OFFSET_MAX(offset));	\
+ 		/* Keep allocation even after "ptr" loses scope. */	\
+ 		asm volatile("" :: "r"(ptr) : "memory");		\
+ 	}								\
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch b/queue-5.16/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
new file mode 100644
index 00000000000..aa05fc5bcd0
--- /dev/null
+++ b/queue-5.16/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
@@ -0,0 +1,44 @@
+From 9bc81a883f897e184e51347a54619cd91df8feeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 19:03:09 +0000
+Subject: staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit f281e4ddbbc0b60f061bc18a2834e9363ba85f9f ]
+
+The bit reversal was wrong for bits 1 and 3 of the 5 bits.
+Result is driver failure to probe if you have more than 2 daisy-chained
+devices.  Discovered via QEMU based device emulation.
+
+Fixes tag is for when this moved from a macro to a function, but it
+was broken before that.
+
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Fixes: 065a7c0b1fec ("Staging: iio: adc: ad7280a.c: Fixed Macro argument reuse")
+Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com>
+Link: https://lore.kernel.org/r/20220206190328.333093-2-jic23@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/adc/ad7280a.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
+index fef0055b8990..20183b2ea127 100644
+--- a/drivers/staging/iio/adc/ad7280a.c
++++ b/drivers/staging/iio/adc/ad7280a.c
+@@ -107,9 +107,9 @@
+ static unsigned int ad7280a_devaddr(unsigned int addr)
+ {
+ 	return ((addr & 0x1) << 4) |
+-	       ((addr & 0x2) << 3) |
++	       ((addr & 0x2) << 2) |
+ 	       (addr & 0x4) |
+-	       ((addr & 0x8) >> 3) |
++	       ((addr & 0x8) >> 2) |
+ 	       ((addr & 0x10) >> 4);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-mt7621-dts-fix-formatting.patch b/queue-5.16/staging-mt7621-dts-fix-formatting.patch
new file mode 100644
index 00000000000..b569fe517a2
--- /dev/null
+++ b/queue-5.16/staging-mt7621-dts-fix-formatting.patch
@@ -0,0 +1,114 @@
+From a420ba094b0556069398d70ba6606dc3ce5b7f67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 18:39:00 +0300
+Subject: staging: mt7621-dts: fix formatting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 7eeec44d33f6be7caca4fe9ca4e653cf315a36c1 ]
+
+Fix formatting on mt7621.dtsi.
+
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20220125153903.1469-2-arinc.unal@arinc9.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/mt7621-dts/mt7621.dtsi | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/mt7621-dts/mt7621.dtsi b/drivers/staging/mt7621-dts/mt7621.dtsi
+index 6d158e4f4b8c..25687f4fa671 100644
+--- a/drivers/staging/mt7621-dts/mt7621.dtsi
++++ b/drivers/staging/mt7621-dts/mt7621.dtsi
+@@ -44,9 +44,9 @@
+ 		regulator-max-microvolt = <3300000>;
+ 		enable-active-high;
+ 		regulator-always-on;
+-	  };
++	};
+ 
+-	  mmc_fixed_1v8_io: fixedregulator@1 {
++	mmc_fixed_1v8_io: fixedregulator@1 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "mmc_io";
+ 		regulator-min-microvolt = <1800000>;
+@@ -363,17 +363,18 @@
+ 
+ 		mediatek,ethsys = <&sysc>;
+ 
+-
+ 		gmac0: mac@0 {
+ 			compatible = "mediatek,eth-mac";
+ 			reg = <0>;
+ 			phy-mode = "rgmii";
++
+ 			fixed-link {
+ 				speed = <1000>;
+ 				full-duplex;
+ 				pause;
+ 			};
+ 		};
++
+ 		gmac1: mac@1 {
+ 			compatible = "mediatek,eth-mac";
+ 			reg = <1>;
+@@ -381,6 +382,7 @@
+ 			phy-mode = "rgmii-rxid";
+ 			phy-handle = <&phy_external>;
+ 		};
++
+ 		mdio-bus {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -411,36 +413,43 @@
+ 					#address-cells = <1>;
+ 					#size-cells = <0>;
+ 					reg = <0>;
++
+ 					port@0 {
+ 						status = "off";
+ 						reg = <0>;
+ 						label = "lan0";
+ 					};
++
+ 					port@1 {
+ 						status = "off";
+ 						reg = <1>;
+ 						label = "lan1";
+ 					};
++
+ 					port@2 {
+ 						status = "off";
+ 						reg = <2>;
+ 						label = "lan2";
+ 					};
++
+ 					port@3 {
+ 						status = "off";
+ 						reg = <3>;
+ 						label = "lan3";
+ 					};
++
+ 					port@4 {
+ 						status = "off";
+ 						reg = <4>;
+ 						label = "lan4";
+ 					};
++
+ 					port@6 {
+ 						reg = <6>;
+ 						label = "cpu";
+ 						ethernet = <&gmac0>;
+ 						phy-mode = "trgmii";
++
+ 						fixed-link {
+ 							speed = <1000>;
+ 							full-duplex;
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-mt7621-dts-fix-gb-pc2-devicetree.patch b/queue-5.16/staging-mt7621-dts-fix-gb-pc2-devicetree.patch
new file mode 100644
index 00000000000..c570451fbfd
--- /dev/null
+++ b/queue-5.16/staging-mt7621-dts-fix-gb-pc2-devicetree.patch
@@ -0,0 +1,172 @@
+From 7eee76c68ec1ce0984694f5a3eb15aa009306205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 12:03:20 +0300
+Subject: staging: mt7621-dts: fix GB-PC2 devicetree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 5bc148649cf358d0cccf525452a4efbd4bc89a0f ]
+
+Fix the GB-PC2 devicetree. Refer to the schematics of the device for more
+information.
+
+GB-PC2 devicetree fixes:
+- Include mt7621.dtsi instead of gbpc1.dts. Add the missing definitions.
+- Remove gpio-leds node as the system LED is not wired to anywhere on
+the board and the power LED is directly wired to GND.
+- Remove uart3 pin group from gpio-pinmux node as it's not used as GPIO.
+- Use reg 7 for the external phy to be on par with
+Documentation/devicetree/bindings/net/dsa/mt7530.txt.
+- Use the status value "okay".
+
+Link: https://github.com/ngiger/GnuBee_Docs/blob/master/GB-PCx/Documents/GB-PC2_V1.1_schematic.pdf
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20220311090320.3068-2-arinc.unal@arinc9.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/mt7621-dts/gbpc2.dts | 110 +++++++++++++++++++++++++--
+ 1 file changed, 102 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/staging/mt7621-dts/gbpc2.dts b/drivers/staging/mt7621-dts/gbpc2.dts
+index 03d6bb6735ac..a7fce8de6147 100644
+--- a/drivers/staging/mt7621-dts/gbpc2.dts
++++ b/drivers/staging/mt7621-dts/gbpc2.dts
+@@ -1,28 +1,122 @@
+ // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+ /dts-v1/;
+ 
+-#include "gbpc1.dts"
++#include "mt7621.dtsi"
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
+ 
+ / {
+ 	compatible = "gnubee,gb-pc2", "mediatek,mt7621-soc";
+ 	model = "GB-PC2";
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x00000000 0x1c000000>,
++		      <0x20000000 0x04000000>;
++	};
++
++	chosen {
++		bootargs = "console=ttyS0,57600";
++	};
++
++	palmbus: palmbus@1e000000 {
++		i2c@900 {
++			status = "okay";
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		reset {
++			label = "reset";
++			gpios = <&gpio 18 GPIO_ACTIVE_HIGH>;
++			linux,code = <KEY_RESTART>;
++		};
++	};
+ };
+ 
+-&default_gpio {
+-	groups = "wdt", "uart3";
+-	function = "gpio";
++&sdhci {
++	status = "okay";
++};
++
++&spi0 {
++	status = "okay";
++
++	m25p80@0 {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <50000000>;
++		broken-flash-reset;
++
++		partition@0 {
++			label = "u-boot";
++			reg = <0x0 0x30000>;
++			read-only;
++		};
++
++		partition@30000 {
++			label = "u-boot-env";
++			reg = <0x30000 0x10000>;
++			read-only;
++		};
++
++		factory: partition@40000 {
++			label = "factory";
++			reg = <0x40000 0x10000>;
++			read-only;
++		};
++
++		partition@50000 {
++			label = "firmware";
++			reg = <0x50000 0x1fb0000>;
++		};
++	};
++};
++
++&pcie {
++	status = "okay";
++};
++
++&pinctrl {
++	pinctrl-names = "default";
++	pinctrl-0 = <&state_default>;
++
++	state_default: state-default {
++		gpio-pinmux {
++			groups = "wdt";
++			function = "gpio";
++		};
++	};
+ };
+ 
+ &ethernet {
+ 	gmac1: mac@1 {
+-		status = "ok";
+-		phy-handle = <&phy_external>;
++		status = "okay";
++		phy-handle = <&ethphy7>;
+ 	};
+ 
+ 	mdio-bus {
+-		phy_external: ethernet-phy@5 {
+-			reg = <5>;
++		ethphy7: ethernet-phy@7 {
++			reg = <7>;
+ 			phy-mode = "rgmii-rxid";
+ 		};
+ 	};
+ };
++
++&switch0 {
++	ports {
++		port@0 {
++			status = "okay";
++			label = "ethblack";
++		};
++
++		port@4 {
++			status = "okay";
++			label = "ethblue";
++		};
++	};
++};
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch b/queue-5.16/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
new file mode 100644
index 00000000000..7a1cc1eb5ab
--- /dev/null
+++ b/queue-5.16/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
@@ -0,0 +1,139 @@
+From ede7025c8c2d3604220ce3afa9262ff3a3e6536f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 12:03:19 +0300
+Subject: staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 6256e18686158fa49e019297f990f1c1817aabf1 ]
+
+Fix LED and pinctrl definitions on the GB-PC1 devicetree. Refer to the
+schematics of the device for more information.
+
+LED fixes:
+- Change GPIO6 LED label from system to power as GPIO6 is connected to
+PLED.
+- Add default-on default-trigger to power LED.
+- Change GPIO8 LED label from status to system as GPIO8 is connected to
+SYS_LED.
+- Add disk-activity default-trigger to system LED.
+- Switch to the color:function naming scheme.
+- Remove lan1 and lan2 LEDs as they don't exist.
+
+Pinctrl fixes:
+- Claim state_default node under pinctrl node.
+- Change pinctrl0 node name to state-default.
+- Change gpio node name to gpio-pinmux to respect
+Documentation/devicetree/bindings/pinctrl/ralink,rt2880-pinmux.yaml.
+- Sort pin groups alphabetically.
+
+Misc fixes:
+- Fix formatting.
+- Use the status value "okay".
+- Define hexadecimal addresses in lower case.
+- Make hexadecimal addresses for memory easier to read.
+
+Link: https://github.com/ngiger/GnuBee_Docs/blob/master/GB-PCx/Documents/GB-PC1_V1.0_Schematic.pdf
+Tested-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20220311090320.3068-1-arinc.unal@arinc9.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/mt7621-dts/gbpc1.dts | 40 +++++++++++++---------------
+ 1 file changed, 18 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts
+index e38a083811e5..5ae94b1ad599 100644
+--- a/drivers/staging/mt7621-dts/gbpc1.dts
++++ b/drivers/staging/mt7621-dts/gbpc1.dts
+@@ -12,7 +12,8 @@
+ 
+ 	memory@0 {
+ 		device_type = "memory";
+-		reg = <0x0 0x1c000000>, <0x20000000 0x4000000>;
++		reg = <0x00000000 0x1c000000>,
++		      <0x20000000 0x04000000>;
+ 	};
+ 
+ 	chosen {
+@@ -38,24 +39,16 @@
+ 	gpio-leds {
+ 		compatible = "gpio-leds";
+ 
+-		system {
+-			label = "gb-pc1:green:system";
++		power {
++			label = "green:power";
+ 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "default-on";
+ 		};
+ 
+-		status {
+-			label = "gb-pc1:green:status";
++		system {
++			label = "green:system";
+ 			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+-		};
+-
+-		lan1 {
+-			label = "gb-pc1:green:lan1";
+-			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+-		};
+-
+-		lan2 {
+-			label = "gb-pc1:green:lan2";
+-			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "disk-activity";
+ 		};
+ 	};
+ };
+@@ -95,9 +88,8 @@
+ 
+ 		partition@50000 {
+ 			label = "firmware";
+-			reg = <0x50000 0x1FB0000>;
++			reg = <0x50000 0x1fb0000>;
+ 		};
+-
+ 	};
+ };
+ 
+@@ -106,9 +98,12 @@
+ };
+ 
+ &pinctrl {
+-	state_default: pinctrl0 {
+-		default_gpio: gpio {
+-			groups = "wdt", "rgmii2", "uart3";
++	pinctrl-names = "default";
++	pinctrl-0 = <&state_default>;
++
++	state_default: state-default {
++		gpio-pinmux {
++			groups = "rgmii2", "uart3", "wdt";
+ 			function = "gpio";
+ 		};
+ 	};
+@@ -117,12 +112,13 @@
+ &switch0 {
+ 	ports {
+ 		port@0 {
++			status = "okay";
+ 			label = "ethblack";
+-			status = "ok";
+ 		};
++
+ 		port@4 {
++			status = "okay";
+ 			label = "ethblue";
+-			status = "ok";
+ 		};
+ 	};
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-mt7621-dts-fix-pinctrl-properties-for-ethern.patch b/queue-5.16/staging-mt7621-dts-fix-pinctrl-properties-for-ethern.patch
new file mode 100644
index 00000000000..aa817f4cd32
--- /dev/null
+++ b/queue-5.16/staging-mt7621-dts-fix-pinctrl-properties-for-ethern.patch
@@ -0,0 +1,96 @@
+From ada8bf5b81791a7a9744f625608697951f21a2d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 18:39:03 +0300
+Subject: staging: mt7621-dts: fix pinctrl properties for ethernet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 0a93c0d75809582893e82039143591b9265b520e ]
+
+Add pinctrl properties with rgmii1 & mdio pins under ethernet node which
+was wrongfully put under an external phy node.
+GMAC1 will start working with this fix.
+
+Link: https://lore.kernel.org/netdev/02ecce91-7aad-4392-c9d7-f45ca1b31e0b@arinc9.com/T/
+
+Move GB-PC2 specific phy_external node to its own device tree.
+
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20220125153903.1469-5-arinc.unal@arinc9.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/mt7621-dts/gbpc2.dts   | 16 +++++++++++-----
+ drivers/staging/mt7621-dts/mt7621.dtsi | 13 +++----------
+ 2 files changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/staging/mt7621-dts/gbpc2.dts b/drivers/staging/mt7621-dts/gbpc2.dts
+index 6fe603c7711d..03d6bb6735ac 100644
+--- a/drivers/staging/mt7621-dts/gbpc2.dts
++++ b/drivers/staging/mt7621-dts/gbpc2.dts
+@@ -13,10 +13,16 @@
+ 	function = "gpio";
+ };
+ 
+-&gmac1 {
+-	status = "ok";
+-};
++&ethernet {
++	gmac1: mac@1 {
++		status = "ok";
++		phy-handle = <&phy_external>;
++	};
+ 
+-&phy_external {
+-	status = "ok";
++	mdio-bus {
++		phy_external: ethernet-phy@5 {
++			reg = <5>;
++			phy-mode = "rgmii-rxid";
++		};
++	};
+ };
+diff --git a/drivers/staging/mt7621-dts/mt7621.dtsi b/drivers/staging/mt7621-dts/mt7621.dtsi
+index 25687f4fa671..7b75e4a92b2a 100644
+--- a/drivers/staging/mt7621-dts/mt7621.dtsi
++++ b/drivers/staging/mt7621-dts/mt7621.dtsi
+@@ -363,6 +363,9 @@
+ 
+ 		mediatek,ethsys = <&sysc>;
+ 
++		pinctrl-names = "default";
++		pinctrl-0 = <&rgmii1_pins &rgmii2_pins &mdio_pins>;
++
+ 		gmac0: mac@0 {
+ 			compatible = "mediatek,eth-mac";
+ 			reg = <0>;
+@@ -380,22 +383,12 @@
+ 			reg = <1>;
+ 			status = "off";
+ 			phy-mode = "rgmii-rxid";
+-			phy-handle = <&phy_external>;
+ 		};
+ 
+ 		mdio-bus {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			phy_external: ethernet-phy@5 {
+-				status = "off";
+-				reg = <5>;
+-				phy-mode = "rgmii-rxid";
+-
+-				pinctrl-names = "default";
+-				pinctrl-0 = <&rgmii2_pins>;
+-			};
+-
+ 			switch0: switch0@0 {
+ 				compatible = "mediatek,mt7621";
+ 				#address-cells = <1>;
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-qlge-add-unregister_netdev-in-qlge_probe.patch b/queue-5.16/staging-qlge-add-unregister_netdev-in-qlge_probe.patch
new file mode 100644
index 00000000000..a2b35515519
--- /dev/null
+++ b/queue-5.16/staging-qlge-add-unregister_netdev-in-qlge_probe.patch
@@ -0,0 +1,57 @@
+From db8884fa55f5e7b278848d09dd0c6ee6cb377e2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 16:55:52 +0800
+Subject: staging: qlge: add unregister_netdev in qlge_probe
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+[ Upstream commit 4fcc0c275e3f59cd68f977c57953783f8014ed15 ]
+
+unregister_netdev need to be called when register_netdev succeeds
+qlge_health_create_reporters fails.
+
+Fixes: d8827ae8e22b ("staging: qlge: deal with the case that devlink_health_reporter_create fails")
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Link: https://lore.kernel.org/r/20220221085552.93561-1-hbh25y@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/qlge/qlge_main.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/qlge/qlge_main.c b/drivers/staging/qlge/qlge_main.c
+index 9873bb2a9ee4..113a3efd12e9 100644
+--- a/drivers/staging/qlge/qlge_main.c
++++ b/drivers/staging/qlge/qlge_main.c
+@@ -4605,14 +4605,12 @@ static int qlge_probe(struct pci_dev *pdev,
+ 	err = register_netdev(ndev);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "net device registration failed.\n");
+-		qlge_release_all(pdev);
+-		pci_disable_device(pdev);
+-		goto netdev_free;
++		goto cleanup_pdev;
+ 	}
+ 
+ 	err = qlge_health_create_reporters(qdev);
+ 	if (err)
+-		goto netdev_free;
++		goto unregister_netdev;
+ 
+ 	/* Start up the timer to trigger EEH if
+ 	 * the bus goes dead
+@@ -4626,6 +4624,11 @@ static int qlge_probe(struct pci_dev *pdev,
+ 	devlink_register(devlink);
+ 	return 0;
+ 
++unregister_netdev:
++	unregister_netdev(ndev);
++cleanup_pdev:
++	qlge_release_all(pdev);
++	pci_disable_device(pdev);
+ netdev_free:
+ 	free_netdev(ndev);
+ devlink_free:
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-r8188eu-convert-dbg_88e_level-call-in-hal-rt.patch b/queue-5.16/staging-r8188eu-convert-dbg_88e_level-call-in-hal-rt.patch
new file mode 100644
index 00000000000..bfd872a5d70
--- /dev/null
+++ b/queue-5.16/staging-r8188eu-convert-dbg_88e_level-call-in-hal-rt.patch
@@ -0,0 +1,38 @@
+From e2097abdf1d76c9c77074da4512d1aae742117d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Nov 2021 00:20:39 +0000
+Subject: staging: r8188eu: convert DBG_88E_LEVEL call in
+ hal/rtl8188e_hal_init.c
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit 5ec394d58bdba731c2a33645be7018e71f72f287 ]
+
+Convert DBG_88E_LEVEL macro call in hal/rtl8188e_hal_init.c to plain
+dev_dbg call, as although the information is potentially useful, we should
+be exposing it using standard kernel debugging functionality.
+
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20211129002041.865-6-phil@philpotter.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/hal/rtl8188e_hal_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+index 8c00f2dd67da..92c3c39e098f 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+@@ -541,7 +541,7 @@ static int load_firmware(struct rt_firmware *pFirmware, struct device *device)
+ 	memcpy(pFirmware->szFwBuffer, fw->data, fw->size);
+ 	pFirmware->ulFwLength = fw->size;
+ 	release_firmware(fw);
+-	DBG_88E_LEVEL(_drv_info_, "+%s: !bUsedWoWLANFw, FmrmwareLen:%d+\n", __func__, pFirmware->ulFwLength);
++	dev_dbg(device, "!bUsedWoWLANFw, FmrmwareLen:%d+\n", pFirmware->ulFwLength);
+ 
+ Exit:
+ 	return rtStatus;
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-r8188eu-fix-endless-loop-in-recv_func.patch b/queue-5.16/staging-r8188eu-fix-endless-loop-in-recv_func.patch
new file mode 100644
index 00000000000..670cc79476f
--- /dev/null
+++ b/queue-5.16/staging-r8188eu-fix-endless-loop-in-recv_func.patch
@@ -0,0 +1,40 @@
+From 87141fb46adf41e307313fe24d3c3df7b3a6c021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 19:14:53 +0100
+Subject: staging: r8188eu: fix endless loop in recv_func
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit 1327fcf175fa63d3b7a058b8148ed7714acdc035 ]
+
+Fix an endless loop in recv_func. If pending_frame is not NULL, we're
+stuck in the while loop forever. We have to call rtw_alloc_recvframe
+each time we loop.
+
+Fixes: 15865124feed ("staging: r8188eu: introduce new core dir for RTL8188eu driver")
+Reported-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Link: https://lore.kernel.org/r/20220226181457.1138035-4-martin@kaiser.cx
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/core/rtw_recv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/staging/r8188eu/core/rtw_recv.c b/drivers/staging/r8188eu/core/rtw_recv.c
+index 51a13262a226..d120d61454a3 100644
+--- a/drivers/staging/r8188eu/core/rtw_recv.c
++++ b/drivers/staging/r8188eu/core/rtw_recv.c
+@@ -1853,8 +1853,7 @@ static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
+ 		struct recv_frame *pending_frame;
+ 		int cnt = 0;
+ 
+-		pending_frame = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue);
+-		while (pending_frame) {
++		while ((pending_frame = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue))) {
+ 			cnt++;
+ 			recv_func_posthandle(padapter, pending_frame);
+ 		}
+-- 
+2.34.1
+
diff --git a/queue-5.16/staging-r8188eu-release_firmware-is-not-called-if-al.patch b/queue-5.16/staging-r8188eu-release_firmware-is-not-called-if-al.patch
new file mode 100644
index 00000000000..17d157af94f
--- /dev/null
+++ b/queue-5.16/staging-r8188eu-release_firmware-is-not-called-if-al.patch
@@ -0,0 +1,44 @@
+From fe9a5e4f050345c2adea6c348d8fa52b15ef57d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 11:36:04 +0100
+Subject: staging: r8188eu: release_firmware is not called if allocation fails
+
+From: Michael Straube <straube.linux@gmail.com>
+
+[ Upstream commit 39850edf2befe27bcb3d6c37b6ee76d2ee4df903 ]
+
+In function load_firmware() release_firmware() is not called if the
+allocation of pFirmware->szFwBuffer fails or if fw->size is greater
+than FW_8188E_SIZE.
+
+Move the call to release_firmware() to the exit label at the end of
+the function to fix this.
+
+Fixes: 8cd574e6af54 ("staging: r8188eu: introduce new hal dir for RTL8188eu driver")
+Signed-off-by: Michael Straube <straube.linux@gmail.com>
+Link: https://lore.kernel.org/r/20220107103620.15648-4-straube.linux@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/hal/rtl8188e_hal_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+index 92c3c39e098f..8656d4061059 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+@@ -540,10 +540,10 @@ static int load_firmware(struct rt_firmware *pFirmware, struct device *device)
+ 	}
+ 	memcpy(pFirmware->szFwBuffer, fw->data, fw->size);
+ 	pFirmware->ulFwLength = fw->size;
+-	release_firmware(fw);
+ 	dev_dbg(device, "!bUsedWoWLANFw, FmrmwareLen:%d+\n", pFirmware->ulFwLength);
+ 
+ Exit:
++	release_firmware(fw);
+ 	return rtStatus;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch b/queue-5.16/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch
new file mode 100644
index 00000000000..2772ffc2885
--- /dev/null
+++ b/queue-5.16/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch
@@ -0,0 +1,65 @@
+From 25f3f2067cbd7d55a7eda401b8172b2b649bdd33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 10:41:44 +1100
+Subject: SUNRPC/call_alloc: async tasks mustn't block waiting for memory
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit c487216bec83b0c5a8803e5c61433d33ad7b104d ]
+
+When memory is short, new worker threads cannot be created and we depend
+on the minimum one rpciod thread to be able to handle everything.
+So it must not block waiting for memory.
+
+mempools are particularly a problem as memory can only be released back
+to the mempool by an async rpc task running.  If all available
+workqueue threads are waiting on the mempool, no thread is available to
+return anything.
+
+rpc_malloc() can block, and this might cause deadlocks.
+So check RPC_IS_ASYNC(), rather than RPC_IS_SWAPPER() to determine if
+blocking is acceptable.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/sched.c              | 4 +++-
+ net/sunrpc/xprtrdma/transport.c | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index e2c835482791..d5b6e897f5a5 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -1023,8 +1023,10 @@ int rpc_malloc(struct rpc_task *task)
+ 	struct rpc_buffer *buf;
+ 	gfp_t gfp = GFP_NOFS;
+ 
++	if (RPC_IS_ASYNC(task))
++		gfp = GFP_NOWAIT | __GFP_NOWARN;
+ 	if (RPC_IS_SWAPPER(task))
+-		gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
++		gfp |= __GFP_MEMALLOC;
+ 
+ 	size += sizeof(struct rpc_buffer);
+ 	if (size <= RPC_BUFFER_MAXSIZE)
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 16e5696314a4..a52277115500 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -574,8 +574,10 @@ xprt_rdma_allocate(struct rpc_task *task)
+ 	gfp_t flags;
+ 
+ 	flags = RPCRDMA_DEF_GFP;
++	if (RPC_IS_ASYNC(task))
++		flags = GFP_NOWAIT | __GFP_NOWARN;
+ 	if (RPC_IS_SWAPPER(task))
+-		flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
++		flags |= __GFP_MEMALLOC;
+ 
+ 	if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize,
+ 				  flags))
+-- 
+2.34.1
+
diff --git a/queue-5.16/sunrpc-don-t-call-connect-more-than-once-on-a-tcp-so.patch b/queue-5.16/sunrpc-don-t-call-connect-more-than-once-on-a-tcp-so.patch
new file mode 100644
index 00000000000..d7f985e27aa
--- /dev/null
+++ b/queue-5.16/sunrpc-don-t-call-connect-more-than-once-on-a-tcp-so.patch
@@ -0,0 +1,85 @@
+From 95764f19cc07c9880adf67333f0f88c84a73b842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 19:10:43 -0400
+Subject: SUNRPC: Don't call connect() more than once on a TCP socket
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 89f42494f92f448747bd8a7ab1ae8b5d5520577d ]
+
+Avoid socket state races due to repeated calls to ->connect() using the
+same socket. If connect() returns 0 due to the connection having
+completed, but we are in fact in a closing state, then we may leave the
+XPRT_CONNECTING flag set on the transport.
+
+Reported-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Fixes: 3be232f11a3c ("SUNRPC: Prevent immediate close+reconnect")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/xprtsock.h |  1 +
+ net/sunrpc/xprtsock.c           | 22 ++++++++++++----------
+ 2 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/include/linux/sunrpc/xprtsock.h b/include/linux/sunrpc/xprtsock.h
+index 3c1423ee74b4..fed813ffe7db 100644
+--- a/include/linux/sunrpc/xprtsock.h
++++ b/include/linux/sunrpc/xprtsock.h
+@@ -88,5 +88,6 @@ struct sock_xprt {
+ #define XPRT_SOCK_WAKE_WRITE	(5)
+ #define XPRT_SOCK_WAKE_PENDING	(6)
+ #define XPRT_SOCK_WAKE_DISCONNECT	(7)
++#define XPRT_SOCK_CONNECT_SENT	(8)
+ 
+ #endif /* _LINUX_SUNRPC_XPRTSOCK_H */
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 821eeea1c83b..37d961c1a5c9 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2257,10 +2257,15 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ 
+ 	if (atomic_read(&xprt->swapper))
+ 		current->flags |= PF_MEMALLOC;
+-	if (!sock) {
+-		sock = xs_create_sock(xprt, transport,
+-				xs_addr(xprt)->sa_family, SOCK_STREAM,
+-				IPPROTO_TCP, true);
++
++	if (xprt_connected(xprt))
++		goto out;
++	if (test_and_clear_bit(XPRT_SOCK_CONNECT_SENT,
++			       &transport->sock_state) ||
++	    !sock) {
++		xs_reset_transport(transport);
++		sock = xs_create_sock(xprt, transport, xs_addr(xprt)->sa_family,
++				      SOCK_STREAM, IPPROTO_TCP, true);
+ 		if (IS_ERR(sock)) {
+ 			xprt_wake_pending_tasks(xprt, PTR_ERR(sock));
+ 			goto out;
+@@ -2284,6 +2289,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ 		fallthrough;
+ 	case -EINPROGRESS:
+ 		/* SYN_SENT! */
++		set_bit(XPRT_SOCK_CONNECT_SENT, &transport->sock_state);
+ 		if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+ 			xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+ 		fallthrough;
+@@ -2345,13 +2351,9 @@ static void xs_connect(struct rpc_xprt *xprt, struct rpc_task *task)
+ 
+ 	WARN_ON_ONCE(!xprt_lock_connect(xprt, task, transport));
+ 
+-	if (transport->sock != NULL && !xprt_connecting(xprt)) {
++	if (transport->sock != NULL) {
+ 		dprintk("RPC:       xs_connect delayed xprt %p for %lu "
+-				"seconds\n",
+-				xprt, xprt->reestablish_timeout / HZ);
+-
+-		/* Start by resetting any existing state */
+-		xs_reset_transport(transport);
++			"seconds\n", xprt, xprt->reestablish_timeout / HZ);
+ 
+ 		delay = xprt_reconnect_delay(xprt);
+ 		xprt_reconnect_backoff(xprt, XS_TCP_INIT_REEST_TO);
+-- 
+2.34.1
+
diff --git a/queue-5.16/sunrpc-don-t-resend-a-task-on-an-offlined-transport.patch b/queue-5.16/sunrpc-don-t-resend-a-task-on-an-offlined-transport.patch
new file mode 100644
index 00000000000..417ad9aa305
--- /dev/null
+++ b/queue-5.16/sunrpc-don-t-resend-a-task-on-an-offlined-transport.patch
@@ -0,0 +1,39 @@
+From 91b992ad830e946eb9f4a6314974d0026155e03f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 10:22:58 -0400
+Subject: SUNRPC don't resend a task on an offlined transport
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 82ee41b85cef16b4be1f4732650012d9baaedddd ]
+
+When a task is being retried, due to an NFS error, if the assigned
+transport has been put offline and the task is relocatable pick a new
+transport.
+
+Fixes: 6f081693e7b2b ("sunrpc: remove an offlined xprt using sysfs")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/clnt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 5985b78eddf1..b36d235d2d6d 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1065,7 +1065,9 @@ rpc_task_get_next_xprt(struct rpc_clnt *clnt)
+ static
+ void rpc_task_set_transport(struct rpc_task *task, struct rpc_clnt *clnt)
+ {
+-	if (task->tk_xprt)
++	if (task->tk_xprt &&
++			!(test_bit(XPRT_OFFLINE, &task->tk_xprt->state) &&
++                        (task->tk_flags & RPC_TASK_MOVEABLE)))
+ 		return;
+ 	if (task->tk_flags & RPC_TASK_NO_ROUND_ROBIN)
+ 		task->tk_xprt = rpc_task_get_first_xprt(clnt);
+-- 
+2.34.1
+
diff --git a/queue-5.16/sunrpc-improve-swap-handling-scheduling-and-pf_memal.patch b/queue-5.16/sunrpc-improve-swap-handling-scheduling-and-pf_memal.patch
new file mode 100644
index 00000000000..fee3088ef04
--- /dev/null
+++ b/queue-5.16/sunrpc-improve-swap-handling-scheduling-and-pf_memal.patch
@@ -0,0 +1,238 @@
+From 172b9eb06c5b0dc3064690f04e44b8a1649738b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 10:41:44 +1100
+Subject: SUNRPC: improve 'swap' handling: scheduling and PF_MEMALLOC
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 8db55a032ac7ac1ed7b98d6b1dc980e6378c652f ]
+
+rpc tasks can be marked as RPC_TASK_SWAPPER.  This causes GFP_MEMALLOC
+to be used for some allocations.  This is needed in some cases, but not
+in all where it is currently provided, and in some where it isn't
+provided.
+
+Currently *all* tasks associated with a rpc_client on which swap is
+enabled get the flag and hence some GFP_MEMALLOC support.
+
+GFP_MEMALLOC is provided for ->buf_alloc() but only swap-writes need it.
+However xdr_alloc_bvec does not get GFP_MEMALLOC - though it often does
+need it.
+
+xdr_alloc_bvec is called while the XPRT_LOCK is held.  If this blocks,
+then it blocks all other queued tasks.  So this allocation needs
+GFP_MEMALLOC for *all* requests, not just writes, when the xprt is used
+for any swap writes.
+
+Similarly, if the transport is not connected, that will block all
+requests including swap writes, so memory allocations should get
+GFP_MEMALLOC if swap writes are possible.
+
+So with this patch:
+ 1/ we ONLY set RPC_TASK_SWAPPER for swap writes.
+ 2/ __rpc_execute() sets PF_MEMALLOC while handling any task
+    with RPC_TASK_SWAPPER set, or when handling any task that
+    holds the XPRT_LOCKED lock on an xprt used for swap.
+    This removes the need for the RPC_IS_SWAPPER() test
+    in ->buf_alloc handlers.
+ 3/ xprt_prepare_transmit() sets PF_MEMALLOC after locking
+    any task to a swapper xprt.  __rpc_execute() will clear it.
+ 3/ PF_MEMALLOC is set for all the connect workers.
+
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com> (for xprtrdma parts)
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c                  |  2 ++
+ net/sunrpc/clnt.c               |  2 --
+ net/sunrpc/sched.c              | 20 +++++++++++++++++---
+ net/sunrpc/xprt.c               |  3 +++
+ net/sunrpc/xprtrdma/transport.c |  6 ++++--
+ net/sunrpc/xprtsock.c           |  8 ++++++++
+ 6 files changed, 34 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 7a23b4644507..e86aff429993 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1411,6 +1411,8 @@ static void nfs_initiate_write(struct nfs_pgio_header *hdr,
+ {
+ 	int priority = flush_task_priority(how);
+ 
++	if (IS_SWAPFILE(hdr->inode))
++		task_setup_data->flags |= RPC_TASK_SWAPPER;
+ 	task_setup_data->priority = priority;
+ 	rpc_ops->write_setup(hdr, msg, &task_setup_data->rpc_client);
+ 	trace_nfs_initiate_write(hdr);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index c83fe618767c..5985b78eddf1 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1085,8 +1085,6 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
+ 		task->tk_flags |= RPC_TASK_TIMEOUT;
+ 	if (clnt->cl_noretranstimeo)
+ 		task->tk_flags |= RPC_TASK_NO_RETRANS_TIMEOUT;
+-	if (atomic_read(&clnt->cl_swapper))
+-		task->tk_flags |= RPC_TASK_SWAPPER;
+ 	/* Add to the client's list of all tasks */
+ 	spin_lock(&clnt->cl_lock);
+ 	list_add_tail(&task->tk_task, &clnt->cl_tasks);
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index d5b6e897f5a5..ae295844ac55 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -876,6 +876,15 @@ void rpc_release_calldata(const struct rpc_call_ops *ops, void *calldata)
+ 		ops->rpc_release(calldata);
+ }
+ 
++static bool xprt_needs_memalloc(struct rpc_xprt *xprt, struct rpc_task *tk)
++{
++	if (!xprt)
++		return false;
++	if (!atomic_read(&xprt->swapper))
++		return false;
++	return test_bit(XPRT_LOCKED, &xprt->state) && xprt->snd_task == tk;
++}
++
+ /*
+  * This is the RPC `scheduler' (or rather, the finite state machine).
+  */
+@@ -884,6 +893,7 @@ static void __rpc_execute(struct rpc_task *task)
+ 	struct rpc_wait_queue *queue;
+ 	int task_is_async = RPC_IS_ASYNC(task);
+ 	int status = 0;
++	unsigned long pflags = current->flags;
+ 
+ 	WARN_ON_ONCE(RPC_IS_QUEUED(task));
+ 	if (RPC_IS_QUEUED(task))
+@@ -906,6 +916,10 @@ static void __rpc_execute(struct rpc_task *task)
+ 		}
+ 		if (!do_action)
+ 			break;
++		if (RPC_IS_SWAPPER(task) ||
++		    xprt_needs_memalloc(task->tk_xprt, task))
++			current->flags |= PF_MEMALLOC;
++
+ 		trace_rpc_task_run_action(task, do_action);
+ 		do_action(task);
+ 
+@@ -943,7 +957,7 @@ static void __rpc_execute(struct rpc_task *task)
+ 		rpc_clear_running(task);
+ 		spin_unlock(&queue->lock);
+ 		if (task_is_async)
+-			return;
++			goto out;
+ 
+ 		/* sync task: sleep here */
+ 		trace_rpc_task_sync_sleep(task, task->tk_action);
+@@ -967,6 +981,8 @@ static void __rpc_execute(struct rpc_task *task)
+ 
+ 	/* Release all resources associated with the task */
+ 	rpc_release_task(task);
++out:
++	current_restore_flags(pflags, PF_MEMALLOC);
+ }
+ 
+ /*
+@@ -1025,8 +1041,6 @@ int rpc_malloc(struct rpc_task *task)
+ 
+ 	if (RPC_IS_ASYNC(task))
+ 		gfp = GFP_NOWAIT | __GFP_NOWARN;
+-	if (RPC_IS_SWAPPER(task))
+-		gfp |= __GFP_MEMALLOC;
+ 
+ 	size += sizeof(struct rpc_buffer);
+ 	if (size <= RPC_BUFFER_MAXSIZE)
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 5388263f8fc8..396a74974f60 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1503,6 +1503,9 @@ bool xprt_prepare_transmit(struct rpc_task *task)
+ 		return false;
+ 
+ 	}
++	if (atomic_read(&xprt->swapper))
++		/* This will be clear in __rpc_execute */
++		current->flags |= PF_MEMALLOC;
+ 	return true;
+ }
+ 
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index a52277115500..6268af7e0310 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -239,8 +239,11 @@ xprt_rdma_connect_worker(struct work_struct *work)
+ 	struct rpcrdma_xprt *r_xprt = container_of(work, struct rpcrdma_xprt,
+ 						   rx_connect_worker.work);
+ 	struct rpc_xprt *xprt = &r_xprt->rx_xprt;
++	unsigned int pflags = current->flags;
+ 	int rc;
+ 
++	if (atomic_read(&xprt->swapper))
++		current->flags |= PF_MEMALLOC;
+ 	rc = rpcrdma_xprt_connect(r_xprt);
+ 	xprt_clear_connecting(xprt);
+ 	if (!rc) {
+@@ -254,6 +257,7 @@ xprt_rdma_connect_worker(struct work_struct *work)
+ 		rpcrdma_xprt_disconnect(r_xprt);
+ 	xprt_unlock_connect(xprt, r_xprt);
+ 	xprt_wake_pending_tasks(xprt, rc);
++	current_restore_flags(pflags, PF_MEMALLOC);
+ }
+ 
+ /**
+@@ -576,8 +580,6 @@ xprt_rdma_allocate(struct rpc_task *task)
+ 	flags = RPCRDMA_DEF_GFP;
+ 	if (RPC_IS_ASYNC(task))
+ 		flags = GFP_NOWAIT | __GFP_NOWARN;
+-	if (RPC_IS_SWAPPER(task))
+-		flags |= __GFP_MEMALLOC;
+ 
+ 	if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize,
+ 				  flags))
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 056fa0230359..821eeea1c83b 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2070,7 +2070,10 @@ static void xs_udp_setup_socket(struct work_struct *work)
+ 	struct rpc_xprt *xprt = &transport->xprt;
+ 	struct socket *sock;
+ 	int status = -EIO;
++	unsigned int pflags = current->flags;
+ 
++	if (atomic_read(&xprt->swapper))
++		current->flags |= PF_MEMALLOC;
+ 	sock = xs_create_sock(xprt, transport,
+ 			xs_addr(xprt)->sa_family, SOCK_DGRAM,
+ 			IPPROTO_UDP, false);
+@@ -2090,6 +2093,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
+ 	xprt_clear_connecting(xprt);
+ 	xprt_unlock_connect(xprt, transport);
+ 	xprt_wake_pending_tasks(xprt, status);
++	current_restore_flags(pflags, PF_MEMALLOC);
+ }
+ 
+ /**
+@@ -2249,7 +2253,10 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ 	struct socket *sock = transport->sock;
+ 	struct rpc_xprt *xprt = &transport->xprt;
+ 	int status;
++	unsigned int pflags = current->flags;
+ 
++	if (atomic_read(&xprt->swapper))
++		current->flags |= PF_MEMALLOC;
+ 	if (!sock) {
+ 		sock = xs_create_sock(xprt, transport,
+ 				xs_addr(xprt)->sa_family, SOCK_STREAM,
+@@ -2314,6 +2321,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ 	xprt_clear_connecting(xprt);
+ out_unlock:
+ 	xprt_unlock_connect(xprt, transport);
++	current_restore_flags(pflags, PF_MEMALLOC);
+ }
+ 
+ /**
+-- 
+2.34.1
+
diff --git a/queue-5.16/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch b/queue-5.16/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
new file mode 100644
index 00000000000..17c5d7dc8c3
--- /dev/null
+++ b/queue-5.16/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
@@ -0,0 +1,68 @@
+From afcc8659964827511fea18aec03a8325dd472d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 09:59:57 -0700
+Subject: tcp: ensure PMTU updates are processed during fastopen
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit ed0c99dc0f499ff8b6e75b5ae6092ab42be1ad39 ]
+
+tp->rx_opt.mss_clamp is not populated, yet, during TFO send so we
+rise it to the local MSS. tp->mss_cache is not updated, however:
+
+tcp_v6_connect():
+  tp->rx_opt.mss_clamp = IPV6_MIN_MTU - headers;
+  tcp_connect():
+     tcp_connect_init():
+       tp->mss_cache = min(mtu, tp->rx_opt.mss_clamp)
+     tcp_send_syn_data():
+       tp->rx_opt.mss_clamp = tp->advmss
+
+After recent fixes to ICMPv6 PTB handling we started dropping
+PMTU updates higher than tp->mss_cache. Because of the stale
+tp->mss_cache value PMTU updates during TFO are always dropped.
+
+Thanks to Wei for helping zero in on the problem and the fix!
+
+Fixes: c7bb4b89033b ("ipv6: tcp: drop silly ICMPv6 packet too big messages")
+Reported-by: Andre Nash <alnash@fb.com>
+Reported-by: Neil Spring <ntspring@fb.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20220321165957.1769954-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 2e6e5a70168e..3a8126dfcd4d 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3719,6 +3719,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
+  */
+ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ {
++	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct tcp_fastopen_request *fo = tp->fastopen_req;
+ 	int space, err = 0;
+@@ -3733,8 +3734,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ 	 * private TCP options. The cost is reduced data space in SYN :(
+ 	 */
+ 	tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp);
++	/* Sync mss_cache after updating the mss_clamp */
++	tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
+ 
+-	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
++	space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) -
+ 		MAX_TCP_OPTION_SPACE;
+ 
+ 	space = min_t(size_t, space, fo->size);
+-- 
+2.34.1
+
diff --git a/queue-5.16/thermal-int340x-check-for-null-after-calling-kmemdup.patch b/queue-5.16/thermal-int340x-check-for-null-after-calling-kmemdup.patch
new file mode 100644
index 00000000000..533d0e8c874
--- /dev/null
+++ b/queue-5.16/thermal-int340x-check-for-null-after-calling-kmemdup.patch
@@ -0,0 +1,45 @@
+From b64cb9ded204821bb5076063b6bcb67a2e452523 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jan 2022 09:48:53 +0800
+Subject: thermal: int340x: Check for NULL after calling kmemdup()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 38b16d6cfe54c820848bcfc999bc5e8a7da1cefb ]
+
+As the potential failure of the allocation, kmemdup() may return NULL.
+
+Then, 'bin_attr_data_vault.private' will be NULL, but
+'bin_attr_data_vault.size' is not 0, which is not consistent.
+
+Therefore, it is better to check the return value of kmemdup() to
+avoid the confusion.
+
+Fixes: 0ba13c763aac ("thermal/int340x_thermal: Export GDDV")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+index 68f61a738930..7ec2d6c7fe42 100644
+--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+@@ -468,6 +468,11 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv)
+ 	priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer,
+ 				   obj->package.elements[0].buffer.length,
+ 				   GFP_KERNEL);
++	if (!priv->data_vault) {
++		kfree(buffer.pointer);
++		return;
++	}
++
+ 	bin_attr_data_vault.private = priv->data_vault;
+ 	bin_attr_data_vault.size = obj->package.elements[0].buffer.length;
+ 	kfree(buffer.pointer);
+-- 
+2.34.1
+
diff --git a/queue-5.16/tipc-fix-the-timer-expires-after-interval-100ms.patch b/queue-5.16/tipc-fix-the-timer-expires-after-interval-100ms.patch
new file mode 100644
index 00000000000..aacb18fae7f
--- /dev/null
+++ b/queue-5.16/tipc-fix-the-timer-expires-after-interval-100ms.patch
@@ -0,0 +1,45 @@
+From 1fb8652bb6e4ae8f1b4dc876cbc508590ef1e63e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 11:22:29 +0700
+Subject: tipc: fix the timer expires after interval 100ms
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 6a7d8cff4a3301087dd139293e9bddcf63827282 ]
+
+In the timer callback function tipc_sk_timeout(), we're trying to
+reschedule another timeout to retransmit a setup request if destination
+link is congested. But we use the incorrect timeout value
+(msecs_to_jiffies(100)) instead of (jiffies + msecs_to_jiffies(100)),
+so that the timer expires immediately, it's irrelevant for original
+description.
+
+In this commit we correct the timeout value in sk_reset_timer()
+
+Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket")
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Link: https://lore.kernel.org/r/20220321042229.314288-1-hoang.h.le@dektech.com.au
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 7545321c3440..17f8c523e33b 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2852,7 +2852,8 @@ static void tipc_sk_retry_connect(struct sock *sk, struct sk_buff_head *list)
+ 
+ 	/* Try again later if dest link is congested */
+ 	if (tsk->cong_link_cnt) {
+-		sk_reset_timer(sk, &sk->sk_timer, msecs_to_jiffies(100));
++		sk_reset_timer(sk, &sk->sk_timer,
++			       jiffies + msecs_to_jiffies(100));
+ 		return;
+ 	}
+ 	/* Prepare SYN for retransmit */
+-- 
+2.34.1
+
diff --git a/queue-5.16/tomoyo-fix-__setup-handlers-return-values.patch b/queue-5.16/tomoyo-fix-__setup-handlers-return-values.patch
new file mode 100644
index 00000000000..87535450680
--- /dev/null
+++ b/queue-5.16/tomoyo-fix-__setup-handlers-return-values.patch
@@ -0,0 +1,72 @@
+From 32e788d79823be39f4d28c06a4ae718c0f4b4fc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 13:45:33 -0800
+Subject: TOMOYO: fix __setup handlers return values
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 39844b7e3084baecef52d1498b5fa81afa2cefa9 ]
+
+__setup() handlers should return 1 if the parameter is handled.
+Returning 0 causes the entire string to be added to init's
+environment strings (limited to 32 strings), unnecessarily polluting it.
+
+Using the documented strings "TOMOYO_loader=string1" and
+"TOMOYO_trigger=string2" causes an Unknown parameter message:
+  Unknown kernel command line parameters
+    "BOOT_IMAGE=/boot/bzImage-517rc5 TOMOYO_loader=string1 \
+     TOMOYO_trigger=string2", will be passed to user space.
+
+and these strings are added to init's environment string space:
+  Run /sbin/init as init process
+    with arguments:
+     /sbin/init
+    with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     TOMOYO_loader=string1
+     TOMOYO_trigger=string2
+
+With this change, these __setup handlers act as expected,
+and init's environment is not polluted with these strings.
+
+Fixes: 0e4ae0e0dec63 ("TOMOYO: Make several options configurable.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: https://lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: James Morris <jmorris@namei.org>
+Cc: Kentaro Takeda <takedakn@nttdata.co.jp>
+Cc: tomoyo-dev-en@lists.osdn.me
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/tomoyo/load_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
+index 3445ae6fd479..363b65be87ab 100644
+--- a/security/tomoyo/load_policy.c
++++ b/security/tomoyo/load_policy.c
+@@ -24,7 +24,7 @@ static const char *tomoyo_loader;
+ static int __init tomoyo_loader_setup(char *str)
+ {
+ 	tomoyo_loader = str;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("TOMOYO_loader=", tomoyo_loader_setup);
+@@ -64,7 +64,7 @@ static const char *tomoyo_trigger;
+ static int __init tomoyo_trigger_setup(char *str)
+ {
+ 	tomoyo_trigger = str;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("TOMOYO_trigger=", tomoyo_trigger_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.16/tools-testing-cxl-fix-root-port-to-host-bridge-assig.patch b/queue-5.16/tools-testing-cxl-fix-root-port-to-host-bridge-assig.patch
new file mode 100644
index 00000000000..997bb8fea64
--- /dev/null
+++ b/queue-5.16/tools-testing-cxl-fix-root-port-to-host-bridge-assig.patch
@@ -0,0 +1,35 @@
+From cd9fb99b1b5e6044da204e048a8453bdca1d9d0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jan 2022 16:31:56 -0800
+Subject: tools/testing/cxl: Fix root port to host bridge assignment
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit a4a0ce242fcd7022349212c4e2f795762e6ff050 ]
+
+Mocked root-ports are meant to be round-robin assigned to host-bridges.
+
+Fixes: 67dcdd4d3b83 ("tools/testing/cxl: Introduce a mocked-up CXL port hierarchy")
+Link: https://lore.kernel.org/r/164298431629.3018233.14004377108116384485.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/cxl/test/cxl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
+index cb32f9e27d5d..5a39b3fdcac4 100644
+--- a/tools/testing/cxl/test/cxl.c
++++ b/tools/testing/cxl/test/cxl.c
+@@ -488,7 +488,7 @@ static __init int cxl_test_init(void)
+ 
+ 	for (i = 0; i < ARRAY_SIZE(cxl_root_port); i++) {
+ 		struct platform_device *bridge =
+-			cxl_host_bridge[i / NR_CXL_ROOT_PORTS];
++			cxl_host_bridge[i % ARRAY_SIZE(cxl_host_bridge)];
+ 		struct platform_device *pdev;
+ 
+ 		pdev = platform_device_alloc("cxl_root_port", i);
+-- 
+2.34.1
+
diff --git a/queue-5.16/tracing-have-trace_define_enum-affect-trace-event-ty.patch b/queue-5.16/tracing-have-trace_define_enum-affect-trace-event-ty.patch
new file mode 100644
index 00000000000..b4715d604d2
--- /dev/null
+++ b/queue-5.16/tracing-have-trace_define_enum-affect-trace-event-ty.patch
@@ -0,0 +1,83 @@
+From 36c3c322909145f53c92217e558bccb5b27379b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 23:27:38 -0500
+Subject: tracing: Have TRACE_DEFINE_ENUM affect trace event types as well
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit b3bc8547d3be60898818885f5bf22d0a62e2eb48 ]
+
+The macro TRACE_DEFINE_ENUM is used to convert enums in the kernel to
+their actual value when they are exported to user space via the trace
+event format file.
+
+Currently only the enums in the "print fmt" (TP_printk in the TRACE_EVENT
+macro) have the enums converted. But the enums can be used to denote array
+size:
+
+        field:unsigned int fc_ineligible_rc[EXT4_FC_REASON_MAX]; offset:12;      size:36;        signed:0;
+
+The EXT4_FC_REASON_MAX has no meaning to userspace but it needs to know
+that information to know how to parse the array.
+
+Have the array indexes also be parsed as well.
+
+Link: https://lore.kernel.org/all/cover.1646922487.git.riteshh@linux.ibm.com/
+
+Reported-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Tested-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index c097d89ca946..f809d795a9a8 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2637,6 +2637,33 @@ static void update_event_printk(struct trace_event_call *call,
+ 	}
+ }
+ 
++static void update_event_fields(struct trace_event_call *call,
++				struct trace_eval_map *map)
++{
++	struct ftrace_event_field *field;
++	struct list_head *head;
++	char *ptr;
++	int len = strlen(map->eval_string);
++
++	head = trace_get_fields(call);
++	list_for_each_entry(field, head, link) {
++		ptr = strchr(field->type, '[');
++		if (!ptr)
++			continue;
++		ptr++;
++
++		if (!isalpha(*ptr) && *ptr != '_')
++			continue;
++
++		if (strncmp(map->eval_string, ptr, len) != 0)
++			continue;
++
++		ptr = eval_replace(ptr, map, len);
++		/* enum/sizeof string smaller than value */
++		WARN_ON_ONCE(!ptr);
++	}
++}
++
+ void trace_event_eval_update(struct trace_eval_map **map, int len)
+ {
+ 	struct trace_event_call *call, *p;
+@@ -2672,6 +2699,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
+ 					first = false;
+ 				}
+ 				update_event_printk(call, map[i]);
++				update_event_fields(call, map[i]);
+ 			}
+ 		}
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.16/tty-hvc-fix-return-value-of-__setup-handler.patch b/queue-5.16/tty-hvc-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..b697ec8bcbd
--- /dev/null
+++ b/queue-5.16/tty-hvc-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,50 @@
+From d4c5138af3bfcb7b3204f98c03f4bcb5aeff1be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 18:42:28 -0800
+Subject: tty: hvc: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 53819a0d97aace1425bb042829e3446952a9e8a9 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled or 0 to indicate that it was not handled.
+Add a pr_warn() message if the option value is invalid and then
+always return 1.
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 86b40567b917 ("tty: replace strict_strtoul() with kstrtoul()")
+Cc: Jingoo Han <jg1.han@samsung.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Julian Wiedmann <jwi@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220308024228.20477-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/hvc/hvc_iucv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
+index 82a76cac94de..32366caca662 100644
+--- a/drivers/tty/hvc/hvc_iucv.c
++++ b/drivers/tty/hvc/hvc_iucv.c
+@@ -1417,7 +1417,9 @@ static int __init hvc_iucv_init(void)
+  */
+ static	int __init hvc_iucv_config(char *val)
+ {
+-	 return kstrtoul(val, 10, &hvc_iucv_devices);
++	if (kstrtoul(val, 10, &hvc_iucv_devices))
++		pr_warn("hvc_iucv= invalid parameter value '%s'\n", val);
++	return 1;
+ }
+ 
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/uaccess-fix-nios2-and-microblaze-get_user_8.patch b/queue-5.16/uaccess-fix-nios2-and-microblaze-get_user_8.patch
new file mode 100644
index 00000000000..e6f424d57f7
--- /dev/null
+++ b/queue-5.16/uaccess-fix-nios2-and-microblaze-get_user_8.patch
@@ -0,0 +1,144 @@
+From e4bcb5998783ff05d9b45b3a16c8a659516e71b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 15:37:37 +0100
+Subject: uaccess: fix nios2 and microblaze get_user_8()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a97b693c3712f040c5802f32b2d685352e08cefa ]
+
+These two architectures implement 8-byte get_user() through
+a memcpy() into a four-byte variable, which won't fit.
+
+Use a temporary 64-bit variable instead here, and use a double
+cast the way that risc-v and openrisc do to avoid compile-time
+warnings.
+
+Fixes: 6a090e97972d ("arch/microblaze: support get_user() of size 8 bytes")
+Fixes: 5ccc6af5e88e ("nios2: Memory management")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/include/asm/uaccess.h | 18 +++++++++---------
+ arch/nios2/include/asm/uaccess.h      | 26 ++++++++++++++++----------
+ 2 files changed, 25 insertions(+), 19 deletions(-)
+
+diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
+index 5b6e0e7788f4..3fe96979d2c6 100644
+--- a/arch/microblaze/include/asm/uaccess.h
++++ b/arch/microblaze/include/asm/uaccess.h
+@@ -130,27 +130,27 @@ extern long __user_bad(void);
+ 
+ #define __get_user(x, ptr)						\
+ ({									\
+-	unsigned long __gu_val = 0;					\
+ 	long __gu_err;							\
+ 	switch (sizeof(*(ptr))) {					\
+ 	case 1:								\
+-		__get_user_asm("lbu", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lbu", (ptr), x, __gu_err);		\
+ 		break;							\
+ 	case 2:								\
+-		__get_user_asm("lhu", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lhu", (ptr), x, __gu_err);		\
+ 		break;							\
+ 	case 4:								\
+-		__get_user_asm("lw", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lw", (ptr), x, __gu_err);		\
+ 		break;							\
+-	case 8:								\
+-		__gu_err = __copy_from_user(&__gu_val, ptr, 8);		\
+-		if (__gu_err)						\
+-			__gu_err = -EFAULT;				\
++	case 8: {							\
++		__u64 __x = 0;						\
++		__gu_err = raw_copy_from_user(&__x, ptr, 8) ?		\
++							-EFAULT : 0;	\
++		(x) = (typeof(x))(typeof((x) - (x)))__x;		\
+ 		break;							\
++	}								\
+ 	default:							\
+ 		/* __gu_val = 0; __gu_err = -EINVAL;*/ __gu_err = __user_bad();\
+ 	}								\
+-	x = (__force __typeof__(*(ptr))) __gu_val;			\
+ 	__gu_err;							\
+ })
+ 
+diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
+index ba9340e96fd4..ca9285a915ef 100644
+--- a/arch/nios2/include/asm/uaccess.h
++++ b/arch/nios2/include/asm/uaccess.h
+@@ -88,6 +88,7 @@ extern __must_check long strnlen_user(const char __user *s, long n);
+ /* Optimized macros */
+ #define __get_user_asm(val, insn, addr, err)				\
+ {									\
++	unsigned long __gu_val;						\
+ 	__asm__ __volatile__(						\
+ 	"       movi    %0, %3\n"					\
+ 	"1:   " insn " %1, 0(%2)\n"					\
+@@ -96,14 +97,20 @@ extern __must_check long strnlen_user(const char __user *s, long n);
+ 	"       .section __ex_table,\"a\"\n"				\
+ 	"       .word 1b, 2b\n"						\
+ 	"       .previous"						\
+-	: "=&r" (err), "=r" (val)					\
++	: "=&r" (err), "=r" (__gu_val)					\
+ 	: "r" (addr), "i" (-EFAULT));					\
++	val = (__force __typeof__(*(addr)))__gu_val;			\
+ }
+ 
+-#define __get_user_unknown(val, size, ptr, err) do {			\
++extern void __get_user_unknown(void);
++
++#define __get_user_8(val, ptr, err) do {				\
++	u64 __val = 0;							\
+ 	err = 0;							\
+-	if (__copy_from_user(&(val), ptr, size)) {			\
++	if (raw_copy_from_user(&(__val), ptr, sizeof(val))) {		\
+ 		err = -EFAULT;						\
++	} else {							\
++		val = (typeof(val))(typeof((val) - (val)))__val;	\
+ 	}								\
+ 	} while (0)
+ 
+@@ -119,8 +126,11 @@ do {									\
+ 	case 4:								\
+ 		__get_user_asm(val, "ldw", ptr, err);			\
+ 		break;							\
++	case 8:								\
++		__get_user_8(val, ptr, err);				\
++		break;							\
+ 	default:							\
+-		__get_user_unknown(val, size, ptr, err);		\
++		__get_user_unknown();					\
+ 		break;							\
+ 	}								\
+ } while (0)
+@@ -129,9 +139,7 @@ do {									\
+ 	({								\
+ 	long __gu_err = -EFAULT;					\
+ 	const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);		\
+-	unsigned long __gu_val = 0;					\
+-	__get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
+-	(x) = (__force __typeof__(x))__gu_val;				\
++	__get_user_common(x, sizeof(*(ptr)), __gu_ptr, __gu_err);	\
+ 	__gu_err;							\
+ 	})
+ 
+@@ -139,11 +147,9 @@ do {									\
+ ({									\
+ 	long __gu_err = -EFAULT;					\
+ 	const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);		\
+-	unsigned long __gu_val = 0;					\
+ 	if (access_ok( __gu_ptr, sizeof(*__gu_ptr)))	\
+-		__get_user_common(__gu_val, sizeof(*__gu_ptr),		\
++		__get_user_common(x, sizeof(*__gu_ptr),			\
+ 			__gu_ptr, __gu_err);				\
+-	(x) = (__force __typeof__(x))__gu_val;				\
+ 	__gu_err;							\
+ })
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/uaccess-fix-type-mismatch-warnings-from-access_ok.patch b/queue-5.16/uaccess-fix-type-mismatch-warnings-from-access_ok.patch
new file mode 100644
index 00000000000..779d1464a4c
--- /dev/null
+++ b/queue-5.16/uaccess-fix-type-mismatch-warnings-from-access_ok.patch
@@ -0,0 +1,232 @@
+From fb7705344cf0227b37ddca8100b93186a9c08e3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 20:22:10 +0100
+Subject: uaccess: fix type mismatch warnings from access_ok()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 23fc539e81295b14b50c6ccc5baeb4f3d59d822d ]
+
+On some architectures, access_ok() does not do any argument type
+checking, so replacing the definition with a generic one causes
+a few warnings for harmless issues that were never caught before.
+
+Fix the ones that I found either through my own test builds or
+that were reported by the 0-day bot.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/process.c          |  2 +-
+ arch/arm/kernel/swp_emulate.c      |  2 +-
+ arch/arm/kernel/traps.c            |  2 +-
+ arch/csky/kernel/perf_callchain.c  |  2 +-
+ arch/csky/kernel/signal.c          |  2 +-
+ arch/nios2/kernel/signal.c         | 20 +++++++++++---------
+ arch/powerpc/lib/sstep.c           |  4 ++--
+ arch/riscv/kernel/perf_callchain.c |  4 ++--
+ arch/sparc/kernel/signal_32.c      |  2 +-
+ lib/test_lockup.c                  |  4 ++--
+ 10 files changed, 23 insertions(+), 21 deletions(-)
+
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index 8e90052f6f05..5f7f5aab361f 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -43,7 +43,7 @@ SYSCALL_DEFINE0(arc_gettls)
+ 	return task_thread_info(current)->thr_ptr;
+ }
+ 
+-SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
++SYSCALL_DEFINE3(arc_usr_cmpxchg, int __user *, uaddr, int, expected, int, new)
+ {
+ 	struct pt_regs *regs = current_pt_regs();
+ 	u32 uval;
+diff --git a/arch/arm/kernel/swp_emulate.c b/arch/arm/kernel/swp_emulate.c
+index 6166ba38bf99..b74bfcf94fb1 100644
+--- a/arch/arm/kernel/swp_emulate.c
++++ b/arch/arm/kernel/swp_emulate.c
+@@ -195,7 +195,7 @@ static int swp_handler(struct pt_regs *regs, unsigned int instr)
+ 		 destreg, EXTRACT_REG_NUM(instr, RT2_OFFSET), data);
+ 
+ 	/* Check access in reasonable access range for both SWP and SWPB */
+-	if (!access_ok((address & ~3), 4)) {
++	if (!access_ok((void __user *)(address & ~3), 4)) {
+ 		pr_debug("SWP{B} emulation: access to %p not allowed!\n",
+ 			 (void *)address);
+ 		res = -EFAULT;
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 90c887aa67a4..f74460d3bef5 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -575,7 +575,7 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ 	if (end < start || flags)
+ 		return -EINVAL;
+ 
+-	if (!access_ok(start, end - start))
++	if (!access_ok((void __user *)start, end - start))
+ 		return -EFAULT;
+ 
+ 	return __do_cache_op(start, end);
+diff --git a/arch/csky/kernel/perf_callchain.c b/arch/csky/kernel/perf_callchain.c
+index 35318a635a5f..75e1f9df5f60 100644
+--- a/arch/csky/kernel/perf_callchain.c
++++ b/arch/csky/kernel/perf_callchain.c
+@@ -49,7 +49,7 @@ static unsigned long user_backtrace(struct perf_callchain_entry_ctx *entry,
+ {
+ 	struct stackframe buftail;
+ 	unsigned long lr = 0;
+-	unsigned long *user_frame_tail = (unsigned long *)fp;
++	unsigned long __user *user_frame_tail = (unsigned long __user *)fp;
+ 
+ 	/* Check accessibility of one struct frame_tail beyond */
+ 	if (!access_ok(user_frame_tail, sizeof(buftail)))
+diff --git a/arch/csky/kernel/signal.c b/arch/csky/kernel/signal.c
+index c7b763d2f526..8867ddf3e6c7 100644
+--- a/arch/csky/kernel/signal.c
++++ b/arch/csky/kernel/signal.c
+@@ -136,7 +136,7 @@ static inline void __user *get_sigframe(struct ksignal *ksig,
+ static int
+ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+ {
+-	struct rt_sigframe *frame;
++	struct rt_sigframe __user *frame;
+ 	int err = 0;
+ 
+ 	frame = get_sigframe(ksig, regs, sizeof(*frame));
+diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
+index 2009ae2d3c3b..386e46443b60 100644
+--- a/arch/nios2/kernel/signal.c
++++ b/arch/nios2/kernel/signal.c
+@@ -36,10 +36,10 @@ struct rt_sigframe {
+ 
+ static inline int rt_restore_ucontext(struct pt_regs *regs,
+ 					struct switch_stack *sw,
+-					struct ucontext *uc, int *pr2)
++					struct ucontext __user *uc, int *pr2)
+ {
+ 	int temp;
+-	unsigned long *gregs = uc->uc_mcontext.gregs;
++	unsigned long __user *gregs = uc->uc_mcontext.gregs;
+ 	int err;
+ 
+ 	/* Always make any pending restarted system calls return -EINTR */
+@@ -102,10 +102,11 @@ asmlinkage int do_rt_sigreturn(struct switch_stack *sw)
+ {
+ 	struct pt_regs *regs = (struct pt_regs *)(sw + 1);
+ 	/* Verify, can we follow the stack back */
+-	struct rt_sigframe *frame = (struct rt_sigframe *) regs->sp;
++	struct rt_sigframe __user *frame;
+ 	sigset_t set;
+ 	int rval;
+ 
++	frame = (struct rt_sigframe __user *) regs->sp;
+ 	if (!access_ok(frame, sizeof(*frame)))
+ 		goto badframe;
+ 
+@@ -124,10 +125,10 @@ asmlinkage int do_rt_sigreturn(struct switch_stack *sw)
+ 	return 0;
+ }
+ 
+-static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
++static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs)
+ {
+ 	struct switch_stack *sw = (struct switch_stack *)regs - 1;
+-	unsigned long *gregs = uc->uc_mcontext.gregs;
++	unsigned long __user *gregs = uc->uc_mcontext.gregs;
+ 	int err = 0;
+ 
+ 	err |= __put_user(MCONTEXT_VERSION, &uc->uc_mcontext.version);
+@@ -162,8 +163,9 @@ static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
+ 	return err;
+ }
+ 
+-static inline void *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
+-				 size_t frame_size)
++static inline void __user *get_sigframe(struct ksignal *ksig,
++					struct pt_regs *regs,
++					size_t frame_size)
+ {
+ 	unsigned long usp;
+ 
+@@ -174,13 +176,13 @@ static inline void *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
+ 	usp = sigsp(usp, ksig);
+ 
+ 	/* Verify, is it 32 or 64 bit aligned */
+-	return (void *)((usp - frame_size) & -8UL);
++	return (void __user *)((usp - frame_size) & -8UL);
+ }
+ 
+ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ 			  struct pt_regs *regs)
+ {
+-	struct rt_sigframe *frame;
++	struct rt_sigframe __user *frame;
+ 	int err = 0;
+ 
+ 	frame = get_sigframe(ksig, regs, sizeof(*frame));
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index b042fcae3913..66d6f7003b18 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -112,9 +112,9 @@ static nokprobe_inline long address_ok(struct pt_regs *regs,
+ {
+ 	if (!user_mode(regs))
+ 		return 1;
+-	if (__access_ok(ea, nb))
++	if (access_ok((void __user *)ea, nb))
+ 		return 1;
+-	if (__access_ok(ea, 1))
++	if (access_ok((void __user *)ea, 1))
+ 		/* Access overlaps the end of the user region */
+ 		regs->dar = TASK_SIZE_MAX - 1;
+ 	else
+diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c
+index d82c291c1e4c..357f985041cb 100644
+--- a/arch/riscv/kernel/perf_callchain.c
++++ b/arch/riscv/kernel/perf_callchain.c
+@@ -15,8 +15,8 @@ static unsigned long user_backtrace(struct perf_callchain_entry_ctx *entry,
+ {
+ 	struct stackframe buftail;
+ 	unsigned long ra = 0;
+-	unsigned long *user_frame_tail =
+-			(unsigned long *)(fp - sizeof(struct stackframe));
++	unsigned long __user *user_frame_tail =
++		(unsigned long __user *)(fp - sizeof(struct stackframe));
+ 
+ 	/* Check accessibility of one struct frame_tail beyond */
+ 	if (!access_ok(user_frame_tail, sizeof(buftail)))
+diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
+index ffab16369bea..74f80443b195 100644
+--- a/arch/sparc/kernel/signal_32.c
++++ b/arch/sparc/kernel/signal_32.c
+@@ -65,7 +65,7 @@ struct rt_signal_frame {
+  */
+ static inline bool invalid_frame_pointer(void __user *fp, int fplen)
+ {
+-	if ((((unsigned long) fp) & 15) || !__access_ok((unsigned long)fp, fplen))
++	if ((((unsigned long) fp) & 15) || !access_ok(fp, fplen))
+ 		return true;
+ 
+ 	return false;
+diff --git a/lib/test_lockup.c b/lib/test_lockup.c
+index 906b598740a7..6a0f329a794a 100644
+--- a/lib/test_lockup.c
++++ b/lib/test_lockup.c
+@@ -417,8 +417,8 @@ static bool test_kernel_ptr(unsigned long addr, int size)
+ 		return false;
+ 
+ 	/* should be at least readable kernel address */
+-	if (access_ok(ptr, 1) ||
+-	    access_ok(ptr + size - 1, 1) ||
++	if (access_ok((void __user *)ptr, 1) ||
++	    access_ok((void __user *)ptr + size - 1, 1) ||
+ 	    get_kernel_nofault(buf, ptr) ||
+ 	    get_kernel_nofault(buf, ptr + size - 1)) {
+ 		pr_err("invalid kernel ptr: %#lx\n", addr);
+-- 
+2.34.1
+
diff --git a/queue-5.16/udmabuf-validate-ubuf-pagecount.patch b/queue-5.16/udmabuf-validate-ubuf-pagecount.patch
new file mode 100644
index 00000000000..d809b663d71
--- /dev/null
+++ b/queue-5.16/udmabuf-validate-ubuf-pagecount.patch
@@ -0,0 +1,47 @@
+From 17e30eeb03e030120844e0a2516983f4b5657120 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 17:26:49 +0300
+Subject: udmabuf: validate ubuf->pagecount
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 2b6dd600dd72573c23ea180b5b0b2f1813405882 ]
+
+Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
+problem was in ubuf->pages == ZERO_PTR.
+
+ubuf->pagecount is calculated from arguments passed from user-space. If
+user creates udmabuf with list.size == 0 then ubuf->pagecount will be
+also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
+
+Fix it by validating ubuf->pagecount before passing it to
+kmalloc_array().
+
+Fixes: fbb0de795078 ("Add udmabuf misc device")
+Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/udmabuf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index c57a609db75b..e7330684d3b8 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
+ 		if (ubuf->pagecount > pglimit)
+ 			goto err;
+ 	}
++
++	if (!ubuf->pagecount)
++		goto err;
++
+ 	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
+ 				    GFP_KERNEL);
+ 	if (!ubuf->pages) {
+-- 
+2.34.1
+
diff --git a/queue-5.16/usb-gadget-eliminate-anonymous-module_init-module_ex.patch b/queue-5.16/usb-gadget-eliminate-anonymous-module_init-module_ex.patch
new file mode 100644
index 00000000000..415d9cf082c
--- /dev/null
+++ b/queue-5.16/usb-gadget-eliminate-anonymous-module_init-module_ex.patch
@@ -0,0 +1,150 @@
+From 2ad5c3d574b13111e65c363fb99dc4325bdc8b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:07 -0700
+Subject: usb: gadget: eliminate anonymous module_init & module_exit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6653b827613aa301de691842c38f01e874604f88 ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: bd25a14edb75 ("usb: gadget: legacy/serial: allow dynamic removal")
+Fixes: 7bb5ea54be47 ("usb gadget serial: use composite gadget framework")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Cc: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: linux-usb@vger.kernel.org
+Link: https://lore.kernel.org/r/20220316192010.19001-7-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/legacy/inode.c  |  8 ++++----
+ drivers/usb/gadget/legacy/serial.c | 10 +++++-----
+ drivers/usb/gadget/udc/dummy_hcd.c |  8 ++++----
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 25c8809e0a38..3818296d1aa4 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -2101,7 +2101,7 @@ MODULE_ALIAS_FS("gadgetfs");
+ 
+ /*----------------------------------------------------------------------*/
+ 
+-static int __init init (void)
++static int __init gadgetfs_init (void)
+ {
+ 	int status;
+ 
+@@ -2111,12 +2111,12 @@ static int __init init (void)
+ 			shortname, driver_desc);
+ 	return status;
+ }
+-module_init (init);
++module_init (gadgetfs_init);
+ 
+-static void __exit cleanup (void)
++static void __exit gadgetfs_cleanup (void)
+ {
+ 	pr_debug ("unregister %s\n", shortname);
+ 	unregister_filesystem (&gadgetfs_type);
+ }
+-module_exit (cleanup);
++module_exit (gadgetfs_cleanup);
+ 
+diff --git a/drivers/usb/gadget/legacy/serial.c b/drivers/usb/gadget/legacy/serial.c
+index da44f89f5e73..dcd3a6603d90 100644
+--- a/drivers/usb/gadget/legacy/serial.c
++++ b/drivers/usb/gadget/legacy/serial.c
+@@ -273,7 +273,7 @@ static struct usb_composite_driver gserial_driver = {
+ static int switch_gserial_enable(bool do_enable)
+ {
+ 	if (!serial_config_driver.label)
+-		/* init() was not called, yet */
++		/* gserial_init() was not called, yet */
+ 		return 0;
+ 
+ 	if (do_enable)
+@@ -283,7 +283,7 @@ static int switch_gserial_enable(bool do_enable)
+ 	return 0;
+ }
+ 
+-static int __init init(void)
++static int __init gserial_init(void)
+ {
+ 	/* We *could* export two configs; that'd be much cleaner...
+ 	 * but neither of these product IDs was defined that way.
+@@ -314,11 +314,11 @@ static int __init init(void)
+ 
+ 	return usb_composite_probe(&gserial_driver);
+ }
+-module_init(init);
++module_init(gserial_init);
+ 
+-static void __exit cleanup(void)
++static void __exit gserial_cleanup(void)
+ {
+ 	if (enable)
+ 		usb_composite_unregister(&gserial_driver);
+ }
+-module_exit(cleanup);
++module_exit(gserial_cleanup);
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index a2d956af42a2..b8cde6d94e4b 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -2765,7 +2765,7 @@ static struct platform_driver dummy_hcd_driver = {
+ static struct platform_device *the_udc_pdev[MAX_NUM_UDC];
+ static struct platform_device *the_hcd_pdev[MAX_NUM_UDC];
+ 
+-static int __init init(void)
++static int __init dummy_hcd_init(void)
+ {
+ 	int	retval = -ENOMEM;
+ 	int	i;
+@@ -2887,9 +2887,9 @@ static int __init init(void)
+ 		platform_device_put(the_hcd_pdev[i]);
+ 	return retval;
+ }
+-module_init(init);
++module_init(dummy_hcd_init);
+ 
+-static void __exit cleanup(void)
++static void __exit dummy_hcd_cleanup(void)
+ {
+ 	int i;
+ 
+@@ -2905,4 +2905,4 @@ static void __exit cleanup(void)
+ 	platform_driver_unregister(&dummy_udc_driver);
+ 	platform_driver_unregister(&dummy_hcd_driver);
+ }
+-module_exit(cleanup);
++module_exit(dummy_hcd_cleanup);
+-- 
+2.34.1
+
diff --git a/queue-5.16/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch b/queue-5.16/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
new file mode 100644
index 00000000000..c90a364db72
--- /dev/null
+++ b/queue-5.16/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
@@ -0,0 +1,39 @@
+From 26462f482b2f3b6f4e934ef397d29cdc7db7d664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 10:35:04 +0300
+Subject: USB: storage: ums-realtek: fix error code in rts51x_read_mem()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b07cabb8361dc692522538205552b1b9dab134be ]
+
+The rts51x_read_mem() function should return negative error codes.
+Currently if the kmalloc() fails it returns USB_STOR_TRANSPORT_ERROR (3)
+which is treated as success by the callers.
+
+Fixes: 065e60964e29 ("ums_realtek: do not use stack memory for DMA")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20220304073504.GA26464@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/realtek_cr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 3789698d9d3c..0c423916d7bf 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -365,7 +365,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len)
+ 
+ 	buf = kmalloc(len, GFP_NOIO);
+ 	if (buf == NULL)
+-		return USB_STOR_TRANSPORT_ERROR;
++		return -ENOMEM;
+ 
+ 	usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/usb-usbip-eliminate-anonymous-module_init-module_exi.patch b/queue-5.16/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
new file mode 100644
index 00000000000..1e4d1333a38
--- /dev/null
+++ b/queue-5.16/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
@@ -0,0 +1,81 @@
+From 8a2ad8a28926701681da184e595edf576aa735fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:08 -0700
+Subject: usb: usbip: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 393dcd1f2b75e50783c805814a96bf6c8e11fe03 ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: 80fd9cd52de6 ("usbip: vudc: Add VUDC main file")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Krzysztof Opasiak <k.opasiak@samsung.com>
+Cc: Igor Kotrasinski <i.kotrasinsk@samsung.com>
+Cc: Valentina Manea <valentina.manea.m@gmail.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Shuah Khan <skhan@linuxfoundation.org>
+Cc: linux-usb@vger.kernel.org
+Link: https://lore.kernel.org/r/20220316192010.19001-8-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vudc_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c
+index 678faa82598c..1ff277764093 100644
+--- a/drivers/usb/usbip/vudc_main.c
++++ b/drivers/usb/usbip/vudc_main.c
+@@ -28,7 +28,7 @@ static struct platform_driver vudc_driver = {
+ 
+ static struct list_head vudc_devices = LIST_HEAD_INIT(vudc_devices);
+ 
+-static int __init init(void)
++static int __init vudc_init(void)
+ {
+ 	int retval = -ENOMEM;
+ 	int i;
+@@ -86,9 +86,9 @@ static int __init init(void)
+ out:
+ 	return retval;
+ }
+-module_init(init);
++module_init(vudc_init);
+ 
+-static void __exit cleanup(void)
++static void __exit vudc_cleanup(void)
+ {
+ 	struct vudc_device *udc_dev = NULL, *udc_dev2 = NULL;
+ 
+@@ -103,7 +103,7 @@ static void __exit cleanup(void)
+ 	}
+ 	platform_driver_unregister(&vudc_driver);
+ }
+-module_exit(cleanup);
++module_exit(vudc_cleanup);
+ 
+ MODULE_DESCRIPTION("USB over IP Device Controller");
+ MODULE_AUTHOR("Krzysztof Opasiak, Karol Kosik, Igor Kotrasinski");
+-- 
+2.34.1
+
diff --git a/queue-5.16/vfio-pci-fix-memory-leak-during-d3hot-to-d0-transiti.patch b/queue-5.16/vfio-pci-fix-memory-leak-during-d3hot-to-d0-transiti.patch
new file mode 100644
index 00000000000..34a52ec8723
--- /dev/null
+++ b/queue-5.16/vfio-pci-fix-memory-leak-during-d3hot-to-d0-transiti.patch
@@ -0,0 +1,66 @@
+From 5a9f6db30b258b770a71c84bba4899835351e266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 17:51:06 +0530
+Subject: vfio/pci: fix memory leak during D3hot to D0 transition
+
+From: Abhishek Sahu <abhsahu@nvidia.com>
+
+[ Upstream commit eadf88ecf6ac7d6a9f47a76c6055d9a1987a8991 ]
+
+If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does
+not have No_Soft_Reset bit set in its PMCSR config register), then
+the current PCI state will be saved locally in
+'vfio_pci_core_device::pm_save' during D0->D3hot transition and same
+will be restored back during D3hot->D0 transition.
+For saving the PCI state locally, pci_store_saved_state() is being
+used and the pci_load_and_free_saved_state() will free the allocated
+memory.
+
+But for reset related IOCTLs, vfio driver calls PCI reset-related
+API's which will internally change the PCI power state back to D0. So,
+when the guest resumes, then it will get the current state as D0 and it
+will skip the call to vfio_pci_set_power_state() for changing the
+power state to D0 explicitly. In this case, the memory pointed by
+'pm_save' will never be freed. In a malicious sequence, the state changing
+to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be
+run in a loop and it can cause an OOM situation.
+
+This patch frees the earlier allocated memory first before overwriting
+'pm_save' to prevent the mentioned memory leak.
+
+Fixes: 51ef3a004b1e ("vfio/pci: Restore device state on PM transition")
+Signed-off-by: Abhishek Sahu <abhsahu@nvidia.com>
+Link: https://lore.kernel.org/r/20220217122107.22434-2-abhsahu@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_core.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
+index f948e6cd2993..87b288affc13 100644
+--- a/drivers/vfio/pci/vfio_pci_core.c
++++ b/drivers/vfio/pci/vfio_pci_core.c
+@@ -228,6 +228,19 @@ int vfio_pci_set_power_state(struct vfio_pci_core_device *vdev, pci_power_t stat
+ 	if (!ret) {
+ 		/* D3 might be unsupported via quirk, skip unless in D3 */
+ 		if (needs_save && pdev->current_state >= PCI_D3hot) {
++			/*
++			 * The current PCI state will be saved locally in
++			 * 'pm_save' during the D3hot transition. When the
++			 * device state is changed to D0 again with the current
++			 * function, then pci_store_saved_state() will restore
++			 * the state and will free the memory pointed by
++			 * 'pm_save'. There are few cases where the PCI power
++			 * state can be changed to D0 without the involvement
++			 * of the driver. For these cases, free the earlier
++			 * allocated memory first before overwriting 'pm_save'
++			 * to prevent the memory leak.
++			 */
++			kfree(vdev->pm_save);
+ 			vdev->pm_save = pci_store_saved_state(pdev);
+ 		} else if (needs_restore) {
+ 			pci_load_and_free_saved_state(pdev, &vdev->pm_save);
+-- 
+2.34.1
+
diff --git a/queue-5.16/vfio-pci-wake-up-devices-around-reset-functions.patch b/queue-5.16/vfio-pci-wake-up-devices-around-reset-functions.patch
new file mode 100644
index 00000000000..766c89860ca
--- /dev/null
+++ b/queue-5.16/vfio-pci-wake-up-devices-around-reset-functions.patch
@@ -0,0 +1,150 @@
+From 527db7b4e57f9d9f46d744bcbea9e6da70b041c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 17:51:07 +0530
+Subject: vfio/pci: wake-up devices around reset functions
+
+From: Abhishek Sahu <abhsahu@nvidia.com>
+
+[ Upstream commit 26a17b12d7f3dd8a7aa45a290e5b46e9cc775ddf ]
+
+If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does
+not have No_Soft_Reset bit set in its PMCSR config register), then the
+current PCI state will be saved locally in
+'vfio_pci_core_device::pm_save' during D0->D3hot transition and same
+will be restored back during D3hot->D0 transition. For reset-related
+functionalities, vfio driver uses PCI reset API's. These
+API's internally change the PCI power state back to D0 first if
+the device power state is non-D0. This state change to D0 will happen
+without the involvement of vfio driver.
+
+Let's consider the following example:
+
+1. The device is in D3hot.
+2. User invokes VFIO_DEVICE_RESET ioctl.
+3. pci_try_reset_function() will be called which internally
+   invokes pci_dev_save_and_disable().
+4. pci_set_power_state(dev, PCI_D0) will be called first.
+5. pci_save_state() will happen then.
+
+Now, for the devices which has NoSoftRst-, the pci_set_power_state()
+can trigger soft reset and the original PCI config state will be lost
+at step (4) and this state cannot be restored again. This original PCI
+state can include any setting which is performed by SBIOS or host
+linux kernel (for example LTR, ASPM L1 substates, etc.). When this
+soft reset will be triggered, then all these settings will be reset,
+and the device state saved at step (5) will also have this setting
+cleared so it cannot be restored. Since the vfio driver only exposes
+limited PCI capabilities to its user, so the vfio driver user also
+won't have the option to save and restore these capabilities state
+either and these original settings will be permanently lost.
+
+For pci_reset_bus() also, we can have the above situation.
+The other functions/devices can be in D3hot and the reset will change
+the power state of all devices to D0 without the involvement of vfio
+driver.
+
+So, before calling any reset-related API's, we need to make sure that
+the device state is D0. This is mainly to preserve the state around
+soft reset.
+
+For vfio_pci_core_disable(), we use __pci_reset_function_locked()
+which internally can use pci_pm_reset() for the function reset.
+pci_pm_reset() requires the device power state to be in D0, otherwise
+it returns error.
+
+This patch changes the device power state to D0 by invoking
+vfio_pci_set_power_state() explicitly before calling any reset related
+API's.
+
+Fixes: 51ef3a004b1e ("vfio/pci: Restore device state on PM transition")
+Signed-off-by: Abhishek Sahu <abhsahu@nvidia.com>
+Link: https://lore.kernel.org/r/20220217122107.22434-3-abhsahu@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_core.c | 48 ++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
+index 87b288affc13..2e6409cc11ad 100644
+--- a/drivers/vfio/pci/vfio_pci_core.c
++++ b/drivers/vfio/pci/vfio_pci_core.c
+@@ -335,6 +335,17 @@ void vfio_pci_core_disable(struct vfio_pci_core_device *vdev)
+ 	/* For needs_reset */
+ 	lockdep_assert_held(&vdev->vdev.dev_set->lock);
+ 
++	/*
++	 * This function can be invoked while the power state is non-D0.
++	 * This function calls __pci_reset_function_locked() which internally
++	 * can use pci_pm_reset() for the function reset. pci_pm_reset() will
++	 * fail if the power state is non-D0. Also, for the devices which
++	 * have NoSoftRst-, the reset function can cause the PCI config space
++	 * reset without restoring the original state (saved locally in
++	 * 'vdev->pm_save').
++	 */
++	vfio_pci_set_power_state(vdev, PCI_D0);
++
+ 	/* Stop the device from further DMA */
+ 	pci_clear_master(pdev);
+ 
+@@ -934,6 +945,19 @@ long vfio_pci_core_ioctl(struct vfio_device *core_vdev, unsigned int cmd,
+ 			return -EINVAL;
+ 
+ 		vfio_pci_zap_and_down_write_memory_lock(vdev);
++
++		/*
++		 * This function can be invoked while the power state is non-D0.
++		 * If pci_try_reset_function() has been called while the power
++		 * state is non-D0, then pci_try_reset_function() will
++		 * internally set the power state to D0 without vfio driver
++		 * involvement. For the devices which have NoSoftRst-, the
++		 * reset function can cause the PCI config space reset without
++		 * restoring the original state (saved locally in
++		 * 'vdev->pm_save').
++		 */
++		vfio_pci_set_power_state(vdev, PCI_D0);
++
+ 		ret = pci_try_reset_function(vdev->pdev);
+ 		up_write(&vdev->memory_lock);
+ 
+@@ -2068,6 +2092,18 @@ static int vfio_pci_dev_set_hot_reset(struct vfio_device_set *dev_set,
+ 	}
+ 	cur_mem = NULL;
+ 
++	/*
++	 * The pci_reset_bus() will reset all the devices in the bus.
++	 * The power state can be non-D0 for some of the devices in the bus.
++	 * For these devices, the pci_reset_bus() will internally set
++	 * the power state to D0 without vfio driver involvement.
++	 * For the devices which have NoSoftRst-, the reset function can
++	 * cause the PCI config space reset without restoring the original
++	 * state (saved locally in 'vdev->pm_save').
++	 */
++	list_for_each_entry(cur, &dev_set->device_list, vdev.dev_set_list)
++		vfio_pci_set_power_state(cur, PCI_D0);
++
+ 	ret = pci_reset_bus(pdev);
+ 
+ err_undo:
+@@ -2121,6 +2157,18 @@ static bool vfio_pci_dev_set_try_reset(struct vfio_device_set *dev_set)
+ 	if (!pdev)
+ 		return false;
+ 
++	/*
++	 * The pci_reset_bus() will reset all the devices in the bus.
++	 * The power state can be non-D0 for some of the devices in the bus.
++	 * For these devices, the pci_reset_bus() will internally set
++	 * the power state to D0 without vfio driver involvement.
++	 * For the devices which have NoSoftRst-, the reset function can
++	 * cause the PCI config space reset without restoring the original
++	 * state (saved locally in 'vdev->pm_save').
++	 */
++	list_for_each_entry(cur, &dev_set->device_list, vdev.dev_set_list)
++		vfio_pci_set_power_state(cur, PCI_D0);
++
+ 	ret = pci_reset_bus(pdev);
+ 	if (ret)
+ 		return false;
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch b/queue-5.16/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
new file mode 100644
index 00000000000..f401cb1dac5
--- /dev/null
+++ b/queue-5.16/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
@@ -0,0 +1,50 @@
+From 33cb588257b5b9df95d6e3fe45c154fad501edf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Dec 2021 12:58:08 +0300
+Subject: video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fee5c1e4b789e41719af9fee0e2dd397cd31988f ]
+
+If "sinfo->config" is not found, then return -ENODEV.  Don't
+return success.
+
+Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/atmel_lcdfb.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index 355b6120dc4f..1fc8de4ecbeb 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1062,15 +1062,16 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
+ 
+ 	INIT_LIST_HEAD(&info->modelist);
+ 
+-	if (pdev->dev.of_node) {
+-		ret = atmel_lcdfb_of_init(sinfo);
+-		if (ret)
+-			goto free_info;
+-	} else {
++	if (!pdev->dev.of_node) {
+ 		dev_err(dev, "cannot get default configuration\n");
+ 		goto free_info;
+ 	}
+ 
++	ret = atmel_lcdfb_of_init(sinfo);
++	if (ret)
++		goto free_info;
++
++	ret = -ENODEV;
+ 	if (!sinfo->config)
+ 		goto free_info;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch b/queue-5.16/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
new file mode 100644
index 00000000000..2531117c4eb
--- /dev/null
+++ b/queue-5.16/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
@@ -0,0 +1,83 @@
+From 48cedef35afcf9af5845efd62e6c274d781fa3a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 15:30:13 -0500
+Subject: video: fbdev: cirrusfb: check pixclock to avoid divide by zero
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ]
+
+Do a sanity check on pixclock value to avoid divide by zero.
+
+If the pixclock value is zero, the cirrusfb driver will round up
+pixclock to get the derived frequency as close to maxclock as
+possible.
+
+Syzkaller reported a divide error in cirrusfb_check_pixclock.
+
+divide error: 0000 [#1] SMP KASAN PTI
+CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2
+RIP: 0010:cirrusfb_check_var+0x6f1/0x1260
+
+Call Trace:
+ fb_set_var+0x398/0xf90
+ do_fb_ioctl+0x4b8/0x6f0
+ fb_ioctl+0xeb/0x130
+ __x64_sys_ioctl+0x19d/0x220
+ do_syscall_64+0x3a/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/cirrusfb.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
+index 93802abbbc72..3d47c347b897 100644
+--- a/drivers/video/fbdev/cirrusfb.c
++++ b/drivers/video/fbdev/cirrusfb.c
+@@ -469,7 +469,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq)
+ 	return 0;
+ }
+ 
+-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var,
+ 				   struct fb_info *info)
+ {
+ 	long freq;
+@@ -478,9 +478,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ 	unsigned maxclockidx = var->bits_per_pixel >> 3;
+ 
+ 	/* convert from ps to kHz */
+-	freq = PICOS2KHZ(var->pixclock);
+-
+-	dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++	freq = PICOS2KHZ(var->pixclock ? : 1);
+ 
+ 	maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx];
+ 	cinfo->multiplexing = 0;
+@@ -488,11 +486,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ 	/* If the frequency is greater than we can support, we might be able
+ 	 * to use multiplexing for the video mode */
+ 	if (freq > maxclock) {
+-		dev_err(info->device,
+-			"Frequency greater than maxclock (%ld kHz)\n",
+-			maxclock);
+-		return -EINVAL;
++		var->pixclock = KHZ2PICOS(maxclock);
++
++		while ((freq = PICOS2KHZ(var->pixclock)) > maxclock)
++			var->pixclock++;
+ 	}
++	dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++
+ 	/*
+ 	 * Additional constraint: 8bpp uses DAC clock doubling to allow maximum
+ 	 * pixel clock
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-controlfb-fix-compile_test-build.patch b/queue-5.16/video-fbdev-controlfb-fix-compile_test-build.patch
new file mode 100644
index 00000000000..eafceffa6c7
--- /dev/null
+++ b/queue-5.16/video-fbdev-controlfb-fix-compile_test-build.patch
@@ -0,0 +1,46 @@
+From 257c262a4d41621d6a45acb7ca7528ea65ddb9be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Dec 2021 17:01:13 +0800
+Subject: video: fbdev: controlfb: Fix COMPILE_TEST build
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 567e44fb51b4f909ae58038a7301352eecea8426 ]
+
+If PPC_BOOK3S, PPC_PMAC and PPC32 is n, COMPILE_TEST build fails:
+
+drivers/video/fbdev/controlfb.c:70:0: error: "pgprot_cached_wthru" redefined [-Werror]
+ #define pgprot_cached_wthru(prot) (prot)
+
+In file included from ./arch/powerpc/include/asm/pgtable.h:20:0,
+                 from ./include/linux/pgtable.h:6,
+                 from ./include/linux/mm.h:33,
+                 from drivers/video/fbdev/controlfb.c:37:
+./arch/powerpc/include/asm/nohash/pgtable.h:243:0: note: this is the location of the previous definition
+ #define pgprot_cached_wthru(prot) (__pgprot((pgprot_val(prot) & ~_PAGE_CACHE_CTL) | \
+
+Fixes: a07a63b0e24d ("video: fbdev: controlfb: add COMPILE_TEST support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/controlfb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/video/fbdev/controlfb.c b/drivers/video/fbdev/controlfb.c
+index 509311471d51..bd59e7b11ed5 100644
+--- a/drivers/video/fbdev/controlfb.c
++++ b/drivers/video/fbdev/controlfb.c
+@@ -67,7 +67,9 @@
+ #define out_8(addr, val)	(void)(val)
+ #define in_le32(addr)		0
+ #define out_le32(addr, val)	(void)(val)
++#ifndef pgprot_cached_wthru
+ #define pgprot_cached_wthru(prot) (prot)
++#endif
+ #else
+ static void invalid_vram_cache(void __force *addr)
+ {
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch b/queue-5.16/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
new file mode 100644
index 00000000000..ebc76b707e4
--- /dev/null
+++ b/queue-5.16/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
@@ -0,0 +1,111 @@
+From d80dd51b08e9d99fcc09bbae48ec53aee7207ce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 16:29:19 +0300
+Subject: video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 78482af095abd9f4f29f1aa3fe575d25c6ae3028 ]
+
+This code has two bugs:
+1) "cnt" is 255 but the size of the buffer is 256 so the last byte is
+   not used.
+2) If we try to print more than 255 characters then "cnt" will be
+   negative and that will trigger a WARN() in snprintf(). The fix for
+   this is to use scnprintf() instead of snprintf().
+
+We can re-write this code to be cleaner:
+1) Rename "offset" to "off" because that's shorter.
+2) Get rid of the "cnt" variable and just use "size - off" directly.
+3) Get rid of the "read" variable and just increment "off" directly.
+
+Fixes: 96fe6a2109db ("fbdev: Add VESA Coordinated Video Timings (CVT) support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbcvt.c | 53 +++++++++++++-------------------
+ 1 file changed, 21 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c
+index 55d2bd0ce5c0..64843464c661 100644
+--- a/drivers/video/fbdev/core/fbcvt.c
++++ b/drivers/video/fbdev/core/fbcvt.c
+@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt)
+ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ {
+ 	u32 pixcount, pixcount_mod;
+-	int cnt = 255, offset = 0, read = 0;
+-	u8 *buf = kzalloc(256, GFP_KERNEL);
++	int size = 256;
++	int off = 0;
++	u8 *buf;
+ 
++	buf = kzalloc(size, GFP_KERNEL);
+ 	if (!buf)
+ 		return;
+ 
+@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ 	pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000;
+ 	pixcount_mod /= 1000;
+ 
+-	read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ",
+-			cvt->xres, cvt->yres, cvt->refresh);
+-	offset += read;
+-	cnt -= read;
++	off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ",
++			    cvt->xres, cvt->yres, cvt->refresh);
+ 
+-	if (cvt->status)
+-		snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega "
+-			 "Pixel Image\n", pixcount, pixcount_mod);
+-	else {
+-		if (pixcount) {
+-			read = snprintf(buf+offset, cnt, "%d", pixcount);
+-			cnt -= read;
+-			offset += read;
+-		}
++	if (cvt->status) {
++		off += scnprintf(buf + off, size - off,
++				 "Not a CVT standard - %d.%03d Mega Pixel Image\n",
++				 pixcount, pixcount_mod);
++	} else {
++		if (pixcount)
++			off += scnprintf(buf + off, size - off, "%d", pixcount);
+ 
+-		read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod);
+-		cnt -= read;
+-		offset += read;
++		off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod);
+ 
+ 		if (cvt->aspect_ratio == 0)
+-			read = snprintf(buf+offset, cnt, "3");
++			off += scnprintf(buf + off, size - off, "3");
+ 		else if (cvt->aspect_ratio == 3)
+-			read = snprintf(buf+offset, cnt, "4");
++			off += scnprintf(buf + off, size - off, "4");
+ 		else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4)
+-			read = snprintf(buf+offset, cnt, "9");
++			off += scnprintf(buf + off, size - off, "9");
+ 		else if (cvt->aspect_ratio == 2)
+-			read = snprintf(buf+offset, cnt, "A");
+-		else
+-			read = 0;
+-		cnt -= read;
+-		offset += read;
+-
+-		if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) {
+-			read = snprintf(buf+offset, cnt, "-R");
+-			cnt -= read;
+-			offset += read;
+-		}
++			off += scnprintf(buf + off, size - off, "A");
++
++		if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK)
++			off += scnprintf(buf + off, size - off, "-R");
+ 	}
+ 
+ 	printk(KERN_INFO "%s\n", buf);
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-matroxfb-set-maxvram-of-vbg200ew-to-the-.patch b/queue-5.16/video-fbdev-matroxfb-set-maxvram-of-vbg200ew-to-the-.patch
new file mode 100644
index 00000000000..0db2eac02e0
--- /dev/null
+++ b/queue-5.16/video-fbdev-matroxfb-set-maxvram-of-vbg200ew-to-the-.patch
@@ -0,0 +1,39 @@
+From e49658c110dbbd565a0ee34392b4e59568d445c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Dec 2021 02:00:35 +0800
+Subject: video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200
+ to avoid black screen
+
+From: Z. Liu <liuzx@knownsec.com>
+
+[ Upstream commit 62d89a7d49afe46e6b9bbe9e23b004ad848dbde4 ]
+
+Start from commit 11be60bd66d54 "matroxfb: add Matrox MGA-G200eW board
+support", when maxvram is 0x800000, monitor become black w/ error message
+said: "The current input timing is not supported by the monitor display.
+Please change your input timing to 1920x1080@60Hz ...".
+
+Fixes: 11be60bd66d5 ("matroxfb: add Matrox MGA-G200eW board support")
+Signed-off-by: Z. Liu <liuzx@knownsec.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/matrox/matroxfb_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/matrox/matroxfb_base.c b/drivers/video/fbdev/matrox/matroxfb_base.c
+index 5c82611e93d9..236521b19daf 100644
+--- a/drivers/video/fbdev/matrox/matroxfb_base.c
++++ b/drivers/video/fbdev/matrox/matroxfb_base.c
+@@ -1377,7 +1377,7 @@ static struct video_board vbG200 = {
+ 	.lowlevel = &matrox_G100
+ };
+ static struct video_board vbG200eW = {
+-	.maxvram = 0x800000,
++	.maxvram = 0x100000,
+ 	.maxdisplayable = 0x800000,
+ 	.accelID = FB_ACCEL_MATROX_MGAG200,
+ 	.lowlevel = &matrox_G100
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch b/queue-5.16/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
new file mode 100644
index 00000000000..367ddf7c666
--- /dev/null
+++ b/queue-5.16/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
@@ -0,0 +1,51 @@
+From 0fb2c39ca6243af76cfa7d98c0fd8af6e12ae23e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 09:45:02 -0600
+Subject: video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
+
+From: Tim Gardner <tim.gardner@canonical.com>
+
+[ Upstream commit 37a1a2e6eeeb101285cd34e12e48a881524701aa ]
+
+Coverity complains of a possible buffer overflow. However,
+given the 'static' scope of nvidia_setup_i2c_bus() it looks
+like that can't happen after examiniing the call sites.
+
+CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
+1. fixed_size_dest: You might overrun the 48-character fixed-size string
+  chan->adapter.name by copying name without checking the length.
+2. parameter_as_source: Note: This defect has an elevated risk because the
+  source argument is a parameter of the current function.
+ 89        strcpy(chan->adapter.name, name);
+
+Fix this warning by using strscpy() which will silence the warning and
+prevent any future buffer overflows should the names used to identify the
+channel become much longer.
+
+Cc: Antonino Daplas <adaplas@gmail.com>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/nvidia/nv_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c
+index d7994a173245..0b48965a6420 100644
+--- a/drivers/video/fbdev/nvidia/nv_i2c.c
++++ b/drivers/video/fbdev/nvidia/nv_i2c.c
+@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name,
+ {
+ 	int rc;
+ 
+-	strcpy(chan->adapter.name, name);
++	strscpy(chan->adapter.name, name, sizeof(chan->adapter.name));
+ 	chan->adapter.owner = THIS_MODULE;
+ 	chan->adapter.class = i2c_class;
+ 	chan->adapter.algo_data = &chan->algo;
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch b/queue-5.16/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
new file mode 100644
index 00000000000..b657123447e
--- /dev/null
+++ b/queue-5.16/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
@@ -0,0 +1,39 @@
+From c6b79f8c4951bda07129a3c2b075b63a747e3294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Nov 2021 08:06:03 +0800
+Subject: video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
+
+From: Yang Guang <yang.guang5@zte.com.cn>
+
+[ Upstream commit 24565bc4115961db7ee64fcc7ad2a7437c0d0a49 ]
+
+coccinelle report:
+./drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c:
+479:9-17: WARNING: use scnprintf or sprintf
+
+Use sysfs_emit instead of scnprintf or sprintf makes more sense.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Yang Guang <yang.guang5@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+index 8d8b5ff7d43c..3696eb09b69b 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+@@ -476,7 +476,7 @@ static ssize_t show_cabc_available_modes(struct device *dev,
+ 	int i;
+ 
+ 	if (!ddata->has_cabc)
+-		return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]);
++		return sysfs_emit(buf, "%s\n", cabc_modes[0]);
+ 
+ 	for (i = 0, len = 0;
+ 	     len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++)
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch b/queue-5.16/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
new file mode 100644
index 00000000000..be0757899d1
--- /dev/null
+++ b/queue-5.16/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
@@ -0,0 +1,35 @@
+From 8fac0b60185aeddbaae259ab23eb16e736003c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:38:12 +0000
+Subject: video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit a58c22cfbbf62fefca090334bbd35fd132e92a23 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+index 2fa436475b40..c8ad3ef42bd3 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+@@ -246,6 +246,7 @@ static int dvic_probe_of(struct platform_device *pdev)
+ 	adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0);
+ 	if (adapter_node) {
+ 		adapter = of_get_i2c_adapter_by_node(adapter_node);
++		of_node_put(adapter_node);
+ 		if (adapter == NULL) {
+ 			dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n");
+ 			omap_dss_put_device(ddata->in);
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch b/queue-5.16/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
new file mode 100644
index 00000000000..e88152d12a8
--- /dev/null
+++ b/queue-5.16/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
@@ -0,0 +1,63 @@
+From 5830a67501a05d0cf92d55bd5fc80bfbf1603615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Nov 2021 08:13:33 +0000
+Subject: video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of
+ snprintf()
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit f63658a59c3d439c8ad7b290f8ec270980e0f384 ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+index 4b0793abdd84..a2c7c5cb1523 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+@@ -409,7 +409,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev,
+ 	if (r)
+ 		return r;
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", errors);
++	return sysfs_emit(buf, "%d\n", errors);
+ }
+ 
+ static ssize_t dsicm_hw_revision_show(struct device *dev,
+@@ -439,7 +439,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev,
+ 	if (r)
+ 		return r;
+ 
+-	return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3);
++	return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3);
+ }
+ 
+ static ssize_t dsicm_store_ulps(struct device *dev,
+@@ -487,7 +487,7 @@ static ssize_t dsicm_show_ulps(struct device *dev,
+ 	t = ddata->ulps_enabled;
+ 	mutex_unlock(&ddata->lock);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%u\n", t);
++	return sysfs_emit(buf, "%u\n", t);
+ }
+ 
+ static ssize_t dsicm_store_ulps_timeout(struct device *dev,
+@@ -532,7 +532,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev,
+ 	t = ddata->ulps_timeout;
+ 	mutex_unlock(&ddata->lock);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%u\n", t);
++	return sysfs_emit(buf, "%u\n", t);
+ }
+ 
+ static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL);
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch b/queue-5.16/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
new file mode 100644
index 00000000000..508f49a08ed
--- /dev/null
+++ b/queue-5.16/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
@@ -0,0 +1,45 @@
+From 628eee1cecf874b362a3ed203cddde642ecb9b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Nov 2021 08:20:44 +0000
+Subject: video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead
+ of snprintf()
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit c07a039cbb96748f54c02995bae8131cc9a73b0a ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c  | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+index afac1d9445aa..57b7d1f49096 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+@@ -169,7 +169,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev,
+ {
+ 	struct panel_drv_data *ddata = dev_get_drvdata(dev);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror);
++	return sysfs_emit(buf, "%d\n", ddata->vmirror);
+ }
+ 
+ static ssize_t tpo_td043_vmirror_store(struct device *dev,
+@@ -199,7 +199,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev,
+ {
+ 	struct panel_drv_data *ddata = dev_get_drvdata(dev);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode);
++	return sysfs_emit(buf, "%d\n", ddata->mode);
+ }
+ 
+ static ssize_t tpo_td043_mode_store(struct device *dev,
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch b/queue-5.16/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
new file mode 100644
index 00000000000..c2f451c0ab4
--- /dev/null
+++ b/queue-5.16/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
@@ -0,0 +1,75 @@
+From 73635f271d9386629244658ae0cd1a3ed3ca5495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 22:33:11 +0800
+Subject: video: fbdev: sm712fb: Fix crash in smtcfb_write()
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 4f01d09b2bbfbcb47b3eb305560a7f4857a32260 ]
+
+When the sm712fb driver writes three bytes to the framebuffer, the
+driver will crash:
+
+    BUG: unable to handle page fault for address: ffffc90001ffffff
+    RIP: 0010:smtcfb_write+0x454/0x5b0
+    Call Trace:
+     vfs_write+0x291/0xd60
+     ? do_sys_openat2+0x27d/0x350
+     ? __fget_light+0x54/0x340
+     ksys_write+0xce/0x190
+     do_syscall_64+0x43/0x90
+     entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fix it by removing the open-coded endianness fixup-code.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sm712fb.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 0dbc6bf8268a..e355089ac7d6 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1130,7 +1130,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ 		count = total_size - p;
+ 	}
+ 
+-	buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
++	buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 	if (!buffer)
+ 		return -ENOMEM;
+ 
+@@ -1148,24 +1148,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ 			break;
+ 		}
+ 
+-		for (i = c >> 2; i--;) {
+-			fb_writel(big_swap(*src), dst++);
++		for (i = (c + 3) >> 2; i--;) {
++			fb_writel(big_swap(*src), dst);
++			dst++;
+ 			src++;
+ 		}
+-		if (c & 3) {
+-			u8 *src8 = (u8 *)src;
+-			u8 __iomem *dst8 = (u8 __iomem *)dst;
+-
+-			for (i = c & 3; i--;) {
+-				if (i & 1) {
+-					fb_writeb(*src8++, ++dst8);
+-				} else {
+-					fb_writeb(*src8++, --dst8);
+-					dst8 += 2;
+-				}
+-			}
+-			dst = (u32 __iomem *)dst8;
+-		}
+ 
+ 		*ppos += c;
+ 		buf += c;
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch b/queue-5.16/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
new file mode 100644
index 00000000000..b01922693b3
--- /dev/null
+++ b/queue-5.16/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
@@ -0,0 +1,62 @@
+From bc1d8bccef2fd198df4b41edc45a221d4d3d7d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 21:22:31 +0800
+Subject: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ]
+
+I got a null-ptr-deref report:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+...
+RIP: 0010:fb_destroy_modelist+0x38/0x100
+...
+Call Trace:
+ ufx_usb_probe.cold+0x2b5/0xac1 [smscufx]
+ usb_probe_interface+0x1aa/0x3c0 [usbcore]
+ really_probe+0x167/0x460
+...
+ ret_from_fork+0x1f/0x30
+
+If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will
+be called to destroy modelist in the error handling path. But modelist
+has not been initialized yet, so it will result in null-ptr-deref.
+
+Initialize modelist before calling fb_alloc_cmap() to fix this bug.
+
+Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/smscufx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
+index bfac3ee4a642..28768c272b73 100644
+--- a/drivers/video/fbdev/smscufx.c
++++ b/drivers/video/fbdev/smscufx.c
+@@ -1656,6 +1656,7 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ 	info->par = dev;
+ 	info->pseudo_palette = dev->pseudo_palette;
+ 	info->fbops = &ufx_ops;
++	INIT_LIST_HEAD(&info->modelist);
+ 
+ 	retval = fb_alloc_cmap(&info->cmap, 256, 0);
+ 	if (retval < 0) {
+@@ -1666,8 +1667,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ 	INIT_DELAYED_WORK(&dev->free_framebuffer_work,
+ 			  ufx_free_framebuffer_work);
+ 
+-	INIT_LIST_HEAD(&info->modelist);
+-
+ 	retval = ufx_reg_read(dev, 0x3000, &id_rev);
+ 	check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
+ 	dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch b/queue-5.16/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
new file mode 100644
index 00000000000..cc4ad99599d
--- /dev/null
+++ b/queue-5.16/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
@@ -0,0 +1,63 @@
+From 91210f490148d2e614d628973da6a94531d0924d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Nov 2021 11:52:29 +0000
+Subject: video: fbdev: udlfb: replace snprintf in show functions with
+ sysfs_emit
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit 81a998288956d09d7a7a2303d47e4d60ad55c401 ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/udlfb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index b9cdd02c1000..90f48b71fd8f 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1426,7 +1426,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_rendered));
+ }
+ 
+@@ -1434,7 +1434,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_identical));
+ }
+ 
+@@ -1442,7 +1442,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_sent));
+ }
+ 
+@@ -1450,7 +1450,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->cpu_kcycles_used));
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/video-fbdev-w100fb-reset-global-state.patch b/queue-5.16/video-fbdev-w100fb-reset-global-state.patch
new file mode 100644
index 00000000000..511398ae063
--- /dev/null
+++ b/queue-5.16/video-fbdev-w100fb-reset-global-state.patch
@@ -0,0 +1,68 @@
+From 1b8def6bd13373dec3c889ae65babb33cfa2ec89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 19:58:26 +0300
+Subject: video: fbdev: w100fb: Reset global state
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 8738ddcac644964ae128ccd3d80d48773c8d528e ]
+
+w100fb_probe() did not reset the global state to its initial state. This
+can result in invocation of iounmap() even when there was not the
+appropriate successful call of ioremap(). For instance, this may be the
+case if first probe fails after two successful ioremap() while second
+probe fails when first ioremap() fails. The similar issue is with
+w100fb_remove(). The patch fixes both bugs.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/w100fb.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
+index d96ab28f8ce4..4e641a780726 100644
+--- a/drivers/video/fbdev/w100fb.c
++++ b/drivers/video/fbdev/w100fb.c
+@@ -770,12 +770,18 @@ static int w100fb_probe(struct platform_device *pdev)
+ 		fb_dealloc_cmap(&info->cmap);
+ 		kfree(info->pseudo_palette);
+ 	}
+-	if (remapped_fbuf != NULL)
++	if (remapped_fbuf != NULL) {
+ 		iounmap(remapped_fbuf);
+-	if (remapped_regs != NULL)
++		remapped_fbuf = NULL;
++	}
++	if (remapped_regs != NULL) {
+ 		iounmap(remapped_regs);
+-	if (remapped_base != NULL)
++		remapped_regs = NULL;
++	}
++	if (remapped_base != NULL) {
+ 		iounmap(remapped_base);
++		remapped_base = NULL;
++	}
+ 	if (info)
+ 		framebuffer_release(info);
+ 	return err;
+@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev)
+ 	fb_dealloc_cmap(&info->cmap);
+ 
+ 	iounmap(remapped_base);
++	remapped_base = NULL;
+ 	iounmap(remapped_regs);
++	remapped_regs = NULL;
+ 	iounmap(remapped_fbuf);
++	remapped_fbuf = NULL;
+ 
+ 	framebuffer_release(info);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/virt-acrn-fix-a-memory-leak-in-acrn_dev_ioctl.patch b/queue-5.16/virt-acrn-fix-a-memory-leak-in-acrn_dev_ioctl.patch
new file mode 100644
index 00000000000..b5b243faf12
--- /dev/null
+++ b/queue-5.16/virt-acrn-fix-a-memory-leak-in-acrn_dev_ioctl.patch
@@ -0,0 +1,76 @@
+From 0c422ec97bbdd8576530c941258a9330e7a84a61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 17:20:47 +0800
+Subject: virt: acrn: fix a memory leak in acrn_dev_ioctl()
+
+From: Xiaolong Huang <butterflyhuangxx@gmail.com>
+
+[ Upstream commit ecd1735f14d6ac868ae5d8b7a2bf193fa11f388b ]
+
+The vm_param and cpu_regs need to be freed via kfree()
+before return -EINVAL error.
+
+Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
+Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
+Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
+Signed-off-by: Fei Li <fei1.li@intel.com>
+Link: https://lore.kernel.org/r/20220308092047.1008409-1-butterflyhuangxx@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
+index 5419794fccf1..423ea888d79a 100644
+--- a/drivers/virt/acrn/hsm.c
++++ b/drivers/virt/acrn/hsm.c
+@@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
+ 		if (IS_ERR(vm_param))
+ 			return PTR_ERR(vm_param);
+ 
+-		if ((vm_param->reserved0 | vm_param->reserved1) != 0)
++		if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
++			kfree(vm_param);
+ 			return -EINVAL;
++		}
+ 
+ 		vm = acrn_vm_create(vm, vm_param);
+ 		if (!vm) {
+@@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
+ 			return PTR_ERR(cpu_regs);
+ 
+ 		for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
+-			if (cpu_regs->reserved[i])
++			if (cpu_regs->reserved[i]) {
++				kfree(cpu_regs);
+ 				return -EINVAL;
++			}
+ 
+ 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
+-			if (cpu_regs->vcpu_regs.reserved_32[i])
++			if (cpu_regs->vcpu_regs.reserved_32[i]) {
++				kfree(cpu_regs);
+ 				return -EINVAL;
++			}
+ 
+ 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
+-			if (cpu_regs->vcpu_regs.reserved_64[i])
++			if (cpu_regs->vcpu_regs.reserved_64[i]) {
++				kfree(cpu_regs);
+ 				return -EINVAL;
++			}
+ 
+ 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
+ 			if (cpu_regs->vcpu_regs.gdt.reserved[i] |
+-			    cpu_regs->vcpu_regs.idt.reserved[i])
++			    cpu_regs->vcpu_regs.idt.reserved[i]) {
++				kfree(cpu_regs);
+ 				return -EINVAL;
++			}
+ 
+ 		ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
+ 		if (ret < 0)
+-- 
+2.34.1
+
diff --git a/queue-5.16/virt-acrn-obtain-pa-from-vma-with-pfnmap-flag.patch b/queue-5.16/virt-acrn-obtain-pa-from-vma-with-pfnmap-flag.patch
new file mode 100644
index 00000000000..ca146e20386
--- /dev/null
+++ b/queue-5.16/virt-acrn-obtain-pa-from-vma-with-pfnmap-flag.patch
@@ -0,0 +1,68 @@
+From 4059fb9b9e7c152c568d4dc6ad92f837760414ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 05:22:12 +0300
+Subject: virt: acrn: obtain pa from VMA with PFNMAP flag
+
+From: Yonghua Huang <yonghua.huang@intel.com>
+
+[ Upstream commit 8a6e85f75a83d16a71077e41f2720c691f432002 ]
+
+ acrn_vm_ram_map can't pin the user pages with VM_PFNMAP flag
+ by calling get_user_pages_fast(), the PA(physical pages)
+ may be mapped by kernel driver and set PFNMAP flag.
+
+ This patch fixes logic to setup EPT mapping for PFN mapped RAM region
+ by checking the memory attribute before adding EPT mapping for them.
+
+Fixes: 88f537d5e8dd ("virt: acrn: Introduce EPT mapping management")
+Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
+Signed-off-by: Fei Li <fei1.li@intel.com>
+Link: https://lore.kernel.org/r/20220228022212.419406-1-yonghua.huang@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/acrn/mm.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c
+index c4f2e15c8a2b..3b1b1e7a844b 100644
+--- a/drivers/virt/acrn/mm.c
++++ b/drivers/virt/acrn/mm.c
+@@ -162,10 +162,34 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)
+ 	void *remap_vaddr;
+ 	int ret, pinned;
+ 	u64 user_vm_pa;
++	unsigned long pfn;
++	struct vm_area_struct *vma;
+ 
+ 	if (!vm || !memmap)
+ 		return -EINVAL;
+ 
++	mmap_read_lock(current->mm);
++	vma = vma_lookup(current->mm, memmap->vma_base);
++	if (vma && ((vma->vm_flags & VM_PFNMAP) != 0)) {
++		if ((memmap->vma_base + memmap->len) > vma->vm_end) {
++			mmap_read_unlock(current->mm);
++			return -EINVAL;
++		}
++
++		ret = follow_pfn(vma, memmap->vma_base, &pfn);
++		mmap_read_unlock(current->mm);
++		if (ret < 0) {
++			dev_dbg(acrn_dev.this_device,
++				"Failed to lookup PFN at VMA:%pK.\n", (void *)memmap->vma_base);
++			return ret;
++		}
++
++		return acrn_mm_region_add(vm, memmap->user_vm_pa,
++			 PFN_PHYS(pfn), memmap->len,
++			 ACRN_MEM_TYPE_WB, memmap->attr);
++	}
++	mmap_read_unlock(current->mm);
++
+ 	/* Get the page number of the map region */
+ 	nr_pages = memmap->len >> PAGE_SHIFT;
+ 	pages = vzalloc(nr_pages * sizeof(struct page *));
+-- 
+2.34.1
+
diff --git a/queue-5.16/virtio_blk-eliminate-anonymous-module_init-module_ex.patch b/queue-5.16/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
new file mode 100644
index 00000000000..a5e17d23f5a
--- /dev/null
+++ b/queue-5.16/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
@@ -0,0 +1,82 @@
+From acc2fb44b3a5374cd74c7452098861029782e7c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:02 -0700
+Subject: virtio_blk: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bcfe9b6cbb4438b8c1cc4bd475221652c8f9301b ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: e467cde23818 ("Block driver using virtio.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: virtualization@lists.linux-foundation.org
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: linux-block@vger.kernel.org
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Link: https://lore.kernel.org/r/20220316192010.19001-2-rdunlap@infradead.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index b3df5e5452a7..66b6723beb92 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -1059,7 +1059,7 @@ static struct virtio_driver virtio_blk = {
+ #endif
+ };
+ 
+-static int __init init(void)
++static int __init virtio_blk_init(void)
+ {
+ 	int error;
+ 
+@@ -1085,14 +1085,14 @@ static int __init init(void)
+ 	return error;
+ }
+ 
+-static void __exit fini(void)
++static void __exit virtio_blk_fini(void)
+ {
+ 	unregister_virtio_driver(&virtio_blk);
+ 	unregister_blkdev(major, "virtblk");
+ 	destroy_workqueue(virtblk_wq);
+ }
+-module_init(init);
+-module_exit(fini);
++module_init(virtio_blk_init);
++module_exit(virtio_blk_fini);
+ 
+ MODULE_DEVICE_TABLE(virtio, id_table);
+ MODULE_DESCRIPTION("Virtio block driver");
+-- 
+2.34.1
+
diff --git a/queue-5.16/vsock-virtio-enable-vqs-early-on-probe.patch b/queue-5.16/vsock-virtio-enable-vqs-early-on-probe.patch
new file mode 100644
index 00000000000..c451b4cfa2f
--- /dev/null
+++ b/queue-5.16/vsock-virtio-enable-vqs-early-on-probe.patch
@@ -0,0 +1,43 @@
+From 67dadad6373085351b564039019a1be0af837658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 18:36:25 +0100
+Subject: vsock/virtio: enable VQs early on probe
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 88704454ef8b00ea91537ae0d47d9348077e0e72 ]
+
+virtio spec requires drivers to set DRIVER_OK before using VQs.
+This is set automatically after probe returns, but virtio-vsock
+driver uses VQs in the probe function to fill rx and event VQs
+with new buffers.
+
+Let's fix this, calling virtio_device_ready() before using VQs
+in the probe function.
+
+Fixes: 0ea9e1d3a9e3 ("VSOCK: Introduce virtio_transport.ko")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 4a8548bdf86c..c5f936fbf876 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -627,6 +627,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 
+ 	vdev->priv = vsock;
+ 
++	virtio_device_ready(vdev);
++
+ 	mutex_lock(&vsock->tx_lock);
+ 	vsock->tx_run = true;
+ 	mutex_unlock(&vsock->tx_lock);
+-- 
+2.34.1
+
diff --git a/queue-5.16/vsock-virtio-initialize-vdev-priv-before-using-vqs.patch b/queue-5.16/vsock-virtio-initialize-vdev-priv-before-using-vqs.patch
new file mode 100644
index 00000000000..187519b3704
--- /dev/null
+++ b/queue-5.16/vsock-virtio-initialize-vdev-priv-before-using-vqs.patch
@@ -0,0 +1,48 @@
+From 1b5d775feb2e9633f04e82d3241a6d05aaea45f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 18:36:23 +0100
+Subject: vsock/virtio: initialize vdev->priv before using VQs
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 4b5f1ad5566ada230aaa2ce861b28d1895f1ea68 ]
+
+When we fill VQs with empty buffers and kick the host, it may send
+an interrupt. `vdev->priv` must be initialized before this since it
+is used in the virtqueue callbacks.
+
+Fixes: 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock")
+Suggested-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index dad9ca65f4f9..fb1b8f99f679 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -622,6 +622,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	INIT_WORK(&vsock->event_work, virtio_transport_event_work);
+ 	INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work);
+ 
++	vdev->priv = vsock;
++
+ 	mutex_lock(&vsock->tx_lock);
+ 	vsock->tx_run = true;
+ 	mutex_unlock(&vsock->tx_lock);
+@@ -639,7 +641,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	if (virtio_has_feature(vdev, VIRTIO_VSOCK_F_SEQPACKET))
+ 		vsock->seqpacket_allow = true;
+ 
+-	vdev->priv = vsock;
+ 	rcu_assign_pointer(the_virtio_vsock, vsock);
+ 
+ 	mutex_unlock(&the_virtio_vsock_mutex);
+-- 
+2.34.1
+
diff --git a/queue-5.16/vsock-virtio-read-the-negotiated-features-before-usi.patch b/queue-5.16/vsock-virtio-read-the-negotiated-features-before-usi.patch
new file mode 100644
index 00000000000..74b4f969a03
--- /dev/null
+++ b/queue-5.16/vsock-virtio-read-the-negotiated-features-before-usi.patch
@@ -0,0 +1,50 @@
+From c569bb40892d055c2d2c228b48a99dd712dd428e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Mar 2022 18:36:24 +0100
+Subject: vsock/virtio: read the negotiated features before using VQs
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit c1011c0b3a9c8d2065f425407475cbcc812540b7 ]
+
+Complete the driver configuration, reading the negotiated features,
+before using the VQs in the virtio_vsock_probe().
+
+Fixes: 53efbba12cc7 ("virtio/vsock: enable SEQPACKET for transport")
+Suggested-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index fb1b8f99f679..4a8548bdf86c 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -622,6 +622,9 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	INIT_WORK(&vsock->event_work, virtio_transport_event_work);
+ 	INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work);
+ 
++	if (virtio_has_feature(vdev, VIRTIO_VSOCK_F_SEQPACKET))
++		vsock->seqpacket_allow = true;
++
+ 	vdev->priv = vsock;
+ 
+ 	mutex_lock(&vsock->tx_lock);
+@@ -638,9 +641,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	vsock->event_run = true;
+ 	mutex_unlock(&vsock->event_lock);
+ 
+-	if (virtio_has_feature(vdev, VIRTIO_VSOCK_F_SEQPACKET))
+-		vsock->seqpacket_allow = true;
+-
+ 	rcu_assign_pointer(the_virtio_vsock, vsock);
+ 
+ 	mutex_unlock(&the_virtio_vsock_mutex);
+-- 
+2.34.1
+
diff --git a/queue-5.16/vsprintf-fix-pk-with-kptr_restrict-0.patch b/queue-5.16/vsprintf-fix-pk-with-kptr_restrict-0.patch
new file mode 100644
index 00000000000..c56a1cba580
--- /dev/null
+++ b/queue-5.16/vsprintf-fix-pk-with-kptr_restrict-0.patch
@@ -0,0 +1,135 @@
+From bed61b17a7900790d9c40aa39f1e7a6bf96cc2fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 09:49:59 +0100
+Subject: vsprintf: Fix %pK with kptr_restrict == 0
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 84842911322fc6a02a03ab9e728a48c691fe3efd ]
+
+Although kptr_restrict is set to 0 and the kernel is booted with
+no_hash_pointers parameter, the content of /proc/vmallocinfo is
+lacking the real addresses.
+
+  / # cat /proc/vmallocinfo
+  0x(ptrval)-0x(ptrval)    8192 load_module+0xc0c/0x2c0c pages=1 vmalloc
+  0x(ptrval)-0x(ptrval)   12288 start_kernel+0x4e0/0x690 pages=2 vmalloc
+  0x(ptrval)-0x(ptrval)   12288 start_kernel+0x4e0/0x690 pages=2 vmalloc
+  0x(ptrval)-0x(ptrval)    8192 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap
+  0x(ptrval)-0x(ptrval)   12288 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap
+    ...
+
+According to the documentation for /proc/sys/kernel/, %pK is
+equivalent to %p when kptr_restrict is set to 0.
+
+Fixes: 5ead723a20e0 ("lib/vsprintf: no_hash_pointers prints all addresses as unhashed")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/107476128e59bff11a309b5bf7579a1753a41aca.1645087605.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt         |  3 +-
+ lib/vsprintf.c                                | 36 +++++++++++--------
+ 2 files changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 391b3f9055fe..3e513d69e9de 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3476,8 +3476,7 @@
+ 			difficult since unequal pointers can no longer be
+ 			compared.  However, if this command-line option is
+ 			specified, then all normal pointers will have their true
+-			value printed.  Pointers printed via %pK may still be
+-			hashed.  This option should only be specified when
++			value printed. This option should only be specified when
+ 			debugging the kernel.  Please do not use on production
+ 			kernels.
+ 
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 01e61c85f274..937dd643008d 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -54,6 +54,10 @@
+ #include <linux/string_helpers.h>
+ #include "kstrtox.h"
+ 
++/* Disable pointer hashing if requested */
++bool no_hash_pointers __ro_after_init;
++EXPORT_SYMBOL_GPL(no_hash_pointers);
++
+ static noinline unsigned long long simple_strntoull(const char *startp, size_t max_chars, char **endp, unsigned int base)
+ {
+ 	const char *cp;
+@@ -849,6 +853,19 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr,
+ 	return pointer_string(buf, end, (const void *)hashval, spec);
+ }
+ 
++static char *default_pointer(char *buf, char *end, const void *ptr,
++			     struct printf_spec spec)
++{
++	/*
++	 * default is to _not_ leak addresses, so hash before printing,
++	 * unless no_hash_pointers is specified on the command line.
++	 */
++	if (unlikely(no_hash_pointers))
++		return pointer_string(buf, end, ptr, spec);
++
++	return ptr_to_id(buf, end, ptr, spec);
++}
++
+ int kptr_restrict __read_mostly;
+ 
+ static noinline_for_stack
+@@ -858,7 +875,7 @@ char *restricted_pointer(char *buf, char *end, const void *ptr,
+ 	switch (kptr_restrict) {
+ 	case 0:
+ 		/* Handle as %p, hash and do _not_ leak addresses. */
+-		return ptr_to_id(buf, end, ptr, spec);
++		return default_pointer(buf, end, ptr, spec);
+ 	case 1: {
+ 		const struct cred *cred;
+ 
+@@ -2235,10 +2252,6 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode,
+ 	return widen_string(buf, buf - buf_start, end, spec);
+ }
+ 
+-/* Disable pointer hashing if requested */
+-bool no_hash_pointers __ro_after_init;
+-EXPORT_SYMBOL_GPL(no_hash_pointers);
+-
+ int __init no_hash_pointers_enable(char *str)
+ {
+ 	if (no_hash_pointers)
+@@ -2467,7 +2480,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ 	case 'e':
+ 		/* %pe with a non-ERR_PTR gets treated as plain %p */
+ 		if (!IS_ERR(ptr))
+-			break;
++			return default_pointer(buf, end, ptr, spec);
+ 		return err_ptr(buf, end, ptr, spec);
+ 	case 'u':
+ 	case 'k':
+@@ -2477,16 +2490,9 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ 		default:
+ 			return error_string(buf, end, "(einval)", spec);
+ 		}
++	default:
++		return default_pointer(buf, end, ptr, spec);
+ 	}
+-
+-	/*
+-	 * default is to _not_ leak addresses, so hash before printing,
+-	 * unless no_hash_pointers is specified on the command line.
+-	 */
+-	if (unlikely(no_hash_pointers))
+-		return pointer_string(buf, end, ptr, spec);
+-	else
+-		return ptr_to_id(buf, end, ptr, spec);
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.16/vsprintf-fix-potential-unaligned-access.patch b/queue-5.16/vsprintf-fix-potential-unaligned-access.patch
new file mode 100644
index 00000000000..508d97525e1
--- /dev/null
+++ b/queue-5.16/vsprintf-fix-potential-unaligned-access.patch
@@ -0,0 +1,75 @@
+From 65c1a4d177d4f2cbc3b4524269987fc8bee78dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 20:12:32 +0200
+Subject: vsprintf: Fix potential unaligned access
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit d75b26f880f60ead301e79ba0f4a635c5a60767f ]
+
+The %p4cc specifier in some cases might get an unaligned pointer.
+Due to this we need to make copy to local variable once to avoid
+potential crashes on some architectures due to improper access.
+
+Fixes: af612e43de6d ("lib/vsprintf: Add support for printing V4L2 and DRM fourccs")
+Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20220127181233.72910-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/vsprintf.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 58d5e567f836..01e61c85f274 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -49,6 +49,7 @@
+ 
+ #include <asm/page.h>		/* for PAGE_SIZE */
+ #include <asm/byteorder.h>	/* cpu_to_le16 */
++#include <asm/unaligned.h>
+ 
+ #include <linux/string_helpers.h>
+ #include "kstrtox.h"
+@@ -1771,7 +1772,7 @@ char *fourcc_string(char *buf, char *end, const u32 *fourcc,
+ 	char output[sizeof("0123 little-endian (0x01234567)")];
+ 	char *p = output;
+ 	unsigned int i;
+-	u32 val;
++	u32 orig, val;
+ 
+ 	if (fmt[1] != 'c' || fmt[2] != 'c')
+ 		return error_string(buf, end, "(%p4?)", spec);
+@@ -1779,21 +1780,22 @@ char *fourcc_string(char *buf, char *end, const u32 *fourcc,
+ 	if (check_pointer(&buf, end, fourcc, spec))
+ 		return buf;
+ 
+-	val = *fourcc & ~BIT(31);
++	orig = get_unaligned(fourcc);
++	val = orig & ~BIT(31);
+ 
+-	for (i = 0; i < sizeof(*fourcc); i++) {
++	for (i = 0; i < sizeof(u32); i++) {
+ 		unsigned char c = val >> (i * 8);
+ 
+ 		/* Print non-control ASCII characters as-is, dot otherwise */
+ 		*p++ = isascii(c) && isprint(c) ? c : '.';
+ 	}
+ 
+-	strcpy(p, *fourcc & BIT(31) ? " big-endian" : " little-endian");
++	strcpy(p, orig & BIT(31) ? " big-endian" : " little-endian");
+ 	p += strlen(p);
+ 
+ 	*p++ = ' ';
+ 	*p++ = '(';
+-	p = special_hex_number(p, output + sizeof(output) - 2, *fourcc, sizeof(u32));
++	p = special_hex_number(p, output + sizeof(output) - 2, orig, sizeof(u32));
+ 	*p++ = ')';
+ 	*p = '\0';
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/vxcan-enable-local-echo-for-sent-can-frames.patch b/queue-5.16/vxcan-enable-local-echo-for-sent-can-frames.patch
new file mode 100644
index 00000000000..ae22232c70f
--- /dev/null
+++ b/queue-5.16/vxcan-enable-local-echo-for-sent-can-frames.patch
@@ -0,0 +1,46 @@
+From 2b44a010f73b56a0b28bd13549822cd02033735f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 13:04:16 +0100
+Subject: vxcan: enable local echo for sent CAN frames
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 259bdba27e32368b4404f69d613b1c1014c07cbf ]
+
+The vxcan driver provides a pair of virtual CAN interfaces to exchange
+CAN traffic between different namespaces - analogue to veth.
+
+In opposite to the vcan driver the local sent CAN traffic on this interface
+is not echo'ed back but only sent to the remote peer. This is unusual and
+can be easily fixed by removing IFF_ECHO from the netdevice flags that
+are set for vxcan interfaces by default at startup.
+
+Without IFF_ECHO set on driver level, the local sent CAN frames are echo'ed
+in af_can.c in can_send(). This patch makes vxcan interfaces adopt the
+same local echo behavior and procedures as known from the vcan interfaces.
+
+Fixes: a8f820a380a2 ("can: add Virtual CAN Tunnel driver (vxcan)")
+Link: https://lore.kernel.org/all/20220309120416.83514-5-socketcan@hartkopp.net
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/vxcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
+index 8861a7d875e7..be5566168d0f 100644
+--- a/drivers/net/can/vxcan.c
++++ b/drivers/net/can/vxcan.c
+@@ -148,7 +148,7 @@ static void vxcan_setup(struct net_device *dev)
+ 	dev->hard_header_len	= 0;
+ 	dev->addr_len		= 0;
+ 	dev->tx_queue_len	= 0;
+-	dev->flags		= (IFF_NOARP|IFF_ECHO);
++	dev->flags		= IFF_NOARP;
+ 	dev->netdev_ops		= &vxcan_netdev_ops;
+ 	dev->needs_free_netdev	= true;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.16/watch_queue-actually-free-the-watch.patch b/queue-5.16/watch_queue-actually-free-the-watch.patch
new file mode 100644
index 00000000000..55c3647dbd1
--- /dev/null
+++ b/queue-5.16/watch_queue-actually-free-the-watch.patch
@@ -0,0 +1,54 @@
+From 8d4f07326ffef202d85df97b553a4a2384ef01a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 11:18:54 +0000
+Subject: watch_queue: Actually free the watch
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3d8dcf278b1ee1eff1e90be848fa2237db4c07a7 ]
+
+free_watch() does everything barring actually freeing the watch object.  Fix
+this by adding the missing kfree.
+
+kmemleak produces a report something like the following.  Note that as an
+address can be seen in the first word, the watch would appear to have gone
+through call_rcu().
+
+BUG: memory leak
+unreferenced object 0xffff88810ce4a200 (size 96):
+  comm "syz-executor352", pid 3605, jiffies 4294947473 (age 13.720s)
+  hex dump (first 32 bytes):
+    e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00  ..H.............
+    80 a2 e4 0c 81 88 ff ff 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581 [inline]
+    [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline]
+    [<ffffffff8214e6cc>] keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800
+    [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490 security/keys/keyctl.c:2016
+    [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+    [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+    [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: c73be61cede5 ("pipe: Add general notification queue support")
+Reported-and-tested-by: syzbot+6e2de48f06cdb2884bfc@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watch_queue.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
+index 12348b41d7ad..38a135d68c05 100644
+--- a/kernel/watch_queue.c
++++ b/kernel/watch_queue.c
+@@ -398,6 +398,7 @@ static void free_watch(struct rcu_head *rcu)
+ 	put_watch_queue(rcu_access_pointer(watch->queue));
+ 	atomic_dec(&watch->cred->user->nr_watches);
+ 	put_cred(watch->cred);
++	kfree(watch);
+ }
+ 
+ static void __put_watch(struct kref *kref)
+-- 
+2.34.1
+
diff --git a/queue-5.16/watch_queue-fix-null-dereference-in-error-cleanup.patch b/queue-5.16/watch_queue-fix-null-dereference-in-error-cleanup.patch
new file mode 100644
index 00000000000..b091c7b9fed
--- /dev/null
+++ b/queue-5.16/watch_queue-fix-null-dereference-in-error-cleanup.patch
@@ -0,0 +1,68 @@
+From c5c5b8aa2a6c4de03479be2ffb88b3c5ffb0577b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 08:11:52 +0000
+Subject: watch_queue: Fix NULL dereference in error cleanup
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit a635415a064e77bcfbf43da413fd9dfe0bbed9cb ]
+
+In watch_queue_set_size(), the error cleanup code doesn't take account of
+the fact that __free_page() can't handle a NULL pointer when trying to free
+up buffer pages that did get allocated.
+
+Fix this by only calling __free_page() on the pages actually allocated.
+
+Without the fix, this can lead to something like the following:
+
+BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473
+Read of size 4 at addr 0000000000000034 by task syz-executor168/3599
+...
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ __kasan_report mm/kasan/report.c:446 [inline]
+ kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
+ check_region_inline mm/kasan/generic.c:183 [inline]
+ kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
+ instrument_atomic_read include/linux/instrumented.h:71 [inline]
+ atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
+ page_ref_count include/linux/page_ref.h:67 [inline]
+ put_page_testzero include/linux/mm.h:717 [inline]
+ __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473
+ watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275
+ pipe_ioctl+0xac/0x2b0 fs/pipe.c:632
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:874 [inline]
+ __se_sys_ioctl fs/ioctl.c:860 [inline]
+ __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fixes: c73be61cede5 ("pipe: Add general notification queue support")
+Reported-and-tested-by: syzbot+d55757faa9b80590767b@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watch_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
+index 055bc20ecdda..12348b41d7ad 100644
+--- a/kernel/watch_queue.c
++++ b/kernel/watch_queue.c
+@@ -274,7 +274,7 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
+ 	return 0;
+ 
+ error_p:
+-	for (i = 0; i < nr_pages; i++)
++	while (--i >= 0)
+ 		__free_page(pages[i]);
+ 	kfree(pages);
+ error:
+-- 
+2.34.1
+
diff --git a/queue-5.16/xen-fix-is_xen_pmu.patch b/queue-5.16/xen-fix-is_xen_pmu.patch
new file mode 100644
index 00000000000..76f751e2074
--- /dev/null
+++ b/queue-5.16/xen-fix-is_xen_pmu.patch
@@ -0,0 +1,127 @@
+From 68ea5fb597016675fa2560a1782aff41a27c87c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 15:20:02 +0100
+Subject: xen: fix is_xen_pmu()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit de2ae403b4c0e79a3410e63bc448542fbb9f9bfc ]
+
+is_xen_pmu() is taking the cpu number as parameter, but it is not using
+it. Instead it just tests whether the Xen PMU initialization on the
+current cpu did succeed. As this test is done by checking a percpu
+pointer, preemption needs to be disabled in order to avoid switching
+the cpu while doing the test. While resuming from suspend() this seems
+not to be the case:
+
+[   88.082751] ACPI: PM: Low-level resume complete
+[   88.087933] ACPI: EC: EC started
+[   88.091464] ACPI: PM: Restoring platform NVS memory
+[   88.097166] xen_acpi_processor: Uploading Xen processor PM info
+[   88.103850] Enabling non-boot CPUs ...
+[   88.108128] installing Xen timer for CPU 1
+[   88.112763] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-sleep/7138
+[   88.122256] caller is is_xen_pmu+0x12/0x30
+[   88.126937] CPU: 0 PID: 7138 Comm: systemd-sleep Tainted: G        W         5.16.13-2.fc32.qubes.x86_64 #1
+[   88.137939] Hardware name: Star Labs StarBook/StarBook, BIOS 7.97 03/21/2022
+[   88.145930] Call Trace:
+[   88.148757]  <TASK>
+[   88.151193]  dump_stack_lvl+0x48/0x5e
+[   88.155381]  check_preemption_disabled+0xde/0xe0
+[   88.160641]  is_xen_pmu+0x12/0x30
+[   88.164441]  xen_smp_intr_init_pv+0x75/0x100
+
+Fix that by replacing is_xen_pmu() by a simple boolean variable which
+reflects the Xen PMU initialization state on cpu 0.
+
+Modify xen_pmu_init() to return early in case it is being called for a
+cpu other than cpu 0 and the boolean variable not being set.
+
+Fixes: bf6dfb154d93 ("xen/PMU: PMU emulation code")
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Link: https://lore.kernel.org/r/20220325142002.31789-1-jgross@suse.com
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/pmu.c    | 10 ++++------
+ arch/x86/xen/pmu.h    |  3 ++-
+ arch/x86/xen/smp_pv.c |  2 +-
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
+index e13b0b49fcdf..d7249f4c90f1 100644
+--- a/arch/x86/xen/pmu.c
++++ b/arch/x86/xen/pmu.c
+@@ -512,10 +512,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
+ 	return ret;
+ }
+ 
+-bool is_xen_pmu(int cpu)
+-{
+-	return (get_xenpmu_data() != NULL);
+-}
++bool is_xen_pmu;
+ 
+ void xen_pmu_init(int cpu)
+ {
+@@ -526,7 +523,7 @@ void xen_pmu_init(int cpu)
+ 
+ 	BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE);
+ 
+-	if (xen_hvm_domain())
++	if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu))
+ 		return;
+ 
+ 	xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL);
+@@ -547,7 +544,8 @@ void xen_pmu_init(int cpu)
+ 	per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data;
+ 	per_cpu(xenpmu_shared, cpu).flags = 0;
+ 
+-	if (cpu == 0) {
++	if (!is_xen_pmu) {
++		is_xen_pmu = true;
+ 		perf_register_guest_info_callbacks(&xen_guest_cbs);
+ 		xen_pmu_arch_init();
+ 	}
+diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h
+index 0e83a160589b..65c58894fc79 100644
+--- a/arch/x86/xen/pmu.h
++++ b/arch/x86/xen/pmu.h
+@@ -4,6 +4,8 @@
+ 
+ #include <xen/interface/xenpmu.h>
+ 
++extern bool is_xen_pmu;
++
+ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id);
+ #ifdef CONFIG_XEN_HAVE_VPMU
+ void xen_pmu_init(int cpu);
+@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu);
+ static inline void xen_pmu_init(int cpu) {}
+ static inline void xen_pmu_finish(int cpu) {}
+ #endif
+-bool is_xen_pmu(int cpu);
+ bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err);
+ bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err);
+ int pmu_apic_update(uint32_t reg);
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 4a6019238ee7..688aa8b6ae29 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -129,7 +129,7 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ 	per_cpu(xen_irq_work, cpu).irq = rc;
+ 	per_cpu(xen_irq_work, cpu).name = callfunc_name;
+ 
+-	if (is_xen_pmu(cpu)) {
++	if (is_xen_pmu) {
+ 		pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu);
+ 		rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu,
+ 					     xen_pmu_irq_handler,
+-- 
+2.34.1
+
diff --git a/queue-5.16/xsk-fix-race-at-socket-teardown.patch b/queue-5.16/xsk-fix-race-at-socket-teardown.patch
new file mode 100644
index 00000000000..1f9fecc7dd6
--- /dev/null
+++ b/queue-5.16/xsk-fix-race-at-socket-teardown.patch
@@ -0,0 +1,246 @@
+From 9ee74abf1dcaf6e941b68c76cf6f2b713fc491a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 10:45:52 +0100
+Subject: xsk: Fix race at socket teardown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 ]
+
+Fix a race in the xsk socket teardown code that can lead to a NULL pointer
+dereference splat. The current xsk unbind code in xsk_unbind_dev() starts by
+setting xs->state to XSK_UNBOUND, sets xs->dev to NULL and then waits for any
+NAPI processing to terminate using synchronize_net(). After that, the release
+code starts to tear down the socket state and free allocated memory.
+
+  BUG: kernel NULL pointer dereference, address: 00000000000000c0
+  PGD 8000000932469067 P4D 8000000932469067 PUD 0
+  Oops: 0000 [#1] PREEMPT SMP PTI
+  CPU: 25 PID: 69132 Comm: grpcpp_sync_ser Tainted: G          I       5.16.0+ #2
+  Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.2.10 03/09/2015
+  RIP: 0010:__xsk_sendmsg+0x2c/0x690
+  [...]
+  RSP: 0018:ffffa2348bd13d50 EFLAGS: 00010246
+  RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff8d5fc632d258
+  RDX: 0000000000400000 RSI: ffffa2348bd13e10 RDI: ffff8d5fc5489800
+  RBP: ffffa2348bd13db0 R08: 0000000000000000 R09: 00007ffffffff000
+  R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d5fc5489800
+  R13: ffff8d5fcb0f5140 R14: ffff8d5fcb0f5140 R15: 0000000000000000
+  FS:  00007f991cff9400(0000) GS:ffff8d6f1f700000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 00000000000000c0 CR3: 0000000114888005 CR4: 00000000001706e0
+  Call Trace:
+  <TASK>
+  ? aa_sk_perm+0x43/0x1b0
+  xsk_sendmsg+0xf0/0x110
+  sock_sendmsg+0x65/0x70
+  __sys_sendto+0x113/0x190
+  ? debug_smp_processor_id+0x17/0x20
+  ? fpregs_assert_state_consistent+0x23/0x50
+  ? exit_to_user_mode_prepare+0xa5/0x1d0
+  __x64_sys_sendto+0x29/0x30
+  do_syscall_64+0x3b/0xc0
+  entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+There are two problems with the current code. First, setting xs->dev to NULL
+before waiting for all users to stop using the socket is not correct. The
+entry to the data plane functions xsk_poll(), xsk_sendmsg(), and xsk_recvmsg()
+are all guarded by a test that xs->state is in the state XSK_BOUND and if not,
+it returns right away. But one process might have passed this test but still
+have not gotten to the point in which it uses xs->dev in the code. In this
+interim, a second process executing xsk_unbind_dev() might have set xs->dev to
+NULL which will lead to a crash for the first process. The solution here is
+just to get rid of this NULL assignment since it is not used anymore. Before
+commit 42fddcc7c64b ("xsk: use state member for socket synchronization"),
+xs->dev was the gatekeeper to admit processes into the data plane functions,
+but it was replaced with the state variable xs->state in the aforementioned
+commit.
+
+The second problem is that synchronize_net() does not wait for any process in
+xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() to complete, which means that the
+state they rely on might be cleaned up prematurely. This can happen when the
+notifier gets called (at driver unload for example) as it uses xsk_unbind_dev().
+Solve this by extending the RCU critical region from just the ndo_xsk_wakeup
+to the whole functions mentioned above, so that both the test of xs->state ==
+XSK_BOUND and the last use of any member of xs is covered by the RCU critical
+section. This will guarantee that when synchronize_net() completes, there will
+be no processes left executing xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() and
+state can be cleaned up safely. Note that we need to drop the RCU lock for the
+skb xmit path as it uses functions that might sleep. Due to this, we have to
+retest the xs->state after we grab the mutex that protects the skb xmit code
+from, among a number of things, an xsk_unbind_dev() being executed from the
+notifier at the same time.
+
+Fixes: 42fddcc7c64b ("xsk: use state member for socket synchronization")
+Reported-by: Elza Mathew <elza.mathew@intel.com>
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Björn Töpel <bjorn@kernel.org>
+Link: https://lore.kernel.org/bpf/20220228094552.10134-1-magnus.karlsson@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 69 +++++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 50 insertions(+), 19 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index f16074eb53c7..468e9b7e3edf 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -403,18 +403,8 @@ EXPORT_SYMBOL(xsk_tx_peek_release_desc_batch);
+ static int xsk_wakeup(struct xdp_sock *xs, u8 flags)
+ {
+ 	struct net_device *dev = xs->dev;
+-	int err;
+-
+-	rcu_read_lock();
+-	err = dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags);
+-	rcu_read_unlock();
+-
+-	return err;
+-}
+ 
+-static int xsk_zc_xmit(struct xdp_sock *xs)
+-{
+-	return xsk_wakeup(xs, XDP_WAKEUP_TX);
++	return dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags);
+ }
+ 
+ static void xsk_destruct_skb(struct sk_buff *skb)
+@@ -533,6 +523,12 @@ static int xsk_generic_xmit(struct sock *sk)
+ 
+ 	mutex_lock(&xs->mutex);
+ 
++	/* Since we dropped the RCU read lock, the socket state might have changed. */
++	if (unlikely(!xsk_is_bound(xs))) {
++		err = -ENXIO;
++		goto out;
++	}
++
+ 	if (xs->queue_id >= xs->dev->real_num_tx_queues)
+ 		goto out;
+ 
+@@ -596,16 +592,26 @@ static int xsk_generic_xmit(struct sock *sk)
+ 	return err;
+ }
+ 
+-static int __xsk_sendmsg(struct sock *sk)
++static int xsk_xmit(struct sock *sk)
+ {
+ 	struct xdp_sock *xs = xdp_sk(sk);
++	int ret;
+ 
+ 	if (unlikely(!(xs->dev->flags & IFF_UP)))
+ 		return -ENETDOWN;
+ 	if (unlikely(!xs->tx))
+ 		return -ENOBUFS;
+ 
+-	return xs->zc ? xsk_zc_xmit(xs) : xsk_generic_xmit(sk);
++	if (xs->zc)
++		return xsk_wakeup(xs, XDP_WAKEUP_TX);
++
++	/* Drop the RCU lock since the SKB path might sleep. */
++	rcu_read_unlock();
++	ret = xsk_generic_xmit(sk);
++	/* Reaquire RCU lock before going into common code. */
++	rcu_read_lock();
++
++	return ret;
+ }
+ 
+ static bool xsk_no_wakeup(struct sock *sk)
+@@ -619,7 +625,7 @@ static bool xsk_no_wakeup(struct sock *sk)
+ #endif
+ }
+ 
+-static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
++static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ {
+ 	bool need_wait = !(m->msg_flags & MSG_DONTWAIT);
+ 	struct sock *sk = sock->sk;
+@@ -639,11 +645,22 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ 
+ 	pool = xs->pool;
+ 	if (pool->cached_need_wakeup & XDP_WAKEUP_TX)
+-		return __xsk_sendmsg(sk);
++		return xsk_xmit(sk);
+ 	return 0;
+ }
+ 
+-static int xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int flags)
++static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
++{
++	int ret;
++
++	rcu_read_lock();
++	ret = __xsk_sendmsg(sock, m, total_len);
++	rcu_read_unlock();
++
++	return ret;
++}
++
++static int __xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int flags)
+ {
+ 	bool need_wait = !(flags & MSG_DONTWAIT);
+ 	struct sock *sk = sock->sk;
+@@ -669,6 +686,17 @@ static int xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int fl
+ 	return 0;
+ }
+ 
++static int xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int flags)
++{
++	int ret;
++
++	rcu_read_lock();
++	ret = __xsk_recvmsg(sock, m, len, flags);
++	rcu_read_unlock();
++
++	return ret;
++}
++
+ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ 			     struct poll_table_struct *wait)
+ {
+@@ -679,8 +707,11 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ 
+ 	sock_poll_wait(file, sock, wait);
+ 
+-	if (unlikely(!xsk_is_bound(xs)))
++	rcu_read_lock();
++	if (unlikely(!xsk_is_bound(xs))) {
++		rcu_read_unlock();
+ 		return mask;
++	}
+ 
+ 	pool = xs->pool;
+ 
+@@ -689,7 +720,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ 			xsk_wakeup(xs, pool->cached_need_wakeup);
+ 		else
+ 			/* Poll needs to drive Tx also in copy mode */
+-			__xsk_sendmsg(sk);
++			xsk_xmit(sk);
+ 	}
+ 
+ 	if (xs->rx && !xskq_prod_is_empty(xs->rx))
+@@ -697,6 +728,7 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ 	if (xs->tx && xsk_tx_writeable(xs))
+ 		mask |= EPOLLOUT | EPOLLWRNORM;
+ 
++	rcu_read_unlock();
+ 	return mask;
+ }
+ 
+@@ -728,7 +760,6 @@ static void xsk_unbind_dev(struct xdp_sock *xs)
+ 
+ 	/* Wait for driver to stop using the xdp socket. */
+ 	xp_del_xsk(xs->pool, xs);
+-	xs->dev = NULL;
+ 	synchronize_net();
+ 	dev_put(dev);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.16/xtensa-add-missing-xchal_have_windowed-check.patch b/queue-5.16/xtensa-add-missing-xchal_have_windowed-check.patch
new file mode 100644
index 00000000000..9c1d8c7e33b
--- /dev/null
+++ b/queue-5.16/xtensa-add-missing-xchal_have_windowed-check.patch
@@ -0,0 +1,39 @@
+From d5a9c619ace6c679fda6379e4ab33c8a2c81e934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Dec 2021 01:20:20 -0800
+Subject: xtensa: add missing XCHAL_HAVE_WINDOWED check
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+[ Upstream commit 8c9ab55c0fbdc76cb876140c2dad75a610bb23ef ]
+
+Add missing preprocessor conditions to secondary reset vector code.
+
+Fixes: 09af39f649da ("xtensa: use register window specific opcodes only when present")
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/kernel/mxhead.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/xtensa/kernel/mxhead.S b/arch/xtensa/kernel/mxhead.S
+index 9f3843742726..b702c0908b1f 100644
+--- a/arch/xtensa/kernel/mxhead.S
++++ b/arch/xtensa/kernel/mxhead.S
+@@ -37,11 +37,13 @@ _SetupOCD:
+ 	 * xt-gdb to single step via DEBUG exceptions received directly
+ 	 * by ocd.
+ 	 */
++#if XCHAL_HAVE_WINDOWED
+ 	movi	a1, 1
+ 	movi	a0, 0
+ 	wsr	a1, windowstart
+ 	wsr	a0, windowbase
+ 	rsync
++#endif
+ 
+ 	movi	a1, LOCKLEVEL
+ 	wsr	a1, ps
+-- 
+2.34.1
+
-- 
2.47.3