From 8faf3776e9b91c26f65951bcfe363d61fa6b82ec Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 2 Apr 2022 08:59:31 -0400
Subject: [PATCH] Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...fix-return-value-of-__setup-handlers.patch |  86 +++++++
 ...it-printable-size-of-bert-table-data.patch |  72 ++++++
 ...king-the-acpi-namespace-if-it-is-not.patch |  44 ++++
 ...hift-out-of-bounds-in-group-mask-cal.patch |  62 +++++
 ...b-fix-uninitialized-flag-for-av-c-de.patch |  84 +++++++
 ...k-add-alc256-samsung-headphone-fixup.patch |  85 +++++++
 .../alsa-spi-add-check-for-clk_enable.patch   |  92 +++++++
 ...add-the-missing-l1-l2-cache-informat.patch | 112 +++++++++
 ...add-missing-lvds-decoder-on-m53menlo.patch |  81 +++++++
 ...-gic_irq_domain_translate-warnings-f.patch |  60 +++++
 ...arm-dts-qcom-ipq4019-fix-sleep-clock.patch |  42 ++++
 ...oid-redundant-loads-or-clobbering-ip.patch | 135 +++++++++++
 ...e-that-adr-takes-the-thumb-bit-into-.patch |  40 +++
 ...mp-fix-failure-to-remove-sram-device.patch |  79 ++++++
 ...-tegra-tamonten-fix-i2c3-pad-setting.patch |  46 ++++
 ...arm64-dts-broadcom-fix-sata-nodename.patch |  41 ++++
 ...2-fix-spi-cpol-and-spi-cpha-property.patch |  52 ++++
 ...m8150-correct-tcs-configuration-for-.patch |  41 ++++
 ...ip-fix-sdio-regulator-supply-propert.patch |  40 +++
 ...issing-of_node_put-in-at91sam9g20ek_.patch |  38 +++
 ...ssc_dai-handle-errors-for-clk_enable.patch |  40 +++
 ...o-not-use-a-null-prepare_slave_confi.patch |  42 ++++
 .../asoc-fsi-add-check-for-clk_enable.patch   |  60 +++++
 ...fix-error-return-code-in-imx_es8328_.patch |  36 +++
 .../asoc-madera-add-dependencies-on-mfd.patch |  59 +++++
 ...-analog-fix-error-handling-in-pm8916.patch |  80 ++++++
 ...-digital-fix-missing-clk_disable_unp.patch |  48 ++++
 ...error-handling-in-mxs_sgtl5000_probe.patch |  43 ++++
 ...xs-saif-handle-errors-for-clk_enable.patch |  40 +++
 ...k-the-return-value-of-devm_kzalloc-i.patch |  39 +++
 ...s-prevent-the-potentially-use-of-nul.patch |  65 +++++
 ...ip-zero-num_dai-component-in-searchi.patch |  47 ++++
 ...da-remove-link-assignment-limitation.patch |  65 +++++
 ...davinci-i2s-add-check-for-clk_enable.patch |  49 ++++
 ...handle-error-for-wm8350_register_irq.patch |  73 ++++++
 ...y-overwrite-of-the-wowlan-wakeup-pac.patch |  56 +++++
 .../ath9k_htc-fix-uninit-value-bugs.patch     | 100 ++++++++
 ...-audit_time_-records-only-from-rules.patch | 167 +++++++++++++
 ...e-after-free-in-bfq_dispatch_request.patch | 183 ++++++++++++++
 queue-5.4/block-bfq-don-t-move-oom_bfqq.patch | 142 +++++++++++
 ...te-queue-kobject-before-its-children.patch |  71 ++++++
 ...dio-fix-kernel-oops-in-btmtksdio_int.patch |  72 ++++++
 ...serdev-call-init_rwsem-before-p-open.patch |  71 ++++++
 ...uild_prologue-first-in-first-jit-pas.patch |  53 ++++
 ...-feed-byte-offset-into-bpf-line-info.patch |  46 ++++
 ...ix-double-uncharge-the-mem-of-sk_msg.patch |  72 ++++++
 ...memleak-in-tcp_bpf_sendmsg-while-sk-.patch | 109 +++++++++
 ...more-uncharged-while-msg-has-more_da.patch | 100 ++++++++
 ...inate-clk_div_table-with-sentinel-el.patch |  58 +++++
 ...minate-clk_div_table-with-sentinel-e.patch |  45 ++++
 ...clk-imx7d-remove-audio_mclk_root_clk.patch |  38 +++
 .../clk-initialize-orphan-req_rate.patch      |  68 ++++++
 ...rminate-clk_div_table-with-sentinel-.patch |  40 +++
 ...2-update-logic-to-calculate-d-value-.patch |  60 +++++
 ...2-update-the-frac-table-for-pixel-cl.patch |  37 +++
 ...clk-qcom-gcc-msm8994-fix-gpll4-width.patch |  43 ++++
 ...pq8074-use-floor-ops-for-sdcc1-clock.patch |  49 ++++
 ...24-emc-fix-missing-put_device-call-i.patch |  39 +++
 ..._pm-fix-return-value-of-__setup-hand.patch |  50 ++++
 ...ers-timer-of-check-return-value-of-o.patch |  45 ++++
 ...ix-sleep-in-atomic-context-in-decryp.patch |  42 ++++
 ...maengine_unregister-release-dma-chan.patch |  69 ++++++
 ...ree-don-t-attempt-0-len-dma-mappings.patch |  45 ++++
 ...o-mxs-dcp-fix-scatterlist-processing.patch |  35 +++
 .../crypto-vmx-add-missing-dependencies.patch |  62 +++++
 ...odes-are-flushed-before-destroy-cach.patch |  51 ++++
 ..._key_size-compiler-warning-if-config.patch |  40 +++
 ...fix-return-value-of-__setup-handlers.patch |  72 ++++++
 ...-fix-return-value-of-__setup-handler.patch |  59 +++++
 ...add-affected-crtcs-to-atomic-state-f.patch |  58 +++++
 ...fix-a-null-pointer-dereference-in-am.patch |  49 ++++
 ...-remove-vupdate_int_entry-definition.patch | 162 +++++++++++++
 ...issing-pm_runtime_disable-in-__dw_mi.patch |  38 +++
 ...dsi-make-sure-to-to-create-proper-al.patch |  38 +++
 ...ree-wrong-object-in-sii8620_init_rcp.patch |  39 +++
 ...-t-clear-formats-if-using-deep-color.patch |  76 ++++++
 ...ference-leak-in-tegra_dsi_ganged_pro.patch |  39 +++
 ...ext2-correct-max-file-size-computing.patch |  58 +++++
 ...f-someone-dirty-pages-without-asking.patch |  84 +++++++
 ...-free-nid-in-f2fs_handle_failed_inod.patch | 109 +++++++++
 ...f2fs-fix-to-avoid-potential-deadlock.patch |  59 +++++
 ...ogle-properly-state-iomem-dependency.patch |  58 +++++
 ...pe-in-assignment-of-ipv6-port-for-au.patch |  35 +++
 ...kleak-exactly-match-strings-instead-.patch |  70 ++++++
 ...get-set_report-for-unnumbered-report.patch |  91 +++++++
 ...rate-limit-unhandled-message-warning.patch |  51 ++++
 ...mon-pmbus-add-mutex-to-regulator-ops.patch |  71 ++++++
 ...wmon-pmbus-add-vin-unit-off-handling.patch |  61 +++++
 ...mmon-replace-wdog_active-with-wdog_h.patch |  45 ++++
 ...g-atmel-disable-trng-on-failure-path.patch |  34 +++
 ...nctrl-do-not-deactivate-a-master-tha.patch |  53 ++++
 .../i2c-xiic-make-bus-names-unique.patch      |  49 ++++
 ...ve-excessive-xdp_packet_headroom-on-.patch |  53 ++++
 ...-ini-qps-to-set-their-local-ack-time.patch |  41 ++++
 ...-check-for-devm_request_threaded_irq.patch |  38 +++
 ...-check-for-error-num-after-setting-m.patch |  42 ++++
 ...-nvic-release-nvic_base-upon-failure.patch |  50 ++++
 .../irqchip-qcom-pdc-fix-broken-locking.patch |  56 +++++
 ...fix-incorrect-device_caps-for-ivtvfb.patch | 123 ++++++++++
 ...io-error-code-that-is-never-returned.patch |  39 +++
 ...-mvm-fix-an-error-code-in-iwl_mvm_up.patch |  39 +++
 .../jfs-fix-divide-error-in-dbnextag.patch    |  56 +++++
 ...-fix-return-value-of-__setup-handler.patch |  76 ++++++
 ...-fix-return-value-of-__setup-handler.patch |  65 +++++
 ...-fix-vmx-vsx-mixup-in-mmio-emulation.patch |  48 ++++
 ...-defer-not-present-segment-check-in-.patch |  69 ++++++
 ...kvm-x86-fix-emulation-in-writing-cr8.patch |  65 +++++
 ...akefile-use-pound-instead-of-for-mak.patch |  85 +++++++
 ...after-free-in-register_test_dev_kmod.patch |  34 +++
 ...ard-declaration-when-counting-duplic.patch |  54 +++++
 ...use-sysfs_emit-in-the-sysfs-xxx-show.patch |  73 ++++++
 ...otection-fault-in-legacy_parse_param.patch |  79 ++++++
 ...eed-correct-value-for-h-total-pixels.patch |  74 ++++++
 ...arning-regression-on-tunerless-devic.patch |  50 ++++
 ...issing-put_device-call-in-coda_get_v.patch |  37 +++
 ...clear-interrupt-status-register-befo.patch |  47 ++++
 ...-initialize-refcount-before-kref_get.patch |  66 +++++
 ...-overfill-bottom-register-field-name.patch |  64 +++++
 ...ialize-dev-worker-at-hdpvr_register_.patch |  61 +++++
 ...ia-em28xx-add-missing-em28xx_close_e.patch |  50 ++++
 ...-start-stream-fails-return-buffers-w.patch | 143 +++++++++++
 ...go7007-s2250-board-fix-leak-in-probe.patch |  57 +++++
 ...-handle-short-reads-of-hdmi-info-fra.patch |  66 +++++
 ...-emif-add-check-for-setup_interrupts.patch |  49 ++++
 ...k-the-pointer-temp-in-get_device_det.patch |  37 +++
 ...ssing-iounmap-on-error-asic3_mfd_pro.patch |  59 +++++
 ...xx-add-check-for-mc13xxx_irq_request.patch |  41 ++++
 ...s-dec-honor-config_mips_fp_support-n.patch |  80 ++++++
 ...-fix-return-value-of-__setup-handler.patch |  57 +++++
 ...alcor_pci-fix-an-error-handling-path.patch |  72 ++++++
 ...inci_mmc-handle-error-for-clk_enable.patch |  43 ++++
 ...an-error-when-enable_sdio_irq-ops-is.patch |  60 +++++
 ...k-sta_rates-pointer-in-mt7603_sta_ra.patch |  37 +++
 ...k-sta_rates-pointer-in-mt7615_sta_ra.patch |  37 +++
 .../mtd-onenand-check-for-error-irq.patch     |  47 ++++
 ...l-fix-refcount-issue-in-atmel_nand_c.patch |  75 ++++++
 ...-gpmi-fix-controller-timings-setting.patch |  59 +++++
 ...t_buf-leak-in-activate-when-lsr-0xff.patch |  76 ++++++
 ...-stronger-register-read-writes-to-as.patch | 115 +++++++++
 ...cfp-fix-an-incorrect-null-check-on-l.patch |  55 +++++
 ...x-enable-port-policy-support-on-6097.patch |  35 +++
 ...hy-broadcom-fix-brcm_fet_config_init.patch |  79 ++++++
 ...l-ptr-deref-caused-by-x25_disconnect.patch |  65 +++++
 ...ntrack_tcp-preserve-liberal-flag-in-.patch |  71 ++++++
 ..._h323-eliminate-anonymous-module_ini.patch |  74 ++++++
 ...ded-check-in-decode_devicenotify_arg.patch |  39 +++
 ...lid-errors-from-nfs2-3_decode_dirent.patch | 106 ++++++++
 ...nother-issue-with-a-list-iterator-po.patch | 120 +++++++++
 ...try-bind_conn_to_session-on-session-.patch |  35 +++
 ...-add-sanity-check-on-allocation-size.patch |  43 ++++
 ...tch-always-update-flow-key-after-nat.patch | 200 +++++++++++++++
 ...-reading-pci_exp_rtsta_pme-bit-on-em.patch |  55 +++++
 ...warnings-on-possible-rw1c-corruption.patch |  71 ++++++
 ...dress-filter-parser-for-multiple-fil.patch |  40 +++
 ...t-fix-address-filter-config-for-32-b.patch |  37 +++
 ...-lpx-parameter-and-its-derivatives-t.patch |  70 ++++++
 ...-fix-missing-of_node_put-in-mtk_pctr.patch |  45 ++++
 ...-paris-fix-argument-argument-type-fo.patch |  45 ++++
 ...-paris-fix-pingroup-pin-config-state.patch |  61 +++++
 ...add-missing-of_node_put-in-nmk_pinct.patch |  41 ++++
 ...-broken-references-to-chip-parent_de.patch | 125 ++++++++++
 ...r8a77470-reduce-size-for-narrow-vin1.patch |  50 ++++
 ...-add-missing-of_node_put-in-rockchip.patch |  45 ++++
 ...q-flags-in-device_pm_check_callbacks.patch | 107 ++++++++
 ...e-fix-__setup-handler-error-handling.patch |  40 +++
 ...-fix-return-value-of-__setup-handler.patch |  73 ++++++
 ...ni-poweroff-fix-irq-check-in-gemini_.patch |  45 ++++
 ...500-fix-memory-leak-in-ab8500_fg_sys.patch |  47 ++++
 ...4190_charger-fix-bq24190_vbus_is_ena.patch |  58 +++++
 ...350-power-add-missing-free-in-free_c.patch |  36 +++
 ...350-power-handle-error-for-wm8350_re.patch | 156 ++++++++++++
 ...a-return-value-error-in-mpc8xx_pic_i.patch |  38 +++
 ...-don-t-pass-mcpu-powerpc64-when-buil.patch |  57 +++++
 ...-t-use-perf_hw_context-for-trace-imc.patch |  52 ++++
 ...ix-incorrect-use-to-determine-if-lis.patch |  50 ++++
 ...n-value-of-printk.devkmsg-__setup-ha.patch |  70 ++++++
 ...initialize-driver-data-and-hardware-.patch |  83 +++++++
 ...-dcb-default-to-returning-eopnotsupp.patch |  81 +++++++
 .../ray_cs-check-ioremap-return-value.patch   |  57 +++++
 ...mory-leak-in-error-flow-for-subscrib.patch |  40 +++
 ...md-fix-for_each_child.cocci-warnings.patch |  48 ++++
 ...fix-missing-of_node_put-in-adsp_allo.patch |  36 +++
 ...wcnss-add-missing-of_node_put-in-wcn.patch |  37 +++
 ...ock-bfq-honor-already-setup-queue-me.patch |  78 ++++++
 ...ve-mpol_get-put-and-task_lock-unlock.patch |  60 +++++
 ...ange-permission-of-parameter-prot_ma.patch |  42 ++++
 ...01-fix-abort-all-task-initialization.patch |  97 ++++++++
 ...command-initialization-in-pm8001_chi.patch |  43 ++++
 ...command-initialization-in-pm80xx_sen.patch |  59 +++++
 ...payload-initialization-in-pm80xx_set.patch |  51 ++++
 ...ke-test_lwt_ip_encap-more-stable-and.patch |  75 ++++++
 ...st_lirc_mode2.sh-exit-with-proper-co.patch |  55 +++++
 ...vxlan_under_vrf-fix-broken-test-case.patch |  69 ++++++
 ...d-validity-check-and-allow-field-spl.patch |  40 +++
 ...-use-correct-type-for-context-length.patch |  47 ++++
 ...race-condition-in-rts-after-send-han.patch |  63 +++++
 ...balance-reference-count-for-pci-dma-.patch |  93 +++++++
 queue-5.4/series                              | 229 ++++++++++++++++++
 ...s-remove-spurious-irqf_oneshot-flags.patch |  50 ++++
 ...heck-for-null-return-of-devm_kcalloc.patch |  43 ++++
 ...pc-fix-irq-check-in-wkup_m3_ipc_prob.patch |  47 ++++
 ...alance-reference-count-for-pci-dma-d.patch |  77 ++++++
 ...-missing-irq-check-in-tegra_spi_prob.patch |  41 ++++
 ...tegra20-use-of_device_get_match_data.patch |  43 ++++
 ...ad7280a-fix-handing-of-device-addres.patch |  44 ++++
 ...ts-fix-leds-and-pinctrl-on-gb-pc1-de.patch | 139 +++++++++++
 ...updates-are-processed-during-fastope.patch |  68 ++++++
 ...e-timer-expires-after-interval-100ms.patch |  45 ++++
 ...o-fix-__setup-handlers-return-values.patch |  72 ++++++
 ...ce_define_enum-affect-trace-event-ty.patch |  83 +++++++
 ...-fix-return-value-of-__setup-handler.patch |  50 ++++
 ...-fix-nios2-and-microblaze-get_user_8.patch | 144 +++++++++++
 .../udmabuf-validate-ubuf-pagecount.patch     |  47 ++++
 ...realtek-fix-error-code-in-rts51x_rea.patch |  39 +++
 ...ate-anonymous-module_init-module_exi.patch |  81 +++++++
 ...l_lcdfb-fix-an-error-code-in-atmel_l.patch |  50 ++++
 ...usfb-check-pixclock-to-avoid-divide-.patch |  83 +++++++
 ...t.c-fix-printing-in-fb_cvt_print_nam.patch | 111 +++++++++
 ...iafb-use-strscpy-to-prevent-buffer-o.patch |  51 ++++
 ...fb-acx565akm-replace-snprintf-with-s.patch |  39 +++
 ...fb-add-missing-of_node_put-in-dvic_p.patch |  35 +++
 ...fb-panel-dsi-cm-use-sysfs_emit-inste.patch |  63 +++++
 ...fb-panel-tpo-td043mtea1-use-sysfs_em.patch |  45 ++++
 ...ev-sm712fb-fix-crash-in-smtcfb_write.patch |  75 ++++++
 ...ufx-fix-null-ptr-deref-in-ufx_usb_pr.patch |  62 +++++
 ...b-replace-snprintf-in-show-functions.patch |  63 +++++
 ...ideo-fbdev-w100fb-reset-global-state.patch |  68 ++++++
 ...nate-anonymous-module_init-module_ex.patch |  82 +++++++
 ...nable-local-echo-for-sent-can-frames.patch |  46 ++++
 queue-5.4/xen-fix-is_xen_pmu.patch            | 127 ++++++++++
 230 files changed, 14710 insertions(+)
 create mode 100644 queue-5.4/acpi-apei-fix-return-value-of-__setup-handlers.patch
 create mode 100644 queue-5.4/acpi-apei-limit-printable-size-of-bert-table-data.patch
 create mode 100644 queue-5.4/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
 create mode 100644 queue-5.4/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
 create mode 100644 queue-5.4/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
 create mode 100644 queue-5.4/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
 create mode 100644 queue-5.4/alsa-spi-add-check-for-clk_enable.patch
 create mode 100644 queue-5.4/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
 create mode 100644 queue-5.4/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
 create mode 100644 queue-5.4/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
 create mode 100644 queue-5.4/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
 create mode 100644 queue-5.4/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
 create mode 100644 queue-5.4/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
 create mode 100644 queue-5.4/arm-mmp-fix-failure-to-remove-sram-device.patch
 create mode 100644 queue-5.4/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
 create mode 100644 queue-5.4/arm64-dts-broadcom-fix-sata-nodename.patch
 create mode 100644 queue-5.4/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
 create mode 100644 queue-5.4/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
 create mode 100644 queue-5.4/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
 create mode 100644 queue-5.4/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
 create mode 100644 queue-5.4/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
 create mode 100644 queue-5.4/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
 create mode 100644 queue-5.4/asoc-fsi-add-check-for-clk_enable.patch
 create mode 100644 queue-5.4/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
 create mode 100644 queue-5.4/asoc-madera-add-dependencies-on-mfd.patch
 create mode 100644 queue-5.4/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
 create mode 100644 queue-5.4/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
 create mode 100644 queue-5.4/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
 create mode 100644 queue-5.4/asoc-mxs-saif-handle-errors-for-clk_enable.patch
 create mode 100644 queue-5.4/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
 create mode 100644 queue-5.4/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
 create mode 100644 queue-5.4/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
 create mode 100644 queue-5.4/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
 create mode 100644 queue-5.4/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
 create mode 100644 queue-5.4/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
 create mode 100644 queue-5.4/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
 create mode 100644 queue-5.4/ath9k_htc-fix-uninit-value-bugs.patch
 create mode 100644 queue-5.4/audit-log-audit_time_-records-only-from-rules.patch
 create mode 100644 queue-5.4/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
 create mode 100644 queue-5.4/block-bfq-don-t-move-oom_bfqq.patch
 create mode 100644 queue-5.4/block-don-t-delete-queue-kobject-before-its-children.patch
 create mode 100644 queue-5.4/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
 create mode 100644 queue-5.4/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
 create mode 100644 queue-5.4/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
 create mode 100644 queue-5.4/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
 create mode 100644 queue-5.4/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
 create mode 100644 queue-5.4/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
 create mode 100644 queue-5.4/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
 create mode 100644 queue-5.4/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
 create mode 100644 queue-5.4/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
 create mode 100644 queue-5.4/clk-imx7d-remove-audio_mclk_root_clk.patch
 create mode 100644 queue-5.4/clk-initialize-orphan-req_rate.patch
 create mode 100644 queue-5.4/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
 create mode 100644 queue-5.4/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
 create mode 100644 queue-5.4/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
 create mode 100644 queue-5.4/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
 create mode 100644 queue-5.4/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
 create mode 100644 queue-5.4/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
 create mode 100644 queue-5.4/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
 create mode 100644 queue-5.4/clocksource-drivers-timer-of-check-return-value-of-o.patch
 create mode 100644 queue-5.4/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
 create mode 100644 queue-5.4/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
 create mode 100644 queue-5.4/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
 create mode 100644 queue-5.4/crypto-mxs-dcp-fix-scatterlist-processing.patch
 create mode 100644 queue-5.4/crypto-vmx-add-missing-dependencies.patch
 create mode 100644 queue-5.4/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
 create mode 100644 queue-5.4/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
 create mode 100644 queue-5.4/dma-debug-fix-return-value-of-__setup-handlers.patch
 create mode 100644 queue-5.4/driver-core-dd-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
 create mode 100644 queue-5.4/drm-amd-display-remove-vupdate_int_entry-definition.patch
 create mode 100644 queue-5.4/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
 create mode 100644 queue-5.4/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
 create mode 100644 queue-5.4/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
 create mode 100644 queue-5.4/drm-edid-don-t-clear-formats-if-using-deep-color.patch
 create mode 100644 queue-5.4/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
 create mode 100644 queue-5.4/ext2-correct-max-file-size-computing.patch
 create mode 100644 queue-5.4/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
 create mode 100644 queue-5.4/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
 create mode 100644 queue-5.4/f2fs-fix-to-avoid-potential-deadlock.patch
 create mode 100644 queue-5.4/firmware-google-properly-state-iomem-dependency.patch
 create mode 100644 queue-5.4/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
 create mode 100644 queue-5.4/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
 create mode 100644 queue-5.4/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
 create mode 100644 queue-5.4/hv_balloon-rate-limit-unhandled-message-warning.patch
 create mode 100644 queue-5.4/hwmon-pmbus-add-mutex-to-regulator-ops.patch
 create mode 100644 queue-5.4/hwmon-pmbus-add-vin-unit-off-handling.patch
 create mode 100644 queue-5.4/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
 create mode 100644 queue-5.4/hwrng-atmel-disable-trng-on-failure-path.patch
 create mode 100644 queue-5.4/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
 create mode 100644 queue-5.4/i2c-xiic-make-bus-names-unique.patch
 create mode 100644 queue-5.4/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
 create mode 100644 queue-5.4/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
 create mode 100644 queue-5.4/iio-adc-add-check-for-devm_request_threaded_irq.patch
 create mode 100644 queue-5.4/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
 create mode 100644 queue-5.4/irqchip-nvic-release-nvic_base-upon-failure.patch
 create mode 100644 queue-5.4/irqchip-qcom-pdc-fix-broken-locking.patch
 create mode 100644 queue-5.4/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
 create mode 100644 queue-5.4/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
 create mode 100644 queue-5.4/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
 create mode 100644 queue-5.4/jfs-fix-divide-error-in-dbnextag.patch
 create mode 100644 queue-5.4/kgdboc-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/kgdbts-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
 create mode 100644 queue-5.4/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
 create mode 100644 queue-5.4/kvm-x86-fix-emulation-in-writing-cr8.patch
 create mode 100644 queue-5.4/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
 create mode 100644 queue-5.4/lib-test-use-after-free-in-register_test_dev_kmod.patch
 create mode 100644 queue-5.4/libbpf-skip-forward-declaration-when-counting-duplic.patch
 create mode 100644 queue-5.4/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
 create mode 100644 queue-5.4/lsm-general-protection-fault-in-legacy_parse_param.patch
 create mode 100644 queue-5.4/media-aspeed-correct-value-for-h-total-pixels.patch
 create mode 100644 queue-5.4/media-bttv-fix-warning-regression-on-tunerless-devic.patch
 create mode 100644 queue-5.4/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
 create mode 100644 queue-5.4/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
 create mode 100644 queue-5.4/media-em28xx-initialize-refcount-before-kref_get.patch
 create mode 100644 queue-5.4/media-hantro-fix-overfill-bottom-register-field-name.patch
 create mode 100644 queue-5.4/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
 create mode 100644 queue-5.4/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
 create mode 100644 queue-5.4/media-stk1160-if-start-stream-fails-return-buffers-w.patch
 create mode 100644 queue-5.4/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
 create mode 100644 queue-5.4/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
 create mode 100644 queue-5.4/memory-emif-add-check-for-setup_interrupts.patch
 create mode 100644 queue-5.4/memory-emif-check-the-pointer-temp-in-get_device_det.patch
 create mode 100644 queue-5.4/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
 create mode 100644 queue-5.4/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
 create mode 100644 queue-5.4/mips-dec-honor-config_mips_fp_support-n.patch
 create mode 100644 queue-5.4/mips-rb532-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/misc-alcor_pci-fix-an-error-handling-path.patch
 create mode 100644 queue-5.4/mmc-davinci_mmc-handle-error-for-clk_enable.patch
 create mode 100644 queue-5.4/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
 create mode 100644 queue-5.4/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
 create mode 100644 queue-5.4/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
 create mode 100644 queue-5.4/mtd-onenand-check-for-error-irq.patch
 create mode 100644 queue-5.4/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
 create mode 100644 queue-5.4/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
 create mode 100644 queue-5.4/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
 create mode 100644 queue-5.4/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
 create mode 100644 queue-5.4/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
 create mode 100644 queue-5.4/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
 create mode 100644 queue-5.4/net-phy-broadcom-fix-brcm_fet_config_init.patch
 create mode 100644 queue-5.4/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
 create mode 100644 queue-5.4/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
 create mode 100644 queue-5.4/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
 create mode 100644 queue-5.4/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
 create mode 100644 queue-5.4/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
 create mode 100644 queue-5.4/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
 create mode 100644 queue-5.4/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
 create mode 100644 queue-5.4/ntfs-add-sanity-check-on-allocation-size.patch
 create mode 100644 queue-5.4/openvswitch-always-update-flow-key-after-nat.patch
 create mode 100644 queue-5.4/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
 create mode 100644 queue-5.4/pci-reduce-warnings-on-possible-rw1c-corruption.patch
 create mode 100644 queue-5.4/perf-core-fix-address-filter-parser-for-multiple-fil.patch
 create mode 100644 queue-5.4/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
 create mode 100644 queue-5.4/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
 create mode 100644 queue-5.4/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
 create mode 100644 queue-5.4/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
 create mode 100644 queue-5.4/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
 create mode 100644 queue-5.4/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
 create mode 100644 queue-5.4/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
 create mode 100644 queue-5.4/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
 create mode 100644 queue-5.4/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
 create mode 100644 queue-5.4/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
 create mode 100644 queue-5.4/pm-hibernate-fix-__setup-handler-error-handling.patch
 create mode 100644 queue-5.4/pm-suspend-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
 create mode 100644 queue-5.4/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
 create mode 100644 queue-5.4/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
 create mode 100644 queue-5.4/power-supply-wm8350-power-add-missing-free-in-free_c.patch
 create mode 100644 queue-5.4/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
 create mode 100644 queue-5.4/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
 create mode 100644 queue-5.4/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
 create mode 100644 queue-5.4/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
 create mode 100644 queue-5.4/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
 create mode 100644 queue-5.4/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
 create mode 100644 queue-5.4/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
 create mode 100644 queue-5.4/qlcnic-dcb-default-to-returning-eopnotsupp.patch
 create mode 100644 queue-5.4/ray_cs-check-ioremap-return-value.patch
 create mode 100644 queue-5.4/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
 create mode 100644 queue-5.4/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
 create mode 100644 queue-5.4/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
 create mode 100644 queue-5.4/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
 create mode 100644 queue-5.4/revert-revert-block-bfq-honor-already-setup-queue-me.patch
 create mode 100644 queue-5.4/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
 create mode 100644 queue-5.4/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
 create mode 100644 queue-5.4/scsi-pm8001-fix-abort-all-task-initialization.patch
 create mode 100644 queue-5.4/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
 create mode 100644 queue-5.4/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
 create mode 100644 queue-5.4/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
 create mode 100644 queue-5.4/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
 create mode 100644 queue-5.4/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
 create mode 100644 queue-5.4/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
 create mode 100644 queue-5.4/selftests-x86-add-validity-check-and-allow-field-spl.patch
 create mode 100644 queue-5.4/selinux-use-correct-type-for-context-length.patch
 create mode 100644 queue-5.4/serial-8250-fix-race-condition-in-rts-after-send-han.patch
 create mode 100644 queue-5.4/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
 create mode 100644 queue-5.4/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
 create mode 100644 queue-5.4/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
 create mode 100644 queue-5.4/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
 create mode 100644 queue-5.4/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
 create mode 100644 queue-5.4/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
 create mode 100644 queue-5.4/spi-tegra20-use-of_device_get_match_data.patch
 create mode 100644 queue-5.4/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
 create mode 100644 queue-5.4/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
 create mode 100644 queue-5.4/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
 create mode 100644 queue-5.4/tipc-fix-the-timer-expires-after-interval-100ms.patch
 create mode 100644 queue-5.4/tomoyo-fix-__setup-handlers-return-values.patch
 create mode 100644 queue-5.4/tracing-have-trace_define_enum-affect-trace-event-ty.patch
 create mode 100644 queue-5.4/tty-hvc-fix-return-value-of-__setup-handler.patch
 create mode 100644 queue-5.4/uaccess-fix-nios2-and-microblaze-get_user_8.patch
 create mode 100644 queue-5.4/udmabuf-validate-ubuf-pagecount.patch
 create mode 100644 queue-5.4/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
 create mode 100644 queue-5.4/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
 create mode 100644 queue-5.4/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
 create mode 100644 queue-5.4/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
 create mode 100644 queue-5.4/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
 create mode 100644 queue-5.4/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
 create mode 100644 queue-5.4/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
 create mode 100644 queue-5.4/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
 create mode 100644 queue-5.4/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
 create mode 100644 queue-5.4/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
 create mode 100644 queue-5.4/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
 create mode 100644 queue-5.4/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
 create mode 100644 queue-5.4/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
 create mode 100644 queue-5.4/video-fbdev-w100fb-reset-global-state.patch
 create mode 100644 queue-5.4/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
 create mode 100644 queue-5.4/vxcan-enable-local-echo-for-sent-can-frames.patch
 create mode 100644 queue-5.4/xen-fix-is_xen_pmu.patch

diff --git a/queue-5.4/acpi-apei-fix-return-value-of-__setup-handlers.patch b/queue-5.4/acpi-apei-fix-return-value-of-__setup-handlers.patch
new file mode 100644
index 00000000000..3a970dbc503
--- /dev/null
+++ b/queue-5.4/acpi-apei-fix-return-value-of-__setup-handlers.patch
@@ -0,0 +1,86 @@
+From 4943e69ccdaef61608437965037b6f7868ad3479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 18:46:20 -0800
+Subject: ACPI: APEI: fix return value of __setup handlers
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f3303ff649dbf7dcdc6a6e1a922235b12b3028f4 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled. Returning 0 causes a boot option to be listed in
+the Unknown kernel command line parameters and also added to init's
+arg list (if no '=' sign) or environment list (if of the form 'a=b').
+
+Unknown kernel command line parameters "erst_disable
+  bert_disable hest_disable BOOT_IMAGE=/boot/bzImage-517rc6", will be
+  passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+     erst_disable
+     bert_disable
+     hest_disable
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc6
+
+Fixes: a3e2acc5e37b ("ACPI / APEI: Add Boot Error Record Table (BERT) support")
+Fixes: a08f82d08053 ("ACPI, APEI, Error Record Serialization Table (ERST) support")
+Fixes: 9dc966641677 ("ACPI, APEI, HEST table parsing")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Reviewed-by: "Huang, Ying" <ying.huang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/bert.c | 2 +-
+ drivers/acpi/apei/erst.c | 2 +-
+ drivers/acpi/apei/hest.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c
+index 1155fb9dcc3a..08d820c04618 100644
+--- a/drivers/acpi/apei/bert.c
++++ b/drivers/acpi/apei/bert.c
+@@ -77,7 +77,7 @@ static int __init setup_bert_disable(char *str)
+ {
+ 	bert_disable = 1;
+ 
+-	return 0;
++	return 1;
+ }
+ __setup("bert_disable", setup_bert_disable);
+ 
+diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
+index 2015a0967cbb..5ee3cb7fcd90 100644
+--- a/drivers/acpi/apei/erst.c
++++ b/drivers/acpi/apei/erst.c
+@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear);
+ static int __init setup_erst_disable(char *str)
+ {
+ 	erst_disable = 1;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("erst_disable", setup_erst_disable);
+diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
+index 267bdbf6a7bf..add6416e78f2 100644
+--- a/drivers/acpi/apei/hest.c
++++ b/drivers/acpi/apei/hest.c
+@@ -219,7 +219,7 @@ static int __init hest_ghes_dev_register(unsigned int ghes_count)
+ static int __init setup_hest_disable(char *str)
+ {
+ 	hest_disable = HEST_DISABLED;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("hest_disable", setup_hest_disable);
+-- 
+2.34.1
+
diff --git a/queue-5.4/acpi-apei-limit-printable-size-of-bert-table-data.patch b/queue-5.4/acpi-apei-limit-printable-size-of-bert-table-data.patch
new file mode 100644
index 00000000000..693f7eb3d54
--- /dev/null
+++ b/queue-5.4/acpi-apei-limit-printable-size-of-bert-table-data.patch
@@ -0,0 +1,72 @@
+From ff1fad37e09d290edab46895d834ce8558b7d913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 10:50:48 -0800
+Subject: ACPI/APEI: Limit printable size of BERT table data
+
+From: Darren Hart <darren@os.amperecomputing.com>
+
+[ Upstream commit 3f8dec116210ca649163574ed5f8df1e3b837d07 ]
+
+Platforms with large BERT table data can trigger soft lockup errors
+while attempting to print the entire BERT table data to the console at
+boot:
+
+  watchdog: BUG: soft lockup - CPU#160 stuck for 23s! [swapper/0:1]
+
+Observed on Ampere Altra systems with a single BERT record of ~250KB.
+
+The original bert driver appears to have assumed relatively small table
+data. Since it is impractical to reassemble large table data from
+interwoven console messages, and the table data is available in
+
+  /sys/firmware/acpi/tables/data/BERT
+
+limit the size for tables printed to the console to 1024 (for no reason
+other than it seemed like a good place to kick off the discussion, would
+appreciate feedback from existing users in terms of what size would
+maintain their current usage model).
+
+Alternatively, we could make printing a CONFIG option, use the
+bert_disable boot arg (or something similar), or use a debug log level.
+However, all those solutions require extra steps or change the existing
+behavior for small table data. Limiting the size preserves existing
+behavior on existing platforms with small table data, and eliminates the
+soft lockups for platforms with large table data, while still making it
+available.
+
+Signed-off-by: Darren Hart <darren@os.amperecomputing.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/bert.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c
+index 08d820c04618..76b7539a37a9 100644
+--- a/drivers/acpi/apei/bert.c
++++ b/drivers/acpi/apei/bert.c
+@@ -29,6 +29,7 @@
+ 
+ #undef pr_fmt
+ #define pr_fmt(fmt) "BERT: " fmt
++#define ACPI_BERT_PRINT_MAX_LEN 1024
+ 
+ static int bert_disable;
+ 
+@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region,
+ 		}
+ 
+ 		pr_info_once("Error records from previous boot:\n");
+-
+-		cper_estatus_print(KERN_INFO HW_ERR, estatus);
++		if (region_len < ACPI_BERT_PRINT_MAX_LEN)
++			cper_estatus_print(KERN_INFO HW_ERR, estatus);
++		else
++			pr_info_once("Max print length exceeded, table data is available at:\n"
++				     "/sys/firmware/acpi/tables/data/BERT");
+ 
+ 		/*
+ 		 * Because the boot error source is "one-time polled" type,
+-- 
+2.34.1
+
diff --git a/queue-5.4/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch b/queue-5.4/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
new file mode 100644
index 00000000000..954627073af
--- /dev/null
+++ b/queue-5.4/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
@@ -0,0 +1,44 @@
+From c1e4002c1869686ad73a9e5fd06768fd541b61b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 20:28:26 +0100
+Subject: ACPICA: Avoid walking the ACPI Namespace if it is not there
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 0c9992315e738e7d6e927ef36839a466b080dba6 ]
+
+ACPICA commit b1c3656ef4950098e530be68d4b589584f06cddc
+
+Prevent acpi_ns_walk_namespace() from crashing when called with
+start_node equal to ACPI_ROOT_OBJECT if the Namespace has not been
+instantiated yet and acpi_gbl_root_node is NULL.
+
+For instance, this can happen if the kernel is run with "acpi=off"
+in the command line.
+
+Link: https://github.com/acpica/acpica/commit/b1c3656ef4950098e530be68d4b589584f06cddc
+Link: https://lore.kernel.org/linux-acpi/CAJZ5v0hJWW_vZ3wwajE7xT38aWjY7cZyvqMJpXHzUL98-SiCVQ@mail.gmail.com/
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/nswalk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
+index ceea6af79d12..bf4eb642f423 100644
+--- a/drivers/acpi/acpica/nswalk.c
++++ b/drivers/acpi/acpica/nswalk.c
+@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type,
+ 
+ 	if (start_node == ACPI_ROOT_OBJECT) {
+ 		start_node = acpi_gbl_root_node;
++		if (!start_node) {
++			return_ACPI_STATUS(AE_NO_NAMESPACE);
++		}
+ 	}
+ 
+ 	/* Null child means "get first node" */
+-- 
+2.34.1
+
diff --git a/queue-5.4/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch b/queue-5.4/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
new file mode 100644
index 00000000000..262cbd5511f
--- /dev/null
+++ b/queue-5.4/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
@@ -0,0 +1,62 @@
+From 4c640472400ce6e9d2a5a62bd76e5702ca913b7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 15:53:06 +0100
+Subject: af_netlink: Fix shift out of bounds in group mask calculation
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 0caf6d9922192dd1afa8dc2131abfb4df1443b9f ]
+
+When a netlink message is received, netlink_recvmsg() fills in the address
+of the sender. One of the fields is the 32-bit bitfield nl_groups, which
+carries the multicast group on which the message was received. The least
+significant bit corresponds to group 1, and therefore the highest group
+that the field can represent is 32. Above that, the UB sanitizer flags the
+out-of-bounds shift attempts.
+
+Which bits end up being set in such case is implementation defined, but
+it's either going to be a wrong non-zero value, or zero, which is at least
+not misleading. Make the latter choice deterministic by always setting to 0
+for higher-numbered multicast groups.
+
+To get information about membership in groups >= 32, userspace is expected
+to use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO
+socket option.
+[0] https://lwn.net/Articles/147608/
+
+The way to trigger this issue is e.g. through monitoring the BRVLAN group:
+
+	# bridge monitor vlan &
+	# ip link add name br type bridge
+
+Which produces the following citation:
+
+	UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19
+	shift exponent 32 is too large for 32-bit type 'int'
+
+Fixes: f7fa9b10edbb ("[NETLINK]: Support dynamic number of multicast groups per netlink family")
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://lore.kernel.org/r/2bef6aabf201d1fc16cca139a744700cff9dcb04.1647527635.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 891e029ad0f8..fb28969899af 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -148,6 +148,8 @@ static const struct rhashtable_params netlink_rhashtable_params;
+ 
+ static inline u32 netlink_group_mask(u32 group)
+ {
++	if (group > 32)
++		return 0;
+ 	return group ? 1 << (group - 1) : 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch b/queue-5.4/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
new file mode 100644
index 00000000000..3f30b52ac29
--- /dev/null
+++ b/queue-5.4/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
@@ -0,0 +1,84 @@
+From b41dae4ddcf4cec6252c7ec0846ebc5fd2c5e60f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 21:56:47 +0900
+Subject: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred
+ transaction
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ]
+
+AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA:
+firewire-lib: Add support for deferred transaction") while 'deferrable'
+flag can be uninitialized for non-control/notify AV/C transactions.
+UBSAN reports it:
+
+kernel: ================================================================================
+kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9
+kernel: load of value 158 is not a valid value for type '_Bool'
+kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P           OE     5.15.0-18-generic #18-Ubuntu
+kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019
+kernel: Call Trace:
+kernel:  <IRQ>
+kernel:  show_stack+0x52/0x58
+kernel:  dump_stack_lvl+0x4a/0x5f
+kernel:  dump_stack+0x10/0x12
+kernel:  ubsan_epilogue+0x9/0x45
+kernel:  __ubsan_handle_load_invalid_value.cold+0x44/0x49
+kernel:  fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib]
+kernel:  fcp_response+0x28/0x30 [snd_firewire_lib]
+kernel:  fw_core_handle_request+0x230/0x3d0 [firewire_core]
+kernel:  handle_ar_packet+0x1d9/0x200 [firewire_ohci]
+kernel:  ? handle_ar_packet+0x1d9/0x200 [firewire_ohci]
+kernel:  ? transmit_complete_callback+0x9f/0x120 [firewire_core]
+kernel:  ar_context_tasklet+0xa8/0x2e0 [firewire_ohci]
+kernel:  tasklet_action_common.constprop.0+0xea/0xf0
+kernel:  tasklet_action+0x22/0x30
+kernel:  __do_softirq+0xd9/0x2e3
+kernel:  ? irq_finalize_oneshot.part.0+0xf0/0xf0
+kernel:  do_softirq+0x75/0xa0
+kernel:  </IRQ>
+kernel:  <TASK>
+kernel:  __local_bh_enable_ip+0x50/0x60
+kernel:  irq_forced_thread_fn+0x7e/0x90
+kernel:  irq_thread+0xba/0x190
+kernel:  ? irq_thread_fn+0x60/0x60
+kernel:  kthread+0x11e/0x140
+kernel:  ? irq_thread_check_affinity+0xf0/0xf0
+kernel:  ? set_kthread_struct+0x50/0x50
+kernel:  ret_from_fork+0x22/0x30
+kernel:  </TASK>
+kernel: ================================================================================
+
+This commit fixes the bug. The bug has no disadvantage for the non-
+control/notify AV/C transactions since the flag has an effect for AV/C
+response with INTERIM (0x0f) status which is not used for the transactions
+in AV/C general specification.
+
+Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/fcp.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c
+index bbfbebf4affb..df44dd5dc4b2 100644
+--- a/sound/firewire/fcp.c
++++ b/sound/firewire/fcp.c
+@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit,
+ 	t.response_match_bytes = response_match_bytes;
+ 	t.state = STATE_PENDING;
+ 	init_waitqueue_head(&t.wait);
+-
+-	if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03)
+-		t.deferrable = true;
++	t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03);
+ 
+ 	spin_lock_irq(&transactions_lock);
+ 	list_add_tail(&t.list, &transactions);
+-- 
+2.34.1
+
diff --git a/queue-5.4/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch b/queue-5.4/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
new file mode 100644
index 00000000000..9f0377d6524
--- /dev/null
+++ b/queue-5.4/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
@@ -0,0 +1,85 @@
+From 31b18a7834f8400870566d25ad73fa226bcbde32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 13:48:17 -0700
+Subject: ALSA: hda/realtek: Add alc256-samsung-headphone fixup
+
+From: Matt Kramer <mccleetus@gmail.com>
+
+[ Upstream commit ef248d9bd616b04df8be25539a4dc5db4b6c56f4 ]
+
+This fixes the near-silence of the headphone jack on the ALC256-based
+Samsung Galaxy Book Flex Alpha (NP730QCJ). The magic verbs were found
+through trial and error, using known ALC298 hacks as inspiration. The
+fixup is auto-enabled only when the NP730QCJ is detected. It can be
+manually enabled using model=alc256-samsung-headphone.
+
+Signed-off-by: Matt Kramer <mccleetus@gmail.com>
+Link: https://lore.kernel.org/r/3168355.aeNJFYEL58@linus
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sound/hd-audio/models.rst |  4 ++++
+ sound/pci/hda/patch_realtek.c           | 11 +++++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index 0ea967d34583..4c91abad7b35 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -261,6 +261,10 @@ alc-sense-combo
+ huawei-mbx-stereo
+     Enable initialization verbs for Huawei MBX stereo speakers;
+     might be risky, try this at your own risk
++alc298-samsung-headphone
++    Samsung laptops with ALC298
++alc256-samsung-headphone
++    Samsung laptops with ALC256
+ 
+ ALC66x/67x/892
+ ==============
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6e1770c76381..05ca4196cb0f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6456,6 +6456,7 @@ enum {
+ 	ALC285_FIXUP_HP_MUTE_LED,
+ 	ALC236_FIXUP_HP_MUTE_LED,
+ 	ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
++	ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
+ 	ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
+ 	ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
+ 	ALC269VC_FIXUP_ACER_HEADSET_MIC,
+@@ -7740,6 +7741,14 @@ static const struct hda_fixup alc269_fixups[] = {
+ 			{ }
+ 		},
+ 	},
++	[ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
++		.type = HDA_FIXUP_VERBS,
++		.v.verbs = (const struct hda_verb[]) {
++			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x08},
++			{ 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf},
++			{ }
++		},
++	},
+ 	[ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -8217,6 +8226,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ 	SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
++	SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+ 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+@@ -8540,6 +8550,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ 	{.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
+ 	{.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
++	{.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"},
+ 	{.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+ 	{.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"},
+ 	{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
+-- 
+2.34.1
+
diff --git a/queue-5.4/alsa-spi-add-check-for-clk_enable.patch b/queue-5.4/alsa-spi-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..cb765de703e
--- /dev/null
+++ b/queue-5.4/alsa-spi-add-check-for-clk_enable.patch
@@ -0,0 +1,92 @@
+From 0ca52f0d7d47ffd26bafeb2567b6fc078029100f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 10:28:39 +0800
+Subject: ALSA: spi: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ca1697eb09208f0168d94b88b72f57505339cbe5 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: 3568459a5113 ("ALSA: at73c213: manage SSC clock")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220228022839.3547266-1-jiasheng@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/spi/at73c213.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
+index 4de1ba9a418d..6e5d315bab59 100644
+--- a/sound/spi/at73c213.c
++++ b/sound/spi/at73c213.c
+@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream)
+ 	runtime->hw = snd_at73c213_playback_hw;
+ 	chip->substream = substream;
+ 
+-	clk_enable(chip->ssc->clk);
++	err = clk_enable(chip->ssc->clk);
++	if (err)
++		return err;
+ 
+ 	return 0;
+ }
+@@ -784,7 +786,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip)
+ 		goto out;
+ 
+ 	/* Enable DAC master clock. */
+-	clk_enable(chip->board->dac_clk);
++	retval = clk_enable(chip->board->dac_clk);
++	if (retval)
++		goto out;
+ 
+ 	/* Initialize at73c213 on SPI bus. */
+ 	retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04);
+@@ -897,7 +901,9 @@ static int snd_at73c213_dev_init(struct snd_card *card,
+ 	chip->card = card;
+ 	chip->irq = -1;
+ 
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->ssc->clk);
++	if (retval)
++		return retval;
+ 
+ 	retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip);
+ 	if (retval) {
+@@ -1016,7 +1022,9 @@ static int snd_at73c213_remove(struct spi_device *spi)
+ 	int retval;
+ 
+ 	/* Stop playback. */
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->ssc->clk);
++	if (retval)
++		goto out;
+ 	ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS));
+ 	clk_disable(chip->ssc->clk);
+ 
+@@ -1096,9 +1104,16 @@ static int snd_at73c213_resume(struct device *dev)
+ {
+ 	struct snd_card *card = dev_get_drvdata(dev);
+ 	struct snd_at73c213 *chip = card->private_data;
++	int retval;
+ 
+-	clk_enable(chip->board->dac_clk);
+-	clk_enable(chip->ssc->clk);
++	retval = clk_enable(chip->board->dac_clk);
++	if (retval)
++		return retval;
++	retval = clk_enable(chip->ssc->clk);
++	if (retval) {
++		clk_disable(chip->board->dac_clk);
++		return retval;
++	}
+ 	ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN));
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch b/queue-5.4/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
new file mode 100644
index 00000000000..1544a16d75d
--- /dev/null
+++ b/queue-5.4/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
@@ -0,0 +1,112 @@
+From d26bc9aecf25db196a88b6199a1dc1af45ecb579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Dec 2021 21:00:09 +0100
+Subject: ARM: dts: bcm2837: Add the missing L1/L2 cache information
+
+From: Richard Schleich <rs@noreya.tech>
+
+[ Upstream commit bdf8762da268d2a34abf517c36528413906e9cd5 ]
+
+This patch fixes the kernel warning
+"cacheinfo: Unable to detect cache hierarchy for CPU 0"
+for the bcm2837 on newer kernel versions.
+
+Signed-off-by: Richard Schleich <rs@noreya.tech>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+[florian: Align and remove comments matching property values]
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2837.dtsi | 49 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi
+index beb6c502dadc..bcad098a7fcc 100644
+--- a/arch/arm/boot/dts/bcm2837.dtsi
++++ b/arch/arm/boot/dts/bcm2837.dtsi
+@@ -38,12 +38,26 @@
+ 		#size-cells = <0>;
+ 		enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit
+ 
++		/* Source for d/i-cache-line-size and d/i-cache-sets
++		 * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system
++		 * /about-the-l1-memory-system?lang=en
++		 *
++		 * Source for d/i-cache-size
++		 * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks
++		 */
+ 		cpu0: cpu@0 {
+ 			device_type = "cpu";
+ 			compatible = "arm,cortex-a53";
+ 			reg = <0>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000d8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -52,6 +66,13 @@
+ 			reg = <1>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu2: cpu@2 {
+@@ -60,6 +81,13 @@
+ 			reg = <2>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000e8>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
+ 		};
+ 
+ 		cpu3: cpu@3 {
+@@ -68,6 +96,27 @@
+ 			reg = <3>;
+ 			enable-method = "spin-table";
+ 			cpu-release-addr = <0x0 0x000000f0>;
++			d-cache-size = <0x8000>;
++			d-cache-line-size = <64>;
++			d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++			i-cache-size = <0x8000>;
++			i-cache-line-size = <64>;
++			i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++			next-level-cache = <&l2>;
++		};
++
++		/* Source for cache-line-size + cache-sets
++		 * https://developer.arm.com/documentation/ddi0500
++		 * /e/level-2-memory-system/about-the-l2-memory-system?lang=en
++		 * Source for cache-size
++		 * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf
++		 */
++		l2: l2-cache0 {
++			compatible = "cache";
++			cache-size = <0x80000>;
++			cache-line-size = <64>;
++			cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set
++			cache-level = <2>;
+ 		};
+ 	};
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch b/queue-5.4/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
new file mode 100644
index 00000000000..0a37aad10f0
--- /dev/null
+++ b/queue-5.4/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
@@ -0,0 +1,81 @@
+From 553f1504d386ecc27f3bf042ff0366e867f378ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 23:11:23 +0100
+Subject: ARM: dts: imx: Add missing LVDS decoder on M53Menlo
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 0c6f71176ea43d6f4003a4d57f7bb518c5ad6145 ]
+
+The M53Menlo display unit uses an LVDS-to-DPI bridge, TI DS90CF364A.
+Describe this bridge in DT, otherwise the DT incorrectly describes
+DPI panel attached directly to LVDS source.
+
+Fixes: 716be61d1869 ("ARM: dts: imx53: Add Menlosystems M53 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index 03c43c1912a7..d002c8f738b5 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -53,6 +53,31 @@
+ 		};
+ 	};
+ 
++	lvds-decoder {
++		compatible = "ti,ds90cf364a", "lvds-decoder";
++
++		ports {
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			port@0 {
++				reg = <0>;
++
++				lvds_decoder_in: endpoint {
++					remote-endpoint = <&lvds0_out>;
++				};
++			};
++
++			port@1 {
++				reg = <1>;
++
++				lvds_decoder_out: endpoint {
++					remote-endpoint = <&panel_in>;
++				};
++			};
++		};
++	};
++
+ 	panel {
+ 		compatible = "edt,etm0700g0dh6";
+ 		pinctrl-0 = <&pinctrl_display_gpio>;
+@@ -61,7 +86,7 @@
+ 
+ 		port {
+ 			panel_in: endpoint {
+-				remote-endpoint = <&lvds0_out>;
++				remote-endpoint = <&lvds_decoder_out>;
+ 			};
+ 		};
+ 	};
+@@ -450,7 +475,7 @@
+ 			reg = <2>;
+ 
+ 			lvds0_out: endpoint {
+-				remote-endpoint = <&panel_in>;
++				remote-endpoint = <&lvds_decoder_in>;
+ 			};
+ 		};
+ 	};
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch b/queue-5.4/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
new file mode 100644
index 00000000000..e67f27a7cb3
--- /dev/null
+++ b/queue-5.4/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
@@ -0,0 +1,60 @@
+From 3550a4405959bb4bfea429dd1d0f5c41a67fc7c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Jan 2022 18:42:28 +0100
+Subject: ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 6f7e221e7a5cfc3299616543fce42b36e631497b ]
+
+IRQ types blindly copied from very similar APQ8064.
+
+Fixes warnings as:
+WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1080 gic_irq_domain_translate+0x118/0x120
+...
+
+Tested-by: LogicalErzor <logicalerzor@gmail.com> # boot-tested on Samsung S3
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220108174229.60384-1-david@ixit.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi
+index f2aeaccdc1ad..15ff0e8fd0d3 100644
+--- a/arch/arm/boot/dts/qcom-msm8960.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi
+@@ -145,7 +145,9 @@
+ 			reg		= <0x108000 0x1000>;
+ 			qcom,ipc	= <&l2cc 0x8 2>;
+ 
+-			interrupts	= <0 19 0>, <0 21 0>, <0 22 0>;
++			interrupts	= <GIC_SPI 19 IRQ_TYPE_EDGE_RISING>,
++					  <GIC_SPI 21 IRQ_TYPE_EDGE_RISING>,
++					  <GIC_SPI 22 IRQ_TYPE_EDGE_RISING>;
+ 			interrupt-names	= "ack", "err", "wakeup";
+ 
+ 			regulators {
+@@ -191,7 +193,7 @@
+ 				compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
+ 				reg = <0x16440000 0x1000>,
+ 				      <0x16400000 0x1000>;
+-				interrupts = <0 154 0x0>;
++				interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>;
+ 				clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>;
+ 				clock-names = "core", "iface";
+ 				status = "disabled";
+@@ -317,7 +319,7 @@
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
+ 				reg = <0x16080000 0x1000>;
+-				interrupts = <0 147 0>;
++				interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
+ 				spi-max-frequency = <24000000>;
+ 				cs-gpios = <&msmgpio 8 0>;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-dts-qcom-ipq4019-fix-sleep-clock.patch b/queue-5.4/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
new file mode 100644
index 00000000000..2681c86ebbb
--- /dev/null
+++ b/queue-5.4/arm-dts-qcom-ipq4019-fix-sleep-clock.patch
@@ -0,0 +1,42 @@
+From 18f45f91bd40438363e08f87ee471300a233f6bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Dec 2021 18:03:52 +0100
+Subject: ARM: dts: qcom: ipq4019: fix sleep clock
+
+From: Pavel Kubelun <be.dissent@gmail.com>
+
+[ Upstream commit 3d7e7980993d2c1ae42d3d314040fc2de6a9c45f ]
+
+It seems like sleep_clk was copied from ipq806x.
+Fix ipq40xx sleep_clk to the value QSDK defines.
+
+Link: https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=d92ec59973484acc86dd24b67f10f8911b4b4b7d
+Link: https://patchwork.kernel.org/comment/22721613/
+Fixes: bec6ba4cdf2a ("qcom: ipq4019: Add basic board/dts support for IPQ4019 SoC")
+Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org> (clock-output-names)
+Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com> (removed clock rename)
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211220170352.34591-1-chunkeey@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 56f51599852d..338256c59ca5 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -141,7 +141,8 @@
+ 	clocks {
+ 		sleep_clk: sleep_clk {
+ 			compatible = "fixed-clock";
+-			clock-frequency = <32768>;
++			clock-frequency = <32000>;
++			clock-output-names = "gcc_sleep_clk_src";
+ 			#clock-cells = <0>;
+ 		};
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch b/queue-5.4/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
new file mode 100644
index 00000000000..52b2066137e
--- /dev/null
+++ b/queue-5.4/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
@@ -0,0 +1,135 @@
+From db35b8053101f689e113a794dcb40e8476f2e6a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jan 2022 20:18:33 +0100
+Subject: ARM: ftrace: avoid redundant loads or clobbering IP
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit d11967870815b5ab89843980e35aab616c97c463 ]
+
+Tweak the ftrace return paths to avoid redundant loads of SP, as well as
+unnecessary clobbering of IP.
+
+This also fixes the inconsistency of using MOV to perform a function
+return, which is sub-optimal on recent micro-architectures but more
+importantly, does not perform an interworking return, unlike compiler
+generated function returns in Thumb2 builds.
+
+Let's fix this by popping PC from the stack like most ordinary code
+does.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-ftrace.S | 51 +++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 29 deletions(-)
+
+diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
+index f4886fb6e9ba..f33c171e3090 100644
+--- a/arch/arm/kernel/entry-ftrace.S
++++ b/arch/arm/kernel/entry-ftrace.S
+@@ -22,10 +22,7 @@
+  * mcount can be thought of as a function called in the middle of a subroutine
+  * call.  As such, it needs to be transparent for both the caller and the
+  * callee: the original lr needs to be restored when leaving mcount, and no
+- * registers should be clobbered.  (In the __gnu_mcount_nc implementation, we
+- * clobber the ip register.  This is OK because the ARM calling convention
+- * allows it to be clobbered in subroutines and doesn't use it to hold
+- * parameters.)
++ * registers should be clobbered.
+  *
+  * When using dynamic ftrace, we patch out the mcount call by a "pop {lr}"
+  * instead of the __gnu_mcount_nc call (see arch/arm/kernel/ftrace.c).
+@@ -70,26 +67,25 @@
+ 
+ .macro __ftrace_regs_caller
+ 
+-	sub	sp, sp, #8	@ space for PC and CPSR OLD_R0,
++	str	lr, [sp, #-8]!	@ store LR as PC and make space for CPSR/OLD_R0,
+ 				@ OLD_R0 will overwrite previous LR
+ 
+-	add 	ip, sp, #12	@ move in IP the value of SP as it was
+-				@ before the push {lr} of the mcount mechanism
++	ldr	lr, [sp, #8]    @ get previous LR
+ 
+-	str     lr, [sp, #0]    @ store LR instead of PC
++	str	r0, [sp, #8]	@ write r0 as OLD_R0 over previous LR
+ 
+-	ldr     lr, [sp, #8]    @ get previous LR
++	str	lr, [sp, #-4]!	@ store previous LR as LR
+ 
+-	str	r0, [sp, #8]	@ write r0 as OLD_R0 over previous LR
++	add 	lr, sp, #16	@ move in LR the value of SP as it was
++				@ before the push {lr} of the mcount mechanism
+ 
+-	stmdb   sp!, {ip, lr}
+-	stmdb   sp!, {r0-r11, lr}
++	push	{r0-r11, ip, lr}
+ 
+ 	@ stack content at this point:
+ 	@ 0  4          48   52       56            60   64    68       72
+-	@ R0 | R1 | ... | LR | SP + 4 | previous LR | LR | PSR | OLD_R0 |
++	@ R0 | R1 | ... | IP | SP + 4 | previous LR | LR | PSR | OLD_R0 |
+ 
+-	mov r3, sp				@ struct pt_regs*
++	mov	r3, sp				@ struct pt_regs*
+ 
+ 	ldr r2, =function_trace_op
+ 	ldr r2, [r2]				@ pointer to the current
+@@ -112,11 +108,9 @@ ftrace_graph_regs_call:
+ #endif
+ 
+ 	@ pop saved regs
+-	ldmia   sp!, {r0-r12}			@ restore r0 through r12
+-	ldr	ip, [sp, #8]			@ restore PC
+-	ldr	lr, [sp, #4]			@ restore LR
+-	ldr	sp, [sp, #0]			@ restore SP
+-	mov	pc, ip				@ return
++	pop	{r0-r11, ip, lr}		@ restore r0 through r12
++	ldr	lr, [sp], #4			@ restore LR
++	ldr	pc, [sp], #12
+ .endm
+ 
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+@@ -132,11 +126,9 @@ ftrace_graph_regs_call:
+ 	bl	prepare_ftrace_return
+ 
+ 	@ pop registers saved in ftrace_regs_caller
+-	ldmia   sp!, {r0-r12}			@ restore r0 through r12
+-	ldr	ip, [sp, #8]			@ restore PC
+-	ldr	lr, [sp, #4]			@ restore LR
+-	ldr	sp, [sp, #0]			@ restore SP
+-	mov	pc, ip				@ return
++	pop	{r0-r11, ip, lr}		@ restore r0 through r12
++	ldr	lr, [sp], #4			@ restore LR
++	ldr	pc, [sp], #12
+ 
+ .endm
+ #endif
+@@ -202,16 +194,17 @@ ftrace_graph_call\suffix:
+ .endm
+ 
+ .macro mcount_exit
+-	ldmia	sp!, {r0-r3, ip, lr}
+-	ret	ip
++	ldmia	sp!, {r0-r3}
++	ldr	lr, [sp, #4]
++	ldr	pc, [sp], #8
+ .endm
+ 
+ ENTRY(__gnu_mcount_nc)
+ UNWIND(.fnstart)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+-	mov	ip, lr
+-	ldmia	sp!, {lr}
+-	ret	ip
++	push	{lr}
++	ldr	lr, [sp, #4]
++	ldr	pc, [sp], #8
+ #else
+ 	__mcount
+ #endif
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch b/queue-5.4/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
new file mode 100644
index 00000000000..ef4be217635
--- /dev/null
+++ b/queue-5.4/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
@@ -0,0 +1,40 @@
+From 0dc6e82f43b936eb10c696712c3fd18eff2ef566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 10:38:15 +0100
+Subject: ARM: ftrace: ensure that ADR takes the Thumb bit into account
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit dd88b03ff0c84f4bcbe1419b93a4bed429fed3be ]
+
+Using ADR to take the address of 'ftrace_stub' via a local label
+produces an address that has the Thumb bit cleared, which means the
+subsequent comparison is guaranteed to fail. Instead, use the badr
+macro, which forces the Thumb bit to be set.
+
+Fixes: a3ba87a61499 ("ARM: 6316/1: ftrace: add Thumb-2 support")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-ftrace.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S
+index a74289ebc803..f4886fb6e9ba 100644
+--- a/arch/arm/kernel/entry-ftrace.S
++++ b/arch/arm/kernel/entry-ftrace.S
+@@ -40,7 +40,7 @@
+ 	mcount_enter
+ 	ldr	r0, =ftrace_trace_function
+ 	ldr	r2, [r0]
+-	adr	r0, .Lftrace_stub
++	badr	r0, .Lftrace_stub
+ 	cmp	r0, r2
+ 	bne	1f
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-mmp-fix-failure-to-remove-sram-device.patch b/queue-5.4/arm-mmp-fix-failure-to-remove-sram-device.patch
new file mode 100644
index 00000000000..b9dbbb298dd
--- /dev/null
+++ b/queue-5.4/arm-mmp-fix-failure-to-remove-sram-device.patch
@@ -0,0 +1,79 @@
+From faacc437ae1f7356d1b05347643d6e4ed2ab2e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 22:01:58 +0200
+Subject: ARM: mmp: Fix failure to remove sram device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 4036b29a146b2749af3bb213b003eb69f3e5ecc4 ]
+
+Make sure in .probe() to set driver data before the function is left to
+make it possible in .remove() to undo the actions done.
+
+This fixes a potential memory leak and stops returning an error code in
+.remove() that is ignored by the driver core anyhow.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-mmp/sram.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c
+index 6794e2db1ad5..ecc46c31004f 100644
+--- a/arch/arm/mach-mmp/sram.c
++++ b/arch/arm/mach-mmp/sram.c
+@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev)
+ 	if (!info)
+ 		return -ENOMEM;
+ 
++	platform_set_drvdata(pdev, info);
++
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	if (res == NULL) {
+ 		dev_err(&pdev->dev, "no memory resource defined\n");
+@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev)
+ 	list_add(&info->node, &sram_bank_list);
+ 	mutex_unlock(&sram_lock);
+ 
+-	platform_set_drvdata(pdev, info);
+-
+ 	dev_info(&pdev->dev, "initialized\n");
+ 	return 0;
+ 
+@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev)
+ 	struct sram_bank_info *info;
+ 
+ 	info = platform_get_drvdata(pdev);
+-	if (info == NULL)
+-		return -ENODEV;
+ 
+-	mutex_lock(&sram_lock);
+-	list_del(&info->node);
+-	mutex_unlock(&sram_lock);
++	if (info->sram_size) {
++		mutex_lock(&sram_lock);
++		list_del(&info->node);
++		mutex_unlock(&sram_lock);
++
++		gen_pool_destroy(info->gpool);
++		iounmap(info->sram_virt);
++		kfree(info->pool_name);
++	}
+ 
+-	gen_pool_destroy(info->gpool);
+-	iounmap(info->sram_virt);
+-	kfree(info->pool_name);
+ 	kfree(info);
++
+ 	return 0;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm-tegra-tamonten-fix-i2c3-pad-setting.patch b/queue-5.4/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
new file mode 100644
index 00000000000..0518eb8e3d6
--- /dev/null
+++ b/queue-5.4/arm-tegra-tamonten-fix-i2c3-pad-setting.patch
@@ -0,0 +1,46 @@
+From a740d8c0b86ed0c8582eff9804791aff4cfdcf54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Dec 2021 17:11:48 +0100
+Subject: ARM: tegra: tamonten: Fix I2C3 pad setting
+
+From: Richard Leitner <richard.leitner@skidata.com>
+
+[ Upstream commit 0092c25b541a5422d7e71892a13c55ee91abc34b ]
+
+This patch fixes the tristate configuration for i2c3 function assigned
+to the dtf pins on the Tamonten Tegra20 SoM.
+
+Signed-off-by: Richard Leitner <richard.leitner@skidata.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index 394a6b4dc69d..69cb65d86c46 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -183,8 +183,8 @@
+ 			};
+ 			conf_ata {
+ 				nvidia,pins = "ata", "atb", "atc", "atd", "ate",
+-					"cdev1", "cdev2", "dap1", "dtb", "gma",
+-					"gmb", "gmc", "gmd", "gme", "gpu7",
++					"cdev1", "cdev2", "dap1", "dtb", "dtf",
++					"gma", "gmb", "gmc", "gmd", "gme", "gpu7",
+ 					"gpv", "i2cp", "irrx", "irtx", "pta",
+ 					"rm", "slxa", "slxk", "spia", "spib",
+ 					"uac";
+@@ -203,7 +203,7 @@
+ 			};
+ 			conf_crtp {
+ 				nvidia,pins = "crtp", "dap2", "dap3", "dap4",
+-					"dtc", "dte", "dtf", "gpu", "sdio1",
++					"dtc", "dte", "gpu", "sdio1",
+ 					"slxc", "slxd", "spdi", "spdo", "spig",
+ 					"uda";
+ 				nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm64-dts-broadcom-fix-sata-nodename.patch b/queue-5.4/arm64-dts-broadcom-fix-sata-nodename.patch
new file mode 100644
index 00000000000..cc6f06fde9e
--- /dev/null
+++ b/queue-5.4/arm64-dts-broadcom-fix-sata-nodename.patch
@@ -0,0 +1,41 @@
+From 8c7005511ca93023726f2ba1b0d8152431047cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 16:24:18 +0100
+Subject: arm64: dts: broadcom: Fix sata nodename
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+[ Upstream commit 55927cb44db43a57699fa652e2437a91620385dc ]
+
+After converting ahci-platform txt binding to yaml nodename is reported
+as not matching the standard:
+
+arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dt.yaml:
+ahci@663f2000: $nodename:0: 'ahci@663f2000' does not match '^sata(@.*)?$'
+
+Fix it to match binding.
+
+Fixes: ac9aae00f0fc ("arm64: dts: Add SATA3 AHCI and SATA3 PHY DT nodes for NS2")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 39802066232e..edc1a8a4c4bc 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -687,7 +687,7 @@
+ 			};
+ 		};
+ 
+-		sata: ahci@663f2000 {
++		sata: sata@663f2000 {
+ 			compatible = "brcm,iproc-ahci", "generic-ahci";
+ 			reg = <0x663f2000 0x1000>;
+ 			dma-coherent;
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch b/queue-5.4/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
new file mode 100644
index 00000000000..209c4b8f2a5
--- /dev/null
+++ b/queue-5.4/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
@@ -0,0 +1,52 @@
+From a9200811912b197fbfebea20d41deb1743fcf2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 16:39:03 +0530
+Subject: arm64: dts: ns2: Fix spi-cpol and spi-cpha property
+
+From: Kuldeep Singh <singh.kuldeep87k@gmail.com>
+
+[ Upstream commit c953c764e505428f59ffe6afb1c73b89b5b1ac35 ]
+
+Broadcom ns2 platform has spi-cpol and spi-cpho properties set
+incorrectly. As per spi-slave-peripheral-prop.yaml, these properties are
+of flag or boolean type and not integer type. Fix the values.
+
+Fixes: d69dbd9f41a7c (arm64: dts: Add ARM PL022 SPI DT nodes for NS2)
+Signed-off-by: Kuldeep Singh <singh.kuldeep87k@gmail.com>
+CC: Ray Jui <rjui@broadcom.com>
+CC: Scott Branden <sbranden@broadcom.com>
+CC: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+index ec19fbf928a1..12a4b1c03390 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+@@ -111,8 +111,8 @@
+ 		compatible = "silabs,si3226x";
+ 		reg = <0>;
+ 		spi-max-frequency = <5000000>;
+-		spi-cpha = <1>;
+-		spi-cpol = <1>;
++		spi-cpha;
++		spi-cpol;
+ 		pl022,hierarchy = <0>;
+ 		pl022,interface = <0>;
+ 		pl022,slave-tx-disable = <0>;
+@@ -135,8 +135,8 @@
+ 		at25,byte-len = <0x8000>;
+ 		at25,addr-mode = <2>;
+ 		at25,page-size = <64>;
+-		spi-cpha = <1>;
+-		spi-cpol = <1>;
++		spi-cpha;
++		spi-cpol;
+ 		pl022,hierarchy = <0>;
+ 		pl022,interface = <0>;
+ 		pl022,slave-tx-disable = <0>;
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch b/queue-5.4/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
new file mode 100644
index 00000000000..2c76e0c660d
--- /dev/null
+++ b/queue-5.4/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
@@ -0,0 +1,41 @@
+From b20be31d74fe8660b6eb0f91fd72dc3a0a31df33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Jan 2022 22:54:58 +0530
+Subject: arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc
+
+From: Maulik Shah <quic_mkshah@quicinc.com>
+
+[ Upstream commit 17ac8af678b6da6a8f1df7da8ebf2c5198741827 ]
+
+Correct the TCS config by updating the number of TCSes for each type.
+
+Cc: devicetree@vger.kernel.org
+Fixes: d8cf9372b654 ("arm64: dts: qcom: sm8150: Add apps shared nodes")
+Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/1641749107-31979-2-git-send-email-quic_mkshah@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 9573da378826..1954cef8c6f0 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -459,9 +459,9 @@
+ 			qcom,tcs-offset = <0xd00>;
+ 			qcom,drv-id = <2>;
+ 			qcom,tcs-config = <ACTIVE_TCS  2>,
+-					  <SLEEP_TCS   1>,
+-					  <WAKE_TCS    1>,
+-					  <CONTROL_TCS 0>;
++					  <SLEEP_TCS   3>,
++					  <WAKE_TCS    3>,
++					  <CONTROL_TCS 1>;
+ 
+ 			rpmhcc: clock-controller {
+ 				compatible = "qcom,sm8150-rpmh-clk";
+-- 
+2.34.1
+
diff --git a/queue-5.4/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch b/queue-5.4/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
new file mode 100644
index 00000000000..e79ffbc24ee
--- /dev/null
+++ b/queue-5.4/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
@@ -0,0 +1,40 @@
+From 35c7a336f38723ff4f681ca2a0384f37d9d38914 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 14:25:58 -0600
+Subject: arm64: dts: rockchip: Fix SDIO regulator supply properties on
+ rk3399-firefly
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 37cbd3c522869247ed4525b5042ff4c6a276c813 ]
+
+A label reference without brackets is a path string, not a phandle as
+intended. Add the missing brackets.
+
+Fixes: a5002c41c383 ("arm64: dts: rockchip: add WiFi module support for Firefly-RK3399")
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220304202559.317749-1-robh@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-firefly.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+index 76f5db696009..5b7e8fbf1ffe 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+@@ -666,8 +666,8 @@
+ 	sd-uhs-sdr104;
+ 
+ 	/* Power supply */
+-	vqmmc-supply = &vcc1v8_s3;	/* IO line */
+-	vmmc-supply = &vcc_sdio;	/* card's power */
++	vqmmc-supply = <&vcc1v8_s3>;	/* IO line */
++	vmmc-supply = <&vcc_sdio>;	/* card's power */
+ 
+ 	#address-cells = <1>;
+ 	#size-cells = <0>;
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch b/queue-5.4/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
new file mode 100644
index 00000000000..6ad0ac2ec5e
--- /dev/null
+++ b/queue-5.4/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
@@ -0,0 +1,38 @@
+From 7c981cf0712a4c80b37fc893554fe56042ba5bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:45:39 +0000
+Subject: ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ]
+
+This node pointer is returned by of_parse_phandle() with refcount
+incremented in this function.
+Calling of_node_put() to avoid the refcount leak.
+
+Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/sam9g20_wm8731.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
+index b1bef2bf142d..05277a88e20d 100644
+--- a/sound/soc/atmel/sam9g20_wm8731.c
++++ b/sound/soc/atmel/sam9g20_wm8731.c
+@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+ 	cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
+ 	if (!cpu_np) {
+ 		dev_err(&pdev->dev, "dai and pcm info missing\n");
++		of_node_put(codec_np);
+ 		return -EINVAL;
+ 	}
+ 	at91sam9g20ek_dai.cpus->of_node = cpu_np;
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch b/queue-5.4/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
new file mode 100644
index 00000000000..7c4a774e9a5
--- /dev/null
+++ b/queue-5.4/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
@@ -0,0 +1,40 @@
+From 880fe6d0b5710ace4b9a5cb68fb1ae5bfe1760d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 17:06:37 +0800
+Subject: ASoC: atmel_ssc_dai: Handle errors for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit f9e2ca0640e59d19af0ff285ee5591ed39069b09 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error if fals.
+
+Fixes: cbaadf0f90d6 ("ASoC: atmel_ssc_dai: refactor the startup and shutdown")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301090637.3776558-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/atmel_ssc_dai.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index ca603397651c..1e0973322cd0 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
+ 
+ 	/* Enable PMC peripheral clock for this SSC */
+ 	pr_debug("atmel_ssc_dai: Starting clock\n");
+-	clk_enable(ssc_p->ssc->clk);
++	ret = clk_enable(ssc_p->ssc->clk);
++	if (ret)
++		return ret;
++
+ 	ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
+ 
+ 	/* Reset the SSC unless initialized to keep it in a clean state */
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch b/queue-5.4/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
new file mode 100644
index 00000000000..db64545091c
--- /dev/null
+++ b/queue-5.4/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
@@ -0,0 +1,42 @@
+From aa86a59378c658f1da5f42a7f269aaa5587c6ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 14:21:57 +0200
+Subject: ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit 9a1e13440a4f2e7566fd4c5eae6a53e6400e08a4 ]
+
+Even if struct snd_dmaengine_pcm_config is used, prepare_slave_config()
+callback might not be set. Check if this callback is set before using it.
+
+Fixes: fa654e085300 ("ASoC: dmaengine-pcm: Provide default config")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220307122202.2251639-2-codrin.ciubotariu@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-generic-dmaengine-pcm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index 5552c66ca642..ca4b17bd95d1 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream,
+ 
+ 	memset(&slave_config, 0, sizeof(slave_config));
+ 
+-	if (!pcm->config)
+-		prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+-	else
++	if (pcm->config && pcm->config->prepare_slave_config)
+ 		prepare_slave_config = pcm->config->prepare_slave_config;
++	else
++		prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+ 
+ 	if (prepare_slave_config) {
+ 		ret = prepare_slave_config(substream, params, &slave_config);
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-fsi-add-check-for-clk_enable.patch b/queue-5.4/asoc-fsi-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..3ef7ba8f9bf
--- /dev/null
+++ b/queue-5.4/asoc-fsi-add-check-for-clk_enable.patch
@@ -0,0 +1,60 @@
+From c73ee97371ff436e1a4d9db1aeafc7f6394e8d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 14:28:44 +0800
+Subject: ASoC: fsi: Add check for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 405afed8a728f23cfaa02f75bbc8bdd6b7322123 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: ab6f6d85210c ("ASoC: fsi: add master clock control functions")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220302062844.46869-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/fsi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
+index 3447dbdba1f1..6ac7df30a289 100644
+--- a/sound/soc/sh/fsi.c
++++ b/sound/soc/sh/fsi.c
+@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev,
+ 			return ret;
+ 		}
+ 
+-		clk_enable(clock->xck);
+-		clk_enable(clock->ick);
+-		clk_enable(clock->div);
++		ret = clk_enable(clock->xck);
++		if (ret)
++			goto err;
++		ret = clk_enable(clock->ick);
++		if (ret)
++			goto disable_xck;
++		ret = clk_enable(clock->div);
++		if (ret)
++			goto disable_ick;
+ 
+ 		clock->count++;
+ 	}
+ 
+ 	return ret;
++
++disable_ick:
++	clk_disable(clock->ick);
++disable_xck:
++	clk_disable(clock->xck);
++err:
++	return ret;
+ }
+ 
+ static int fsi_clk_disable(struct device *dev,
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch b/queue-5.4/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
new file mode 100644
index 00000000000..508aa761078
--- /dev/null
+++ b/queue-5.4/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
@@ -0,0 +1,36 @@
+From c762de2ed580e9760f5cc652381f4510b3757a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 09:19:02 +0000
+Subject: ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 3b891513f95cba3944e72c1139ea706d04f3781b ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 7e7292dba215 ("ASoC: fsl: add imx-es8328 machine driver")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Link: https://lore.kernel.org/r/20220310091902.129299-1-wangwensheng4@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-es8328.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c
+index fad1eb6253d5..9e602c345619 100644
+--- a/sound/soc/fsl/imx-es8328.c
++++ b/sound/soc/fsl/imx-es8328.c
+@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev)
+ 	if (int_port > MUX_PORT_MAX || int_port == 0) {
+ 		dev_err(dev, "mux-int-port: hardware only has %d mux ports\n",
+ 			MUX_PORT_MAX);
++		ret = -EINVAL;
+ 		goto fail;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-madera-add-dependencies-on-mfd.patch b/queue-5.4/asoc-madera-add-dependencies-on-mfd.patch
new file mode 100644
index 00000000000..242a157dcbf
--- /dev/null
+++ b/queue-5.4/asoc-madera-add-dependencies-on-mfd.patch
@@ -0,0 +1,59 @@
+From f8b1850dc08b55b54c066dfba1f44215f6ad2b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 11:50:25 +0000
+Subject: ASoC: madera: Add dependencies on MFD
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ec29170c724ca30305fc3a19ba2ee73ecac65509 ]
+
+The Madera CODECs use regmap_irq functions but nothing ensures that
+regmap_irq is built into the kernel. Add dependencies on the ASoC
+symbols for the relevant MFD component. There is no point in building
+the ASoC driver if the MFD doesn't support it and the MFD part contains
+the necessary dependencies to ensure everything is built into the
+kernel.
+
+Reported-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220203115025.16464-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/Kconfig | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
+index 229cc89f8c5a..466dc67799f4 100644
+--- a/sound/soc/codecs/Kconfig
++++ b/sound/soc/codecs/Kconfig
+@@ -586,21 +586,26 @@ config SND_SOC_CS4349
+ 
+ config SND_SOC_CS47L15
+ 	tristate
++	depends on MFD_CS47L15
+ 
+ config SND_SOC_CS47L24
+ 	tristate
+ 
+ config SND_SOC_CS47L35
+ 	tristate
++	depends on MFD_CS47L35
+ 
+ config SND_SOC_CS47L85
+ 	tristate
++	depends on MFD_CS47L85
+ 
+ config SND_SOC_CS47L90
+ 	tristate
++	depends on MFD_CS47L90
+ 
+ config SND_SOC_CS47L92
+ 	tristate
++	depends on MFD_CS47L92
+ 
+ # Cirrus Logic Quad-Channel ADC
+ config SND_SOC_CS53L30
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch b/queue-5.4/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
new file mode 100644
index 00000000000..0fec52f483a
--- /dev/null
+++ b/queue-5.4/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
@@ -0,0 +1,80 @@
+From 8971f5606d4f2df4f14f287b4d5d438b876774ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 04:19:24 +0000
+Subject: ASoC: msm8916-wcd-analog: Fix error handling in
+ pm8916_wcd_analog_spmi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 9ebd62d60edcd4d9c75485e5ccd0b79581ad3c49 ]
+
+In the error handling path, the clk_prepare_enable() function
+call should be balanced by a corresponding 'clk_disable_unprepare()'
+call , as already done in the remove function.
+
+Fixes: de66b3455023 ("ASoC: codecs: msm8916-wcd-analog: add MBHC support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220316041924.17560-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index 337bddb7c2a4..5a8eedea6be0 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -1195,8 +1195,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq_byname(pdev, "mbhc_switch_int");
+-	if (irq < 0)
+-		return irq;
++	if (irq < 0) {
++		ret = irq;
++		goto err_disable_clk;
++	}
+ 
+ 	ret = devm_request_threaded_irq(dev, irq, NULL,
+ 			       pm8916_mbhc_switch_irq_handler,
+@@ -1208,8 +1210,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 
+ 	if (priv->mbhc_btn_enabled) {
+ 		irq = platform_get_irq_byname(pdev, "mbhc_but_press_det");
+-		if (irq < 0)
+-			return irq;
++		if (irq < 0) {
++			ret = irq;
++			goto err_disable_clk;
++		}
+ 
+ 		ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				       mbhc_btn_press_irq_handler,
+@@ -1220,8 +1224,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 			dev_err(dev, "cannot request mbhc button press irq\n");
+ 
+ 		irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det");
+-		if (irq < 0)
+-			return irq;
++		if (irq < 0) {
++			ret = irq;
++			goto err_disable_clk;
++		}
+ 
+ 		ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				       mbhc_btn_release_irq_handler,
+@@ -1238,6 +1244,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
+ 	return devm_snd_soc_register_component(dev, &pm8916_wcd_analog,
+ 				      pm8916_wcd_analog_dai,
+ 				      ARRAY_SIZE(pm8916_wcd_analog_dai));
++
++err_disable_clk:
++	clk_disable_unprepare(priv->mclk);
++	return ret;
+ }
+ 
+ static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev)
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch b/queue-5.4/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
new file mode 100644
index 00000000000..dae3eba802e
--- /dev/null
+++ b/queue-5.4/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
@@ -0,0 +1,48 @@
+From cd030a95f6ab3b27b13399c83c0229fad35e0ec8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 08:45:22 +0000
+Subject: ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in
+ msm8916_wcd_digital_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 375a347da4889f64d86e1ab7f4e6702b6e9bf299 ]
+
+Fix the missing clk_disable_unprepare() before return
+from msm8916_wcd_digital_probe in the error handling case.
+
+Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307084523.28687-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-digital.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
+index 09fccacadd6b..d5269ab5f91c 100644
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ 	ret = clk_prepare_enable(priv->mclk);
+ 	if (ret < 0) {
+ 		dev_err(dev, "failed to enable mclk %d\n", ret);
+-		return ret;
++		goto err_clk;
+ 	}
+ 
+ 	dev_set_drvdata(dev, priv);
+@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ 	return devm_snd_soc_register_component(dev, &msm8916_wcd_digital,
+ 				      msm8916_wcd_digital_dai,
+ 				      ARRAY_SIZE(msm8916_wcd_digital_dai));
++err_clk:
++	clk_disable_unprepare(priv->ahbclk);
++	return ret;
+ }
+ 
+ static int msm8916_wcd_digital_remove(struct platform_device *pdev)
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch b/queue-5.4/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
new file mode 100644
index 00000000000..19589c5eb7f
--- /dev/null
+++ b/queue-5.4/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
@@ -0,0 +1,43 @@
+From 74c93c3d27c84ec90583603af467649f2d31ca32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 02:01:44 +0000
+Subject: ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6ae0a4d8fec551ec581d620f0eb1fe31f755551c ]
+
+This function only calls of_node_put() in the regular path.
+And it will cause refcount leak in error paths.
+For example, when codec_np is NULL, saif_np[0] and saif_np[1]
+are not NULL, it will cause leaks.
+
+of_node_put() will check if the node pointer is NULL, so we can
+call it directly to release the refcount of regular pointers.
+
+Fixes: e968194b45c4 ("ASoC: mxs: add device tree support for mxs-sgtl5000")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220308020146.26496-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mxs/mxs-sgtl5000.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c
+index 9841e1da9782..8282fe6d00dd 100644
+--- a/sound/soc/mxs/mxs-sgtl5000.c
++++ b/sound/soc/mxs/mxs-sgtl5000.c
+@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev)
+ 	codec_np = of_parse_phandle(np, "audio-codec", 0);
+ 	if (!saif_np[0] || !saif_np[1] || !codec_np) {
+ 		dev_err(&pdev->dev, "phandle missing or invalid\n");
++		of_node_put(codec_np);
++		of_node_put(saif_np[0]);
++		of_node_put(saif_np[1]);
+ 		return -EINVAL;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-mxs-saif-handle-errors-for-clk_enable.patch b/queue-5.4/asoc-mxs-saif-handle-errors-for-clk_enable.patch
new file mode 100644
index 00000000000..64676e81da2
--- /dev/null
+++ b/queue-5.4/asoc-mxs-saif-handle-errors-for-clk_enable.patch
@@ -0,0 +1,40 @@
+From 93c2fd44fd88e4cf2c890729add57c0257e62c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 16:17:17 +0800
+Subject: ASoC: mxs-saif: Handle errors for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2ecf362d220317debf5da376e0390e9f7a3f7b29 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it, like mxs_saif_trigger().
+
+Fixes: d0ba4c014934 ("ASoC: mxs-saif: set a base clock rate for EXTMASTER mode work")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301081717.3727190-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mxs/mxs-saif.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
+index 1e38ce858326..cb1b525cbe9d 100644
+--- a/sound/soc/mxs/mxs-saif.c
++++ b/sound/soc/mxs/mxs-saif.c
+@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream,
+ 		* basic clock which should be fast enough for the internal
+ 		* logic.
+ 		*/
+-		clk_enable(saif->clk);
++		ret = clk_enable(saif->clk);
++		if (ret)
++			return ret;
++
+ 		ret = clk_set_rate(saif->clk, 24000000);
+ 		clk_disable(saif->clk);
+ 		if (ret)
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch b/queue-5.4/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
new file mode 100644
index 00000000000..3a5c639222c
--- /dev/null
+++ b/queue-5.4/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
@@ -0,0 +1,39 @@
+From 0f675e7c0013f1bb55ad756cb095341fe1c380c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 05:10:30 -0800
+Subject: ASoC: rt5663: check the return value of devm_kzalloc() in
+ rt5663_parse_dp()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 4d06f92f38b799295ae22c98be7a20cac3e2a1a7 ]
+
+The function devm_kzalloc() in rt5663_parse_dp() can fail, so its return
+value should be checked.
+
+Fixes: 457c25efc592 ("ASoC: rt5663: Add the function of impedance sensing")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220225131030.27248-1-baijiaju1990@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5663.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
+index 3610be1590fc..19e2f622718d 100644
+--- a/sound/soc/codecs/rt5663.c
++++ b/sound/soc/codecs/rt5663.c
+@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev)
+ 		table_size = sizeof(struct impedance_mapping_table) *
+ 			rt5663->pdata.impedance_sensing_num;
+ 		rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
++		if (!rt5663->imp_table)
++			return -ENOMEM;
+ 		ret = device_property_read_u32_array(dev,
+ 			"realtek,impedance_sensing_table",
+ 			(u32 *)rt5663->imp_table, table_size);
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch b/queue-5.4/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
new file mode 100644
index 00000000000..65ab96f189d
--- /dev/null
+++ b/queue-5.4/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
@@ -0,0 +1,65 @@
+From 09c4d7f9223752013fbccc520ed10b7640f54f3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 08:13:53 +0000
+Subject: ASoC: soc-compress: prevent the potentially use of null pointer
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit de2c6f98817fa5decb9b7d3b3a8a3ab864c10588 ]
+
+There is one call trace that snd_soc_register_card()
+->snd_soc_bind_card()->soc_init_pcm_runtime()
+->snd_soc_dai_compress_new()->snd_soc_new_compress().
+In the trace the 'codec_dai' transfers from card->dai_link,
+and we can see from the snd_soc_add_pcm_runtime() in
+snd_soc_bind_card() that, if value of card->dai_link->num_codecs
+is 0, then 'codec_dai' could be null pointer caused
+by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'.
+And snd_soc_register_card() is called by various platforms.
+Therefore, it is better to add the check in the case of misusing.
+And because 'cpu_dai' has already checked in soc_init_pcm_runtime(),
+there is no need to check again.
+Adding the check as follow, then if 'codec_dai' is null,
+snd_soc_new_compress() will not pass through the check
+'if (playback + capture != 1)', avoiding the leftover use of
+'codec_dai'.
+
+Fixes: 467fece ("ASoC: soc-dai: move snd_soc_dai_stream_valid() to soc-dai.c")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/1634285633-529368-1-git-send-email-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-compress.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index 9e54d8ae6d2c..fec736c8c45f 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -872,12 +872,14 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ 	}
+ 
+ 	/* check client and interface hw capabilities */
+-	if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) &&
+-	    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_PLAYBACK))
+-		playback = 1;
+-	if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) &&
+-	    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_CAPTURE))
+-		capture = 1;
++	if (codec_dai) {
++		if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) &&
++		    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_PLAYBACK))
++			playback = 1;
++		if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) &&
++		    snd_soc_dai_stream_valid(cpu_dai,   SNDRV_PCM_STREAM_CAPTURE))
++			capture = 1;
++	}
+ 
+ 	/*
+ 	 * Compress devices are unidirectional so only one of the directions
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch b/queue-5.4/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
new file mode 100644
index 00000000000..fff03eb8313
--- /dev/null
+++ b/queue-5.4/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
@@ -0,0 +1,47 @@
+From a4afc2c70080f8b17930048df6a9f545d5486767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 19:19:12 +0800
+Subject: ASoC: soc-core: skip zero num_dai component in searching dai name
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit f7d344a2bd5ec81fbd1ce76928fd059e57ec9bea ]
+
+In the case like dmaengine which's not a dai but as a component, the
+num_dai is zero, dmaengine component has the same component_of_node
+as cpu dai, when cpu dai component is not ready, but dmaengine component
+is ready, try to get cpu dai name, the snd_soc_get_dai_name() return
+-EINVAL, not -EPROBE_DEFER, that cause below error:
+
+asoc-simple-card <card name>: parse error -22
+asoc-simple-card: probe of <card name> failed with error -22
+
+The sound card failed to probe.
+
+So this patch fixes the issue above by skipping the zero num_dai
+component in searching dai name.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1644491952-7457-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index c0e03cc8ea82..093ab32ea2c3 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3362,7 +3362,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args,
+ 	for_each_component(pos) {
+ 		component_of_node = soc_component_to_node(pos);
+ 
+-		if (component_of_node != args->np)
++		if (component_of_node != args->np || !pos->num_dai)
+ 			continue;
+ 
+ 		ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name);
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-sof-intel-hda-remove-link-assignment-limitation.patch b/queue-5.4/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
new file mode 100644
index 00000000000..899d3844ed4
--- /dev/null
+++ b/queue-5.4/asoc-sof-intel-hda-remove-link-assignment-limitation.patch
@@ -0,0 +1,65 @@
+From 8319c63d1b7dc5a35593acf0705a801ffd148d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 15:00:17 +0200
+Subject: ASoC: SOF: Intel: hda: Remove link assignment limitation
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 2ce0d008dcc59f9c01f43277b9f9743af7b01dad ]
+
+The limitation to assign a link DMA channel for a BE iff the
+corresponding host DMA channel is assigned to a connected FE is only
+applicable if the PROCEN_FMT_QUIRK is set. So, remove it for platforms
+that do not enable the quirk.
+
+Complements: a792bfc1c2bc ("ASoC: SOF: Intel: hda-stream: limit PROCEN workaround")
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20220128130017.28508-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index b3cdd10c83ae..80e3a02e629f 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -57,6 +57,8 @@ static struct hdac_ext_stream *
+ {
+ 	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+ 	struct sof_intel_hda_stream *hda_stream;
++	const struct sof_intel_dsp_desc *chip;
++	struct snd_sof_dev *sdev;
+ 	struct hdac_ext_stream *res = NULL;
+ 	struct hdac_stream *stream = NULL;
+ 
+@@ -75,9 +77,20 @@ static struct hdac_ext_stream *
+ 			continue;
+ 
+ 		hda_stream = hstream_to_sof_hda_stream(hstream);
++		sdev = hda_stream->sdev;
++		chip = get_chip_info(sdev->pdata);
+ 
+ 		/* check if link is available */
+ 		if (!hstream->link_locked) {
++			/*
++			 * choose the first available link for platforms that do not have the
++			 * PROCEN_FMT_QUIRK set.
++			 */
++			if (!(chip->quirks & SOF_INTEL_PROCEN_FMT_QUIRK)) {
++				res = hstream;
++				break;
++			}
++
+ 			if (stream->opened) {
+ 				/*
+ 				 * check if the stream tag matches the stream
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch b/queue-5.4/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..4b63d866dcf
--- /dev/null
+++ b/queue-5.4/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
@@ -0,0 +1,49 @@
+From 933a60406a1828b45066400aedc24f79338eb33e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 11:15:40 +0800
+Subject: ASoC: ti: davinci-i2s: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit ed7c9fef11931fc5d32a83d68017ff390bf5c280 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: 5f9a50c3e55e ("ASoC: Davinci: McBSP: add device tree support for McBSP")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20220228031540.3571959-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/davinci-i2s.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c
+index d89b5c928c4d..b2b2dcdb05d4 100644
+--- a/sound/soc/ti/davinci-i2s.c
++++ b/sound/soc/ti/davinci-i2s.c
+@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev)
+ 	dev->clk = clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(dev->clk))
+ 		return -ENODEV;
+-	clk_enable(dev->clk);
++	ret = clk_enable(dev->clk);
++	if (ret)
++		goto err_put_clk;
+ 
+ 	dev->dev = &pdev->dev;
+ 	dev_set_drvdata(&pdev->dev, dev);
+@@ -730,6 +732,7 @@ static int davinci_i2s_probe(struct platform_device *pdev)
+ 	snd_soc_unregister_component(&pdev->dev);
+ err_release_clk:
+ 	clk_disable(dev->clk);
++err_put_clk:
+ 	clk_put(dev->clk);
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/asoc-wm8350-handle-error-for-wm8350_register_irq.patch b/queue-5.4/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
new file mode 100644
index 00000000000..e923b3c9009
--- /dev/null
+++ b/queue-5.4/asoc-wm8350-handle-error-for-wm8350_register_irq.patch
@@ -0,0 +1,73 @@
+From bade7f88e1a42032664e95bfa7a56481c56934ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 10:38:21 +0800
+Subject: ASoC: wm8350: Handle error for wm8350_register_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit db0350da8084ad549bca16cc0486c11cc70a1f9b ]
+
+As the potential failure of the wm8350_register_irq(),
+it should be better to check it and return error if fails.
+Also, use 'free_' in order to avoid the same code.
+
+Fixes: a6ba2b2dabb5 ("ASoC: Implement WM8350 headphone jack detection")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220304023821.391936-1-jiasheng@iscas.ac.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8350.c | 28 ++++++++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
+index fe99584c917f..9cd91bb0a902 100644
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -1535,18 +1535,38 @@ static  int wm8350_component_probe(struct snd_soc_component *component)
+ 	wm8350_clear_bits(wm8350, WM8350_JACK_DETECT,
+ 			  WM8350_JDL_ENA | WM8350_JDR_ENA);
+ 
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
+ 			    wm8350_hpl_jack_handler, 0, "Left jack detect",
+ 			    priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
++	if (ret != 0)
++		goto err;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
+ 			    wm8350_hpr_jack_handler, 0, "Right jack detect",
+ 			    priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
++	if (ret != 0)
++		goto free_jck_det_l;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
+ 			    wm8350_mic_handler, 0, "Microphone short", priv);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
++	if (ret != 0)
++		goto free_jck_det_r;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
+ 			    wm8350_mic_handler, 0, "Microphone detect", priv);
++	if (ret != 0)
++		goto free_micscd;
+ 
+ 	return 0;
++
++free_micscd:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv);
++free_jck_det_r:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv);
++free_jck_det_l:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv);
++err:
++	return ret;
+ }
+ 
+ static void wm8350_component_remove(struct snd_soc_component *component)
+-- 
+2.34.1
+
diff --git a/queue-5.4/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch b/queue-5.4/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
new file mode 100644
index 00000000000..d5569555559
--- /dev/null
+++ b/queue-5.4/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
@@ -0,0 +1,56 @@
+From 6b2645fd8fc0553617b0b83248a70ad9e60006f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 16:24:13 +0200
+Subject: ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit e3fb3d4418fce5484dfe7995fcd94c18b10a431a ]
+
+In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for
+the new->pattern, and currently the new->pattern and new->mask is same
+with the old, then the memcpy of new->pattern will also overwrite the
+old->pattern, because the header format of new->pattern is 802.11,
+its length is larger than the old->pattern which is 802.3. Then the
+operation of "Copy frame body" will copy a mistake value because the
+body memory has been overwrite when memcpy the new->pattern.
+
+Assign another empty value to new_pattern to avoid the overwrite issue.
+
+Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049
+
+Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11")
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20211222031347.25463-1-quic_wgong@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wow.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
+index 8c26adddd034..b4f54ca12756 100644
+--- a/drivers/net/wireless/ath/ath10k/wow.c
++++ b/drivers/net/wireless/ath/ath10k/wow.c
+@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
+ 			if (patterns[i].mask[j / 8] & BIT(j % 8))
+ 				bitmask[j] = 0xff;
+ 		old_pattern.mask = bitmask;
+-		new_pattern = old_pattern;
+ 
+ 		if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
+-			if (patterns[i].pkt_offset < ETH_HLEN)
++			if (patterns[i].pkt_offset < ETH_HLEN) {
+ 				ath10k_wow_convert_8023_to_80211(&new_pattern,
+ 								 &old_pattern);
+-			else
++			} else {
++				new_pattern = old_pattern;
+ 				new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
++			}
+ 		}
+ 
+ 		if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
+-- 
+2.34.1
+
diff --git a/queue-5.4/ath9k_htc-fix-uninit-value-bugs.patch b/queue-5.4/ath9k_htc-fix-uninit-value-bugs.patch
new file mode 100644
index 00000000000..0ccc00b18dd
--- /dev/null
+++ b/queue-5.4/ath9k_htc-fix-uninit-value-bugs.patch
@@ -0,0 +1,100 @@
+From f4658d4072b36cf1bc677671906cea7e283a1fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 10:52:37 +0200
+Subject: ath9k_htc: fix uninit value bugs
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit d1e0df1c57bd30871dd1c855742a7c346dbca853 ]
+
+Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
+field initialization.
+
+In htc_connect_service() svc_meta_len and pad are not initialized. Based
+on code it looks like in current skb there is no service data, so simply
+initialize svc_meta_len to 0.
+
+htc_issue_send() does not initialize htc_frame_hdr::control array. Based
+on firmware code, it will initialize it by itself, so simply zero whole
+array to make KMSAN happy
+
+Fail logs:
+
+BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
+ hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
+ htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
+ htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
+...
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:524 [inline]
+ slab_alloc_node mm/slub.c:3251 [inline]
+ __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
+ kmalloc_reserve net/core/skbuff.c:354 [inline]
+ __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
+ alloc_skb include/linux/skbuff.h:1126 [inline]
+ htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
+...
+
+Bytes 4-7 of 18 are uninitialized
+Memory access of size 18 starts at ffff888027377e00
+
+BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
+ hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
+ hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
+ htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
+ htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
+...
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:524 [inline]
+ slab_alloc_node mm/slub.c:3251 [inline]
+ __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
+ kmalloc_reserve net/core/skbuff.c:354 [inline]
+ __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
+ alloc_skb include/linux/skbuff.h:1126 [inline]
+ htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
+...
+
+Bytes 16-17 of 18 are uninitialized
+Memory access of size 18 starts at ffff888027377e00
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_hst.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 510e61e97dbc..994ec48b2f66 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
+ 	hdr->endpoint_id = epid;
+ 	hdr->flags = flags;
+ 	hdr->payload_len = cpu_to_be16(len);
++	memset(hdr->control, 0, sizeof(hdr->control));
+ 
+ 	status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb);
+ 
+@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target,
+ 	conn_msg->dl_pipeid = endpoint->dl_pipeid;
+ 	conn_msg->ul_pipeid = endpoint->ul_pipeid;
+ 
++	/* To prevent infoleak */
++	conn_msg->svc_meta_len = 0;
++	conn_msg->pad = 0;
++
+ 	ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
+ 	if (ret)
+ 		goto err;
+-- 
+2.34.1
+
diff --git a/queue-5.4/audit-log-audit_time_-records-only-from-rules.patch b/queue-5.4/audit-log-audit_time_-records-only-from-rules.patch
new file mode 100644
index 00000000000..1d045d02e06
--- /dev/null
+++ b/queue-5.4/audit-log-audit_time_-records-only-from-rules.patch
@@ -0,0 +1,167 @@
+From e59287875e16461f73d153067579467451c120db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 11:44:51 -0500
+Subject: audit: log AUDIT_TIME_* records only from rules
+
+From: Richard Guy Briggs <rgb@redhat.com>
+
+[ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ]
+
+AUDIT_TIME_* events are generated when there are syscall rules present
+that are not related to time keeping.  This will produce noisy log
+entries that could flood the logs and hide events we really care about.
+
+Rather than immediately produce the AUDIT_TIME_* records, store the data
+in the context and log it at syscall exit time respecting the filter
+rules.
+
+Note: This eats the audit_buffer, unlike any others in show_special().
+
+Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919
+
+Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment")
+Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments")
+Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
+[PM: fixed style/whitespace issues]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit.h   |  4 +++
+ kernel/auditsc.c | 87 +++++++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 71 insertions(+), 20 deletions(-)
+
+diff --git a/kernel/audit.h b/kernel/audit.h
+index ddc22878433d..fed8e93ce169 100644
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -191,6 +191,10 @@ struct audit_context {
+ 		struct {
+ 			char			*name;
+ 		} module;
++		struct {
++			struct audit_ntp_data	ntp_data;
++			struct timespec64	tk_injoffset;
++		} time;
+ 	};
+ 	int fds[2];
+ 	struct audit_proctitle proctitle;
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index d33c5dccde1c..e8e90c0c4936 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1185,6 +1185,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
+ 			 from_kuid(&init_user_ns, name->fcap.rootid));
+ }
+ 
++static void audit_log_time(struct audit_context *context, struct audit_buffer **ab)
++{
++	const struct audit_ntp_data *ntp = &context->time.ntp_data;
++	const struct timespec64 *tk = &context->time.tk_injoffset;
++	static const char * const ntp_name[] = {
++		"offset",
++		"freq",
++		"status",
++		"tai",
++		"tick",
++		"adjust",
++	};
++	int type;
++
++	if (context->type == AUDIT_TIME_ADJNTPVAL) {
++		for (type = 0; type < AUDIT_NTP_NVALS; type++) {
++			if (ntp->vals[type].newval != ntp->vals[type].oldval) {
++				if (!*ab) {
++					*ab = audit_log_start(context,
++							GFP_KERNEL,
++							AUDIT_TIME_ADJNTPVAL);
++					if (!*ab)
++						return;
++				}
++				audit_log_format(*ab, "op=%s old=%lli new=%lli",
++						 ntp_name[type],
++						 ntp->vals[type].oldval,
++						 ntp->vals[type].newval);
++				audit_log_end(*ab);
++				*ab = NULL;
++			}
++		}
++	}
++	if (tk->tv_sec != 0 || tk->tv_nsec != 0) {
++		if (!*ab) {
++			*ab = audit_log_start(context, GFP_KERNEL,
++					      AUDIT_TIME_INJOFFSET);
++			if (!*ab)
++				return;
++		}
++		audit_log_format(*ab, "sec=%lli nsec=%li",
++				 (long long)tk->tv_sec, tk->tv_nsec);
++		audit_log_end(*ab);
++		*ab = NULL;
++	}
++}
++
+ static void show_special(struct audit_context *context, int *call_panic)
+ {
+ 	struct audit_buffer *ab;
+@@ -1290,6 +1337,11 @@ static void show_special(struct audit_context *context, int *call_panic)
+ 			audit_log_format(ab, "(null)");
+ 
+ 		break;
++	case AUDIT_TIME_ADJNTPVAL:
++	case AUDIT_TIME_INJOFFSET:
++		/* this call deviates from the rest, eating the buffer */
++		audit_log_time(context, &ab);
++		break;
+ 	}
+ 	audit_log_end(ab);
+ }
+@@ -2518,31 +2570,26 @@ void __audit_fanotify(unsigned int response)
+ 
+ void __audit_tk_injoffset(struct timespec64 offset)
+ {
+-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET,
+-		  "sec=%lli nsec=%li",
+-		  (long long)offset.tv_sec, offset.tv_nsec);
+-}
+-
+-static void audit_log_ntp_val(const struct audit_ntp_data *ad,
+-			      const char *op, enum audit_ntp_type type)
+-{
+-	const struct audit_ntp_val *val = &ad->vals[type];
+-
+-	if (val->newval == val->oldval)
+-		return;
++	struct audit_context *context = audit_context();
+ 
+-	audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL,
+-		  "op=%s old=%lli new=%lli", op, val->oldval, val->newval);
++	/* only set type if not already set by NTP */
++	if (!context->type)
++		context->type = AUDIT_TIME_INJOFFSET;
++	memcpy(&context->time.tk_injoffset, &offset, sizeof(offset));
+ }
+ 
+ void __audit_ntp_log(const struct audit_ntp_data *ad)
+ {
+-	audit_log_ntp_val(ad, "offset",	AUDIT_NTP_OFFSET);
+-	audit_log_ntp_val(ad, "freq",	AUDIT_NTP_FREQ);
+-	audit_log_ntp_val(ad, "status",	AUDIT_NTP_STATUS);
+-	audit_log_ntp_val(ad, "tai",	AUDIT_NTP_TAI);
+-	audit_log_ntp_val(ad, "tick",	AUDIT_NTP_TICK);
+-	audit_log_ntp_val(ad, "adjust",	AUDIT_NTP_ADJUST);
++	struct audit_context *context = audit_context();
++	int type;
++
++	for (type = 0; type < AUDIT_NTP_NVALS; type++)
++		if (ad->vals[type].newval != ad->vals[type].oldval) {
++			/* unconditionally set type, overwriting TK */
++			context->type = AUDIT_TIME_ADJNTPVAL;
++			memcpy(&context->time.ntp_data, ad, sizeof(*ad));
++			break;
++		}
+ }
+ 
+ static void audit_log_task(struct audit_buffer *ab)
+-- 
+2.34.1
+
diff --git a/queue-5.4/bfq-fix-use-after-free-in-bfq_dispatch_request.patch b/queue-5.4/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
new file mode 100644
index 00000000000..e909ac3c184
--- /dev/null
+++ b/queue-5.4/bfq-fix-use-after-free-in-bfq_dispatch_request.patch
@@ -0,0 +1,183 @@
+From a32723a2b66fc017be4e9851ffe19bac426b2e4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 15:03:34 +0800
+Subject: bfq: fix use-after-free in bfq_dispatch_request
+
+From: Zhang Wensheng <zhangwensheng5@huawei.com>
+
+[ Upstream commit ab552fcb17cc9e4afe0e4ac4df95fc7b30e8490a ]
+
+KASAN reports a use-after-free report when doing normal scsi-mq test
+
+[69832.239032] ==================================================================
+[69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0
+[69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155
+[69832.244656]
+[69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8
+[69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+[69832.249069] Workqueue: kblockd blk_mq_run_work_fn
+[69832.250022] Call Trace:
+[69832.250541]  dump_stack+0x9b/0xce
+[69832.251232]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.252243]  print_address_description.constprop.6+0x3e/0x60
+[69832.253381]  ? __cpuidle_text_end+0x5/0x5
+[69832.254211]  ? vprintk_func+0x6b/0x120
+[69832.254994]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.255952]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.256914]  kasan_report.cold.9+0x22/0x3a
+[69832.257753]  ? bfq_dispatch_request+0x1045/0x44b0
+[69832.258755]  check_memory_region+0x1c1/0x1e0
+[69832.260248]  bfq_dispatch_request+0x1045/0x44b0
+[69832.261181]  ? bfq_bfqq_expire+0x2440/0x2440
+[69832.262032]  ? blk_mq_delay_run_hw_queues+0xf9/0x170
+[69832.263022]  __blk_mq_do_dispatch_sched+0x52f/0x830
+[69832.264011]  ? blk_mq_sched_request_inserted+0x100/0x100
+[69832.265101]  __blk_mq_sched_dispatch_requests+0x398/0x4f0
+[69832.266206]  ? blk_mq_do_dispatch_ctx+0x570/0x570
+[69832.267147]  ? __switch_to+0x5f4/0xee0
+[69832.267898]  blk_mq_sched_dispatch_requests+0xdf/0x140
+[69832.268946]  __blk_mq_run_hw_queue+0xc0/0x270
+[69832.269840]  blk_mq_run_work_fn+0x51/0x60
+[69832.278170]  process_one_work+0x6d4/0xfe0
+[69832.278984]  worker_thread+0x91/0xc80
+[69832.279726]  ? __kthread_parkme+0xb0/0x110
+[69832.280554]  ? process_one_work+0xfe0/0xfe0
+[69832.281414]  kthread+0x32d/0x3f0
+[69832.282082]  ? kthread_park+0x170/0x170
+[69832.282849]  ret_from_fork+0x1f/0x30
+[69832.283573]
+[69832.283886] Allocated by task 7725:
+[69832.284599]  kasan_save_stack+0x19/0x40
+[69832.285385]  __kasan_kmalloc.constprop.2+0xc1/0xd0
+[69832.286350]  kmem_cache_alloc_node+0x13f/0x460
+[69832.287237]  bfq_get_queue+0x3d4/0x1140
+[69832.287993]  bfq_get_bfqq_handle_split+0x103/0x510
+[69832.289015]  bfq_init_rq+0x337/0x2d50
+[69832.289749]  bfq_insert_requests+0x304/0x4e10
+[69832.290634]  blk_mq_sched_insert_requests+0x13e/0x390
+[69832.291629]  blk_mq_flush_plug_list+0x4b4/0x760
+[69832.292538]  blk_flush_plug_list+0x2c5/0x480
+[69832.293392]  io_schedule_prepare+0xb2/0xd0
+[69832.294209]  io_schedule_timeout+0x13/0x80
+[69832.295014]  wait_for_common_io.constprop.1+0x13c/0x270
+[69832.296137]  submit_bio_wait+0x103/0x1a0
+[69832.296932]  blkdev_issue_discard+0xe6/0x160
+[69832.297794]  blk_ioctl_discard+0x219/0x290
+[69832.298614]  blkdev_common_ioctl+0x50a/0x1750
+[69832.304715]  blkdev_ioctl+0x470/0x600
+[69832.305474]  block_ioctl+0xde/0x120
+[69832.306232]  vfs_ioctl+0x6c/0xc0
+[69832.306877]  __se_sys_ioctl+0x90/0xa0
+[69832.307629]  do_syscall_64+0x2d/0x40
+[69832.308362]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[69832.309382]
+[69832.309701] Freed by task 155:
+[69832.310328]  kasan_save_stack+0x19/0x40
+[69832.311121]  kasan_set_track+0x1c/0x30
+[69832.311868]  kasan_set_free_info+0x1b/0x30
+[69832.312699]  __kasan_slab_free+0x111/0x160
+[69832.313524]  kmem_cache_free+0x94/0x460
+[69832.314367]  bfq_put_queue+0x582/0x940
+[69832.315112]  __bfq_bfqd_reset_in_service+0x166/0x1d0
+[69832.317275]  bfq_bfqq_expire+0xb27/0x2440
+[69832.318084]  bfq_dispatch_request+0x697/0x44b0
+[69832.318991]  __blk_mq_do_dispatch_sched+0x52f/0x830
+[69832.319984]  __blk_mq_sched_dispatch_requests+0x398/0x4f0
+[69832.321087]  blk_mq_sched_dispatch_requests+0xdf/0x140
+[69832.322225]  __blk_mq_run_hw_queue+0xc0/0x270
+[69832.323114]  blk_mq_run_work_fn+0x51/0x60
+[69832.323942]  process_one_work+0x6d4/0xfe0
+[69832.324772]  worker_thread+0x91/0xc80
+[69832.325518]  kthread+0x32d/0x3f0
+[69832.326205]  ret_from_fork+0x1f/0x30
+[69832.326932]
+[69832.338297] The buggy address belongs to the object at ffff88802622b968
+[69832.338297]  which belongs to the cache bfq_queue of size 512
+[69832.340766] The buggy address is located 288 bytes inside of
+[69832.340766]  512-byte region [ffff88802622b968, ffff88802622bb68)
+[69832.343091] The buggy address belongs to the page:
+[69832.344097] page:ffffea0000988a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802622a528 pfn:0x26228
+[69832.346214] head:ffffea0000988a00 order:2 compound_mapcount:0 compound_pincount:0
+[69832.347719] flags: 0x1fffff80010200(slab|head)
+[69832.348625] raw: 001fffff80010200 ffffea0000dbac08 ffff888017a57650 ffff8880179fe840
+[69832.354972] raw: ffff88802622a528 0000000000120008 00000001ffffffff 0000000000000000
+[69832.356547] page dumped because: kasan: bad access detected
+[69832.357652]
+[69832.357970] Memory state around the buggy address:
+[69832.358926]  ffff88802622b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.360358]  ffff88802622ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.361810] >ffff88802622ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[69832.363273]                       ^
+[69832.363975]  ffff88802622bb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
+[69832.375960]  ffff88802622bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[69832.377405] ==================================================================
+
+In bfq_dispatch_requestfunction, it may have function call:
+
+bfq_dispatch_request
+	__bfq_dispatch_request
+		bfq_select_queue
+			bfq_bfqq_expire
+				__bfq_bfqd_reset_in_service
+					bfq_put_queue
+						kmem_cache_free
+In this function call, in_serv_queue has beed expired and meet the
+conditions to free. In the function bfq_dispatch_request, the address
+of in_serv_queue pointing to has been released. For getting the value
+of idle_timer_disabled, it will get flags value from the address which
+in_serv_queue pointing to, then the problem of use-after-free happens;
+
+Fix the problem by check in_serv_queue == bfqd->in_service_queue, to
+get the value of idle_timer_disabled if in_serve_queue is equel to
+bfqd->in_service_queue. If the space of in_serv_queue pointing has
+been released, this judge will aviod use-after-free problem.
+And if in_serv_queue may be expired or finished, the idle_timer_disabled
+will be false which would not give effects to bfq_update_dispatch_stats.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Wensheng <zhangwensheng5@huawei.com>
+Link: https://lore.kernel.org/r/20220303070334.3020168-1-zhangwensheng5@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 1a0c581512f2..38c39d50ae04 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -4793,7 +4793,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ 	struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
+ 	struct request *rq;
+ 	struct bfq_queue *in_serv_queue;
+-	bool waiting_rq, idle_timer_disabled;
++	bool waiting_rq, idle_timer_disabled = false;
+ 
+ 	spin_lock_irq(&bfqd->lock);
+ 
+@@ -4801,14 +4801,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ 	waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue);
+ 
+ 	rq = __bfq_dispatch_request(hctx);
+-
+-	idle_timer_disabled =
+-		waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++	if (in_serv_queue == bfqd->in_service_queue) {
++		idle_timer_disabled =
++			waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++	}
+ 
+ 	spin_unlock_irq(&bfqd->lock);
+-
+-	bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue,
+-				  idle_timer_disabled);
++	bfq_update_dispatch_stats(hctx->queue, rq,
++			idle_timer_disabled ? in_serv_queue : NULL,
++				idle_timer_disabled);
+ 
+ 	return rq;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/block-bfq-don-t-move-oom_bfqq.patch b/queue-5.4/block-bfq-don-t-move-oom_bfqq.patch
new file mode 100644
index 00000000000..921b22b4ddb
--- /dev/null
+++ b/queue-5.4/block-bfq-don-t-move-oom_bfqq.patch
@@ -0,0 +1,142 @@
+From 2434f09e439938ed1dc1799f6dd9c9eb97fbb644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jan 2022 09:59:24 +0800
+Subject: block, bfq: don't move oom_bfqq
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 8410f70977734f21b8ed45c37e925d311dfda2e7 ]
+
+Our test report a UAF:
+
+[ 2073.019181] ==================================================================
+[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168
+[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584
+[ 2073.019192]
+[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5
+[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
+[ 2073.019200] Call trace:
+[ 2073.019203]  dump_backtrace+0x0/0x310
+[ 2073.019206]  show_stack+0x28/0x38
+[ 2073.019210]  dump_stack+0xec/0x15c
+[ 2073.019216]  print_address_description+0x68/0x2d0
+[ 2073.019220]  kasan_report+0x238/0x2f0
+[ 2073.019224]  __asan_store8+0x88/0xb0
+[ 2073.019229]  __bfq_put_async_bfqq+0xa0/0x168
+[ 2073.019233]  bfq_put_async_queues+0xbc/0x208
+[ 2073.019236]  bfq_pd_offline+0x178/0x238
+[ 2073.019240]  blkcg_deactivate_policy+0x1f0/0x420
+[ 2073.019244]  bfq_exit_queue+0x128/0x178
+[ 2073.019249]  blk_mq_exit_sched+0x12c/0x160
+[ 2073.019252]  elevator_exit+0xc8/0xd0
+[ 2073.019256]  blk_exit_queue+0x50/0x88
+[ 2073.019259]  blk_cleanup_queue+0x228/0x3d8
+[ 2073.019267]  null_del_dev+0xfc/0x1e0 [null_blk]
+[ 2073.019274]  null_exit+0x90/0x114 [null_blk]
+[ 2073.019278]  __arm64_sys_delete_module+0x358/0x5a0
+[ 2073.019282]  el0_svc_common+0xc8/0x320
+[ 2073.019287]  el0_svc_handler+0xf8/0x160
+[ 2073.019290]  el0_svc+0x10/0x218
+[ 2073.019291]
+[ 2073.019294] Allocated by task 14163:
+[ 2073.019301]  kasan_kmalloc+0xe0/0x190
+[ 2073.019305]  kmem_cache_alloc_node_trace+0x1cc/0x418
+[ 2073.019308]  bfq_pd_alloc+0x54/0x118
+[ 2073.019313]  blkcg_activate_policy+0x250/0x460
+[ 2073.019317]  bfq_create_group_hierarchy+0x38/0x110
+[ 2073.019321]  bfq_init_queue+0x6d0/0x948
+[ 2073.019325]  blk_mq_init_sched+0x1d8/0x390
+[ 2073.019330]  elevator_switch_mq+0x88/0x170
+[ 2073.019334]  elevator_switch+0x140/0x270
+[ 2073.019338]  elv_iosched_store+0x1a4/0x2a0
+[ 2073.019342]  queue_attr_store+0x90/0xe0
+[ 2073.019348]  sysfs_kf_write+0xa8/0xe8
+[ 2073.019351]  kernfs_fop_write+0x1f8/0x378
+[ 2073.019359]  __vfs_write+0xe0/0x360
+[ 2073.019363]  vfs_write+0xf0/0x270
+[ 2073.019367]  ksys_write+0xdc/0x1b8
+[ 2073.019371]  __arm64_sys_write+0x50/0x60
+[ 2073.019375]  el0_svc_common+0xc8/0x320
+[ 2073.019380]  el0_svc_handler+0xf8/0x160
+[ 2073.019383]  el0_svc+0x10/0x218
+[ 2073.019385]
+[ 2073.019387] Freed by task 72584:
+[ 2073.019391]  __kasan_slab_free+0x120/0x228
+[ 2073.019394]  kasan_slab_free+0x10/0x18
+[ 2073.019397]  kfree+0x94/0x368
+[ 2073.019400]  bfqg_put+0x64/0xb0
+[ 2073.019404]  bfqg_and_blkg_put+0x90/0xb0
+[ 2073.019408]  bfq_put_queue+0x220/0x228
+[ 2073.019413]  __bfq_put_async_bfqq+0x98/0x168
+[ 2073.019416]  bfq_put_async_queues+0xbc/0x208
+[ 2073.019420]  bfq_pd_offline+0x178/0x238
+[ 2073.019424]  blkcg_deactivate_policy+0x1f0/0x420
+[ 2073.019429]  bfq_exit_queue+0x128/0x178
+[ 2073.019433]  blk_mq_exit_sched+0x12c/0x160
+[ 2073.019437]  elevator_exit+0xc8/0xd0
+[ 2073.019440]  blk_exit_queue+0x50/0x88
+[ 2073.019443]  blk_cleanup_queue+0x228/0x3d8
+[ 2073.019451]  null_del_dev+0xfc/0x1e0 [null_blk]
+[ 2073.019459]  null_exit+0x90/0x114 [null_blk]
+[ 2073.019462]  __arm64_sys_delete_module+0x358/0x5a0
+[ 2073.019467]  el0_svc_common+0xc8/0x320
+[ 2073.019471]  el0_svc_handler+0xf8/0x160
+[ 2073.019474]  el0_svc+0x10/0x218
+[ 2073.019475]
+[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00
+ which belongs to the cache kmalloc-1024 of size 1024
+[ 2073.019484] The buggy address is located 552 bytes inside of
+ 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)
+[ 2073.019486] The buggy address belongs to the page:
+[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0
+[ 2073.020123] flags: 0x7ffff0000008100(slab|head)
+[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00
+[ 2073.020409] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000
+[ 2073.020411] page dumped because: kasan: bad access detected
+[ 2073.020412]
+[ 2073.020414] Memory state around the buggy address:
+[ 2073.020420]  ffff8000ccf64000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020424]  ffff8000ccf64080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020428] >ffff8000ccf64100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020430]                                   ^
+[ 2073.020434]  ffff8000ccf64180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020438]  ffff8000ccf64200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 2073.020439] ==================================================================
+
+The same problem exist in mainline as well.
+
+This is because oom_bfqq is moved to a non-root group, thus root_group
+is freed earlier.
+
+Thus fix the problem by don't move oom_bfqq.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Acked-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20220129015924.3958918-4-yukuai3@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 342a1cfa48c5..c17eb794f0ae 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -625,6 +625,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ 	struct bfq_entity *entity = &bfqq->entity;
+ 
++	/*
++	 * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group
++	 * until elevator exit.
++	 */
++	if (bfqq == &bfqd->oom_bfqq)
++		return;
+ 	/*
+ 	 * Get extra reference to prevent bfqq from being freed in
+ 	 * next possible expire or deactivate.
+-- 
+2.34.1
+
diff --git a/queue-5.4/block-don-t-delete-queue-kobject-before-its-children.patch b/queue-5.4/block-don-t-delete-queue-kobject-before-its-children.patch
new file mode 100644
index 00000000000..0f656890f7a
--- /dev/null
+++ b/queue-5.4/block-don-t-delete-queue-kobject-before-its-children.patch
@@ -0,0 +1,71 @@
+From e65eb29fc2448e0498eefeeb09a2da388fc03cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 13:59:37 -0800
+Subject: block: don't delete queue kobject before its children
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ]
+
+kobjects aren't supposed to be deleted before their child kobjects are
+deleted.  Apparently this is usually benign; however, a WARN will be
+triggered if one of the child kobjects has a named attribute group:
+
+    sysfs group 'modes' not found for kobject 'crypto'
+    WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80
+    ...
+    Call Trace:
+      sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312
+      __kobject_del+0x20/0x80 lib/kobject.c:611
+      kobject_cleanup+0xa4/0x140 lib/kobject.c:696
+      kobject_release lib/kobject.c:736 [inline]
+      kref_put include/linux/kref.h:65 [inline]
+      kobject_put+0x53/0x70 lib/kobject.c:753
+      blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159
+      blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962
+      del_gendisk+0x117/0x250 block/genhd.c:610
+
+Fix this by moving the kobject_del() and the corresponding
+kobject_uevent() to the correct place.
+
+Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}register_queue()")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-sysfs.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index bf33570da5ac..3fb37135264b 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -1060,15 +1060,17 @@ void blk_unregister_queue(struct gendisk *disk)
+ 	 */
+ 	if (queue_is_mq(q))
+ 		blk_mq_unregister_dev(disk_to_dev(disk), q);
+-
+-	kobject_uevent(&q->kobj, KOBJ_REMOVE);
+-	kobject_del(&q->kobj);
+ 	blk_trace_remove_sysfs(disk_to_dev(disk));
+ 
+ 	mutex_lock(&q->sysfs_lock);
+ 	if (q->elevator)
+ 		elv_unregister_queue(q);
+ 	mutex_unlock(&q->sysfs_lock);
++
++	/* Now that we've deleted all child objects, we can delete the queue. */
++	kobject_uevent(&q->kobj, KOBJ_REMOVE);
++	kobject_del(&q->kobj);
++
+ 	mutex_unlock(&q->sysfs_dir_lock);
+ 
+ 	kobject_put(&disk_to_dev(disk)->kobj);
+-- 
+2.34.1
+
diff --git a/queue-5.4/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch b/queue-5.4/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
new file mode 100644
index 00000000000..4ab65823e37
--- /dev/null
+++ b/queue-5.4/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
@@ -0,0 +1,72 @@
+From 417f093a66aa3640eccaf310ec5666bb203ba6b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 07:15:19 +0800
+Subject: Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
+
+From: Yake Yang <yake.yang@mediatek.com>
+
+[ Upstream commit b062a0b9c1dc1ff63094337dccfe1568d5b62023 ]
+
+Fix the following kernel oops in btmtksdio_interrrupt
+
+[   14.339134]  btmtksdio_interrupt+0x28/0x54
+[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0
+[   14.339144]  sdio_irq_work+0x40/0x70
+[   14.339154]  process_one_work+0x184/0x39c
+[   14.339160]  worker_thread+0x228/0x3e8
+[   14.339168]  kthread+0x148/0x3ac
+[   14.339176]  ret_from_fork+0x10/0x30
+
+That happened because hdev->power_on is already called before
+sdio_set_drvdata which btmtksdio_interrupt handler relies on is not
+properly set up.
+
+The details are shown as the below: hci_register_dev would run
+queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI
+workqueue_struct to complete the power-on sequeunce and thus hci_power_on
+may run before sdio_set_drvdata is done in btmtksdio_probe.
+
+The hci_dev_do_open in hci_power_on would initialize the device and enable
+the interrupt and thus it is possible that btmtksdio_interrupt is being
+called right before sdio_set_drvdata is filled out.
+
+When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled
+, the kernel oops is going to happen because btmtksdio_interrupt access an
+uninitialized pointer.
+
+Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
+Reviewed-by: Mark Chen <markyawenchen@gmail.com>
+Co-developed-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Yake Yang <yake.yang@mediatek.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtksdio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
+index c2eb64bcd5d5..0e7f44461946 100644
+--- a/drivers/bluetooth/btmtksdio.c
++++ b/drivers/bluetooth/btmtksdio.c
+@@ -980,6 +980,8 @@ static int btmtksdio_probe(struct sdio_func *func,
+ 	hdev->manufacturer = 70;
+ 	set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
+ 
++	sdio_set_drvdata(func, bdev);
++
+ 	err = hci_register_dev(hdev);
+ 	if (err < 0) {
+ 		dev_err(&func->dev, "Can't register HCI device\n");
+@@ -987,8 +989,6 @@ static int btmtksdio_probe(struct sdio_func *func,
+ 		return err;
+ 	}
+ 
+-	sdio_set_drvdata(func, bdev);
+-
+ 	/* pm_runtime_enable would be done after the firmware is being
+ 	 * downloaded because the core layer probably already enables
+ 	 * runtime PM for this func such as the case host->caps &
+-- 
+2.34.1
+
diff --git a/queue-5.4/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch b/queue-5.4/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
new file mode 100644
index 00000000000..6b89563a05d
--- /dev/null
+++ b/queue-5.4/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
@@ -0,0 +1,71 @@
+From c79bd3289f58c33fdcf171c47ac533274107815e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jan 2022 16:27:04 +0300
+Subject: Bluetooth: hci_serdev: call init_rwsem() before p->open()
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 9d7cbe2b9cf5f650067df4f402fdd799d4bbb4e1 ]
+
+kvartet reported, that hci_uart_tx_wakeup() uses uninitialized rwsem.
+The problem was in wrong place for percpu_init_rwsem() call.
+
+hci_uart_proto::open() may register a timer whose callback may call
+hci_uart_tx_wakeup(). There is a chance, that hci_uart_register_device()
+thread won't be fast enough to call percpu_init_rwsem().
+
+Fix it my moving percpu_init_rwsem() call before p->open().
+
+INFO: trying to register non-static key.
+The code is fine but needs lockdep annotation, or maybe
+you didn't initialize this object before use?
+turning off the locking correctness validator.
+CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9
+...
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ assign_lock_key kernel/locking/lockdep.c:951 [inline]
+ register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263
+ __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906
+ lock_acquire kernel/locking/lockdep.c:5637 [inline]
+ lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602
+ percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline]
+ hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124
+ h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188
+ call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
+
+Fixes: d73e17281665 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
+Reported-by: Yiru Xu <xyru1999@gmail.com>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_serdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 1b4ad231e6ed..fd081bdd2dd8 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -279,6 +279,8 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 	if (err)
+ 		return err;
+ 
++	percpu_init_rwsem(&hu->proto_lock);
++
+ 	err = p->open(hu);
+ 	if (err)
+ 		goto err_open;
+@@ -301,7 +303,6 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 
+ 	INIT_WORK(&hu->init_ready, hci_uart_init_work);
+ 	INIT_WORK(&hu->write_work, hci_uart_write_work);
+-	percpu_init_rwsem(&hu->proto_lock);
+ 
+ 	/* Only when vendor specific setup callback is provided, consider
+ 	 * the manufacturer information valid. This avoids filling in the
+-- 
+2.34.1
+
diff --git a/queue-5.4/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch b/queue-5.4/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
new file mode 100644
index 00000000000..03ffbffa6ed
--- /dev/null
+++ b/queue-5.4/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
@@ -0,0 +1,53 @@
+From 20550d692ad64fa3f07f8efad14eaa999268d181 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 20:19:05 +0800
+Subject: bpf, arm64: Call build_prologue() first in first JIT pass
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 68e4f238b0e9d3670a1612ad900a6e98b2b3f7dd ]
+
+BPF line info needs ctx->offset to be the instruction offset in the whole JITed
+image instead of the body itself, so also call build_prologue() first in first
+JIT pass.
+
+Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220226121906.5709-2-houtao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index a343677837c7..6332288dfb44 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -909,15 +909,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 		goto out_off;
+ 	}
+ 
+-	/* 1. Initial fake pass to compute ctx->idx. */
+-
+-	/* Fake pass to fill in ctx->offset. */
+-	if (build_body(&ctx, extra_pass)) {
++	/*
++	 * 1. Initial fake pass to compute ctx->idx and ctx->offset.
++	 *
++	 * BPF line info needs ctx->offset[i] to be the offset of
++	 * instruction[i] in jited image, so build prologue first.
++	 */
++	if (build_prologue(&ctx, was_classic)) {
+ 		prog = orig_prog;
+ 		goto out_off;
+ 	}
+ 
+-	if (build_prologue(&ctx, was_classic)) {
++	if (build_body(&ctx, extra_pass)) {
+ 		prog = orig_prog;
+ 		goto out_off;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch b/queue-5.4/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
new file mode 100644
index 00000000000..9f6955a4cfd
--- /dev/null
+++ b/queue-5.4/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
@@ -0,0 +1,46 @@
+From 9ea2f2da05bda74f8654d33aedc3d6590683146d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Feb 2022 20:19:06 +0800
+Subject: bpf, arm64: Feed byte-offset into bpf line info
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit dda7596c109fc382876118627e29db7607cde35d ]
+
+insn_to_jit_off passed to bpf_prog_fill_jited_linfo() is calculated in
+instruction granularity instead of bytes granularity, but BPF line info
+requires byte offset.
+
+bpf_prog_fill_jited_linfo() will be the last user of ctx.offset before
+it is freed, so convert the offset into byte-offset before calling into
+bpf_prog_fill_jited_linfo() in order to fix the line info dump on arm64.
+
+Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info")
+Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220226121906.5709-3-houtao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 6332288dfb44..17a8d1484f9b 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -986,6 +986,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ 	prog->jited_len = image_size;
+ 
+ 	if (!prog->is_func || extra_pass) {
++		int i;
++
++		/* offset[prog->len] is the size of program */
++		for (i = 0; i <= prog->len; i++)
++			ctx.offset[i] *= AARCH64_INSN_SIZE;
+ 		bpf_prog_fill_jited_linfo(prog, ctx.offset + 1);
+ out_off:
+ 		kfree(ctx.offset);
+-- 
+2.34.1
+
diff --git a/queue-5.4/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch b/queue-5.4/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
new file mode 100644
index 00000000000..b45bbb82771
--- /dev/null
+++ b/queue-5.4/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
@@ -0,0 +1,72 @@
+From 8e007caecfb8942e1b9bb00187abcb522711b106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:45 +0800
+Subject: bpf, sockmap: Fix double uncharge the mem of sk_msg
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 2486ab434b2c2a14e9237296db00b1e1b7ae3273 ]
+
+If tcp_bpf_sendmsg is running during a tear down operation, psock may be
+freed.
+
+tcp_bpf_sendmsg()
+ tcp_bpf_send_verdict()
+  sk_msg_return()
+  tcp_bpf_sendmsg_redir()
+   unlikely(!psock))
+     sk_msg_free()
+
+The mem of msg has been uncharged in tcp_bpf_send_verdict() by
+sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock
+is null, we can simply returning an error code, this would then trigger
+the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have
+the side effect of throwing an error up to user space. This would be a
+slight change in behavior from user side but would look the same as an
+error if the redirect on the socket threw an error.
+
+This issue can cause the following info:
+WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ worker_thread+0x30/0x350
+ ? process_one_work+0x3c0/0x3c0
+ kthread+0xe6/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-5-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 1584863bbdc1..bcc13368c836 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -296,10 +296,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg,
+ 	struct sk_psock *psock = sk_psock_get(sk);
+ 	int ret;
+ 
+-	if (unlikely(!psock)) {
+-		sk_msg_free(sk, msg);
+-		return 0;
+-	}
++	if (unlikely(!psock))
++		return -EPIPE;
++
+ 	ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) :
+ 			tcp_bpf_push_locked(sk, msg, bytes, flags, false);
+ 	sk_psock_put(sk, psock);
+-- 
+2.34.1
+
diff --git a/queue-5.4/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch b/queue-5.4/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
new file mode 100644
index 00000000000..72e8a536599
--- /dev/null
+++ b/queue-5.4/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
@@ -0,0 +1,109 @@
+From e14fcf83e675ac709304d4fe83a9e3efb0ae2394 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:43 +0800
+Subject: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8 ]
+
+If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc()
+returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial
+memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is
+greater than osize after sk_msg_alloc(), memleak occurs. To fix we use
+sk_msg_trim() to release the allocated memory, then goto wait for memory.
+
+Other call paths of sk_msg_alloc() have the similar issue, such as
+tls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(),
+as Cong Wang suggested.
+
+This issue can cause the following info:
+WARNING: CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0
+Call Trace:
+ <TASK>
+ inet_csk_destroy_sock+0x55/0x110
+ __tcp_close+0x279/0x470
+ tcp_close+0x1f/0x60
+ inet_release+0x3f/0x80
+ __sock_release+0x3d/0xb0
+ sock_close+0x11/0x20
+ __fput+0x92/0x250
+ task_work_run+0x6a/0xa0
+ do_exit+0x33b/0xb60
+ do_group_exit+0x2f/0xa0
+ get_signal+0xb6/0x950
+ arch_do_signal_or_restart+0xac/0x2a0
+ exit_to_user_mode_prepare+0xa9/0x200
+ syscall_exit_to_user_mode+0x12/0x30
+ do_syscall_64+0x46/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ </TASK>
+
+WARNING: CPU: 3 PID: 2094 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ kthread+0xe6/0x110
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-3-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 17cc1edd149c..a606ad8e8be2 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 		 int elem_first_coalesce)
+ {
+ 	struct page_frag *pfrag = sk_page_frag(sk);
++	u32 osize = msg->sg.size;
+ 	int ret = 0;
+ 
+ 	len -= msg->sg.size;
+@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 		u32 orig_offset;
+ 		int use, i;
+ 
+-		if (!sk_page_frag_refill(sk, pfrag))
+-			return -ENOMEM;
++		if (!sk_page_frag_refill(sk, pfrag)) {
++			ret = -ENOMEM;
++			goto msg_trim;
++		}
+ 
+ 		orig_offset = pfrag->offset;
+ 		use = min_t(int, len, pfrag->size - orig_offset);
+-		if (!sk_wmem_schedule(sk, use))
+-			return -ENOMEM;
++		if (!sk_wmem_schedule(sk, use)) {
++			ret = -ENOMEM;
++			goto msg_trim;
++		}
+ 
+ 		i = msg->sg.end;
+ 		sk_msg_iter_var_prev(i);
+@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len,
+ 	}
+ 
+ 	return ret;
++
++msg_trim:
++	sk_msg_trim(sk, msg, osize);
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(sk_msg_alloc);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch b/queue-5.4/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
new file mode 100644
index 00000000000..99dee40a5e2
--- /dev/null
+++ b/queue-5.4/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
@@ -0,0 +1,100 @@
+From 9b817ea5d33e8b1abd9ef11f4ce570174ae3801b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:11:44 +0800
+Subject: bpf, sockmap: Fix more uncharged while msg has more_data
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+[ Upstream commit 84472b436e760ba439e1969a9e3c5ae7c86de39d ]
+
+In tcp_bpf_send_verdict(), if msg has more data after
+tcp_bpf_sendmsg_redir():
+
+tcp_bpf_send_verdict()
+ tosend = msg->sg.size  //msg->sg.size = 22220
+ case __SK_REDIRECT:
+  sk_msg_return()  //uncharged msg->sg.size(22220) sk->sk_forward_alloc
+  tcp_bpf_sendmsg_redir() //after tcp_bpf_sendmsg_redir, msg->sg.size=11000
+ goto more_data;
+ tosend = msg->sg.size  //msg->sg.size = 11000
+ case __SK_REDIRECT:
+  sk_msg_return()  //uncharged msg->sg.size(11000) to sk->sk_forward_alloc
+
+The msg->sg.size(11000) has been uncharged twice, to fix we can charge the
+remaining msg->sg.size before goto more data.
+
+This issue can cause the following info:
+WARNING: CPU: 0 PID: 9860 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0
+Call Trace:
+ <TASK>
+ inet_csk_destroy_sock+0x55/0x110
+ __tcp_close+0x279/0x470
+ tcp_close+0x1f/0x60
+ inet_release+0x3f/0x80
+ __sock_release+0x3d/0xb0
+ sock_close+0x11/0x20
+ __fput+0x92/0x250
+ task_work_run+0x6a/0xa0
+ do_exit+0x33b/0xb60
+ do_group_exit+0x2f/0xa0
+ get_signal+0xb6/0x950
+ arch_do_signal_or_restart+0xac/0x2a0
+ ? vfs_write+0x237/0x290
+ exit_to_user_mode_prepare+0xa9/0x200
+ syscall_exit_to_user_mode+0x12/0x30
+ do_syscall_64+0x46/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ </TASK>
+
+WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
+Call Trace:
+ <TASK>
+ __sk_destruct+0x24/0x1f0
+ sk_psock_destroy+0x19b/0x1c0
+ process_one_work+0x1b3/0x3c0
+ worker_thread+0x30/0x350
+ ? process_one_work+0x3c0/0x3c0
+ kthread+0xe6/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20220304081145.2037182-4-wangyufen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 7df7ec74807a..1584863bbdc1 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -367,7 +367,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
+ 			cork = true;
+ 			psock->cork = NULL;
+ 		}
+-		sk_msg_return(sk, msg, tosend);
++		sk_msg_return(sk, msg, msg->sg.size);
+ 		release_sock(sk);
+ 
+ 		ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
+@@ -407,8 +407,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
+ 		}
+ 		if (msg &&
+ 		    msg->sg.data[msg->sg.start].page_link &&
+-		    msg->sg.data[msg->sg.start].length)
++		    msg->sg.data[msg->sg.start].length) {
++			if (eval == __SK_REDIRECT)
++				sk_mem_charge(sk, msg->sg.size);
+ 			goto more_data;
++		}
+ 	}
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-actions-terminate-clk_div_table-with-sentinel-el.patch b/queue-5.4/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
new file mode 100644
index 00000000000..a4cb1d4c8bc
--- /dev/null
+++ b/queue-5.4/clk-actions-terminate-clk_div_table-with-sentinel-el.patch
@@ -0,0 +1,58 @@
+From d437471486e50faaa450702562856ce1e973cba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:17 +0100
+Subject: clk: actions: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit d8a441e53e2434b1401e52dfd66b05263e442edc ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+In owl-s900.s, the { 0, 8 } element was probably meant to be just that,
+so this patch changes { 0, 8 } to { 0, 0 }.
+
+Fixes: d47317ca4ade1 ("clk: actions: Add S700 SoC clock support")
+Fixes: d85d20053e195 ("clk: actions: Add S900 SoC clock support")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/20220218000922.134857-2-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-s700.c | 1 +
+ drivers/clk/actions/owl-s900.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c
+index a2f34d13fb54..6ea7da1d6d75 100644
+--- a/drivers/clk/actions/owl-s700.c
++++ b/drivers/clk/actions/owl-s700.c
+@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = {
+ 
+ static struct clk_div_table rmii_div_table[] = {
+ 	{0, 4},   {1, 10},
++	{0, 0}
+ };
+ 
+ /* divider clocks */
+diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c
+index 790890978424..5144ada2c7e1 100644
+--- a/drivers/clk/actions/owl-s900.c
++++ b/drivers/clk/actions/owl-s900.c
+@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = {
+ 
+ static struct clk_div_table usb3_mac_div_table[] = {
+ 	{ 1, 2 }, { 2, 3 }, { 3, 4 },
+-	{ 0, 8 },
++	{ 0, 0 }
+ };
+ 
+ static struct clk_div_table i2s_div_table[] = {
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch b/queue-5.4/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
new file mode 100644
index 00000000000..2cc1ee0e6c2
--- /dev/null
+++ b/queue-5.4/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
@@ -0,0 +1,45 @@
+From 7ee159b8276495e11639420e9cefb917ba6eb9e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:20 +0100
+Subject: clk: clps711x: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 8bed4ed5aa3431085d9d27afc35d684856460eda ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+Fixes: 631c53478973d ("clk: Add CLPS711X clk driver")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Link: https://lore.kernel.org/r/20220218000922.134857-5-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-clps711x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c
+index a2c6486ef170..f8417ee2961a 100644
+--- a/drivers/clk/clk-clps711x.c
++++ b/drivers/clk/clk-clps711x.c
+@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = {
+ 	{ .val = 1, .div = 8, },
+ 	{ .val = 2, .div = 2, },
+ 	{ .val = 3, .div = 1, },
++	{ /* sentinel */ }
+ };
+ 
+ static const struct clk_div_table timer_div_table[] = {
+ 	{ .val = 0, .div = 256, },
+ 	{ .val = 1, .div = 1, },
++	{ /* sentinel */ }
+ };
+ 
+ struct clps711x_clk {
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-imx7d-remove-audio_mclk_root_clk.patch b/queue-5.4/clk-imx7d-remove-audio_mclk_root_clk.patch
new file mode 100644
index 00000000000..a9742da31d2
--- /dev/null
+++ b/queue-5.4/clk-imx7d-remove-audio_mclk_root_clk.patch
@@ -0,0 +1,38 @@
+From d6e6788d58e422de1a77967fd3d9c9f26038afa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 16:10:52 +0200
+Subject: clk: imx7d: Remove audio_mclk_root_clk
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit eccac77ede3946c90143447cdc785dc16aec4b24 ]
+
+The audio_mclk_root_clk was added as a gate with the CCGR121 (0x4790),
+but according to the reference manual, there is no such gate. The
+CCGR121 belongs to ECSPI2 and it is not shared.
+
+Fixes: 8f6d8094b215b57 ("ARM: imx: add imx7d clk tree support")
+Reported-by: David Wolfe <david.wolfe@nxp.com>
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20220127141052.1900174-2-abel.vesa@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index fbea774ef687..58577548fe21 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -859,7 +859,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ 	hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0);
+ 	hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0);
+ 	hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0);
+-	hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0);
+ 	hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0);
+ 	hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0);
+ 	hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0);
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-initialize-orphan-req_rate.patch b/queue-5.4/clk-initialize-orphan-req_rate.patch
new file mode 100644
index 00000000000..ae254962a67
--- /dev/null
+++ b/queue-5.4/clk-initialize-orphan-req_rate.patch
@@ -0,0 +1,68 @@
+From 73084370fb125f086d9537a3087d95c5700def03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 17:11:42 +0100
+Subject: clk: Initialize orphan req_rate
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 5f7e2af00807f2117650e711a58b7f0e986ce1df ]
+
+When registering a clock that doesn't have a recalc_rate implementation,
+and doesn't have its parent registered yet, we initialize the clk_core
+rate and 'req_rate' fields to 0.
+
+The rate field is later updated when the parent is registered in
+clk_core_reparent_orphans_nolock() using __clk_recalc_rates(), but the
+'req_rate' field is never updated.
+
+This leads to an issue in clk_set_rate_range() and clk_put(), since
+those functions will call clk_set_rate() with the content of 'req_rate'
+to provide drivers with the opportunity to change the rate based on the
+new boundaries. In this case, we would call clk_set_rate() with a rate
+of 0, effectively enforcing the minimum allowed for this clock whenever
+we would call one of those two functions, even though the actual rate
+might be within range.
+
+Let's fix this by setting 'req_rate' in
+clk_core_reparent_orphans_nolock() with the rate field content just
+updated by the call to __clk_recalc_rates().
+
+Fixes: 1c8e600440c7 ("clk: Add rate constraints to clocks")
+Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> # T30 Nexus7
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220325161144.1901695-2-maxime@cerno.tech
+[sboyd@kernel.org: Reword comment]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index e4e1b4e94a67..ccb26a513b29 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3278,6 +3278,19 @@ static void clk_core_reparent_orphans_nolock(void)
+ 			__clk_set_parent_after(orphan, parent, NULL);
+ 			__clk_recalc_accuracies(orphan);
+ 			__clk_recalc_rates(orphan, 0);
++
++			/*
++			 * __clk_init_parent() will set the initial req_rate to
++			 * 0 if the clock doesn't have clk_ops::recalc_rate and
++			 * is an orphan when it's registered.
++			 *
++			 * 'req_rate' is used by clk_set_rate_range() and
++			 * clk_put() to trigger a clk_set_rate() call whenever
++			 * the boundaries are modified. Let's make sure
++			 * 'req_rate' is set to something non-zero so that
++			 * clk_set_rate_range() doesn't drop the frequency.
++			 */
++			orphan->req_rate = orphan->rate;
+ 		}
+ 	}
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch b/queue-5.4/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
new file mode 100644
index 00000000000..58cb2cda7e6
--- /dev/null
+++ b/queue-5.4/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
@@ -0,0 +1,40 @@
+From af6abb671d04156980d80b890707a93bb5994cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 01:09:18 +0100
+Subject: clk: loongson1: Terminate clk_div_table with sentinel element
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 3eb00f89162e80083dfcaa842468b510462cfeaa ]
+
+In order that the end of a clk_div_table can be detected, it must be
+terminated with a sentinel element (.div = 0).
+
+Fixes: b4626a7f4892 ("CLK: Add Loongson1C clock support")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Link: https://lore.kernel.org/r/20220218000922.134857-3-j.neuschaefer@gmx.net
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/loongson1/clk-loongson1c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c
+index 703f87622cf5..1ebf740380ef 100644
+--- a/drivers/clk/loongson1/clk-loongson1c.c
++++ b/drivers/clk/loongson1/clk-loongson1c.c
+@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = {
+ 	[1] = { .val = 1, .div = 4 },
+ 	[2] = { .val = 2, .div = 3 },
+ 	[3] = { .val = 3, .div = 3 },
++	[4] = { /* sentinel */ }
+ };
+ 
+ void __init ls1x_clk_init(void)
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch b/queue-5.4/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
new file mode 100644
index 00000000000..71e256acf50
--- /dev/null
+++ b/queue-5.4/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
@@ -0,0 +1,60 @@
+From 6d3c109a76ea5454501eafadc704787a94e49f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Feb 2022 23:25:35 +0530
+Subject: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit 58922910add18583d5273c2edcdb9fd7bf4eca02 ]
+
+The display pixel clock has a requirement on certain newer platforms to
+support M/N as (2/3) and the final D value calculated results in
+underflow errors.
+As the current implementation does not check for D value is within
+the accepted range for a given M & N value. Update the logic to
+calculate the final D value based on the range.
+
+Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220227175536.3131-1-tdas@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index a88101480e33..d86c9ad3f6e8 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -263,7 +263,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw,
+ 
+ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f)
+ {
+-	u32 cfg, mask;
++	u32 cfg, mask, d_val, not2d_val, n_minus_m;
+ 	struct clk_hw *hw = &rcg->clkr.hw;
+ 	int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src);
+ 
+@@ -282,8 +282,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f)
+ 		if (ret)
+ 			return ret;
+ 
++		/* Calculate 2d value */
++		d_val = f->n;
++
++		n_minus_m = f->n - f->m;
++		n_minus_m *= 2;
++
++		d_val = clamp_t(u32, d_val, f->m, n_minus_m);
++		not2d_val = ~d_val & mask;
++
+ 		ret = regmap_update_bits(rcg->clkr.regmap,
+-				RCG_D_OFFSET(rcg), mask, ~f->n);
++				RCG_D_OFFSET(rcg), mask, not2d_val);
+ 		if (ret)
+ 			return ret;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch b/queue-5.4/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
new file mode 100644
index 00000000000..568922a1cbb
--- /dev/null
+++ b/queue-5.4/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
@@ -0,0 +1,37 @@
+From 90b16ebaeadc78566748bb479a935402fe1a6028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Feb 2022 23:25:36 +0530
+Subject: clk: qcom: clk-rcg2: Update the frac table for pixel clock
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit b527358cb4cd58a8279c9062b0786f1fab628fdc ]
+
+Support the new numerator and denominator for pixel clock on SM8350 and
+support rgb101010, RGB888 use cases on SM8450.
+
+Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220227175536.3131-2-tdas@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index d86c9ad3f6e8..89c1adeb84d4 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -647,6 +647,7 @@ static const struct frac_entry frac_table_pixel[] = {
+ 	{ 2, 9 },
+ 	{ 4, 9 },
+ 	{ 1, 1 },
++	{ 2, 3 },
+ 	{ }
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-qcom-gcc-msm8994-fix-gpll4-width.patch b/queue-5.4/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
new file mode 100644
index 00000000000..97094b51ee2
--- /dev/null
+++ b/queue-5.4/clk-qcom-gcc-msm8994-fix-gpll4-width.patch
@@ -0,0 +1,43 @@
+From 3ba5590c6af2fc5afe70c0a7979a96de76742642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Mar 2022 18:49:40 +0100
+Subject: clk: qcom: gcc-msm8994: Fix gpll4 width
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+[ Upstream commit 71021db1c532c2545ae53b9ee85b37b7154f51d4 ]
+
+The gpll4 postdiv is actually a div4, so make sure that Linux is aware of
+this.
+
+This fixes the following error messages:
+
+ mmc1: Card appears overclocked; req 200000000 Hz, actual 343999999 Hz
+ mmc1: Card appears overclocked; req 400000000 Hz, actual 687999999 Hz
+
+Fixes: aec89f78cf01 ("clk: qcom: Add support for msm8994 global clock controller")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20220319174940.341137-1-konrad.dybcio@somainline.org
+Tested-by: Petr Vorel <petr.vorel@gmail.com>
+Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8994.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c
+index b7fc8c7ba195..14f0d5d84080 100644
+--- a/drivers/clk/qcom/gcc-msm8994.c
++++ b/drivers/clk/qcom/gcc-msm8994.c
+@@ -107,6 +107,7 @@ static struct clk_alpha_pll gpll4_early = {
+ 
+ static struct clk_alpha_pll_postdiv gpll4 = {
+ 	.offset = 0x1dc0,
++	.width = 4,
+ 	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+ 	.clkr.hw.init = &(struct clk_init_data)
+ 	{
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch b/queue-5.4/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
new file mode 100644
index 00000000000..726e6d5a10a
--- /dev/null
+++ b/queue-5.4/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
@@ -0,0 +1,49 @@
+From 131df75c8940920b532d281dabc014cbada058fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 18:31:00 +0100
+Subject: clk: qcom: ipq8074: Use floor ops for SDCC1 clock
+
+From: Dirk Buchwalder <buchwalder@posteo.de>
+
+[ Upstream commit b77d8306d84f83d1da68028a68c91da9c867b6f6 ]
+
+Use floor ops on SDCC1 APPS clock in order to round down selected clock
+frequency and avoid overclocking SD/eMMC cards.
+
+For example, currently HS200 cards were failling tuning as they were
+actually being clocked at 384MHz instead of 192MHz.
+This caused some boards to disable 1.8V I/O and force the eMMC into the
+standard HS mode (50MHz) and that appeared to work despite the eMMC being
+overclocked to 96Mhz in that case.
+
+There was a previous commit to use floor ops on SDCC clocks, but it looks
+to have only covered SDCC2 clock.
+
+Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks")
+
+Signed-off-by: Dirk Buchwalder <buchwalder@posteo.de>
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220210173100.505128-1-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index e01f5f591d1e..de48ba7eba3a 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ 		.name = "sdcc1_apps_clk_src",
+ 		.parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ 		.num_parents = 4,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch b/queue-5.4/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
new file mode 100644
index 00000000000..ad7d677108b
--- /dev/null
+++ b/queue-5.4/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
@@ -0,0 +1,39 @@
+From 82d056c7f42c0af23d6eae5f67efa306b11cd7ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 10:45:01 +0000
+Subject: clk: tegra: tegra124-emc: Fix missing put_device() call in
+ emc_ensure_emc_driver
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6d6ef58c2470da85a99119f74d34216c8074b9f0 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling path.
+
+Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20220112104501.30655-1-linmq006@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-emc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c
+index ea39caf3d762..0c1b83bedb73 100644
+--- a/drivers/clk/tegra/clk-emc.c
++++ b/drivers/clk/tegra/clk-emc.c
+@@ -191,6 +191,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra)
+ 
+ 	tegra->emc = platform_get_drvdata(pdev);
+ 	if (!tegra->emc) {
++		put_device(&pdev->dev);
+ 		pr_err("%s: cannot find EMC driver\n", __func__);
+ 		return NULL;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch b/queue-5.4/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
new file mode 100644
index 00000000000..bb46cee23cf
--- /dev/null
+++ b/queue-5.4/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
@@ -0,0 +1,50 @@
+From ed4c403564c68e718becadb3508646f9a89e68f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 08:39:39 -0700
+Subject: clocksource: acpi_pm: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6a861abceecb68497dd82a324fee45a5332dcece ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) environment strings.
+
+The __setup() handler interface isn't meant to handle negative return
+values -- they are non-zero, so they mean "handled" (like a return
+value of 1 does), but that's just a quirk. So return 1 from
+parse_pmtmr(). Also print a warning message if kstrtouint() returns
+an error.
+
+Fixes: 6b148507d3d0 ("pmtmr: allow command line override of ioport")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/acpi_pm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
+index eb596ff9e7bb..279ddff81ab4 100644
+--- a/drivers/clocksource/acpi_pm.c
++++ b/drivers/clocksource/acpi_pm.c
+@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg)
+ 	int ret;
+ 
+ 	ret = kstrtouint(arg, 16, &base);
+-	if (ret)
+-		return ret;
++	if (ret) {
++		pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg);
++		return 1;
++	}
+ 
+ 	pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport,
+ 		base);
+-- 
+2.34.1
+
diff --git a/queue-5.4/clocksource-drivers-timer-of-check-return-value-of-o.patch b/queue-5.4/clocksource-drivers-timer-of-check-return-value-of-o.patch
new file mode 100644
index 00000000000..87960566b7f
--- /dev/null
+++ b/queue-5.4/clocksource-drivers-timer-of-check-return-value-of-o.patch
@@ -0,0 +1,45 @@
+From f3030e255cc8f740ef2b66338c9c4eeac7e49b3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 18:26:56 +0100
+Subject: clocksource/drivers/timer-of: Check return value of of_iomap in
+ timer_of_base_init()
+
+From: Guillaume Ranquet <granquet@baylibre.com>
+
+[ Upstream commit 4467b8bad2401794fb89a0268c8c8257180bf60f ]
+
+of_base->base can either be iomapped using of_io_request_and_map() or
+of_iomap() depending whether or not an of_base->name has been set.
+
+Thus check of_base->base against NULL as of_iomap() does not return a
+PTR_ERR() in case of error.
+
+Fixes: 9aea417afa6b ("clocksource/drivers/timer-of: Don't request the resource by name")
+Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>
+Link: https://lore.kernel.org/r/20220307172656.4836-1-granquet@baylibre.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-of.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
+index a3c73e972fce..bf2a6f64ba0c 100644
+--- a/drivers/clocksource/timer-of.c
++++ b/drivers/clocksource/timer-of.c
+@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np,
+ 	of_base->base = of_base->name ?
+ 		of_io_request_and_map(np, of_base->index, of_base->name) :
+ 		of_iomap(np, of_base->index);
+-	if (IS_ERR(of_base->base)) {
+-		pr_err("Failed to iomap (%s)\n", of_base->name);
+-		return PTR_ERR(of_base->base);
++	if (IS_ERR_OR_NULL(of_base->base)) {
++		pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name);
++		return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM;
+ 	}
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch b/queue-5.4/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
new file mode 100644
index 00000000000..0da7e0bb48c
--- /dev/null
+++ b/queue-5.4/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
@@ -0,0 +1,42 @@
+From 47037326635555941a544ea22259aa9102a30054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jan 2022 17:58:40 +1100
+Subject: crypto: authenc - Fix sleep in atomic context in decrypt_tail
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 66eae850333d639fc278d6f915c6fc01499ea893 ]
+
+The function crypto_authenc_decrypt_tail discards its flags
+argument and always relies on the flags from the original request
+when starting its sub-request.
+
+This is clearly wrong as it may cause the SLEEPABLE flag to be
+set when it shouldn't.
+
+Fixes: 92d95ba91772 ("crypto: authenc - Convert to new AEAD interface")
+Reported-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/authenc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 3f0ed9402582..321da9038995 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -263,7 +263,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req,
+ 		dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
+ 
+ 	skcipher_request_set_tfm(skreq, ctx->enc);
+-	skcipher_request_set_callback(skreq, aead_request_flags(req),
++	skcipher_request_set_callback(skreq, flags,
+ 				      req->base.complete, req->base.data);
+ 	skcipher_request_set_crypt(skreq, src, dst,
+ 				   req->cryptlen - authsize, req->iv);
+-- 
+2.34.1
+
diff --git a/queue-5.4/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch b/queue-5.4/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
new file mode 100644
index 00000000000..a2452e2443f
--- /dev/null
+++ b/queue-5.4/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
@@ -0,0 +1,69 @@
+From 82f4d76ccdb38384c04a1ec856622fa82d86a784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 05:15:45 +0200
+Subject: crypto: ccp - ccp_dmaengine_unregister release dma channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dāvis Mosāns <davispuh@gmail.com>
+
+[ Upstream commit 54cce8ecb9254f971b40a72911c6da403720a2d2 ]
+
+ccp_dmaengine_register adds dma_chan->device_node to dma_dev->channels list
+but ccp_dmaengine_unregister didn't remove them.
+That can cause crashes in various dmaengine methods that tries to use dma_dev->channels
+
+Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA...")
+Signed-off-by: Dāvis Mosāns <davispuh@gmail.com>
+Acked-by: John Allen <john.allen@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-dmaengine.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 0770a83bf1a5..b3eea329f840 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -633,6 +633,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ 	return 0;
+ }
+ 
++static void ccp_dma_release(struct ccp_device *ccp)
++{
++	struct ccp_dma_chan *chan;
++	struct dma_chan *dma_chan;
++	unsigned int i;
++
++	for (i = 0; i < ccp->cmd_q_count; i++) {
++		chan = ccp->ccp_dma_chan + i;
++		dma_chan = &chan->dma_chan;
++		tasklet_kill(&chan->cleanup_tasklet);
++		list_del_rcu(&dma_chan->device_node);
++	}
++}
++
+ int ccp_dmaengine_register(struct ccp_device *ccp)
+ {
+ 	struct ccp_dma_chan *chan;
+@@ -737,6 +751,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ 	return 0;
+ 
+ err_reg:
++	ccp_dma_release(ccp);
+ 	kmem_cache_destroy(ccp->dma_desc_cache);
+ 
+ err_cache:
+@@ -753,6 +768,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)
+ 		return;
+ 
+ 	dma_async_device_unregister(dma_dev);
++	ccp_dma_release(ccp);
+ 
+ 	kmem_cache_destroy(ccp->dma_desc_cache);
+ 	kmem_cache_destroy(ccp->dma_cmd_cache);
+-- 
+2.34.1
+
diff --git a/queue-5.4/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch b/queue-5.4/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
new file mode 100644
index 00000000000..7cebb13304d
--- /dev/null
+++ b/queue-5.4/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
@@ -0,0 +1,45 @@
+From 7c5c1aad96512c00455e518d62d3d139711a983b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 21:27:26 +0200
+Subject: crypto: ccree - don't attempt 0 len DMA mappings
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+[ Upstream commit 1fb37b5692c915edcc2448a6b37255738c7c77e0 ]
+
+Refuse to try mapping zero bytes as this may cause a fault
+on some configurations / platforms and it seems the prev.
+attempt is not enough and we need to be more explicit.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Reported-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Fixes: ce0fc6db38de ("crypto: ccree - protect against empty or NULL
+scatterlists")
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_buffer_mgr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
+index 954f14bddf1d..dce30ae2b704 100644
+--- a/drivers/crypto/ccree/cc_buffer_mgr.c
++++ b/drivers/crypto/ccree/cc_buffer_mgr.c
+@@ -295,6 +295,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg,
+ {
+ 	int ret = 0;
+ 
++	if (!nbytes) {
++		*mapped_nents = 0;
++		*lbytes = 0;
++		*nents = 0;
++		return 0;
++	}
++
+ 	*nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes);
+ 	if (*nents > max_sg_nents) {
+ 		*nents = 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/crypto-mxs-dcp-fix-scatterlist-processing.patch b/queue-5.4/crypto-mxs-dcp-fix-scatterlist-processing.patch
new file mode 100644
index 00000000000..6d4009ca591
--- /dev/null
+++ b/queue-5.4/crypto-mxs-dcp-fix-scatterlist-processing.patch
@@ -0,0 +1,35 @@
+From 304354b692c3f8e758710db89ac981dfe74540c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 18:07:53 +0100
+Subject: crypto: mxs-dcp - Fix scatterlist processing
+
+From: Tomas Paukrt <tomaspaukrt@email.cz>
+
+[ Upstream commit 28e9b6d8199a3f124682b143800c2dacdc3d70dd ]
+
+This patch fixes a bug in scatterlist processing that may cause incorrect AES block encryption/decryption.
+
+Fixes: 2e6d793e1bf0 ("crypto: mxs-dcp - Use sg_mapping_iter to copy data")
+Signed-off-by: Tomas Paukrt <tomaspaukrt@email.cz>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index 547111079207..9443f31acd27 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -329,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ 		memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
+ 	}
+ 
+-	for_each_sg(req->src, src, sg_nents(src), i) {
++	for_each_sg(req->src, src, sg_nents(req->src), i) {
+ 		src_buf = sg_virt(src);
+ 		len = sg_dma_len(src);
+ 		tlen += len;
+-- 
+2.34.1
+
diff --git a/queue-5.4/crypto-vmx-add-missing-dependencies.patch b/queue-5.4/crypto-vmx-add-missing-dependencies.patch
new file mode 100644
index 00000000000..df5d54a14fd
--- /dev/null
+++ b/queue-5.4/crypto-vmx-add-missing-dependencies.patch
@@ -0,0 +1,62 @@
+From ea4ee848543ecd6922b979b70a89ddfe4cbea597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 16:11:15 +0100
+Subject: crypto: vmx - add missing dependencies
+
+From: Petr Vorel <pvorel@suse.cz>
+
+[ Upstream commit 647d41d3952d726d4ae49e853a9eff68ebad3b3f ]
+
+vmx-crypto module depends on CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or
+CRYPTO_XTS, thus add them.
+
+These dependencies are likely to be enabled, but if
+CRYPTO_DEV_VMX=y && !CRYPTO_MANAGER_DISABLE_TESTS
+and either of CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or CRYPTO_XTS is built
+as module or disabled, alg_test() from crypto/testmgr.c complains during
+boot about failing to allocate the generic fallback implementations
+(2 == ENOENT):
+
+[    0.540953] Failed to allocate xts(aes) fallback: -2
+[    0.541014] alg: skcipher: failed to allocate transform for p8_aes_xts: -2
+[    0.541120] alg: self-tests for p8_aes_xts (xts(aes)) failed (rc=-2)
+[    0.544440] Failed to allocate ctr(aes) fallback: -2
+[    0.544497] alg: skcipher: failed to allocate transform for p8_aes_ctr: -2
+[    0.544603] alg: self-tests for p8_aes_ctr (ctr(aes)) failed (rc=-2)
+[    0.547992] Failed to allocate cbc(aes) fallback: -2
+[    0.548052] alg: skcipher: failed to allocate transform for p8_aes_cbc: -2
+[    0.548156] alg: self-tests for p8_aes_cbc (cbc(aes)) failed (rc=-2)
+[    0.550745] Failed to allocate transformation for 'aes': -2
+[    0.550801] alg: cipher: Failed to load transform for p8_aes: -2
+[    0.550892] alg: self-tests for p8_aes (aes) failed (rc=-2)
+
+Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS")
+Fixes: d2e3ae6f3aba ("crypto: vmx - Enabling VMX module for PPC64")
+
+Suggested-by: Nicolai Stange <nstange@suse.de>
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/vmx/Kconfig | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig
+index c85fab7ef0bd..b2c28b87f14b 100644
+--- a/drivers/crypto/vmx/Kconfig
++++ b/drivers/crypto/vmx/Kconfig
+@@ -2,7 +2,11 @@
+ config CRYPTO_DEV_VMX_ENCRYPT
+ 	tristate "Encryption acceleration support on P8 CPU"
+ 	depends on CRYPTO_DEV_VMX
++	select CRYPTO_AES
++	select CRYPTO_CBC
++	select CRYPTO_CTR
+ 	select CRYPTO_GHASH
++	select CRYPTO_XTS
+ 	default m
+ 	help
+ 	  Support for VMX cryptographic acceleration instructions on Power8 CPU.
+-- 
+2.34.1
+
diff --git a/queue-5.4/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch b/queue-5.4/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
new file mode 100644
index 00000000000..54803fdc558
--- /dev/null
+++ b/queue-5.4/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
@@ -0,0 +1,51 @@
+From 43cd7ec0e7af9e8bc947310ac90aac64992da1dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 23:11:11 -0800
+Subject: dax: make sure inodes are flushed before destroy cache
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit a7e8de822e0b1979f08767c751f6c8a9c1d4ad86 ]
+
+A bug can be triggered by following command
+
+$ modprobe nd_pmem && modprobe -r nd_pmem
+
+[   10.060014] BUG dax_cache (Not tainted): Objects remaining in dax_cache on __kmem_cache_shutdown()
+[   10.060938] Slab 0x0000000085b729ac objects=9 used=1 fp=0x000000004f5ae469 flags=0x200000000010200(slab|head|node)
+[   10.062433] Call Trace:
+[   10.062673]  dump_stack_lvl+0x34/0x44
+[   10.062865]  slab_err+0x90/0xd0
+[   10.063619]  __kmem_cache_shutdown+0x13b/0x2f0
+[   10.063848]  kmem_cache_destroy+0x4a/0x110
+[   10.064058]  __x64_sys_delete_module+0x265/0x300
+
+This is caused by dax_fs_exit() not flushing inodes before destroy cache.
+To fix this issue, call rcu_barrier() before destroy cache.
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220212071111.148575-1-ztong0001@gmail.com
+Fixes: 7b6be8444e0f ("dax: refactor dax-fs into a generic provider of 'struct dax_device' instances")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dax/super.c b/drivers/dax/super.c
+index 8074e5de815b..5005b92b197d 100644
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -691,6 +691,7 @@ static int dax_fs_init(void)
+ static void dax_fs_exit(void)
+ {
+ 	kern_unmount(dax_mnt);
++	rcu_barrier();
+ 	kmem_cache_destroy(dax_cache);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch b/queue-5.4/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
new file mode 100644
index 00000000000..9f96415a863
--- /dev/null
+++ b/queue-5.4/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
@@ -0,0 +1,40 @@
+From f5b717084845f22e48014ba1d63ab8e15c2f8379 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 12:15:38 +0000
+Subject: dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
+
+From: Aashish Sharma <shraash@google.com>
+
+[ Upstream commit 6fc51504388c1a1a53db8faafe9fff78fccc7c87 ]
+
+Explicitly convert unsigned int in the right of the conditional
+expression to int to match the left side operand and the return type,
+fixing the following compiler warning:
+
+drivers/md/dm-crypt.c:2593:43: warning: signed and unsigned
+type in conditional expression [-Wsign-compare]
+
+Fixes: c538f6ec9f56 ("dm crypt: add ability to use keys from the kernel key retention service")
+Signed-off-by: Aashish Sharma <shraash@google.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-crypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 571c04e70343..3ed8ca47bc6e 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2010,7 +2010,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
+ 
+ static int get_key_size(char **key_string)
+ {
+-	return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1;
++	return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1);
+ }
+ 
+ #endif
+-- 
+2.34.1
+
diff --git a/queue-5.4/dma-debug-fix-return-value-of-__setup-handlers.patch b/queue-5.4/dma-debug-fix-return-value-of-__setup-handlers.patch
new file mode 100644
index 00000000000..c5fdce23a00
--- /dev/null
+++ b/queue-5.4/dma-debug-fix-return-value-of-__setup-handlers.patch
@@ -0,0 +1,72 @@
+From 7b6178d9c06e04cae1e6ed6829246dc7f090e8be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:04:53 -0800
+Subject: dma-debug: fix return value of __setup handlers
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 80e4390981618e290616dbd06ea190d4576f219d ]
+
+When valid kernel command line parameters
+  dma_debug=off dma_debug_entries=100
+are used, they are reported as Unknown parameters and added to init's
+environment strings, polluting it.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5
+    dma_debug=off dma_debug_entries=100", will be passed to user space.
+
+and
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     dma_debug=off
+     dma_debug_entries=100
+
+Return 1 from these __setup handlers to indicate that the command line
+option has been handled.
+
+Fixes: 59d3daafa1726 ("dma-debug: add kernel command line parameters")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: iommu@lists.linux-foundation.org
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index b28665f4d8c7..4dc3bbfd3e3f 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -980,7 +980,7 @@ static __init int dma_debug_cmdline(char *str)
+ 		global_disable = true;
+ 	}
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ static __init int dma_debug_entries_cmdline(char *str)
+@@ -989,7 +989,7 @@ static __init int dma_debug_entries_cmdline(char *str)
+ 		return -EINVAL;
+ 	if (!get_option(&str, &nr_prealloc_entries))
+ 		nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("dma_debug=", dma_debug_cmdline);
+-- 
+2.34.1
+
diff --git a/queue-5.4/driver-core-dd-fix-return-value-of-__setup-handler.patch b/queue-5.4/driver-core-dd-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..ba9407843ff
--- /dev/null
+++ b/queue-5.4/driver-core-dd-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,59 @@
+From 9c9998eecfe19dbdf16b0b3fcf472e2a5ae20de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 20:18:29 -0800
+Subject: driver core: dd: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f2aad54703dbe630f9d8b235eb58e8c8cc78f37d ]
+
+When "driver_async_probe=nulltty" is used on the kernel boot command line,
+it causes an Unknown parameter message and the string is added to init's
+environment strings, polluting them.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc6
+  driver_async_probe=nulltty", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc6
+     driver_async_probe=nulltty
+
+Change the return value of the __setup function to 1 to indicate
+that the __setup option has been handled.
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 1ea61b68d0f8 ("async: Add cmdline option to specify drivers to be async probed")
+Cc: Feng Tang <feng.tang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Feng Tang <feng.tang@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220301041829.15137-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index cf7e5b4afc1b..26cd4ce3ac75 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -747,7 +747,7 @@ static int __init save_async_options(char *buf)
+ 			"Too long list of driver names for 'driver_async_probe'!\n");
+ 
+ 	strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN);
+-	return 0;
++	return 1;
+ }
+ __setup("driver_async_probe=", save_async_options);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch b/queue-5.4/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
new file mode 100644
index 00000000000..ea845d28b4d
--- /dev/null
+++ b/queue-5.4/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
@@ -0,0 +1,58 @@
+From 9b734b06d370c1a63308f5b32bab467208e10313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 17:39:57 -0500
+Subject: drm/amd/display: Add affected crtcs to atomic state for dsc mst
+ unplug
+
+From: Roman Li <Roman.Li@amd.com>
+
+[ Upstream commit 128f8ed5902a287a6bb4afe0ffdae8a80b2a64ec ]
+
+[Why]
+When display topology changed on DSC hub we add all crtcs with dsc support to
+atomic state.
+Refer to patch:"drm/amd/display: Trigger modesets on MST DSC connectors"
+However the original implementation may skip crtc if the topology change
+caused by unplug.
+That potentially could lead to no-lightup or corruption on DSC hub after
+unplug event on one of the connectors.
+
+[How]
+Update add_affected_mst_dsc_crtcs() to use old connector state
+if new connector state has no crtc (undergoes modeset due to unplug)
+
+Fixes: 44be939ff7ac58 ("drm/amd/display: Trigger modesets on MST DSC connectors")
+
+Reviewed-by: Hersen Wu <hersenwu@amd.com>
+Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
+Signed-off-by: Roman Li <Roman.Li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 29f8b4bd5a76..c5231c50c412 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7268,10 +7268,13 @@ dm_determine_update_type_for_commit(struct amdgpu_display_manager *dm,
+ static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc)
+ {
+ 	struct drm_connector *connector;
+-	struct drm_connector_state *conn_state;
++	struct drm_connector_state *conn_state, *old_conn_state;
+ 	struct amdgpu_dm_connector *aconnector = NULL;
+ 	int i;
+-	for_each_new_connector_in_state(state, connector, conn_state, i) {
++	for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) {
++		if (!conn_state->crtc)
++			conn_state = old_conn_state;
++
+ 		if (conn_state->crtc != crtc)
+ 			continue;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch b/queue-5.4/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
new file mode 100644
index 00000000000..6f8ac849207
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
@@ -0,0 +1,49 @@
+From c693c5d55a2831c2d466339f98587948147c69f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 00:57:29 +0800
+Subject: drm/amd/display: Fix a NULL pointer dereference in
+ amdgpu_dm_connector_add_common_modes()
+
+From: Zhou Qingyang <zhou1615@umn.edu>
+
+[ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ]
+
+In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode()
+is assigned to mode and is passed to drm_mode_probed_add() directly after
+that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and
+there is a dereference of it in list_add_tail() without recoveries, which
+could lead to NULL pointer dereference on failure of
+amdgpu_dm_create_common_mode().
+
+Fix this by adding a NULL check of mode.
+
+This bug was found by a static analyzer.
+
+Builds with 'make allyesconfig' show no new warnings,
+and our static analyzer no longer warns about this code.
+
+Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm")
+Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8e4d863c7570..29f8b4bd5a76 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5013,6 +5013,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder,
+ 		mode = amdgpu_dm_create_common_mode(encoder,
+ 				common_modes[i].name, common_modes[i].w,
+ 				common_modes[i].h);
++		if (!mode)
++			continue;
++
+ 		drm_mode_probed_add(connector, mode);
+ 		amdgpu_dm_connector->num_modes++;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-amd-display-remove-vupdate_int_entry-definition.patch b/queue-5.4/drm-amd-display-remove-vupdate_int_entry-definition.patch
new file mode 100644
index 00000000000..8eadda34f38
--- /dev/null
+++ b/queue-5.4/drm-amd-display-remove-vupdate_int_entry-definition.patch
@@ -0,0 +1,162 @@
+From 2a7bef3ece25f693b9170fdbde179f6310a201ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 10:16:57 -0300
+Subject: drm/amd/display: Remove vupdate_int_entry definition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <maira.canal@usp.br>
+
+[ Upstream commit 3679b8518cd213c25d555553ef212e233faf698c ]
+
+Remove the vupdate_int_entry definition and utilization to avoid the
+following warning by Clang:
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:410:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(0),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:404:2:
+note: previous initialization is here
+    vupdate_int_entry(0),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:411:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(1),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:405:2:
+note: previous initialization is here
+    vupdate_int_entry(1),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:412:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(2),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:406:2:
+note: previous initialization is here
+    vupdate_int_entry(2),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:413:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(3),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:407:2:
+note: previous initialization is here
+    vupdate_int_entry(3),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:414:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(4),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:408:2:
+note: previous initialization is here
+    vupdate_int_entry(4),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:415:2:
+warning: initializer overrides prior initialization of this subobject
+[-Winitializer-overrides]
+    vupdate_no_lock_int_entry(5),
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39:
+note: expanded from macro 'vupdate_no_lock_int_entry'
+    [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+    ^~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:409:2:
+note: previous initialization is here
+    vupdate_int_entry(5),
+    ^~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39:
+note: expanded from macro 'vupdate_int_entry'
+        [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+        ^~
+6 warnings generated.
+
+Fixes: 688f97ed3f5e ("drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1")
+Signed-off-by: Maíra Canal <maira.canal@usp.br>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/irq/dcn21/irq_service_dcn21.c   | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
+index 623455cd7520..d6f988403941 100644
+--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
+@@ -227,14 +227,6 @@ static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = {
+ 		.funcs = &pflip_irq_info_funcs\
+ 	}
+ 
+-#define vupdate_int_entry(reg_num)\
+-	[DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
+-		IRQ_REG_ENTRY(OTG, reg_num,\
+-			OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\
+-			OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\
+-		.funcs = &vblank_irq_info_funcs\
+-	}
+-
+ /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic
+  * of DCE's DC_IRQ_SOURCE_VUPDATEx.
+  */
+@@ -348,12 +340,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = {
+ 	dc_underflow_int_entry(6),
+ 	[DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(),
+ 	[DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(),
+-	vupdate_int_entry(0),
+-	vupdate_int_entry(1),
+-	vupdate_int_entry(2),
+-	vupdate_int_entry(3),
+-	vupdate_int_entry(4),
+-	vupdate_int_entry(5),
+ 	vupdate_no_lock_int_entry(0),
+ 	vupdate_no_lock_int_entry(1),
+ 	vupdate_no_lock_int_entry(2),
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch b/queue-5.4/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
new file mode 100644
index 00000000000..1da5757f1b4
--- /dev/null
+++ b/queue-5.4/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
@@ -0,0 +1,38 @@
+From 37026243e8d1b007f8b6b9f26f7242edf732e2b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jan 2022 10:41:09 +0000
+Subject: drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 96211b7c56b109a52768e6cc5e23a1f79316eca0 ]
+
+If the probe fails, we should use pm_runtime_disable() to balance
+pm_runtime_enable().
+Add missing pm_runtime_disable() for __dw_mipi_dsi_probe.
+
+Fixes: 46fc51546d44 ("drm/bridge/synopsys: Add MIPI DSI host controller bridge")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220105104113.31415-1-linmq006@gmail.com
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+index 77384c49fb8d..2fc27931d3b5 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+@@ -1057,6 +1057,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev,
+ 	ret = mipi_dsi_host_register(&dsi->dsi_host);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to register MIPI host: %d\n", ret);
++		pm_runtime_disable(dev);
+ 		dw_mipi_dsi_debugfs_remove(dsi);
+ 		return ERR_PTR(ret);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch b/queue-5.4/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
new file mode 100644
index 00000000000..59ee81fe756
--- /dev/null
+++ b/queue-5.4/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
@@ -0,0 +1,38 @@
+From 19f3b9901ba7100e451c19f19db7ca81e7af10db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 12:40:59 -0500
+Subject: drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit ffb5c099aaa13ab7f73c29ea6ae26bce8d7575ae ]
+
+Add MODULE_DEVICE_TABLE to the device tree table to create required
+aliases needed for module to be loaded with device tree based platform.
+
+Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210921174059.17946-1-nm@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cdns-dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c
+index 0cb9dd6986ec..9c3f9110895e 100644
+--- a/drivers/gpu/drm/bridge/cdns-dsi.c
++++ b/drivers/gpu/drm/bridge/cdns-dsi.c
+@@ -1284,6 +1284,7 @@ static const struct of_device_id cdns_dsi_of_match[] = {
+ 	{ .compatible = "cdns,dsi" },
+ 	{ },
+ };
++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match);
+ 
+ static struct platform_driver cdns_dsi_platform_driver = {
+ 	.probe  = cdns_dsi_drm_probe,
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch b/queue-5.4/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
new file mode 100644
index 00000000000..61f01b8168b
--- /dev/null
+++ b/queue-5.4/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
@@ -0,0 +1,39 @@
+From c416d7052d39433d6b4dce24635a3935481859ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Dec 2021 09:25:22 +0000
+Subject: drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 7c442e76c06cb1bef16a6c523487438175584eea ]
+
+rc_dev is allocated by rc_allocate_device(), and doesn't assigned to
+ctx->rc_dev before calling  rc_free_device(ctx->rc_dev).
+So it should call rc_free_device(rc_dev);
+
+Fixes: e25f1f7c94e1 ("drm/bridge/sii8620: add remote control support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211227092522.21755-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/sil-sii8620.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index 04431dbac4a4..fb0b64c965b7 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -2118,7 +2118,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx)
+ 	if (ret) {
+ 		dev_err(ctx->dev, "Failed to register RC device\n");
+ 		ctx->error = ret;
+-		rc_free_device(ctx->rc_dev);
++		rc_free_device(rc_dev);
+ 		return;
+ 	}
+ 	ctx->rc_dev = rc_dev;
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-edid-don-t-clear-formats-if-using-deep-color.patch b/queue-5.4/drm-edid-don-t-clear-formats-if-using-deep-color.patch
new file mode 100644
index 00000000000..70eb711f05f
--- /dev/null
+++ b/queue-5.4/drm-edid-don-t-clear-formats-if-using-deep-color.patch
@@ -0,0 +1,76 @@
+From b4541dd154450fb0c5ecb6d5c9bef29569fd1427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 16:16:11 +0100
+Subject: drm/edid: Don't clear formats if using deep color
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 75478b3b393bcbdca4e6da76fe3a9f1a4133ec5d ]
+
+The current code, when parsing the EDID Deep Color depths, that the
+YUV422 cannot be used, referring to the HDMI 1.3 Specification.
+
+This specification, in its section 6.2.4, indeed states:
+
+  For each supported Deep Color mode, RGB 4:4:4 shall be supported and
+  optionally YCBCR 4:4:4 may be supported.
+
+  YCBCR 4:2:2 is not permitted for any Deep Color mode.
+
+This indeed can be interpreted like the code does, but the HDMI 1.4
+specification further clarifies that statement in its section 6.2.4:
+
+  For each supported Deep Color mode, RGB 4:4:4 shall be supported and
+  optionally YCBCR 4:4:4 may be supported.
+
+  YCBCR 4:2:2 is also 36-bit mode but does not require the further use
+  of the Deep Color modes described in section 6.5.2 and 6.5.3.
+
+This means that, even though YUV422 can be used with 12 bit per color,
+it shouldn't be treated as a deep color mode.
+
+This is also broken with YUV444 if it's supported by the display, but
+DRM_EDID_HDMI_DC_Y444 isn't set. In such a case, the code will clear
+color_formats of the YUV444 support set previously in
+drm_parse_cea_ext(), but will not set it back.
+
+Since the formats supported are already setup properly in
+drm_parse_cea_ext(), let's just remove the code modifying the formats in
+drm_parse_hdmi_deep_color_info()
+
+Fixes: d0c94692e0a3 ("drm/edid: Parse and handle HDMI deep color modes.")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220120151625.594595-3-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 3f0a79890600..7d632b98fc02 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -4533,16 +4533,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector,
+ 		  connector->name, dc_bpc);
+ 	info->bpc = dc_bpc;
+ 
+-	/*
+-	 * Deep color support mandates RGB444 support for all video
+-	 * modes and forbids YCRCB422 support for all video modes per
+-	 * HDMI 1.3 spec.
+-	 */
+-	info->color_formats = DRM_COLOR_FORMAT_RGB444;
+-
+ 	/* YCRCB444 is optional according to spec. */
+ 	if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) {
+-		info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
+ 		DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n",
+ 			  connector->name);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch b/queue-5.4/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
new file mode 100644
index 00000000000..d2ac237918d
--- /dev/null
+++ b/queue-5.4/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
@@ -0,0 +1,39 @@
+From 85c52a4bb163a2b8fa847c3ea7cbf4909bd13af7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 06:53:16 +0000
+Subject: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 221e3638feb8bc42143833c9a704fa89b6c366bb ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore. Add put_device() call to fix this.
+
+Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index a5d47e301c5f..13413d2b2602 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1455,8 +1455,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
+ 		dsi->slave = platform_get_drvdata(gangster);
+ 		of_node_put(np);
+ 
+-		if (!dsi->slave)
++		if (!dsi->slave) {
++			put_device(&gangster->dev);
+ 			return -EPROBE_DEFER;
++		}
+ 
+ 		dsi->slave->master = dsi;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/ext2-correct-max-file-size-computing.patch b/queue-5.4/ext2-correct-max-file-size-computing.patch
new file mode 100644
index 00000000000..4ff4316906d
--- /dev/null
+++ b/queue-5.4/ext2-correct-max-file-size-computing.patch
@@ -0,0 +1,58 @@
+From 32808d8d07136ca87a4d777e1f6d73c8abfa3b00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 13:05:32 +0800
+Subject: ext2: correct max file size computing
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 50b3a818991074177a56c87124c7a7bdf5fa4f67 ]
+
+We need to calculate the max file size accurately if the total blocks
+that can address by block tree exceed the upper_limit. But this check is
+not correct now, it only compute the total data blocks but missing
+metadata blocks are needed. So in the case of "data blocks < upper_limit
+&& total blocks > upper_limit", we will get wrong result. Fortunately,
+this case could not happen in reality, but it's confused and better to
+correct the computing.
+
+  bits   data blocks   metadatablocks   upper_limit
+  10        16843020            66051    2147483647
+  11       134480396           263171    1073741823
+  12      1074791436          1050627     536870911 (*)
+  13      8594130956          4198403     268435455 (*)
+  14     68736258060         16785411     134217727 (*)
+  15    549822930956         67125251      67108863 (*)
+  16   4398314962956        268468227      33554431 (*)
+
+  [*] Need to calculate in depth.
+
+Fixes: 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()")
+Link: https://lore.kernel.org/r/20220212050532.179055-1-yi.zhang@huawei.com
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 065cd2d1bdc6..db403c01d4d5 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -770,8 +770,12 @@ static loff_t ext2_max_size(int bits)
+ 	res += 1LL << (bits-2);
+ 	res += 1LL << (2*(bits-2));
+ 	res += 1LL << (3*(bits-2));
++	/* Compute how many metadata blocks are needed */
++	meta_blocks = 1;
++	meta_blocks += 1 + ppb;
++	meta_blocks += 1 + ppb + ppb * ppb;
+ 	/* Does block tree limit file size? */
+-	if (res < upper_limit)
++	if (res + meta_blocks <= upper_limit)
+ 		goto check_lfs;
+ 
+ 	res = upper_limit;
+-- 
+2.34.1
+
diff --git a/queue-5.4/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch b/queue-5.4/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
new file mode 100644
index 00000000000..dadf95aa94c
--- /dev/null
+++ b/queue-5.4/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
@@ -0,0 +1,84 @@
+From 9cf93e46e1c953754e98359864732428e7c31a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 09:38:47 -0500
+Subject: ext4: don't BUG if someone dirty pages without asking ext4 first
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ]
+
+[un]pin_user_pages_remote is dirtying pages without properly warning
+the file system in advance.  A related race was noted by Jan Kara in
+2018[1]; however, more recently instead of it being a very hard-to-hit
+race, it could be reliably triggered by process_vm_writev(2) which was
+discovered by Syzbot[2].
+
+This is technically a bug in mm/gup.c, but arguably ext4 is fragile in
+that if some other kernel subsystem dirty pages without properly
+notifying the file system using page_mkwrite(), ext4 will BUG, while
+other file systems will not BUG (although data will still be lost).
+
+So instead of crashing with a BUG, issue a warning (since there may be
+potential data loss) and just mark the page as clean to avoid
+unprivileged denial of service attacks until the problem can be
+properly fixed.  More discussion and background can be found in the
+thread starting at [2].
+
+[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
+[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com
+
+Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db@syzkaller.appspotmail.com
+Reported-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index dcbd8ac8d471..0d62f05f8925 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2161,6 +2161,15 @@ static int ext4_writepage(struct page *page,
+ 	else
+ 		len = PAGE_SIZE;
+ 
++	/* Should never happen but for bugs in other kernel subsystems */
++	if (!page_has_buffers(page)) {
++		ext4_warning_inode(inode,
++		   "page %lu does not have buffers attached", page->index);
++		ClearPageDirty(page);
++		unlock_page(page);
++		return 0;
++	}
++
+ 	page_bufs = page_buffers(page);
+ 	/*
+ 	 * We cannot do block allocation or other extent handling in this
+@@ -2710,6 +2719,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
+ 			wait_on_page_writeback(page);
+ 			BUG_ON(PageWriteback(page));
+ 
++			/*
++			 * Should never happen but for buggy code in
++			 * other subsystems that call
++			 * set_page_dirty() without properly warning
++			 * the file system first.  See [1] for more
++			 * information.
++			 *
++			 * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
++			 */
++			if (!page_has_buffers(page)) {
++				ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index);
++				ClearPageDirty(page);
++				unlock_page(page);
++				continue;
++			}
++
+ 			if (mpd->map.m_len == 0)
+ 				mpd->first_page = page->index;
+ 			mpd->next_page = page->index + 1;
+-- 
+2.34.1
+
diff --git a/queue-5.4/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch b/queue-5.4/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
new file mode 100644
index 00000000000..47395ad1012
--- /dev/null
+++ b/queue-5.4/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
@@ -0,0 +1,109 @@
+From 366ad9780c8ad2db4da638c423fab2b62376beb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Feb 2022 18:56:46 -0800
+Subject: f2fs: fix missing free nid in f2fs_handle_failed_inode
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 2fef99b8372c1ae3d8445ab570e888b5a358dbe9 ]
+
+This patch fixes xfstests/generic/475 failure.
+
+[  293.680694] F2FS-fs (dm-1): May loss orphan inode, run fsck to fix.
+[  293.685358] Buffer I/O error on dev dm-1, logical block 8388592, async page read
+[  293.691527] Buffer I/O error on dev dm-1, logical block 8388592, async page read
+[  293.691764] sh (7615): drop_caches: 3
+[  293.691819] sh (7616): drop_caches: 3
+[  293.694017] Buffer I/O error on dev dm-1, logical block 1, async page read
+[  293.695659] sh (7618): drop_caches: 3
+[  293.696979] sh (7617): drop_caches: 3
+[  293.700290] sh (7623): drop_caches: 3
+[  293.708621] sh (7626): drop_caches: 3
+[  293.711386] sh (7628): drop_caches: 3
+[  293.711825] sh (7627): drop_caches: 3
+[  293.716738] sh (7630): drop_caches: 3
+[  293.719613] sh (7632): drop_caches: 3
+[  293.720971] sh (7633): drop_caches: 3
+[  293.727741] sh (7634): drop_caches: 3
+[  293.730783] sh (7636): drop_caches: 3
+[  293.732681] sh (7635): drop_caches: 3
+[  293.732988] sh (7637): drop_caches: 3
+[  293.738836] sh (7639): drop_caches: 3
+[  293.740568] sh (7641): drop_caches: 3
+[  293.743053] sh (7640): drop_caches: 3
+[  293.821889] ------------[ cut here ]------------
+[  293.824654] kernel BUG at fs/f2fs/node.c:3334!
+[  293.826226] invalid opcode: 0000 [#1] PREEMPT SMP PTI
+[  293.828713] CPU: 0 PID: 7653 Comm: umount Tainted: G           OE     5.17.0-rc1-custom #1
+[  293.830946] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+[  293.832526] RIP: 0010:f2fs_destroy_node_manager+0x33f/0x350 [f2fs]
+[  293.833905] Code: e8 d6 3d f9 f9 48 8b 45 d0 65 48 2b 04 25 28 00 00 00 75 1a 48 81 c4 28 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b
+[  293.837783] RSP: 0018:ffffb04ec31e7a20 EFLAGS: 00010202
+[  293.839062] RAX: 0000000000000001 RBX: ffff9df947db2eb8 RCX: 0000000080aa0072
+[  293.840666] RDX: 0000000000000000 RSI: ffffe86c0432a140 RDI: ffffffffc0b72a21
+[  293.842261] RBP: ffffb04ec31e7d70 R08: ffff9df94ca85780 R09: 0000000080aa0072
+[  293.843909] R10: ffff9df94ca85700 R11: ffff9df94e1ccf58 R12: ffff9df947db2e00
+[  293.845594] R13: ffff9df947db2ed0 R14: ffff9df947db2eb8 R15: ffff9df947db2eb8
+[  293.847855] FS:  00007f5a97379800(0000) GS:ffff9dfa77c00000(0000) knlGS:0000000000000000
+[  293.850647] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  293.852940] CR2: 00007f5a97528730 CR3: 000000010bc76005 CR4: 0000000000370ef0
+[  293.854680] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  293.856423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  293.858380] Call Trace:
+[  293.859302]  <TASK>
+[  293.860311]  ? ttwu_do_wakeup+0x1c/0x170
+[  293.861800]  ? ttwu_do_activate+0x6d/0xb0
+[  293.863057]  ? _raw_spin_unlock_irqrestore+0x29/0x40
+[  293.864411]  ? try_to_wake_up+0x9d/0x5e0
+[  293.865618]  ? debug_smp_processor_id+0x17/0x20
+[  293.866934]  ? debug_smp_processor_id+0x17/0x20
+[  293.868223]  ? free_unref_page+0xbf/0x120
+[  293.869470]  ? __free_slab+0xcb/0x1c0
+[  293.870614]  ? preempt_count_add+0x7a/0xc0
+[  293.871811]  ? __slab_free+0xa0/0x2d0
+[  293.872918]  ? __wake_up_common_lock+0x8a/0xc0
+[  293.874186]  ? __slab_free+0xa0/0x2d0
+[  293.875305]  ? free_inode_nonrcu+0x20/0x20
+[  293.876466]  ? free_inode_nonrcu+0x20/0x20
+[  293.877650]  ? debug_smp_processor_id+0x17/0x20
+[  293.878949]  ? call_rcu+0x11a/0x240
+[  293.880060]  ? f2fs_destroy_stats+0x59/0x60 [f2fs]
+[  293.881437]  ? kfree+0x1fe/0x230
+[  293.882674]  f2fs_put_super+0x160/0x390 [f2fs]
+[  293.883978]  generic_shutdown_super+0x7a/0x120
+[  293.885274]  kill_block_super+0x27/0x50
+[  293.886496]  kill_f2fs_super+0x7f/0x100 [f2fs]
+[  293.887806]  deactivate_locked_super+0x35/0xa0
+[  293.889271]  deactivate_super+0x40/0x50
+[  293.890513]  cleanup_mnt+0x139/0x190
+[  293.891689]  __cleanup_mnt+0x12/0x20
+[  293.892850]  task_work_run+0x64/0xa0
+[  293.894035]  exit_to_user_mode_prepare+0x1b7/0x1c0
+[  293.895409]  syscall_exit_to_user_mode+0x27/0x50
+[  293.896872]  do_syscall_64+0x48/0xc0
+[  293.898090]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+[  293.899517] RIP: 0033:0x7f5a975cd25b
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 2383d52b1f42..264c19e17779 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -777,6 +777,7 @@ void f2fs_handle_failed_inode(struct inode *inode)
+ 	err = f2fs_get_node_info(sbi, inode->i_ino, &ni);
+ 	if (err) {
+ 		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		set_inode_flag(inode, FI_FREE_NID);
+ 		f2fs_warn(sbi, "May loss orphan inode, run fsck to fix.");
+ 		goto out;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/f2fs-fix-to-avoid-potential-deadlock.patch b/queue-5.4/f2fs-fix-to-avoid-potential-deadlock.patch
new file mode 100644
index 00000000000..faa5c0af51c
--- /dev/null
+++ b/queue-5.4/f2fs-fix-to-avoid-potential-deadlock.patch
@@ -0,0 +1,59 @@
+From d014a9bd97edef6fb1bd0e4e9b29bde0ea674759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 13:44:49 +0800
+Subject: f2fs: fix to avoid potential deadlock
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit df77fbd8c5b222c680444801ffd20e8bbc90a56e ]
+
+Using f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential
+deadlock like we did in f2fs_write_single_data_page().
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 6 +++++-
+ fs/f2fs/node.c | 6 +++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 1679f9c0b63b..773028921c48 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2467,8 +2467,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping,
+ 	/* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */
+ 	if (wbc->sync_mode == WB_SYNC_ALL)
+ 		atomic_inc(&sbi->wb_sync_req[DATA]);
+-	else if (atomic_read(&sbi->wb_sync_req[DATA]))
++	else if (atomic_read(&sbi->wb_sync_req[DATA])) {
++		/* to avoid potential deadlock */
++		if (current->plug)
++			blk_finish_plug(current->plug);
+ 		goto skip_write;
++	}
+ 
+ 	if (__should_serialize_io(inode, wbc)) {
+ 		mutex_lock(&sbi->writepages);
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 0cd1d51dde06..3dc7cc3d6ac6 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1995,8 +1995,12 @@ static int f2fs_write_node_pages(struct address_space *mapping,
+ 
+ 	if (wbc->sync_mode == WB_SYNC_ALL)
+ 		atomic_inc(&sbi->wb_sync_req[NODE]);
+-	else if (atomic_read(&sbi->wb_sync_req[NODE]))
++	else if (atomic_read(&sbi->wb_sync_req[NODE])) {
++		/* to avoid potential deadlock */
++		if (current->plug)
++			blk_finish_plug(current->plug);
+ 		goto skip_write;
++	}
+ 
+ 	trace_f2fs_writepages(mapping->host, wbc, NODE);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/firmware-google-properly-state-iomem-dependency.patch b/queue-5.4/firmware-google-properly-state-iomem-dependency.patch
new file mode 100644
index 00000000000..828f1578d9e
--- /dev/null
+++ b/queue-5.4/firmware-google-properly-state-iomem-dependency.patch
@@ -0,0 +1,58 @@
+From 329ea909cc2c05462ae2ec74a9721b2870065421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 12:15:02 +0800
+Subject: firmware: google: Properly state IOMEM dependency
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 37fd83916da2e4cae03d350015c82a67b1b334c4 ]
+
+The Google Coreboot implementation requires IOMEM functions
+(memmremap, memunmap, devm_memremap), but does not specify this is its
+Kconfig. This results in build errors when HAS_IOMEM is not set, such as
+on some UML configurations:
+
+/usr/bin/ld: drivers/firmware/google/coreboot_table.o: in function `coreboot_table_probe':
+coreboot_table.c:(.text+0x311): undefined reference to `memremap'
+/usr/bin/ld: coreboot_table.c:(.text+0x34e): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/memconsole-coreboot.o: in function `memconsole_probe':
+memconsole-coreboot.c:(.text+0x12d): undefined reference to `memremap'
+/usr/bin/ld: memconsole-coreboot.c:(.text+0x17e): undefined reference to `devm_memremap'
+/usr/bin/ld: memconsole-coreboot.c:(.text+0x191): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_destroy.isra.0':
+vpd.c:(.text+0x300): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_init':
+vpd.c:(.text+0x382): undefined reference to `memremap'
+/usr/bin/ld: vpd.c:(.text+0x459): undefined reference to `memunmap'
+/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_probe':
+vpd.c:(.text+0x59d): undefined reference to `memremap'
+/usr/bin/ld: vpd.c:(.text+0x5d3): undefined reference to `memunmap'
+collect2: error: ld returned 1 exit status
+
+Fixes: a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core")
+Acked-By: anton ivanov <anton.ivanov@cambridgegreys.com>
+Acked-By: Julius Werner <jwerner@chromium.org>
+Signed-off-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/r/20220225041502.1901806-1-davidgow@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/google/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig
+index 2fba0aa7fc54..20dfe39a0537 100644
+--- a/drivers/firmware/google/Kconfig
++++ b/drivers/firmware/google/Kconfig
+@@ -21,7 +21,7 @@ config GOOGLE_SMI
+ 
+ config GOOGLE_COREBOOT_TABLE
+ 	tristate "Coreboot Table Access"
+-	depends on ACPI || OF
++	depends on HAS_IOMEM && (ACPI || OF)
+ 	help
+ 	  This option enables the coreboot_table module, which provides other
+ 	  firmware modules access to the coreboot table. The coreboot table
+-- 
+2.34.1
+
diff --git a/queue-5.4/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch b/queue-5.4/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
new file mode 100644
index 00000000000..45520fbef7d
--- /dev/null
+++ b/queue-5.4/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
@@ -0,0 +1,35 @@
+From abb09bf1c117406f4682ef5ad82de5cb0b8272cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 15:45:32 -0800
+Subject: Fix incorrect type in assignment of ipv6 port for audit
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit a5cd1ab7ab679d252a6d2f483eee7d45ebf2040c ]
+
+Remove inappropriate use of ntohs() and assign the
+port value directly.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack_lsm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 12c0fa85d9f8..0253cd2e2358 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2501,7 +2501,7 @@ static int smk_ipv6_check(struct smack_known *subject,
+ #ifdef CONFIG_AUDIT
+ 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ 	ad.a.u.net->family = PF_INET6;
+-	ad.a.u.net->dport = ntohs(address->sin6_port);
++	ad.a.u.net->dport = address->sin6_port;
+ 	if (act == SMK_RECEIVING)
+ 		ad.a.u.net->v6info.saddr = address->sin6_addr;
+ 	else
+-- 
+2.34.1
+
diff --git a/queue-5.4/gcc-plugins-stackleak-exactly-match-strings-instead-.patch b/queue-5.4/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
new file mode 100644
index 00000000000..eac7365bfa4
--- /dev/null
+++ b/queue-5.4/gcc-plugins-stackleak-exactly-match-strings-instead-.patch
@@ -0,0 +1,70 @@
+From 12401d096434ecab471d619c5d57eecd642548c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 09:08:20 -0800
+Subject: gcc-plugins/stackleak: Exactly match strings instead of prefixes
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 27e9faf415dbf94af19b9c827842435edbc1fbbc ]
+
+Since STRING_CST may not be NUL terminated, strncmp() was used for check
+for equality. However, this may lead to mismatches for longer section
+names where the start matches the tested-for string. Test for exact
+equality by checking for the presences of NUL termination.
+
+Cc: Alexander Popov <alex.popov@linux.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gcc-plugins/stackleak_plugin.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
+index dbd37460c573..f46abb315010 100644
+--- a/scripts/gcc-plugins/stackleak_plugin.c
++++ b/scripts/gcc-plugins/stackleak_plugin.c
+@@ -262,6 +262,23 @@ static unsigned int stackleak_cleanup_execute(void)
+ 	return 0;
+ }
+ 
++/*
++ * STRING_CST may or may not be NUL terminated:
++ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html
++ */
++static inline bool string_equal(tree node, const char *string, int length)
++{
++	if (TREE_STRING_LENGTH(node) < length)
++		return false;
++	if (TREE_STRING_LENGTH(node) > length + 1)
++		return false;
++	if (TREE_STRING_LENGTH(node) == length + 1 &&
++	    TREE_STRING_POINTER(node)[length] != '\0')
++		return false;
++	return !memcmp(TREE_STRING_POINTER(node), string, length);
++}
++#define STRING_EQUAL(node, str)	string_equal(node, str, strlen(str))
++
+ static bool stackleak_gate(void)
+ {
+ 	tree section;
+@@ -271,13 +288,13 @@ static bool stackleak_gate(void)
+ 	if (section && TREE_VALUE(section)) {
+ 		section = TREE_VALUE(TREE_VALUE(section));
+ 
+-		if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
++		if (STRING_EQUAL(section, ".init.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
++		if (STRING_EQUAL(section, ".devinit.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
++		if (STRING_EQUAL(section, ".cpuinit.text"))
+ 			return false;
+-		if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
++		if (STRING_EQUAL(section, ".meminit.text"))
+ 			return false;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch b/queue-5.4/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
new file mode 100644
index 00000000000..8b85f8b5375
--- /dev/null
+++ b/queue-5.4/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
@@ -0,0 +1,91 @@
+From 055c1c84343edb504020c2bab44e5564843e15f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jan 2022 23:26:18 -0800
+Subject: HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit a5e5e03e94764148a01757b2fa4737d3445c13a6 ]
+
+Internally kernel prepends all report buffers, for both numbered and
+unnumbered reports, with report ID, therefore to properly handle unnumbered
+reports we should prepend it ourselves.
+
+For the same reason we should skip the first byte of the buffer when
+calling i2c_hid_set_or_send_report() which then will take care of properly
+formatting the transfer buffer based on its separate report ID argument
+along with report payload.
+
+[jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin]
+Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index ac076ac73de5..1547b0ec6a11 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -622,6 +622,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ 	if (report_type == HID_OUTPUT_REPORT)
+ 		return -EINVAL;
+ 
++	/*
++	 * In case of unnumbered reports the response from the device will
++	 * not have the report ID that the upper layers expect, so we need
++	 * to stash it the buffer ourselves and adjust the data size.
++	 */
++	if (!report_number) {
++		buf[0] = 0;
++		buf++;
++		count--;
++	}
++
+ 	/* +2 bytes to include the size of the reply in the query buffer */
+ 	ask_count = min(count + 2, (size_t)ihid->bufsize);
+ 
+@@ -643,6 +654,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ 	count = min(count, ret_count - 2);
+ 	memcpy(buf, ihid->rawbuf + 2, count);
+ 
++	if (!report_number)
++		count++;
++
+ 	return count;
+ }
+ 
+@@ -659,17 +673,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
+ 
+ 	mutex_lock(&ihid->reset_lock);
+ 
+-	if (report_id) {
+-		buf++;
+-		count--;
+-	}
+-
++	/*
++	 * Note that both numbered and unnumbered reports passed here
++	 * are supposed to have report ID stored in the 1st byte of the
++	 * buffer, so we strip it off unconditionally before passing payload
++	 * to i2c_hid_set_or_send_report which takes care of encoding
++	 * everything properly.
++	 */
+ 	ret = i2c_hid_set_or_send_report(client,
+ 				report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
+-				report_id, buf, count, use_data);
++				report_id, buf + 1, count - 1, use_data);
+ 
+-	if (report_id && ret >= 0)
+-		ret++; /* add report_id to the number of transfered bytes */
++	if (ret >= 0)
++		ret++; /* add report_id to the number of transferred bytes */
+ 
+ 	mutex_unlock(&ihid->reset_lock);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/hv_balloon-rate-limit-unhandled-message-warning.patch b/queue-5.4/hv_balloon-rate-limit-unhandled-message-warning.patch
new file mode 100644
index 00000000000..dcab5607dec
--- /dev/null
+++ b/queue-5.4/hv_balloon-rate-limit-unhandled-message-warning.patch
@@ -0,0 +1,51 @@
+From 7b08b789e2ed7dd4e3956d90dc084e10bcbd48c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 16:14:00 +0200
+Subject: hv_balloon: rate-limit "Unhandled message" warning
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+[ Upstream commit 1d7286729aa616772be334eb908e11f527e1e291 ]
+
+For a couple of times I have encountered a situation where
+
+  hv_balloon: Unhandled message: type: 12447
+
+is being flooded over 1 million times per second with various values,
+filling the log and consuming cycles, making debugging difficult.
+
+Add rate limiting to the message.
+
+Most other Hyper-V drivers already have similar rate limiting in their
+message callbacks.
+
+The cause of the floods in my case was probably fixed by 96d9d1fa5cd5
+("Drivers: hv: balloon: account for vmbus packet header in
+max_pkt_size").
+
+Fixes: 9aa8b50b2b3d ("Drivers: hv: Add Hyper-V balloon driver")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20220222141400.98160-1-anssi.hannula@bitwise.fi
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv_balloon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index bd4e72f6dfd4..44d6de6fc03d 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1550,7 +1550,7 @@ static void balloon_onchannelcallback(void *context)
+ 			break;
+ 
+ 		default:
+-			pr_warn("Unhandled message: type: %d\n", dm_hdr->type);
++			pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type);
+ 
+ 		}
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/hwmon-pmbus-add-mutex-to-regulator-ops.patch b/queue-5.4/hwmon-pmbus-add-mutex-to-regulator-ops.patch
new file mode 100644
index 00000000000..ca6fa8a2e29
--- /dev/null
+++ b/queue-5.4/hwmon-pmbus-add-mutex-to-regulator-ops.patch
@@ -0,0 +1,71 @@
+From c3c4aae4e31abdce101ff7a003a699de634168b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 17:06:09 +0100
+Subject: hwmon: (pmbus) Add mutex to regulator ops
+
+From: Patrick Rudolph <patrick.rudolph@9elements.com>
+
+[ Upstream commit 686d303ee6301261b422ea51e64833d7909a2c36 ]
+
+On PMBUS devices with multiple pages, the regulator ops need to be
+protected with the update mutex. This prevents accidentally changing
+the page in a separate thread while operating on the PMBUS_OPERATION
+register.
+
+Tested on Infineon xdpe11280 while a separate thread polls for sensor
+data.
+
+Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
+Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io>
+Link: https://lore.kernel.org/r/b991506bcbf665f7af185945f70bf9d5cf04637c.1645804976.git.sylv@sylv.io
+Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support")
+Cc: Alan Tull <atull@opensource.altera.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 8470097907bc..b2dfbd1cb543 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2174,10 +2174,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev)
+ {
+ 	struct device *dev = rdev_get_dev(rdev);
+ 	struct i2c_client *client = to_i2c_client(dev->parent);
++	struct pmbus_data *data = i2c_get_clientdata(client);
+ 	u8 page = rdev_get_id(rdev);
+ 	int ret;
+ 
++	mutex_lock(&data->update_lock);
+ 	ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
++	mutex_unlock(&data->update_lock);
++
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -2188,11 +2192,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable)
+ {
+ 	struct device *dev = rdev_get_dev(rdev);
+ 	struct i2c_client *client = to_i2c_client(dev->parent);
++	struct pmbus_data *data = i2c_get_clientdata(client);
+ 	u8 page = rdev_get_id(rdev);
++	int ret;
+ 
+-	return pmbus_update_byte_data(client, page, PMBUS_OPERATION,
+-				      PB_OPERATION_CONTROL_ON,
+-				      enable ? PB_OPERATION_CONTROL_ON : 0);
++	mutex_lock(&data->update_lock);
++	ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION,
++				     PB_OPERATION_CONTROL_ON,
++				     enable ? PB_OPERATION_CONTROL_ON : 0);
++	mutex_unlock(&data->update_lock);
++
++	return ret;
+ }
+ 
+ static int pmbus_regulator_enable(struct regulator_dev *rdev)
+-- 
+2.34.1
+
diff --git a/queue-5.4/hwmon-pmbus-add-vin-unit-off-handling.patch b/queue-5.4/hwmon-pmbus-add-vin-unit-off-handling.patch
new file mode 100644
index 00000000000..c1d27129ca2
--- /dev/null
+++ b/queue-5.4/hwmon-pmbus-add-vin-unit-off-handling.patch
@@ -0,0 +1,61 @@
+From db764ed4b7243cf514c9cb713be0fb23ae74fec8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Mar 2022 23:21:23 +0000
+Subject: hwmon: (pmbus) Add Vin unit off handling
+
+From: Brandon Wyman <bjwyman@gmail.com>
+
+[ Upstream commit a5436af598779219b375c1977555c82def1c35d0 ]
+
+If there is an input undervoltage fault, reported in STATUS_INPUT
+command response, there is quite likely a "Unit Off For Insufficient
+Input Voltage" condition as well.
+
+Add a constant for bit 3 of STATUS_INPUT. Update the Vin limit
+attributes to include both bits in the mask for clearing faults.
+
+If an input undervoltage fault occurs, causing a unit off for
+insufficient input voltage, but the unit is off bit is not cleared, the
+STATUS_WORD will not be updated to clear the input fault condition.
+Including the unit is off bit (bit 3) allows for the input fault
+condition to completely clear.
+
+Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
+Link: https://lore.kernel.org/r/20220317232123.2103592-1-bjwyman@gmail.com
+Fixes: b4ce237b7f7d3 ("hwmon: (pmbus) Introduce infrastructure to detect sensors and limit registers")
+[groeck: Dropped unnecessary ()]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus.h      | 1 +
+ drivers/hwmon/pmbus/pmbus_core.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
+index d198af3a92b6..9731f1f830b1 100644
+--- a/drivers/hwmon/pmbus/pmbus.h
++++ b/drivers/hwmon/pmbus/pmbus.h
+@@ -292,6 +292,7 @@ enum pmbus_fan_mode { percent = 0, rpm };
+ /*
+  * STATUS_VOUT, STATUS_INPUT
+  */
++#define PB_VOLTAGE_VIN_OFF		BIT(3)
+ #define PB_VOLTAGE_UV_FAULT		BIT(4)
+ #define PB_VOLTAGE_UV_WARNING		BIT(5)
+ #define PB_VOLTAGE_OV_WARNING		BIT(6)
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index b2dfbd1cb543..beb443d020c2 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1324,7 +1324,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = {
+ 		.reg = PMBUS_VIN_UV_FAULT_LIMIT,
+ 		.attr = "lcrit",
+ 		.alarm = "lcrit_alarm",
+-		.sbit = PB_VOLTAGE_UV_FAULT,
++		.sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF,
+ 	}, {
+ 		.reg = PMBUS_VIN_OV_WARN_LIMIT,
+ 		.attr = "max",
+-- 
+2.34.1
+
diff --git a/queue-5.4/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch b/queue-5.4/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
new file mode 100644
index 00000000000..e8af66c2775
--- /dev/null
+++ b/queue-5.4/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
@@ -0,0 +1,45 @@
+From 3181e56942e8f2314fc652afb23eccdfd8acf5da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 22:19:35 +0100
+Subject: hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 647d6f09bea7dacf4cdb6d4ea7e3051883955297 ]
+
+If the watchdog was already enabled by the BIOS after booting, the
+watchdog infrastructure needs to regularly send keepalives to
+prevent a unexpected reset.
+WDOG_ACTIVE only serves as an status indicator for userspace,
+we want to use WDOG_HW_RUNNING instead.
+
+Since my Fujitsu Esprimo P720 does not support the watchdog,
+this change is compile-tested only.
+
+Suggested-by: Guenter Roeck <linux@roeck-us.net>
+Fixes: fb551405c0f8 (watchdog: sch56xx: Use watchdog core)
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20220131211935.3656-5-W_Armin@gmx.de
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/sch56xx-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c
+index 6c84780e358e..066b12990fbf 100644
+--- a/drivers/hwmon/sch56xx-common.c
++++ b/drivers/hwmon/sch56xx-common.c
+@@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent,
+ 	if (nowayout)
+ 		set_bit(WDOG_NO_WAY_OUT, &data->wddev.status);
+ 	if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE)
+-		set_bit(WDOG_ACTIVE, &data->wddev.status);
++		set_bit(WDOG_HW_RUNNING, &data->wddev.status);
+ 
+ 	/* Since the watchdog uses a downcounter there is no register to read
+ 	   the BIOS set timeout from (if any was set at all) ->
+-- 
+2.34.1
+
diff --git a/queue-5.4/hwrng-atmel-disable-trng-on-failure-path.patch b/queue-5.4/hwrng-atmel-disable-trng-on-failure-path.patch
new file mode 100644
index 00000000000..da9f10988c0
--- /dev/null
+++ b/queue-5.4/hwrng-atmel-disable-trng-on-failure-path.patch
@@ -0,0 +1,34 @@
+From fcd1880dce247e9d29a6827bc5b10d576d8e3155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Feb 2022 09:59:23 +0200
+Subject: hwrng: atmel - disable trng on failure path
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit a223ea9f89ab960eb254ba78429efd42eaf845eb ]
+
+Call atmel_trng_disable() on failure path of probe.
+
+Fixes: a1fa98d8116f ("hwrng: atmel - disable TRNG during suspend")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/atmel-rng.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c
+index e55705745d5e..f4c94f8acfe0 100644
+--- a/drivers/char/hw_random/atmel-rng.c
++++ b/drivers/char/hw_random/atmel-rng.c
+@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev)
+ 
+ err_register:
+ 	clk_disable_unprepare(trng->clk);
++	atmel_trng_disable(trng);
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch b/queue-5.4/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
new file mode 100644
index 00000000000..669802811c7
--- /dev/null
+++ b/queue-5.4/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
@@ -0,0 +1,53 @@
+From 568ac097c725d8b1c71902209a81e241ee3188a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 12:22:35 +0100
+Subject: i2c: mux: demux-pinctrl: do not deactivate a master that is not
+ active
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 1a22aabf20adf89cb216f566913196128766f25b ]
+
+Attempting to rollback the activation of the current master when
+the current master has not been activated is bad. priv->cur_chan
+and priv->cur_adap are both still zeroed out and the rollback
+may result in attempts to revert an of changeset that has not been
+applied and do result in calls to both del and put the zeroed out
+i2c_adapter. Maybe it crashes, or whatever, but it's bad in any
+case.
+
+Fixes: e9d1a0a41d44 ("i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 5365199a31f4..f7a7405d4350 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 
+ 	err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ 	if (err)
+-		goto err_rollback;
++		goto err_rollback_activation;
+ 
+ 	err = device_create_file(&pdev->dev, &dev_attr_current_master);
+ 	if (err)
+@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ 
+ err_rollback_available:
+ 	device_remove_file(&pdev->dev, &dev_attr_available_masters);
+-err_rollback:
++err_rollback_activation:
+ 	i2c_demux_deactivate_master(priv);
++err_rollback:
+ 	for (j = 0; j < i; j++) {
+ 		of_node_put(priv->chan[j].parent_np);
+ 		of_changeset_destroy(&priv->chan[j].chgset);
+-- 
+2.34.1
+
diff --git a/queue-5.4/i2c-xiic-make-bus-names-unique.patch b/queue-5.4/i2c-xiic-make-bus-names-unique.patch
new file mode 100644
index 00000000000..14dbb1d2096
--- /dev/null
+++ b/queue-5.4/i2c-xiic-make-bus-names-unique.patch
@@ -0,0 +1,49 @@
+From 35a93f7829b28a4de0d2bccadbc4a232a0128fe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 11:50:13 -0600
+Subject: i2c: xiic: Make bus names unique
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 1d366c2f9df8279df2adbb60471f86fc40a1c39e ]
+
+This driver is for an FPGA logic core, so there can be arbitrarily many
+instances of the bus on a given system. Previously all of the I2C bus
+names were "xiic-i2c" which caused issues with lm_sensors when trying to
+map human-readable names to sensor inputs because it could not properly
+distinguish the busses, for example. Append the platform device name to
+the I2C bus name so it is unique between different instances.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Tested-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 37b3b9307d07..a48bee59dcde 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -715,7 +715,6 @@ static const struct i2c_adapter_quirks xiic_quirks = {
+ 
+ static const struct i2c_adapter xiic_adapter = {
+ 	.owner = THIS_MODULE,
+-	.name = DRIVER_NAME,
+ 	.class = I2C_CLASS_DEPRECATED,
+ 	.algo = &xiic_algorithm,
+ 	.quirks = &xiic_quirks,
+@@ -752,6 +751,8 @@ static int xiic_i2c_probe(struct platform_device *pdev)
+ 	i2c_set_adapdata(&i2c->adap, i2c);
+ 	i2c->adap.dev.parent = &pdev->dev;
+ 	i2c->adap.dev.of_node = pdev->dev.of_node;
++	snprintf(i2c->adap.name, sizeof(i2c->adap.name),
++		 DRIVER_NAME " %s", pdev->name);
+ 
+ 	mutex_init(&i2c->lock);
+ 	init_waitqueue_head(&i2c->wait);
+-- 
+2.34.1
+
diff --git a/queue-5.4/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch b/queue-5.4/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
new file mode 100644
index 00000000000..bc4143e22c1
--- /dev/null
+++ b/queue-5.4/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
@@ -0,0 +1,53 @@
+From f41eaf006bd4df4f697a62e36587a47167f14fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Dec 2021 15:06:54 +0100
+Subject: i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb
+
+From: Alexander Lobakin <alexandr.lobakin@intel.com>
+
+[ Upstream commit bc97f9c6f988b31b728eb47a94ca825401dbeffe ]
+
+{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD
++ NET_IP_ALIGN for any skb.
+OTOH, i40e_construct_skb_zc() currently allocates and reserves
+additional `xdp->data - xdp->data_hard_start`, which is
+XDP_PACKET_HEADROOM for XSK frames.
+There's no need for that at all as the frame is post-XDP and will
+go only to the networking stack core.
+Pass the size of the actual data only to __napi_alloc_skb() and
+don't reserve anything. This will give enough headroom for stack
+processing.
+
+Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support")
+Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index a9ad788c4913..fd2da58c7140 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -505,13 +505,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring,
+ 	struct sk_buff *skb;
+ 
+ 	/* allocate a skb to store the frags */
+-	skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
+-			       xdp->data_end - xdp->data_hard_start,
++	skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize,
+ 			       GFP_ATOMIC | __GFP_NOWARN);
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	skb_reserve(skb, xdp->data - xdp->data_hard_start);
+ 	memcpy(__skb_put(skb, datasize), xdp->data, datasize);
+ 	if (metasize)
+ 		skb_metadata_set(skb, metasize);
+-- 
+2.34.1
+
diff --git a/queue-5.4/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch b/queue-5.4/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
new file mode 100644
index 00000000000..89dd834fa2f
--- /dev/null
+++ b/queue-5.4/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
@@ -0,0 +1,41 @@
+From 58057d646f92494587dce219d375d16e7da8eb74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Feb 2022 16:39:35 +0100
+Subject: IB/cma: Allow XRC INI QPs to set their local ACK timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 748663c8ccf6b2e5a800de19127c2cc1c4423fd2 ]
+
+XRC INI QPs should be able to adjust their local ACK timeout.
+
+Fixes: 2c1619edef61 ("IB/cma: Define option to set ack timeout and pack tos_set")
+Link: https://lore.kernel.org/r/1644421175-31943-1-git-send-email-haakon.bugge@oracle.com
+Signed-off-by: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+Suggested-by: Avneesh Pant <avneesh.pant@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 5e2b688e36fc..de7df5ab06f3 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2559,7 +2559,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout)
+ {
+ 	struct rdma_id_private *id_priv;
+ 
+-	if (id->qp_type != IB_QPT_RC)
++	if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI)
+ 		return -EINVAL;
+ 
+ 	id_priv = container_of(id, struct rdma_id_private, id);
+-- 
+2.34.1
+
diff --git a/queue-5.4/iio-adc-add-check-for-devm_request_threaded_irq.patch b/queue-5.4/iio-adc-add-check-for-devm_request_threaded_irq.patch
new file mode 100644
index 00000000000..37d83ddbe66
--- /dev/null
+++ b/queue-5.4/iio-adc-add-check-for-devm_request_threaded_irq.patch
@@ -0,0 +1,38 @@
+From b1a67a9083a72482176bc3a8e932e9f833c1fbd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 14:28:49 +0800
+Subject: iio: adc: Add check for devm_request_threaded_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b30537a4cedcacf0ade2f33ebb7610178ed1e7d7 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value and return
+error if fails.
+
+Fixes: fa659a40b80b ("iio: adc: twl6030-gpadc: Use devm_* API family")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220224062849.3280966-1-jiasheng@iscas.ac.cn
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/twl6030-gpadc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
+index f24148bd15de..fb77c3ff5a3e 100644
+--- a/drivers/iio/adc/twl6030-gpadc.c
++++ b/drivers/iio/adc/twl6030-gpadc.c
+@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev)
+ 	ret = devm_request_threaded_irq(dev, irq, NULL,
+ 				twl6030_gpadc_irq_handler,
+ 				IRQF_ONESHOT, "twl6030_gpadc", indio_dev);
++	if (ret)
++		return ret;
+ 
+ 	ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK);
+ 	if (ret < 0) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch b/queue-5.4/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
new file mode 100644
index 00000000000..3f196317a90
--- /dev/null
+++ b/queue-5.4/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
@@ -0,0 +1,42 @@
+From c4aaa02efea82ee38cf48c3cacc11567665e966e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jan 2022 10:43:02 +0800
+Subject: iommu/ipmmu-vmsa: Check for error num after setting mask
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 1fdbbfd5099f797a4dac05e7ef0192ba4a9c39b4 ]
+
+Because of the possible failure of the dma_supported(), the
+dma_set_mask_and_coherent() may return error num.
+Therefore, it should be better to check it and return the error if
+fails.
+
+Fixes: 1c894225bf5b ("iommu/ipmmu-vmsa: IPMMU device is 40-bit bus master")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
+Link: https://lore.kernel.org/r/20220106024302.2574180-1-jiasheng@iscas.ac.cn
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/ipmmu-vmsa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index 2639fc718117..584eefab1dbc 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -1061,7 +1061,9 @@ static int ipmmu_probe(struct platform_device *pdev)
+ 	bitmap_zero(mmu->ctx, IPMMU_CTX_MAX);
+ 	mmu->features = of_device_get_match_data(&pdev->dev);
+ 	memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs);
+-	dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
++	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
++	if (ret)
++		return ret;
+ 
+ 	/* Map I/O memory and request IRQ. */
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-- 
+2.34.1
+
diff --git a/queue-5.4/irqchip-nvic-release-nvic_base-upon-failure.patch b/queue-5.4/irqchip-nvic-release-nvic_base-upon-failure.patch
new file mode 100644
index 00000000000..f480167ffbc
--- /dev/null
+++ b/queue-5.4/irqchip-nvic-release-nvic_base-upon-failure.patch
@@ -0,0 +1,50 @@
+From 944ca9d2ba72a6b9a92ef3d57bc16bd71ae47a32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 22:03:03 +0530
+Subject: irqchip/nvic: Release nvic_base upon failure
+
+From: Souptick Joarder (HPE) <jrdr.linux@gmail.com>
+
+[ Upstream commit e414c25e3399b2b3d7337dc47abccab5c71b7c8f ]
+
+smatch warning was reported as below ->
+
+smatch warnings:
+drivers/irqchip/irq-nvic.c:131 nvic_of_init()
+warn: 'nvic_base' not released on lines: 97.
+
+Release nvic_base upon failure.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Souptick Joarder (HPE) <jrdr.linux@gmail.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220218163303.33344-1-jrdr.linux@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-nvic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c
+index 160b39b5cd10..128a26d219e2 100644
+--- a/drivers/irqchip/irq-nvic.c
++++ b/drivers/irqchip/irq-nvic.c
+@@ -105,6 +105,7 @@ static int __init nvic_of_init(struct device_node *node,
+ 
+ 	if (!nvic_irq_domain) {
+ 		pr_warn("Failed to allocate irq domain\n");
++		iounmap(nvic_base);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -114,6 +115,7 @@ static int __init nvic_of_init(struct device_node *node,
+ 	if (ret) {
+ 		pr_warn("Failed to allocate irq chips\n");
+ 		irq_domain_remove(nvic_irq_domain);
++		iounmap(nvic_base);
+ 		return ret;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/irqchip-qcom-pdc-fix-broken-locking.patch b/queue-5.4/irqchip-qcom-pdc-fix-broken-locking.patch
new file mode 100644
index 00000000000..9988b4c1fe1
--- /dev/null
+++ b/queue-5.4/irqchip-qcom-pdc-fix-broken-locking.patch
@@ -0,0 +1,56 @@
+From 852d38226024896b23b3807ca197c4d7ddb7cef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:12:25 +0000
+Subject: irqchip/qcom-pdc: Fix broken locking
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit a6aca2f460e203781dc41391913cc5b54f4bc0ce ]
+
+pdc_enable_intr() serves as a primitive to qcom_pdc_gic_{en,dis}able,
+and has a raw spinlock for mutual exclusion, which is uses with
+interruptible primitives.
+
+This means that this critical section can itself be interrupted.
+Should the interrupt also be a PDC interrupt, and the endpoint driver
+perform an irq_disable() on that interrupt, we end-up in a deadlock.
+
+Fix this by using the irqsave/irqrestore variants of the locking
+primitives.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Maulik Shah <quic_mkshah@quicinc.com>
+Link: https://lore.kernel.org/r/20220224101226.88373-5-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/qcom-pdc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index faa7d61b9d6c..239a889df608 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i)
+ static void pdc_enable_intr(struct irq_data *d, bool on)
+ {
+ 	int pin_out = d->hwirq;
++	unsigned long flags;
+ 	u32 index, mask;
+ 	u32 enable;
+ 
+ 	index = pin_out / 32;
+ 	mask = pin_out % 32;
+ 
+-	raw_spin_lock(&pdc_lock);
++	raw_spin_lock_irqsave(&pdc_lock, flags);
+ 	enable = pdc_reg_read(IRQ_ENABLE_BANK, index);
+ 	enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask);
+ 	pdc_reg_write(IRQ_ENABLE_BANK, index, enable);
+-	raw_spin_unlock(&pdc_lock);
++	raw_spin_unlock_irqrestore(&pdc_lock, flags);
+ }
+ 
+ static void qcom_pdc_gic_mask(struct irq_data *d)
+-- 
+2.34.1
+
diff --git a/queue-5.4/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch b/queue-5.4/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
new file mode 100644
index 00000000000..e75d5bf7e27
--- /dev/null
+++ b/queue-5.4/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
@@ -0,0 +1,123 @@
+From 50db0912d422c0778ec40d468925988230f66ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Mar 2022 12:29:11 +0100
+Subject: ivtv: fix incorrect device_caps for ivtvfb
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 25e94139218c0293b4375233c14f2256d7dcfaa8 ]
+
+The VIDIOC_G_FBUF and related overlay ioctls no longer worked (-ENOTTY was
+returned).
+
+The root cause was the introduction of the caps field in ivtv-driver.h.
+While loading the ivtvfb module would update the video_device device_caps
+field with V4L2_CAP_VIDEO_OUTPUT_OVERLAY it would not update that caps
+field, and that's what the overlay ioctls would look at.
+
+It's a bad idea to keep information in two places, so drop the caps field
+and only use vdev.device_caps.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Martin Dauskardt <martin.dauskardt@gmx.de>
+Fixes: 2161536516ed (media: media/pci: set device_caps in struct video_device)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-driver.h  |  1 -
+ drivers/media/pci/ivtv/ivtv-ioctl.c   | 10 +++++-----
+ drivers/media/pci/ivtv/ivtv-streams.c | 11 ++++-------
+ 3 files changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index cafba6b1055d..90f38552bd36 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -333,7 +333,6 @@ struct ivtv_stream {
+ 	struct ivtv *itv;		/* for ease of use */
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+-	u32 caps;			/* V4L2 capabilities */
+ 
+ 	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
+ 	spinlock_t qlock;		/* locks access to the queues */
+diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c
+index 137853944e46..396cc931f41a 100644
+--- a/drivers/media/pci/ivtv/ivtv-ioctl.c
++++ b/drivers/media/pci/ivtv/ivtv-ioctl.c
+@@ -443,7 +443,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 	struct v4l2_window *winfmt = &fmt->fmt.win;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -EINVAL;
+ 	if (!itv->osd_video_pbase)
+ 		return -EINVAL;
+@@ -554,7 +554,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2
+ 	u32 chromakey = fmt->fmt.win.chromakey;
+ 	u8 global_alpha = fmt->fmt.win.global_alpha;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -EINVAL;
+ 	if (!itv->osd_video_pbase)
+ 		return -EINVAL;
+@@ -1386,7 +1386,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb)
+ 		0,
+ 	};
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+@@ -1453,7 +1453,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 	struct yuv_playback_info *yi = &itv->yuv_info;
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+@@ -1473,7 +1473,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on)
+ 	struct ivtv *itv = id->itv;
+ 	struct ivtv_stream *s = &itv->streams[fh2id(fh)->type];
+ 
+-	if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
++	if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY))
+ 		return -ENOTTY;
+ 	if (!itv->osd_video_pbase)
+ 		return -ENOTTY;
+diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c
+index f7de9118f609..200d2100dbff 100644
+--- a/drivers/media/pci/ivtv/ivtv-streams.c
++++ b/drivers/media/pci/ivtv/ivtv-streams.c
+@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type)
+ 	s->itv = itv;
+ 	s->type = type;
+ 	s->name = ivtv_stream_info[type].name;
+-	s->caps = ivtv_stream_info[type].v4l2_caps;
++	s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps;
+ 
+ 	if (ivtv_stream_info[type].pio)
+ 		s->dma = PCI_DMA_NONE;
+@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type)
+ 		if (s_mpg->vdev.v4l2_dev)
+ 			num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset;
+ 	}
+-	s->vdev.device_caps = s->caps;
+-	if (itv->osd_video_pbase) {
+-		itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |=
+-			V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+-		itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |=
+-			V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
++	if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV ||
++				     type == IVTV_DEC_STREAM_TYPE_MPG)) {
++		s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+ 		itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY;
+ 	}
+ 	video_set_drvdata(&s->vdev, s);
+-- 
+2.34.1
+
diff --git a/queue-5.4/iwlwifi-fix-eio-error-code-that-is-never-returned.patch b/queue-5.4/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
new file mode 100644
index 00000000000..0a936160762
--- /dev/null
+++ b/queue-5.4/iwlwifi-fix-eio-error-code-that-is-never-returned.patch
@@ -0,0 +1,39 @@
+From 50e2856d6b18a22d438fc7c3af8f4deaba5c9a10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 11:46:58 +0100
+Subject: iwlwifi: Fix -EIO error code that is never returned
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c305c94bdc18e45b5ad1db54da4269f8cbfdff6b ]
+
+Currently the error -EIO is being assinged to variable ret when
+the READY_BIT is not set but the function iwlagn_mac_start returns
+0 rather than ret. Fix this by returning ret instead of 0.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 7335613ae27a ("iwlwifi: move all mac80211 related functions to one place")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210907104658.14706-1-colin.king@canonical.com
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+index 6512d25e3563..f3bb1f91b587 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -303,7 +303,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw)
+ 
+ 	priv->is_open = 1;
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+-	return 0;
++	return ret;
+ }
+ 
+ static void iwlagn_mac_stop(struct ieee80211_hw *hw)
+-- 
+2.34.1
+
diff --git a/queue-5.4/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch b/queue-5.4/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
new file mode 100644
index 00000000000..c544da46799
--- /dev/null
+++ b/queue-5.4/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
@@ -0,0 +1,39 @@
+From dbabc0eef74f3aa61e1dd08caf9013aea541f94f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:39:30 +0300
+Subject: iwlwifi: mvm: Fix an error code in iwl_mvm_up()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 583d18336abdfb1b355270289ff8f6a2608ba905 ]
+
+Return -ENODEV instead of success on this error path.
+
+Fixes: dd36a507c806 ("iwlwifi: mvm: look for the first supported channel when add/remove phy ctxt")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20210816183930.GA2068@kili
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 7272d8522a9e..c5b08a68f6fa 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1417,8 +1417,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ 	while (!sband && i < NUM_NL80211_BANDS)
+ 		sband = mvm->hw->wiphy->bands[i++];
+ 
+-	if (WARN_ON_ONCE(!sband))
++	if (WARN_ON_ONCE(!sband)) {
++		ret = -ENODEV;
+ 		goto error;
++	}
+ 
+ 	chan = &sband->channels[0];
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/jfs-fix-divide-error-in-dbnextag.patch b/queue-5.4/jfs-fix-divide-error-in-dbnextag.patch
new file mode 100644
index 00000000000..b5f51f68923
--- /dev/null
+++ b/queue-5.4/jfs-fix-divide-error-in-dbnextag.patch
@@ -0,0 +1,56 @@
+From 8328dc50dade66bc08d79ad6fcc7db88baae8883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Mar 2022 22:30:00 +0300
+Subject: jfs: fix divide error in dbNextAG
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]
+
+Syzbot reported divide error in dbNextAG(). The problem was in missing
+validation check for malicious image.
+
+Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
+validation checks, but dbNextAG() blindly use bmp->db_numag in divide
+expression
+
+Fix it by validating bmp->db_numag in dbMount() and return an error if
+image is malicious
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 6fe82ce8663e..79f3440e204b 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -148,6 +148,7 @@ static const s8 budtab[256] = {
+  *	0	- success
+  *	-ENOMEM	- insufficient memory
+  *	-EIO	- i/o error
++ *	-EINVAL - wrong bmap data
+  */
+ int dbMount(struct inode *ipbmap)
+ {
+@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap)
+ 	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
+ 	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
+ 	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
++	if (!bmp->db_numag) {
++		release_metapage(mp);
++		kfree(bmp);
++		return -EINVAL;
++	}
++
+ 	bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
+ 	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
+ 	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
+-- 
+2.34.1
+
diff --git a/queue-5.4/kgdboc-fix-return-value-of-__setup-handler.patch b/queue-5.4/kgdboc-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..f521450f77f
--- /dev/null
+++ b/queue-5.4/kgdboc-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,76 @@
+From 9dca9b1462d843f6362a72fc23cdb65f26bfe9de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 19:30:18 -0800
+Subject: kgdboc: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ab818c7aa7544bf8d2dd4bdf68878b17a02eb332 ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) environment strings.
+So return 1 from kgdboc_option_setup().
+
+Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7
+  kgdboc=kbd kgdbts=", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc7
+     kgdboc=kbd
+     kgdbts=
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 1bd54d851f50 ("kgdboc: Passing ekgdboc to command line causes panic")
+Fixes: f2d937f3bf00 ("consoles: polling support, kgdboc")
+Cc: He Zhe <zhe.he@windriver.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: kgdb-bugreport@lists.sourceforge.net
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: linux-serial@vger.kernel.org
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220309033018.17936-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/kgdboc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index f5608ad68ae1..6d4792ec9e5f 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -391,16 +391,16 @@ static int kgdboc_option_setup(char *opt)
+ {
+ 	if (!opt) {
+ 		pr_err("config string not provided\n");
+-		return -EINVAL;
++		return 1;
+ 	}
+ 
+ 	if (strlen(opt) >= MAX_CONFIG_LEN) {
+ 		pr_err("config string too long\n");
+-		return -ENOSPC;
++		return 1;
+ 	}
+ 	strcpy(config, opt);
+ 
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kgdboc=", kgdboc_option_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.4/kgdbts-fix-return-value-of-__setup-handler.patch b/queue-5.4/kgdbts-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..48e6d657643
--- /dev/null
+++ b/queue-5.4/kgdbts-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,65 @@
+From 74a0c630608f2643196f1576d85161b0b10c5b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 19:32:55 -0800
+Subject: kgdbts: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 96c9e802c64014a7716865332d732cc9c7f24593 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled. A return of 0 causes the boot option/value to be
+listed as an Unknown kernel parameter and added to init's (limited)
+environment strings. So return 1 from kgdbts_option_setup().
+
+Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7
+  kgdboc=kbd kgdbts=", will be passed to user space.
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc7
+     kgdboc=kbd
+     kgdbts=
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: e8d31c204e36 ("kgdb: add kgdb internal test suite")
+Cc: kgdb-bugreport@lists.sourceforge.net
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220308033255.22118-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 8d18f19c99c4..2f8858105733 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -1060,10 +1060,10 @@ static int kgdbts_option_setup(char *opt)
+ {
+ 	if (strlen(opt) >= MAX_CONFIG_LEN) {
+ 		printk(KERN_ERR "kgdbts: config string too long\n");
+-		return -ENOSPC;
++		return 1;
+ 	}
+ 	strcpy(config, opt);
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kgdbts=", kgdbts_option_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.4/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch b/queue-5.4/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
new file mode 100644
index 00000000000..69ed0f8d8da
--- /dev/null
+++ b/queue-5.4/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
@@ -0,0 +1,48 @@
+From 78554cef400d760debf4e699ff0efe0102a60acd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 18:56:52 -0300
+Subject: KVM: PPC: Fix vmx/vsx mixup in mmio emulation
+
+From: Fabiano Rosas <farosas@linux.ibm.com>
+
+[ Upstream commit b99234b918c6e36b9aa0a5b2981e86b6bd11f8e2 ]
+
+The MMIO emulation code for vector instructions is duplicated between
+VSX and VMX. When emulating VMX we should check the VMX copy size
+instead of the VSX one.
+
+Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction ...")
+Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220125215655.1026224-3-farosas@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/powerpc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 8dd4d2b83677..eb8c72846b7f 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1495,7 +1495,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ {
+ 	enum emulation_result emulated = EMULATE_DONE;
+ 
+-	if (vcpu->arch.mmio_vsx_copy_nums > 2)
++	if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ 		return EMULATE_FAIL;
+ 
+ 	while (vcpu->arch.mmio_vmx_copy_nums) {
+@@ -1592,7 +1592,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ 	unsigned int index = rs & KVM_MMIO_REG_MASK;
+ 	enum emulation_result emulated = EMULATE_DONE;
+ 
+-	if (vcpu->arch.mmio_vsx_copy_nums > 2)
++	if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ 		return EMULATE_FAIL;
+ 
+ 	vcpu->arch.io_gpr = rs;
+-- 
+2.34.1
+
diff --git a/queue-5.4/kvm-x86-emulator-defer-not-present-segment-check-in-.patch b/queue-5.4/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
new file mode 100644
index 00000000000..ca6c3618329
--- /dev/null
+++ b/queue-5.4/kvm-x86-emulator-defer-not-present-segment-check-in-.patch
@@ -0,0 +1,69 @@
+From 17ba9f8c663f0b284fd8c2a025616985e5df27ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 17:34:03 +0800
+Subject: KVM: x86/emulator: Defer not-present segment check in
+ __load_segment_descriptor()
+
+From: Hou Wenlong <houwenlong.hwl@antgroup.com>
+
+[ Upstream commit ca85f002258fdac3762c57d12d5e6e401b6a41af ]
+
+Per Intel's SDM on the "Instruction Set Reference", when
+loading segment descriptor, not-present segment check should
+be after all type and privilege checks. But the emulator checks
+it first, then #NP is triggered instead of #GP if privilege fails
+and segment is not present. Put not-present segment check after
+type and privilege checks in __load_segment_descriptor().
+
+Fixes: 38ba30ba51a00 (KVM: x86 emulator: Emulate task switch in emulator.c)
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
+Message-Id: <52573c01d369f506cadcf7233812427cf7db81a7.1644292363.git.houwenlong.hwl@antgroup.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/emulate.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 60c8dcb907a5..ea48a2fb1677 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1714,11 +1714,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 		goto exception;
+ 	}
+ 
+-	if (!seg_desc.p) {
+-		err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
+-		goto exception;
+-	}
+-
+ 	dpl = seg_desc.dpl;
+ 
+ 	switch (seg) {
+@@ -1758,6 +1753,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 	case VCPU_SREG_TR:
+ 		if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
+ 			goto exception;
++		if (!seg_desc.p) {
++			err_vec = NP_VECTOR;
++			goto exception;
++		}
+ 		old_desc = seg_desc;
+ 		seg_desc.type |= 2; /* busy */
+ 		ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
+@@ -1782,6 +1781,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 		break;
+ 	}
+ 
++	if (!seg_desc.p) {
++		err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
++		goto exception;
++	}
++
+ 	if (seg_desc.s) {
+ 		/* mark segment as accessed */
+ 		if (!(seg_desc.type & 1)) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/kvm-x86-fix-emulation-in-writing-cr8.patch b/queue-5.4/kvm-x86-fix-emulation-in-writing-cr8.patch
new file mode 100644
index 00000000000..5e0b95381ad
--- /dev/null
+++ b/queue-5.4/kvm-x86-fix-emulation-in-writing-cr8.patch
@@ -0,0 +1,65 @@
+From 4e91146a9819afdfc87b5201c4930c33ba00b16a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Feb 2022 17:45:06 +0800
+Subject: KVM: x86: Fix emulation in writing cr8
+
+From: Zhenzhong Duan <zhenzhong.duan@intel.com>
+
+[ Upstream commit f66af9f222f08d5b11ea41c1bd6c07a0f12daa07 ]
+
+In emulation of writing to cr8, one of the lowest four bits in TPR[3:0]
+is kept.
+
+According to Intel SDM 10.8.6.1(baremetal scenario):
+"APIC.TPR[bits 7:4] = CR8[bits 3:0], APIC.TPR[bits 3:0] = 0";
+
+and SDM 28.3(use TPR shadow):
+"MOV to CR8. The instruction stores bits 3:0 of its source operand into
+bits 7:4 of VTPR; the remainder of VTPR (bits 3:0 and bits 31:8) are
+cleared.";
+
+and AMD's APM 16.6.4:
+"Task Priority Sub-class (TPS)-Bits 3 : 0. The TPS field indicates the
+current sub-priority to be used when arbitrating lowest-priority messages.
+This field is written with zero when TPR is written using the architectural
+CR8 register.";
+
+so in KVM emulated scenario, clear TPR[3:0] to make a consistent behavior
+as in other scenarios.
+
+This doesn't impact evaluation and delivery of pending virtual interrupts
+because processor does not use the processor-priority sub-class to
+determine which interrupts to delivery and which to inhibit.
+
+Sub-class is used by hardware to arbitrate lowest priority interrupts,
+but KVM just does a round-robin style delivery.
+
+Fixes: b93463aa59d6 ("KVM: Accelerated apic support")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20220210094506.20181-1-zhenzhong.duan@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/lapic.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index eea2d6f10f59..afe3b8e61514 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2099,10 +2099,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
+ 
+ void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8)
+ {
+-	struct kvm_lapic *apic = vcpu->arch.apic;
+-
+-	apic_set_tpr(apic, ((cr8 & 0x0f) << 4)
+-		     | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4));
++	apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4);
+ }
+ 
+ u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu)
+-- 
+2.34.1
+
diff --git a/queue-5.4/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch b/queue-5.4/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
new file mode 100644
index 00000000000..98e1914b901
--- /dev/null
+++ b/queue-5.4/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
@@ -0,0 +1,85 @@
+From ae86b48015614d9aa9a49c99c7c6f248b9d41e82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Feb 2022 16:21:48 +0100
+Subject: lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit 633174a7046ec3b4572bec24ef98e6ee89bce14b ]
+
+Buidling raid6test on Ubuntu 21.10 (ppc64le) with GNU Make 4.3 shows the
+errors below:
+
+    $ cd lib/raid6/test/
+    $ make
+    <stdin>:1:1: error: stray ‘\’ in program
+    <stdin>:1:2: error: stray ‘#’ in program
+    <stdin>:1:11: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ \
+        before ‘<’ token
+
+    [...]
+
+The errors come from the HAS_ALTIVEC test, which fails, and the POWER
+optimized versions are not built. That’s also reason nobody noticed on the
+other architectures.
+
+GNU Make 4.3 does not remove the backslash anymore. From the 4.3 release
+announcment:
+
+> * WARNING: Backward-incompatibility!
+>   Number signs (#) appearing inside a macro reference or function invocation
+>   no longer introduce comments and should not be escaped with backslashes:
+>   thus a call such as:
+>     foo := $(shell echo '#')
+>   is legal.  Previously the number sign needed to be escaped, for example:
+>     foo := $(shell echo '\#')
+>   Now this latter will resolve to "\#".  If you want to write makefiles
+>   portable to both versions, assign the number sign to a variable:
+>     H := \#
+>     foo := $(shell echo '$H')
+>   This was claimed to be fixed in 3.81, but wasn't, for some reason.
+>   To detect this change search for 'nocomment' in the .FEATURES variable.
+
+So, do the same as commit 9564a8cf422d ("Kbuild: fix # escaping in .cmd
+files for future Make") and commit 929bef467771 ("bpf: Use $(pound) instead
+of \# in Makefiles") and define and use a $(pound) variable.
+
+Reference for the change in make:
+https://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b57
+
+Cc: Matt Brown <matthew.brown.dev@gmail.com>
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/test/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index b9e6c3648be1..98b9fd0354dd 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -4,6 +4,8 @@
+ # from userspace.
+ #
+ 
++pound := \#
++
+ CC	 = gcc
+ OPTFLAGS = -O2			# Adjust as desired
+ CFLAGS	 = -I.. -I ../../../include -g $(OPTFLAGS)
+@@ -47,7 +49,7 @@ else ifeq ($(HAS_NEON),yes)
+         OBJS   += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+         CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+-        HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
++        HAS_ALTIVEC := $(shell printf '$(pound)include <altivec.h>\nvector int a;\n' |\
+                          gcc -c -x c - >/dev/null && rm ./-.o && echo yes)
+         ifeq ($(HAS_ALTIVEC),yes)
+                 CFLAGS += -I../../../arch/powerpc/include
+-- 
+2.34.1
+
diff --git a/queue-5.4/lib-test-use-after-free-in-register_test_dev_kmod.patch b/queue-5.4/lib-test-use-after-free-in-register_test_dev_kmod.patch
new file mode 100644
index 00000000000..eb2a7c79276
--- /dev/null
+++ b/queue-5.4/lib-test-use-after-free-in-register_test_dev_kmod.patch
@@ -0,0 +1,34 @@
+From 9c90e396b5715cffb27595bcb86c6000fd2ea37d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 08:52:07 +0300
+Subject: lib/test: use after free in register_test_dev_kmod()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dc0ce6cc4b133f5f2beb8b47dacae13a7d283c2c ]
+
+The "test_dev" pointer is freed but then returned to the caller.
+
+Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kmod.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index 87a0cc750ea2..6813b183aa34 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
+ 	if (ret) {
+ 		pr_err("could not register misc device: %d\n", ret);
+ 		free_test_dev_kmod(test_dev);
++		test_dev = NULL;
+ 		goto out;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/libbpf-skip-forward-declaration-when-counting-duplic.patch b/queue-5.4/libbpf-skip-forward-declaration-when-counting-duplic.patch
new file mode 100644
index 00000000000..787ee77a7d3
--- /dev/null
+++ b/queue-5.4/libbpf-skip-forward-declaration-when-counting-duplic.patch
@@ -0,0 +1,54 @@
+From 4ee81fe3cd10f7c51c4f77739c911580b59208b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 00:32:49 -0500
+Subject: libbpf: Skip forward declaration when counting duplicated type names
+
+From: Xu Kuohai <xukuohai@huawei.com>
+
+[ Upstream commit 4226961b0019b2e1612029e8950a9e911affc995 ]
+
+Currently if a declaration appears in the BTF before the definition, the
+definition is dumped as a conflicting name, e.g.:
+
+    $ bpftool btf dump file vmlinux format raw | grep "'unix_sock'"
+    [81287] FWD 'unix_sock' fwd_kind=struct
+    [89336] STRUCT 'unix_sock' size=1024 vlen=14
+
+    $ bpftool btf dump file vmlinux format c | grep "struct unix_sock"
+    struct unix_sock;
+    struct unix_sock___2 {	<--- conflict, the "___2" is unexpected
+		    struct unix_sock___2 *unix_sk;
+
+This causes a compilation error if the dump output is used as a header file.
+
+Fix it by skipping declaration when counting duplicated type names.
+
+Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion")
+Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20220301053250.1464204-2-xukuohai@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index b2fc45250450..a1176a9e8430 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -1366,6 +1366,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id,
+ 	if (s->name_resolved)
+ 		return *cached_name ? *cached_name : orig_name;
+ 
++	if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) {
++		s->name_resolved = 1;
++		return orig_name;
++	}
++
+ 	dup_cnt = btf_dump_name_dups(d, name_map, orig_name);
+ 	if (dup_cnt > 1) {
+ 		const size_t max_len = 256;
+-- 
+2.34.1
+
diff --git a/queue-5.4/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch b/queue-5.4/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
new file mode 100644
index 00000000000..10d7027e6f7
--- /dev/null
+++ b/queue-5.4/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
@@ -0,0 +1,73 @@
+From 740cc2f5df301783a66f9b406ece47557f0f7e27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 13:33:07 -0800
+Subject: loop: use sysfs_emit() in the sysfs xxx show()
+
+From: Chaitanya Kulkarni <kch@nvidia.com>
+
+[ Upstream commit b27824d31f09ea7b4a6ba2c1b18bd328df3e8bed ]
+
+sprintf does not know the PAGE_SIZE maximum of the temporary buffer
+used for outputting sysfs content and it's possible to overrun the
+PAGE_SIZE buffer length.
+
+Use a generic sysfs_emit function that knows the size of the
+temporary buffer and ensures that no overrun is done for offset
+attribute in
+loop_attr_[offset|sizelimit|autoclear|partscan|dio]_show() callbacks.
+
+Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Link: https://lore.kernel.org/r/20220215213310.7264-2-kch@nvidia.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index ffbe792410d1..6b3e27b8cd24 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -794,33 +794,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
+ 
+ static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf)
+ {
+-	return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset);
++	return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset);
+ }
+ 
+ static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf)
+ {
+-	return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
++	return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
+ }
+ 
+ static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf)
+ {
+ 	int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR);
+ 
+-	return sprintf(buf, "%s\n", autoclear ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0");
+ }
+ 
+ static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf)
+ {
+ 	int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN);
+ 
+-	return sprintf(buf, "%s\n", partscan ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", partscan ? "1" : "0");
+ }
+ 
+ static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf)
+ {
+ 	int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO);
+ 
+-	return sprintf(buf, "%s\n", dio ? "1" : "0");
++	return sysfs_emit(buf, "%s\n", dio ? "1" : "0");
+ }
+ 
+ LOOP_ATTR_RO(backing_file);
+-- 
+2.34.1
+
diff --git a/queue-5.4/lsm-general-protection-fault-in-legacy_parse_param.patch b/queue-5.4/lsm-general-protection-fault-in-legacy_parse_param.patch
new file mode 100644
index 00000000000..728bba1ac93
--- /dev/null
+++ b/queue-5.4/lsm-general-protection-fault-in-legacy_parse_param.patch
@@ -0,0 +1,79 @@
+From 1058a834340a58ed99aaea2fae0f02aed82933c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 04:51:00 +0000
+Subject: LSM: general protection fault in legacy_parse_param
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ]
+
+The usual LSM hook "bail on fail" scheme doesn't work for cases where
+a security module may return an error code indicating that it does not
+recognize an input.  In this particular case Smack sees a mount option
+that it recognizes, and returns 0. A call to a BPF hook follows, which
+returns -ENOPARAM, which confuses the caller because Smack has processed
+its data.
+
+The SELinux hook incorrectly returns 1 on success. There was a time
+when this was correct, however the current expectation is that it
+return 0 on success. This is repaired.
+
+Reported-by: syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Acked-by: James Morris <jamorris@linux.microsoft.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/security.c      | 17 +++++++++++++++--
+ security/selinux/hooks.c |  5 ++---
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/security/security.c b/security/security.c
+index c34ec4c7d98c..f633717311a3 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -802,9 +802,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
+ 	return call_int_hook(fs_context_dup, 0, fc, src_fc);
+ }
+ 
+-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param)
++int security_fs_context_parse_param(struct fs_context *fc,
++				    struct fs_parameter *param)
+ {
+-	return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
++	struct security_hook_list *hp;
++	int trc;
++	int rc = -ENOPARAM;
++
++	hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
++			     list) {
++		trc = hp->hook.fs_context_parse_param(fc, param);
++		if (trc == 0)
++			rc = 0;
++		else if (trc != -ENOPARAM)
++			return trc;
++	}
++	return rc;
+ }
+ 
+ int security_sb_alloc(struct super_block *sb)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 56418cf72069..d9f15c84aab7 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2855,10 +2855,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc,
+ 		return opt;
+ 
+ 	rc = selinux_add_opt(opt, param->string, &fc->security);
+-	if (!rc) {
++	if (!rc)
+ 		param->string = NULL;
+-		rc = 1;
+-	}
++
+ 	return rc;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-aspeed-correct-value-for-h-total-pixels.patch b/queue-5.4/media-aspeed-correct-value-for-h-total-pixels.patch
new file mode 100644
index 00000000000..2bcc6b88a29
--- /dev/null
+++ b/queue-5.4/media-aspeed-correct-value-for-h-total-pixels.patch
@@ -0,0 +1,74 @@
+From 4eda014c434004e4a8b48745d60e1916d447cab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 07:44:07 +0100
+Subject: media: aspeed: Correct value for h-total-pixels
+
+From: Jammy Huang <jammy_huang@aspeedtech.com>
+
+[ Upstream commit 4b732a0016853eaff35944f900b0db66f3914374 ]
+
+Previous reg-field, 0x98[11:0], stands for the period of the detected
+hsync signal.
+Use the correct reg, 0xa0, to get h-total in pixels.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index 1e0867016bf3..c87eddb1c93f 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -151,7 +151,7 @@
+ #define  VE_SRC_TB_EDGE_DET_BOT		GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF)
+ 
+ #define VE_MODE_DETECT_STATUS		0x098
+-#define  VE_MODE_DETECT_H_PIXELS	GENMASK(11, 0)
++#define  VE_MODE_DETECT_H_PERIOD	GENMASK(11, 0)
+ #define  VE_MODE_DETECT_V_LINES_SHF	16
+ #define  VE_MODE_DETECT_V_LINES		GENMASK(27, VE_MODE_DETECT_V_LINES_SHF)
+ #define  VE_MODE_DETECT_STATUS_VSYNC	BIT(28)
+@@ -162,6 +162,8 @@
+ #define  VE_SYNC_STATUS_VSYNC_SHF	16
+ #define  VE_SYNC_STATUS_VSYNC		GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF)
+ 
++#define VE_H_TOTAL_PIXELS		0x0A0
++
+ #define VE_INTERRUPT_CTRL		0x304
+ #define VE_INTERRUPT_STATUS		0x308
+ #define  VE_INTERRUPT_MODE_DETECT_WD	BIT(0)
+@@ -743,6 +745,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 	u32 src_lr_edge;
+ 	u32 src_tb_edge;
+ 	u32 sync;
++	u32 htotal;
+ 	struct v4l2_bt_timings *det = &video->detected_timings;
+ 
+ 	det->width = MIN_WIDTH;
+@@ -787,6 +790,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 		src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET);
+ 		mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS);
+ 		sync = aspeed_video_read(video, VE_SYNC_STATUS);
++		htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS);
+ 
+ 		video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >>
+ 			VE_SRC_TB_EDGE_DET_BOT_SHF;
+@@ -803,8 +807,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 			VE_SRC_LR_EDGE_DET_RT_SHF;
+ 		video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT;
+ 		det->hfrontporch = video->frame_left;
+-		det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) -
+-			video->frame_right;
++		det->hbackporch = htotal - video->frame_right;
+ 		det->hsync = sync & VE_SYNC_STATUS_HSYNC;
+ 		if (video->frame_left > video->frame_right)
+ 			continue;
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-bttv-fix-warning-regression-on-tunerless-devic.patch b/queue-5.4/media-bttv-fix-warning-regression-on-tunerless-devic.patch
new file mode 100644
index 00000000000..7368d730531
--- /dev/null
+++ b/queue-5.4/media-bttv-fix-warning-regression-on-tunerless-devic.patch
@@ -0,0 +1,50 @@
+From f8983e5684cb3e172ad9d9b7840f56e94ea87daa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Dec 2021 22:58:44 +0100
+Subject: media: bttv: fix WARNING regression on tunerless devices
+
+From: Ondrej Zary <linux@zary.sk>
+
+[ Upstream commit ef058cc8b7193d15a771272359c7454839ae74ee ]
+
+Commit 2161536516ed ("media: media/pci: set device_caps in struct video_device")
+introduced a regression: V4L2_CAP_TUNER is always present in device_caps,
+even when the device has no tuner.
+
+This causes a warning:
+WARNING: CPU: 0 PID: 249 at drivers/media/v4l2-core/v4l2-ioctl.c:1102 v4l_querycap+0xa0/0xb0 [videodev]
+
+Fixes: 2161536516ed ("media: media/pci: set device_caps in struct video_device")
+Signed-off-by: Ondrej Zary <linux@zary.sk>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 570530d976d2..6441e7d63d97 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -3898,7 +3898,7 @@ static int bttv_register_video(struct bttv *btv)
+ 
+ 	/* video */
+ 	vdev_init(btv, &btv->video_dev, &bttv_video_template, "video");
+-	btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER |
++	btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE |
+ 				     V4L2_CAP_READWRITE | V4L2_CAP_STREAMING;
+ 	if (btv->tuner_type != TUNER_ABSENT)
+ 		btv->video_dev.device_caps |= V4L2_CAP_TUNER;
+@@ -3919,7 +3919,7 @@ static int bttv_register_video(struct bttv *btv)
+ 	/* vbi */
+ 	vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi");
+ 	btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE |
+-				   V4L2_CAP_STREAMING | V4L2_CAP_TUNER;
++				   V4L2_CAP_STREAMING;
+ 	if (btv->tuner_type != TUNER_ABSENT)
+ 		btv->vbi_dev.device_caps |= V4L2_CAP_TUNER;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-coda-fix-missing-put_device-call-in-coda_get_v.patch b/queue-5.4/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
new file mode 100644
index 00000000000..9cbd39bb6e7
--- /dev/null
+++ b/queue-5.4/media-coda-fix-missing-put_device-call-in-coda_get_v.patch
@@ -0,0 +1,37 @@
+From 1a9dd45a95bc0a02e07c6ea4343f31b032a22447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jan 2022 12:05:54 +0100
+Subject: media: coda: Fix missing put_device() call in coda_get_vdoa_data
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ca85d271531a1e1c86f24b892f57b7d0a3ddb5a6 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+Add the corresponding 'put_device()' in the error handling path.
+
+Fixes: e7f3c5481035 ("[media] coda: use VDOA for un-tiling custom macroblock format")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 834f11fe9dc2..0adc54832657 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -372,6 +372,7 @@ static struct vdoa_data *coda_get_vdoa_data(void)
+ 	if (!vdoa_data)
+ 		vdoa_data = ERR_PTR(-EPROBE_DEFER);
+ 
++	put_device(&vdoa_pdev->dev);
+ out:
+ 	of_node_put(vdoa_node);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-cx88-mpeg-clear-interrupt-status-register-befo.patch b/queue-5.4/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
new file mode 100644
index 00000000000..c1b9c2e01ae
--- /dev/null
+++ b/queue-5.4/media-cx88-mpeg-clear-interrupt-status-register-befo.patch
@@ -0,0 +1,47 @@
+From 1d9e659d39d572b8fd5ac2981f16706a2ab27a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 19:19:50 +0100
+Subject: media: cx88-mpeg: clear interrupt status register before streaming
+ video
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel González Cabanelas <dgcbueu@gmail.com>
+
+[ Upstream commit 56cb61f70e547e1b0cdfe6ff5a1f1ce6242e6d96 ]
+
+Some cx88 video cards may have transport stream status interrupts set
+to 1 from cold start, causing errors like this:
+
+  cx88xx: cx88_print_irqbits: core:irq mpeg  [0x100000] ts_err?*
+  cx8802: cx8802_mpeg_irq: mpeg:general errors: 0x00100000
+
+According to CX2388x datasheet, the interrupt status register should be
+cleared before enabling IRQs to stream video.
+
+Fix it by clearing the Transport Stream Interrupt Status register.
+
+Signed-off-by: Daniel González Cabanelas <dgcbueu@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx88/cx88-mpeg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
+index a57c991b165b..10d2971ef062 100644
+--- a/drivers/media/pci/cx88/cx88-mpeg.c
++++ b/drivers/media/pci/cx88/cx88-mpeg.c
+@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev    *dev,
+ 	cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET);
+ 	q->count = 0;
+ 
++	/* clear interrupt status register */
++	cx_write(MO_TS_INTSTAT,  0x1f1111);
++
+ 	/* enable irqs */
+ 	dprintk(1, "setting the interrupt mask\n");
+ 	cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT);
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-em28xx-initialize-refcount-before-kref_get.patch b/queue-5.4/media-em28xx-initialize-refcount-before-kref_get.patch
new file mode 100644
index 00000000000..83486a69110
--- /dev/null
+++ b/queue-5.4/media-em28xx-initialize-refcount-before-kref_get.patch
@@ -0,0 +1,66 @@
+From b0b53616889e788272ee4edb70e962cb7d3a33f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:44:59 +0800
+Subject: media: em28xx: initialize refcount before kref_get
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ]
+
+The commit 47677e51e2a4("[media] em28xx: Only deallocate struct
+em28xx after finishing all extensions") adds kref_get to many init
+functions (e.g., em28xx_audio_init). However, kref_init is called too
+late in em28xx_usb_probe, since em28xx_init_dev before will invoke
+those init functions and call kref_get function. Then refcount bug
+occurs in my local syzkaller instance.
+
+Fix it by moving kref_init before em28xx_init_dev. This issue occurs
+not only in dev but also dev->dev_next.
+
+Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index bfca9d0a1fe1..885ccb840ab0 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -3821,6 +3821,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 		goto err_free;
+ 	}
+ 
++	kref_init(&dev->ref);
++
+ 	dev->devno = nr;
+ 	dev->model = id->driver_info;
+ 	dev->alt   = -1;
+@@ -3921,6 +3923,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) {
++		kref_init(&dev->dev_next->ref);
++
+ 		dev->dev_next->ts = SECONDARY_TS;
+ 		dev->dev_next->alt   = -1;
+ 		dev->dev_next->is_audio_only = has_vendor_audio &&
+@@ -3975,12 +3979,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 			em28xx_write_reg(dev, 0x0b, 0x82);
+ 			mdelay(100);
+ 		}
+-
+-		kref_init(&dev->dev_next->ref);
+ 	}
+ 
+-	kref_init(&dev->ref);
+-
+ 	request_modules(dev);
+ 
+ 	/*
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-hantro-fix-overfill-bottom-register-field-name.patch b/queue-5.4/media-hantro-fix-overfill-bottom-register-field-name.patch
new file mode 100644
index 00000000000..cf4ace7fd1a
--- /dev/null
+++ b/queue-5.4/media-hantro-fix-overfill-bottom-register-field-name.patch
@@ -0,0 +1,64 @@
+From 24726de4f5f9348046633ef50a924aef62b4be87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jan 2022 10:34:49 +0100
+Subject: media: hantro: Fix overfill bottom register field name
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 89d78e0133e71ba324fb67ca776223fba4353418 ]
+
+The Hantro H1 hardware can crop off pixels from the right and bottom of
+the source frame. These are controlled with the H1_REG_IN_IMG_CTRL_OVRFLB
+and H1_REG_IN_IMG_CTRL_OVRFLR in the H1_REG_IN_IMG_CTRL register.
+
+The ChromeOS kernel driver that this was based on incorrectly added the
+_D4 suffix H1_REG_IN_IMG_CTRL_OVRFLB. This field crops the bottom of the
+input frame, and the number is _not_ divided by 4. [1]
+
+Correct the name to avoid confusion when crop support with the selection
+API is added.
+
+[1] https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/ \
+	heads/chromeos-4.19/drivers/staging/media/hantro/hantro_h1_vp8_enc.c#377
+
+Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
+Fixes: a29add8c9bb2 ("media: rockchip/vpu: rename from rockchip to hantro")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +-
+ drivers/staging/media/hantro/hantro_h1_regs.h     | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+index 8b76f1f13b06..e81a354b8872 100644
+--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c
+@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu,
+ 
+ 	reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width)
+ 		| H1_REG_IN_IMG_CTRL_OVRFLR_D4(0)
+-		| H1_REG_IN_IMG_CTRL_OVRFLB_D4(0)
++		| H1_REG_IN_IMG_CTRL_OVRFLB(0)
+ 		| H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt);
+ 	vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL);
+ }
+diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h
+index d6e9825bb5c7..30e7e7b920b5 100644
+--- a/drivers/staging/media/hantro/hantro_h1_regs.h
++++ b/drivers/staging/media/hantro/hantro_h1_regs.h
+@@ -47,7 +47,7 @@
+ #define H1_REG_IN_IMG_CTRL				0x03c
+ #define     H1_REG_IN_IMG_CTRL_ROW_LEN(x)		((x) << 12)
+ #define     H1_REG_IN_IMG_CTRL_OVRFLR_D4(x)		((x) << 10)
+-#define     H1_REG_IN_IMG_CTRL_OVRFLB_D4(x)		((x) << 6)
++#define     H1_REG_IN_IMG_CTRL_OVRFLB(x)		((x) << 6)
+ #define     H1_REG_IN_IMG_CTRL_FMT(x)			((x) << 2)
+ #define H1_REG_ENC_CTRL0				0x040
+ #define    H1_REG_ENC_CTRL0_INIT_QP(x)			((x) << 26)
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch b/queue-5.4/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
new file mode 100644
index 00000000000..db36a9230a9
--- /dev/null
+++ b/queue-5.4/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
@@ -0,0 +1,61 @@
+From ae82c5eb72c67763e56c27fcb0b25086332ca8eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Feb 2022 10:41:30 +0100
+Subject: media: hdpvr: initialize dev->worker at hdpvr_register_videodev
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 07922937e9a580825f9965c46fd15e23ba5754b6 ]
+
+hdpvr_register_videodev is responsible to initialize a worker in
+hdpvr_device. However, the worker is only initialized at
+hdpvr_start_streaming other than hdpvr_register_videodev.
+When hdpvr_probe does not initialize its worker, the hdpvr_disconnect
+will encounter one WARN in flush_work.The stack trace is as follows:
+
+ hdpvr_disconnect+0xb8/0xf2 drivers/media/usb/hdpvr/hdpvr-core.c:425
+ usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
+ __device_release_driver drivers/base/dd.c:1206 [inline]
+ device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1237
+ bus_remove_device+0x108/0x160 drivers/base/bus.c:529
+ device_del+0x1fe/0x510 drivers/base/core.c:3592
+ usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
+ usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2228
+
+Fix this by moving the initialization of dev->worker to the starting of
+hdpvr_register_videodev
+
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/hdpvr/hdpvr-video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index bad71d863d39..7849f1fbbcc4 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
+ 
+ 	dev->status = STATUS_STREAMING;
+ 
+-	INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
+ 	schedule_work(&dev->worker);
+ 
+ 	v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
+@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
+ 	bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP;
+ 	int res;
+ 
++	// initialize dev->worker
++	INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
++
+ 	dev->cur_std = V4L2_STD_525_60;
+ 	dev->width = 720;
+ 	dev->height = 480;
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-revert-media-em28xx-add-missing-em28xx_close_e.patch b/queue-5.4/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
new file mode 100644
index 00000000000..63954660de8
--- /dev/null
+++ b/queue-5.4/media-revert-media-em28xx-add-missing-em28xx_close_e.patch
@@ -0,0 +1,50 @@
+From 5df5932749a0b98129d01ebfebbdf21b34d73aa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 20:37:30 +0100
+Subject: media: Revert "media: em28xx: add missing em28xx_close_extension"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit fde18c3bac3f964d8333ae53b304d8fee430502b ]
+
+This reverts commit 2c98b8a3458df03abdc6945bbef67ef91d181938.
+
+Reverted patch causes problems with Hauppauge WinTV dualHD as Maximilian
+reported [1]. Since quick solution didn't come up let's just revert it
+to make this device work with upstream kernels.
+
+Link: https://lore.kernel.org/all/6a72a37b-e972-187d-0322-16336e12bdc5@elbmurf.de/ [1]
+
+Reported-by: Maximilian Böhm <maximilian.boehm@elbmurf.de>
+Tested-by: Maximilian Böhm <maximilian.boehm@elbmurf.de>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 885ccb840ab0..5ae13ee9272d 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4035,11 +4035,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+ 
+ 	em28xx_close_extension(dev);
+ 
+-	if (dev->dev_next) {
+-		em28xx_close_extension(dev->dev_next);
++	if (dev->dev_next)
+ 		em28xx_release_resources(dev->dev_next);
+-	}
+-
+ 	em28xx_release_resources(dev);
+ 
+ 	if (dev->dev_next) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-stk1160-if-start-stream-fails-return-buffers-w.patch b/queue-5.4/media-stk1160-if-start-stream-fails-return-buffers-w.patch
new file mode 100644
index 00000000000..8ef71d3b6d6
--- /dev/null
+++ b/queue-5.4/media-stk1160-if-start-stream-fails-return-buffers-w.patch
@@ -0,0 +1,143 @@
+From 70a13d881d0d2de159a8621cd41f82d5a27dd659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jan 2022 09:02:11 +0100
+Subject: media: stk1160: If start stream fails, return buffers with
+ VB2_BUF_STATE_QUEUED
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ]
+
+If the callback 'start_streaming' fails, then all
+queued buffers in the driver should be returned with
+state 'VB2_BUF_STATE_QUEUED'. Currently, they are
+returned with 'VB2_BUF_STATE_ERROR' which is wrong.
+Fix this. This also fixes the warning:
+
+[   65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6
+[   65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G        W         5.16.0-rc4-62408-g32447129cb30-dirty #14
+[   65.590293] Hardware name: Radxa ROCK Pi 4B (DT)
+[   65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common]
+[   65.592395] sp : ffff800012bc3ad0
+[   65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8
+[   65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612
+[   65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0
+[   65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff
+[   65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78
+[   65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce
+[   65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228
+[   65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78
+[   65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880
+[   65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0
+[   65.598940] Call trace:
+[   65.599155]  vb2_start_streaming+0xd4/0x160 [videobuf2_common]
+[   65.599672]  vb2_core_streamon+0x17c/0x1a8 [videobuf2_common]
+[   65.600179]  vb2_streamon+0x54/0x88 [videobuf2_v4l2]
+[   65.600619]  vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2]
+[   65.601103]  v4l_streamon+0x3c/0x50 [videodev]
+[   65.601521]  __video_do_ioctl+0x1a4/0x428 [videodev]
+[   65.601977]  video_usercopy+0x320/0x828 [videodev]
+[   65.602419]  video_ioctl2+0x3c/0x58 [videodev]
+[   65.602830]  v4l2_ioctl+0x60/0x90 [videodev]
+[   65.603227]  __arm64_sys_ioctl+0xa8/0xe0
+[   65.603576]  invoke_syscall+0x54/0x118
+[   65.603911]  el0_svc_common.constprop.3+0x84/0x100
+[   65.604332]  do_el0_svc+0x34/0xa0
+[   65.604625]  el0_svc+0x1c/0x50
+[   65.604897]  el0t_64_sync_handler+0x88/0xb0
+[   65.605264]  el0t_64_sync+0x16c/0x170
+[   65.605587] ---[ end trace 578e0ba07742170d ]---
+
+Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails")
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stk1160/stk1160-core.c |  2 +-
+ drivers/media/usb/stk1160/stk1160-v4l.c  | 10 +++++-----
+ drivers/media/usb/stk1160/stk1160.h      |  2 +-
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
+index 4e1698f78818..ce717502ea4c 100644
+--- a/drivers/media/usb/stk1160/stk1160-core.c
++++ b/drivers/media/usb/stk1160/stk1160-core.c
+@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface)
+ 	/* Here is the only place where isoc get released */
+ 	stk1160_uninit_isoc(dev);
+ 
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+ 
+ 	video_unregister_device(&dev->vdev);
+ 	v4l2_device_disconnect(&dev->v4l2_dev);
+diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c
+index bcd14c66e8df..a307807571ab 100644
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -258,7 +258,7 @@ static int stk1160_start_streaming(struct stk1160 *dev)
+ 	stk1160_uninit_isoc(dev);
+ out_stop_hw:
+ 	usb_set_interface(dev->udev, 0, 0);
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED);
+ 
+ 	mutex_unlock(&dev->v4l_lock);
+ 
+@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev)
+ 
+ 	stk1160_stop_hw(dev);
+ 
+-	stk1160_clear_queue(dev);
++	stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+ 
+ 	stk1160_dbg("streaming stopped\n");
+ 
+@@ -745,7 +745,7 @@ static const struct video_device v4l_template = {
+ /********************************************************************/
+ 
+ /* Must be called with both v4l_lock and vb_queue_lock hold */
+-void stk1160_clear_queue(struct stk1160 *dev)
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state)
+ {
+ 	struct stk1160_buffer *buf;
+ 	unsigned long flags;
+@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ 		buf = list_first_entry(&dev->avail_bufs,
+ 			struct stk1160_buffer, list);
+ 		list_del(&buf->list);
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ 		stk1160_dbg("buffer [%p/%d] aborted\n",
+ 			    buf, buf->vb.vb2_buf.index);
+ 	}
+@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ 		buf = dev->isoc_ctl.buf;
+ 		dev->isoc_ctl.buf = NULL;
+ 
+-		vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++		vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ 		stk1160_dbg("buffer [%p/%d] aborted\n",
+ 			    buf, buf->vb.vb2_buf.index);
+ 	}
+diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h
+index a31ea1c80f25..a70963ce8753 100644
+--- a/drivers/media/usb/stk1160/stk1160.h
++++ b/drivers/media/usb/stk1160/stk1160.h
+@@ -166,7 +166,7 @@ struct regval {
+ int stk1160_vb2_setup(struct stk1160 *dev);
+ int stk1160_video_register(struct stk1160 *dev);
+ void stk1160_video_unregister(struct stk1160 *dev);
+-void stk1160_clear_queue(struct stk1160 *dev);
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state);
+ 
+ /* Provided by stk1160-video.c */
+ int stk1160_alloc_isoc(struct stk1160 *dev);
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-usb-go7007-s2250-board-fix-leak-in-probe.patch b/queue-5.4/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
new file mode 100644
index 00000000000..dc6644de2b8
--- /dev/null
+++ b/queue-5.4/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
@@ -0,0 +1,57 @@
+From 1d9b063ad7af21023072460e1e60931d269ddb21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 20:52:01 +0300
+Subject: media: usb: go7007: s2250-board: fix leak in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 67e4550ecd6164bfbdff54c169e5bbf9ccfaf14d ]
+
+Call i2c_unregister_device(audio) on this error path.
+
+Fixes: d3b2ccd9e307 ("[media] s2250: convert to the control framework")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/s2250-board.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c
+index 49e75a1a1f3f..af3b18c6d9e1 100644
+--- a/drivers/media/usb/go7007/s2250-board.c
++++ b/drivers/media/usb/go7007/s2250-board.c
+@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client,
+ 	u8 *data;
+ 	struct go7007 *go = i2c_get_adapdata(adapter);
+ 	struct go7007_usb *usb = go->hpi_context;
++	int err = -EIO;
+ 
+ 	audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1);
+ 	if (IS_ERR(audio))
+@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client,
+ 		V4L2_CID_HUE, -512, 511, 1, 0);
+ 	sd->ctrl_handler = &state->hdl;
+ 	if (state->hdl.error) {
+-		int err = state->hdl.error;
+-
+-		v4l2_ctrl_handler_free(&state->hdl);
+-		kfree(state);
+-		return err;
++		err = state->hdl.error;
++		goto fail;
+ 	}
+ 
+ 	state->std = V4L2_STD_NTSC;
+@@ -600,7 +598,7 @@ static int s2250_probe(struct i2c_client *client,
+ 	i2c_unregister_device(audio);
+ 	v4l2_ctrl_handler_free(&state->hdl);
+ 	kfree(state);
+-	return -EIO;
++	return err;
+ }
+ 
+ static int s2250_remove(struct i2c_client *client)
+-- 
+2.34.1
+
diff --git a/queue-5.4/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch b/queue-5.4/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
new file mode 100644
index 00000000000..37348e87858
--- /dev/null
+++ b/queue-5.4/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
@@ -0,0 +1,66 @@
+From b79e4abed8c373c8ed0b885b2e50f23d407ec86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 19:01:46 +0200
+Subject: media: video/hdmi: handle short reads of hdmi info frame.
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ]
+
+Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
+the size checking done later in hdmi_infoframe_unpack().  A better
+value is the amount of data read into buffer.
+
+Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7511-v4l2.c | 2 +-
+ drivers/media/i2c/adv7604.c      | 2 +-
+ drivers/media/i2c/adv7842.c      | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
+index 809fa44ed988..86267e01c251 100644
+--- a/drivers/media/i2c/adv7511-v4l2.c
++++ b/drivers/media/i2c/adv7511-v4l2.c
+@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_
+ 	buffer[3] = 0;
+ 	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
+ 
+-	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+ 		return;
+ 	}
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index b887299ac195..1cee69919e1b 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index,
+ 		buffer[i + 3] = infoframe_read(sd,
+ 				       adv76xx_cri[index].payload_addr + i);
+ 
+-	if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,
+ 			 adv76xx_cri[index].desc);
+ 		return -ENOENT;
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 02cbab826d0b..a581e822ce6f 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr
+ 	for (i = 0; i < len; i++)
+ 		buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);
+ 
+-	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
++	if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {
+ 		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+ 		return;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/memory-emif-add-check-for-setup_interrupts.patch b/queue-5.4/memory-emif-add-check-for-setup_interrupts.patch
new file mode 100644
index 00000000000..84080bd352c
--- /dev/null
+++ b/queue-5.4/memory-emif-add-check-for-setup_interrupts.patch
@@ -0,0 +1,49 @@
+From 7357063cddbbf5acebfea0969432ec3a537f0034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:54:44 +0800
+Subject: memory: emif: Add check for setup_interrupts
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit fd7bd80b46373887b390852f490f21b07e209498 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value of the
+setup_interrupts() and return error if fails.
+
+Fixes: 68b4aee35d1f ("memory: emif: add interrupt and temperature handling")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220224025444.3256530-1-jiasheng@iscas.ac.cn
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/emif.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index af296b6fcbbd..0d6b975616bb 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -1515,7 +1515,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ {
+ 	struct emif_data	*emif;
+ 	struct resource		*res;
+-	int			irq;
++	int			irq, ret;
+ 
+ 	if (pdev->dev.of_node)
+ 		emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev);
+@@ -1549,7 +1549,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ 	emif_onetime_settings(emif);
+ 	emif_debugfs_init(emif);
+ 	disable_and_clear_all_interrupts(emif);
+-	setup_interrupts(emif, irq);
++	ret = setup_interrupts(emif, irq);
++	if (ret)
++		goto error;
+ 
+ 	/* One-time actions taken on probing the first device */
+ 	if (!emif1) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/memory-emif-check-the-pointer-temp-in-get_device_det.patch b/queue-5.4/memory-emif-check-the-pointer-temp-in-get_device_det.patch
new file mode 100644
index 00000000000..d5729479c9c
--- /dev/null
+++ b/queue-5.4/memory-emif-check-the-pointer-temp-in-get_device_det.patch
@@ -0,0 +1,37 @@
+From 5dc5b742689d1cfd6504f18e336397ff138bcb33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 05:25:52 -0800
+Subject: memory: emif: check the pointer temp in get_device_details()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 5b5ab1bfa1898c6d52936a57c25c5ceba2cb2f87 ]
+
+The pointer temp is allocated by devm_kzalloc(), so it should be
+checked for error handling.
+
+Fixes: 7ec944538dde ("memory: emif: add basic infrastructure for EMIF driver")
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20220225132552.27894-1-baijiaju1990@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/emif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index 0d6b975616bb..9c4c668f9a88 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -1423,7 +1423,7 @@ static struct emif_data *__init_or_module get_device_details(
+ 	temp	= devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+ 	dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL);
+ 
+-	if (!emif || !pd || !dev_info) {
++	if (!emif || !temp || !dev_info) {
+ 		dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__);
+ 		goto error;
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch b/queue-5.4/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
new file mode 100644
index 00000000000..022df07a9a9
--- /dev/null
+++ b/queue-5.4/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
@@ -0,0 +1,59 @@
+From 11141e74b3f82a329ef38f6a2289d6ed8d27d0aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 07:29:47 +0000
+Subject: mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit e84ee1a75f944a0fe3c277aaa10c426603d2b0bc ]
+
+Add the missing iounmap() before return from asic3_mfd_probe
+in the error handling case.
+
+Fixes: 64e8867ba809 ("mfd: tmio_mmc hardware abstraction for CNF area")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20220307072947.5369-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/asic3.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
+index a6bd2134cea2..14e4bbe6a9da 100644
+--- a/drivers/mfd/asic3.c
++++ b/drivers/mfd/asic3.c
+@@ -914,14 +914,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ 		ret = mfd_add_devices(&pdev->dev, pdev->id,
+ 			&asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL);
+ 		if (ret < 0)
+-			goto out;
++			goto out_unmap;
+ 	}
+ 
+ 	if (mem_sdio && (irq >= 0)) {
+ 		ret = mfd_add_devices(&pdev->dev, pdev->id,
+ 			&asic3_cell_mmc, 1, mem_sdio, irq, NULL);
+ 		if (ret < 0)
+-			goto out;
++			goto out_unmap;
+ 	}
+ 
+ 	ret = 0;
+@@ -935,8 +935,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ 		ret = mfd_add_devices(&pdev->dev, 0,
+ 			asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL);
+ 	}
++	return ret;
+ 
+- out:
++out_unmap:
++	if (asic->tmio_cnf)
++		iounmap(asic->tmio_cnf);
++out:
+ 	return ret;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch b/queue-5.4/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
new file mode 100644
index 00000000000..8443ac05b26
--- /dev/null
+++ b/queue-5.4/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
@@ -0,0 +1,41 @@
+From 2b4c084ac5d632e1cf07441fb83816222dc062b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:23:31 +0800
+Subject: mfd: mc13xxx: Add check for mc13xxx_irq_request
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit e477e51a41cb5d6034f3c5ea85a71ad4613996b9 ]
+
+As the potential failure of the devm_request_threaded_irq(),
+it should be better to check the return value of the
+mc13xxx_irq_request() and return error if fails.
+
+Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20220224022331.3208275-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index 1abe7432aad8..e281a9202f11 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ 		adc1 |= MC13783_ADC1_ATOX;
+ 
+ 	dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__);
+-	mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
++	ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
+ 			mc13xxx_handler_adcdone, __func__, &adcdone_data);
++	if (ret)
++		goto out;
+ 
+ 	mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0);
+ 	mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1);
+-- 
+2.34.1
+
diff --git a/queue-5.4/mips-dec-honor-config_mips_fp_support-n.patch b/queue-5.4/mips-dec-honor-config_mips_fp_support-n.patch
new file mode 100644
index 00000000000..14c357e6868
--- /dev/null
+++ b/queue-5.4/mips-dec-honor-config_mips_fp_support-n.patch
@@ -0,0 +1,80 @@
+From fe899312dcc8cb1ec3537eba67eee81f14b3b662 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 08:24:27 -0800
+Subject: mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 97bf0395c226907e1a9b908511a35192bf1e09bb ]
+
+Include the DECstation interrupt handler in opting out of
+FPU support.
+
+Fixes a linker error:
+
+mips-linux-ld: arch/mips/dec/int-handler.o: in function `fpu':
+(.text+0x148): undefined reference to `handle_fpe_int'
+
+Fixes: 183b40f992c8 ("MIPS: Allow FP support to be disabled")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Paul Burton <paulburton@kernel.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: Maciej W. Rozycki <macro@orcam.me.uk>
+Cc: linux-mips@vger.kernel.org
+Acked-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/dec/int-handler.S | 6 +++---
+ arch/mips/dec/setup.c       | 3 ++-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
+index a25ef822e725..5ed38e618019 100644
+--- a/arch/mips/dec/int-handler.S
++++ b/arch/mips/dec/int-handler.S
+@@ -131,7 +131,7 @@
+ 		 */
+ 		mfc0	t0,CP0_CAUSE		# get pending interrupts
+ 		mfc0	t1,CP0_STATUS
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ 		lw	t2,cpu_fpu_mask
+ #endif
+ 		andi	t0,ST0_IM		# CAUSE.CE may be non-zero!
+@@ -139,7 +139,7 @@
+ 
+ 		beqz	t0,spurious
+ 
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ 		 and	t2,t0
+ 		bnez	t2,fpu			# handle FPU immediately
+ #endif
+@@ -280,7 +280,7 @@ handle_it:
+ 		j	dec_irq_dispatch
+ 		 nop
+ 
+-#ifdef CONFIG_32BIT
++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
+ fpu:
+ 		lw	t0,fpu_kstat_irq
+ 		nop
+diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
+index 1fc8dffa8d1d..649b50ae5b1e 100644
+--- a/arch/mips/dec/setup.c
++++ b/arch/mips/dec/setup.c
+@@ -766,7 +766,8 @@ void __init arch_init_irq(void)
+ 		dec_interrupt[DEC_IRQ_HALT] = -1;
+ 
+ 	/* Register board interrupts: FPU and cascade. */
+-	if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) {
++	if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) &&
++	    dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) {
+ 		struct irq_desc *desc_fpu;
+ 		int irq_fpu;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/mips-rb532-fix-return-value-of-__setup-handler.patch b/queue-5.4/mips-rb532-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..645a0d029a0
--- /dev/null
+++ b/queue-5.4/mips-rb532-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,57 @@
+From c18dc155b9f1ceda15666cd123b3a0bde2aaf189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 20:20:26 -0800
+Subject: MIPS: RB532: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 8755d57ba1ff910666572fab9e32890e8cc6ed3b ]
+
+__setup() handlers should return 1 to obsolete_checksetup() in
+init/main.c to indicate that the boot option has been handled.
+A return of 0 causes the boot option/value to be listed as an Unknown
+kernel parameter and added to init's (limited) argument or environment
+strings. Also, error return codes don't mean anything to
+obsolete_checksetup() -- only non-zero (usually 1) or zero.
+So return 1 from setup_kmac().
+
+Fixes: 9e21c7e40b7e ("MIPS: RB532: Replace parse_mac_addr() with mac_pton().")
+Fixes: 73b4390fb234 ("[MIPS] Routerboard 532: Support for base system")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+From: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Phil Sutter <n0-1@freewrt.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Daniel Walter <dwalter@google.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/rb532/devices.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
+index c9ecf17f8660..74808619fefe 100644
+--- a/arch/mips/rb532/devices.c
++++ b/arch/mips/rb532/devices.c
+@@ -310,11 +310,9 @@ static int __init plat_setup_devices(void)
+ static int __init setup_kmac(char *s)
+ {
+ 	printk(KERN_INFO "korina mac = %s\n", s);
+-	if (!mac_pton(s, korina_dev0_data.mac)) {
++	if (!mac_pton(s, korina_dev0_data.mac))
+ 		printk(KERN_ERR "Invalid mac\n");
+-		return -EINVAL;
+-	}
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("kmac=", setup_kmac);
+-- 
+2.34.1
+
diff --git a/queue-5.4/misc-alcor_pci-fix-an-error-handling-path.patch b/queue-5.4/misc-alcor_pci-fix-an-error-handling-path.patch
new file mode 100644
index 00000000000..a24747b787f
--- /dev/null
+++ b/queue-5.4/misc-alcor_pci-fix-an-error-handling-path.patch
@@ -0,0 +1,72 @@
+From dec26a91c88c568179ff7d22735491ec5ee9b6ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 09:39:54 +0100
+Subject: misc: alcor_pci: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5b3dc949f554379edcb8ef6111aa5ecb78feb798 ]
+
+A successful ida_simple_get() should be balanced by a corresponding
+ida_simple_remove().
+
+Add the missing call in the error handling path of the probe.
+
+While at it, switch to ida_alloc()/ida_free() instead to
+ida_simple_get()/ida_simple_remove().
+The latter is deprecated and more verbose.
+
+Fixes: 4f556bc04e3c ("misc: cardreader: add new Alcor Micro Cardreader PCI driver")
+Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/918a9875b7f67b7f8f123c4446452603422e8c5e.1644136776.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cardreader/alcor_pci.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c
+index 1fadb95b85b0..ba5d5c102b3c 100644
+--- a/drivers/misc/cardreader/alcor_pci.c
++++ b/drivers/misc/cardreader/alcor_pci.c
+@@ -260,7 +260,7 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL);
++	ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL);
+ 	if (ret < 0)
+ 		return ret;
+ 	priv->id = ret;
+@@ -274,7 +274,8 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 	ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Cannot request region\n");
+-		return -ENOMEM;
++		ret = -ENOMEM;
++		goto error_free_ida;
+ 	}
+ 
+ 	if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) {
+@@ -318,6 +319,8 @@ static int alcor_pci_probe(struct pci_dev *pdev,
+ 
+ error_release_regions:
+ 	pci_release_regions(pdev);
++error_free_ida:
++	ida_free(&alcor_pci_idr, priv->id);
+ 	return ret;
+ }
+ 
+@@ -331,7 +334,7 @@ static void alcor_pci_remove(struct pci_dev *pdev)
+ 
+ 	mfd_remove_devices(&pdev->dev);
+ 
+-	ida_simple_remove(&alcor_pci_idr, priv->id);
++	ida_free(&alcor_pci_idr, priv->id);
+ 
+ 	pci_release_regions(pdev);
+ 	pci_set_drvdata(pdev, NULL);
+-- 
+2.34.1
+
diff --git a/queue-5.4/mmc-davinci_mmc-handle-error-for-clk_enable.patch b/queue-5.4/mmc-davinci_mmc-handle-error-for-clk_enable.patch
new file mode 100644
index 00000000000..500a898793f
--- /dev/null
+++ b/queue-5.4/mmc-davinci_mmc-handle-error-for-clk_enable.patch
@@ -0,0 +1,43 @@
+From e46be18b6b34150e370b07a9cd51b2c01541f807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 15:14:15 +0800
+Subject: mmc: davinci_mmc: Handle error for clk_enable
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 09e7af76db02c74f2a339b3cb2d95460fa2ddbe4 ]
+
+As the potential failure of the clk_enable(),
+it should be better to check it and return error
+if fails.
+
+Fixes: bbce5802afc5 ("davinci: mmc: updates to suspend/resume implementation")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220308071415.1093393-1-jiasheng@iscas.ac.cn
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/davinci_mmc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
+index ebfaeb33bc8c..ade7c022a33c 100644
+--- a/drivers/mmc/host/davinci_mmc.c
++++ b/drivers/mmc/host/davinci_mmc.c
+@@ -1376,8 +1376,12 @@ static int davinci_mmcsd_suspend(struct device *dev)
+ static int davinci_mmcsd_resume(struct device *dev)
+ {
+ 	struct mmc_davinci_host *host = dev_get_drvdata(dev);
++	int ret;
++
++	ret = clk_enable(host->clk);
++	if (ret)
++		return ret;
+ 
+-	clk_enable(host->clk);
+ 	mmc_davinci_reset_ctrl(host, 0);
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch b/queue-5.4/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
new file mode 100644
index 00000000000..a8df629aeac
--- /dev/null
+++ b/queue-5.4/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
@@ -0,0 +1,60 @@
+From e93502dfbd38fdb4f6abedf055e5c965f7a0b5fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:51:42 +0100
+Subject: mmc: host: Return an error when ->enable_sdio_irq() ops is missing
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit d6c9219ca1139b74541b2a98cee47a3426d754a9 ]
+
+Even if the current WARN() notifies the user that something is severely
+wrong, we can still end up in a PANIC() when trying to invoke the missing
+->enable_sdio_irq() ops. Therefore, let's also return an error code and
+prevent the host from being added.
+
+While at it, move the code into a separate function to prepare for
+subsequent changes and for further host caps validations.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://lore.kernel.org/r/20220303165142.129745-1-ulf.hansson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/host.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index e955f1ef2564..32801639e0be 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -497,6 +497,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+ 
+ EXPORT_SYMBOL(mmc_alloc_host);
+ 
++static int mmc_validate_host_caps(struct mmc_host *host)
++{
++	if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) {
++		dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ /**
+  *	mmc_add_host - initialise host hardware
+  *	@host: mmc host
+@@ -509,8 +519,9 @@ int mmc_add_host(struct mmc_host *host)
+ {
+ 	int err;
+ 
+-	WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) &&
+-		!host->ops->enable_sdio_irq);
++	err = mmc_validate_host_caps(host);
++	if (err)
++		return err;
+ 
+ 	err = device_add(&host->class_dev);
+ 	if (err)
+-- 
+2.34.1
+
diff --git a/queue-5.4/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch b/queue-5.4/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
new file mode 100644
index 00000000000..3f43f8670fe
--- /dev/null
+++ b/queue-5.4/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
@@ -0,0 +1,37 @@
+From f161b55689c864755d9b113dd67582a6beeebc2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:58:57 +0100
+Subject: mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fc8e2c707ce11c8ec2e992885b0d53a5e04031ac ]
+
+Check sta_rates pointer value in mt7603_sta_rate_tbl_update routine
+since minstrel_ht_update_rates can fail allocating rates array.
+
+Fixes: c8846e1015022 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+index 0a5695c3d924..625492284389 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+@@ -605,6 +605,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates);
+ 	int i;
+ 
++	if (!sta_rates)
++		return;
++
+ 	spin_lock_bh(&dev->mt76.lock);
+ 	for (i = 0; i < ARRAY_SIZE(msta->rates); i++) {
+ 		msta->rates[i].idx = sta_rates->rate[i].idx;
+-- 
+2.34.1
+
diff --git a/queue-5.4/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch b/queue-5.4/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
new file mode 100644
index 00000000000..c113febfad7
--- /dev/null
+++ b/queue-5.4/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
@@ -0,0 +1,37 @@
+From 0618010567a5f6390665bffa35247d520fa8872a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jan 2022 15:58:58 +0100
+Subject: mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 6a6f457ed5fdf6777536c20644a9e42128a50ec2 ]
+
+Check sta_rates pointer value in mt7615_sta_rate_tbl_update routine
+since minstrel_ht_update_rates can fail allocating rates array.
+
+Fixes: 04b8e65922f63 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+index 38183aef0eb9..5ad8b0afa41f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c
+@@ -385,6 +385,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw,
+ 	struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates);
+ 	int i;
+ 
++	if (!sta_rates)
++		return;
++
+ 	spin_lock_bh(&dev->mt76.lock);
+ 	for (i = 0; i < ARRAY_SIZE(msta->rates); i++) {
+ 		msta->rates[i].idx = sta_rates->rate[i].idx;
+-- 
+2.34.1
+
diff --git a/queue-5.4/mtd-onenand-check-for-error-irq.patch b/queue-5.4/mtd-onenand-check-for-error-irq.patch
new file mode 100644
index 00000000000..ef19d37caed
--- /dev/null
+++ b/queue-5.4/mtd-onenand-check-for-error-irq.patch
@@ -0,0 +1,47 @@
+From ed67e1ae102ab5accf79e73781c23edbbd1fcacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jan 2022 00:26:58 +0800
+Subject: mtd: onenand: Check for error irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 3e68f331c8c759c0daa31cc92c3449b23119a215 ]
+
+For the possible failure of the platform_get_irq(), the returned irq
+could be error number and will finally cause the failure of the
+request_irq().
+Consider that platform_get_irq() can now in certain cases return
+-EPROBE_DEFER, and the consequences of letting request_irq() effectively
+convert that into -EINVAL, even at probe time rather than later on.
+So it might be better to check just now.
+
+Fixes: 2c22120fbd01 ("MTD: OneNAND: interrupt based wait support")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220104162658.1988142-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/onenand/generic.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c
+index 8b6f4da5d720..a4b8b65fe15f 100644
+--- a/drivers/mtd/nand/onenand/generic.c
++++ b/drivers/mtd/nand/onenand/generic.c
+@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL;
+-	info->onenand.irq = platform_get_irq(pdev, 0);
++
++	err = platform_get_irq(pdev, 0);
++	if (err < 0)
++		goto out_iounmap;
++
++	info->onenand.irq = err;
+ 
+ 	info->mtd.dev.parent = &pdev->dev;
+ 	info->mtd.priv = &info->onenand;
+-- 
+2.34.1
+
diff --git a/queue-5.4/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch b/queue-5.4/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
new file mode 100644
index 00000000000..9a75d416b34
--- /dev/null
+++ b/queue-5.4/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
@@ -0,0 +1,75 @@
+From c9d91eadf99389b34aeaf580899fb8e9bf02dbe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 16:53:32 +0800
+Subject: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
+
+From: Xin Xiong <xiongx18@fudan.edu.cn>
+
+[ Upstream commit fecbd4a317c95d73c849648c406bcf1b6a0ec1cf ]
+
+The reference counting issue happens in several error handling paths
+on a refcounted object "nc->dmac". In these paths, the function simply
+returns the error code, forgetting to balance the reference count of
+"nc->dmac", increased earlier by dma_request_channel(), which may
+cause refcount leaks.
+
+Fix it by decrementing the refcount of specific object in those error
+paths.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220304085330.3610-1-xiongx18@fudan.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index 23d11e8b5644..17c751f359d3 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2004,13 +2004,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ 	nc->mck = of_clk_get(dev->parent->of_node, 0);
+ 	if (IS_ERR(nc->mck)) {
+ 		dev_err(dev, "Failed to retrieve MCK clk\n");
+-		return PTR_ERR(nc->mck);
++		ret = PTR_ERR(nc->mck);
++		goto out_release_dma;
+ 	}
+ 
+ 	np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0);
+ 	if (!np) {
+ 		dev_err(dev, "Missing or invalid atmel,smc property\n");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto out_release_dma;
+ 	}
+ 
+ 	nc->smc = syscon_node_to_regmap(np);
+@@ -2018,10 +2020,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ 	if (IS_ERR(nc->smc)) {
+ 		ret = PTR_ERR(nc->smc);
+ 		dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
+-		return ret;
++		goto out_release_dma;
+ 	}
+ 
+ 	return 0;
++
++out_release_dma:
++	if (nc->dmac)
++		dma_release_channel(nc->dmac);
++
++	return ret;
+ }
+ 
+ static int
+-- 
+2.34.1
+
diff --git a/queue-5.4/mtd-rawnand-gpmi-fix-controller-timings-setting.patch b/queue-5.4/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
new file mode 100644
index 00000000000..ea986cf4f1a
--- /dev/null
+++ b/queue-5.4/mtd-rawnand-gpmi-fix-controller-timings-setting.patch
@@ -0,0 +1,59 @@
+From e2ba7e34838e3d6810f69698ce3099a516ff5635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:54:32 +0100
+Subject: mtd: rawnand: gpmi: fix controller timings setting
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 2970bf5a32f079e1e9197411db4fe9faccb1503a ]
+
+Set the controller registers according to the real clock rate. The
+controller registers configuration (setup, hold, timeout, ... cycles)
+depends on the clock rate of the GPMI. Using the real rate instead of
+the ideal one, avoids that this inaccuracy (required_rate - real_rate)
+affects the registers setting.
+
+This patch has been tested on two custom boards with i.MX28 and i.MX6
+SOCs:
+- i.MX28:
+  required rate 100MHz, real rate 99.3MHz
+- i.MX6
+  required rate 100MHz, real rate 99MHz
+
+Fixes: b1206122069a ("mtd: rawnand: gpmi: use core timings instead of an empirical derivation")
+Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Tested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20220118095434.35081-3-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index ab2f824abf54..02218c3b548f 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -645,6 +645,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this,
+ 				     const struct nand_sdr_timings *sdr)
+ {
+ 	struct gpmi_nfc_hardware_timing *hw = &this->hw;
++	struct resources *r = &this->resources;
+ 	unsigned int dll_threshold_ps = this->devdata->max_chain_delay;
+ 	unsigned int period_ps, reference_period_ps;
+ 	unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles;
+@@ -668,6 +669,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this,
+ 		wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY;
+ 	}
+ 
++	hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate);
++
+ 	/* SDR core timings are given in picoseconds */
+ 	period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch b/queue-5.4/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
new file mode 100644
index 00000000000..11031a574f3
--- /dev/null
+++ b/queue-5.4/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
@@ -0,0 +1,76 @@
+From 10c23dd0e9bc565cff59e31cccb0eef65553b258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 08:14:24 +0100
+Subject: mxser: fix xmit_buf leak in activate when LSR == 0xff
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ]
+
+When LSR is 0xff in ->activate() (rather unlike), we return an error.
+Provided ->shutdown() is not called when ->activate() fails, nothing
+actually frees the buffer in this case.
+
+Fix this by properly freeing the buffer in a designated label. We jump
+there also from the "!info->type" if now too.
+
+Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/mxser.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
+index 9d00ff5ef961..085dc8dd1327 100644
+--- a/drivers/tty/mxser.c
++++ b/drivers/tty/mxser.c
+@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 	struct mxser_port *info = container_of(port, struct mxser_port, port);
+ 	unsigned long page;
+ 	unsigned long flags;
++	int ret;
+ 
+ 	page = __get_free_page(GFP_KERNEL);
+ 	if (!page)
+@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 
+ 	if (!info->ioaddr || !info->type) {
+ 		set_bit(TTY_IO_ERROR, &tty->flags);
+-		free_page(page);
+ 		spin_unlock_irqrestore(&info->slock, flags);
+-		return 0;
++		ret = 0;
++		goto err_free_xmit;
+ 	}
+ 	info->port.xmit_buf = (unsigned char *) page;
+ 
+@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 		if (capable(CAP_SYS_ADMIN)) {
+ 			set_bit(TTY_IO_ERROR, &tty->flags);
+ 			return 0;
+-		} else
+-			return -ENODEV;
++		}
++
++		ret = -ENODEV;
++		goto err_free_xmit;
+ 	}
+ 
+ 	/*
+@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ 	spin_unlock_irqrestore(&info->slock, flags);
+ 
+ 	return 0;
++err_free_xmit:
++	free_page(page);
++	info->port.xmit_buf = NULL;
++	return ret;
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.4/net-bcmgenet-use-stronger-register-read-writes-to-as.patch b/queue-5.4/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
new file mode 100644
index 00000000000..eda8e5fcdd8
--- /dev/null
+++ b/queue-5.4/net-bcmgenet-use-stronger-register-read-writes-to-as.patch
@@ -0,0 +1,115 @@
+From 33241bfaf72f7d0216df7fb66e135c4ad348fad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 22:53:58 -0600
+Subject: net: bcmgenet: Use stronger register read/writes to assure ordering
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit 8d3ea3d402db94b61075617e71b67459a714a502 ]
+
+GCC12 appears to be much smarter about its dependency tracking and is
+aware that the relaxed variants are just normal loads and stores and
+this is causing problems like:
+
+[  210.074549] ------------[ cut here ]------------
+[  210.079223] NETDEV WATCHDOG: enabcm6e4ei0 (bcmgenet): transmit queue 1 timed out
+[  210.086717] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:529 dev_watchdog+0x234/0x240
+[  210.095044] Modules linked in: genet(E) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat]
+[  210.146561] ACPI CPPC: PCC check channel failed for ss: 0. ret=-110
+[  210.146927] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E     5.17.0-rc7G12+ #58
+[  210.153226] CPPC Cpufreq:cppc_scale_freq_workfn: failed to read perf counters
+[  210.161349] Hardware name: Raspberry Pi Foundation Raspberry Pi 4 Model B/Raspberry Pi 4 Model B, BIOS EDK2-DEV 02/08/2022
+[  210.161353] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[  210.161358] pc : dev_watchdog+0x234/0x240
+[  210.161364] lr : dev_watchdog+0x234/0x240
+[  210.161368] sp : ffff8000080a3a40
+[  210.161370] x29: ffff8000080a3a40 x28: ffffcd425af87000 x27: ffff8000080a3b20
+[  210.205150] x26: ffffcd425aa00000 x25: 0000000000000001 x24: ffffcd425af8ec08
+[  210.212321] x23: 0000000000000100 x22: ffffcd425af87000 x21: ffff55b142688000
+[  210.219491] x20: 0000000000000001 x19: ffff55b1426884c8 x18: ffffffffffffffff
+[  210.226661] x17: 64656d6974203120 x16: 0000000000000001 x15: 6d736e617274203a
+[  210.233831] x14: 2974656e65676d63 x13: ffffcd4259c300d8 x12: ffffcd425b07d5f0
+[  210.241001] x11: 00000000ffffffff x10: ffffcd425b07d5f0 x9 : ffffcd4258bdad9c
+[  210.248171] x8 : 00000000ffffdfff x7 : 000000000000003f x6 : 0000000000000000
+[  210.255341] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000001000
+[  210.262511] x2 : 0000000000001000 x1 : 0000000000000005 x0 : 0000000000000044
+[  210.269682] Call trace:
+[  210.272133]  dev_watchdog+0x234/0x240
+[  210.275811]  call_timer_fn+0x3c/0x15c
+[  210.279489]  __run_timers.part.0+0x288/0x310
+[  210.283777]  run_timer_softirq+0x48/0x80
+[  210.287716]  __do_softirq+0x128/0x360
+[  210.291392]  __irq_exit_rcu+0x138/0x140
+[  210.295243]  irq_exit_rcu+0x1c/0x30
+[  210.298745]  el1_interrupt+0x38/0x54
+[  210.302334]  el1h_64_irq_handler+0x18/0x24
+[  210.306445]  el1h_64_irq+0x7c/0x80
+[  210.309857]  arch_cpu_idle+0x18/0x2c
+[  210.313445]  default_idle_call+0x4c/0x140
+[  210.317470]  cpuidle_idle_call+0x14c/0x1a0
+[  210.321584]  do_idle+0xb0/0x100
+[  210.324737]  cpu_startup_entry+0x30/0x8c
+[  210.328675]  secondary_start_kernel+0xe4/0x110
+[  210.333138]  __secondary_switched+0x94/0x98
+
+The assumption when these were relaxed seems to be that device memory
+would be mapped non reordering, and that other constructs
+(spinlocks/etc) would provide the barriers to assure that packet data
+and in memory rings/queues were ordered with respect to device
+register reads/writes. This itself seems a bit sketchy, but the real
+problem with GCC12 is that it is moving the actual reads/writes around
+at will as though they were independent operations when in truth they
+are not, but the compiler can't know that. When looking at the
+assembly dumps for many of these routines its possible to see very
+clean, but not strictly in program order operations occurring as the
+compiler would be free to do if these weren't actually register
+reads/write operations.
+
+Its possible to suppress the timeout with a liberal bit of dma_mb()'s
+sprinkled around but the device still seems unable to reliably
+send/receive data. A better plan is to use the safer readl/writel
+everywhere.
+
+Since this partially reverts an older commit, which notes the use of
+the relaxed variants for performance reasons. I would suggest that
+any performance problems with this commit are targeted at relaxing only
+the performance critical code paths after assuring proper barriers.
+
+Fixes: 69d2ea9c79898 ("net: bcmgenet: Use correct I/O accessors")
+Reported-by: Peter Robinson <pbrobinson@gmail.com>
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Acked-by: Peter Robinson <pbrobinson@gmail.com>
+Tested-by: Peter Robinson <pbrobinson@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220310045358.224350-1-jeremy.linton@arm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 2affdddc12bf..7a8a53807909 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -80,7 +80,7 @@ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ 	if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ 		__raw_writel(value, offset);
+ 	else
+-		writel_relaxed(value, offset);
++		writel(value, offset);
+ }
+ 
+ static inline u32 bcmgenet_readl(void __iomem *offset)
+@@ -88,7 +88,7 @@ static inline u32 bcmgenet_readl(void __iomem *offset)
+ 	if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ 		return __raw_readl(offset);
+ 	else
+-		return readl_relaxed(offset);
++		return readl(offset);
+ }
+ 
+ static inline void dmadesc_set_length_status(struct bcmgenet_priv *priv,
+-- 
+2.34.1
+
diff --git a/queue-5.4/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch b/queue-5.4/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
new file mode 100644
index 00000000000..fa27586db3f
--- /dev/null
+++ b/queue-5.4/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
@@ -0,0 +1,55 @@
+From eb3a6e306367dc65e7f0346100265b760aeb4bab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Mar 2022 11:24:31 +0800
+Subject: net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator
+
+From: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+
+[ Upstream commit 6da69b1da130e7d96766042750cd9f902e890eba ]
+
+The bug is here:
+	return rule;
+
+The list iterator value 'rule' will *always* be set and non-NULL
+by list_for_each_entry(), so it is incorrect to assume that the
+iterator value will be NULL if the list is empty or no element
+is found.
+
+To fix the bug, return 'rule' when found, otherwise return NULL.
+
+Fixes: ae7a5aff783c7 ("net: dsa: bcm_sf2: Keep copy of inserted rules")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+Link: https://lore.kernel.org/r/20220328032431.22538-1-xiam0nd.tong@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2_cfp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
+index e15d18bb981e..5cc31118b97e 100644
+--- a/drivers/net/dsa/bcm_sf2_cfp.c
++++ b/drivers/net/dsa/bcm_sf2_cfp.c
+@@ -542,14 +542,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv,
+ static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv,
+ 					      int port, u32 location)
+ {
+-	struct cfp_rule *rule = NULL;
++	struct cfp_rule *rule;
+ 
+ 	list_for_each_entry(rule, &priv->cfp.rules_list, next) {
+ 		if (rule->port == port && rule->fs.location == location)
+-			break;
++			return rule;
+ 	}
+ 
+-	return rule;
++	return NULL;
+ }
+ 
+ static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port,
+-- 
+2.34.1
+
diff --git a/queue-5.4/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch b/queue-5.4/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
new file mode 100644
index 00000000000..a9efd11a22c
--- /dev/null
+++ b/queue-5.4/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
@@ -0,0 +1,35 @@
+From 1b4f2d5255ecd0b339647d1be6301ef967ef82dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Feb 2022 11:16:55 +0100
+Subject: net: dsa: mv88e6xxx: Enable port policy support on 6097
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 585d42bb57bb358d48906660a8de273b078810b1 ]
+
+This chip has support for the same per-port policy actions found in
+later versions of LinkStreet devices.
+
+Fixes: f3a2cd326e44 ("net: dsa: mv88e6xxx: introduce .port_set_policy")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 40b105daaf9e..87d28ef82559 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3062,6 +3062,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = {
+ 	.port_set_duplex = mv88e6xxx_port_set_duplex,
+ 	.port_set_speed = mv88e6185_port_set_speed,
+ 	.port_tag_remap = mv88e6095_port_tag_remap,
++	.port_set_policy = mv88e6352_port_set_policy,
+ 	.port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ 	.port_set_egress_floods = mv88e6352_port_set_egress_floods,
+ 	.port_set_ether_type = mv88e6351_port_set_ether_type,
+-- 
+2.34.1
+
diff --git a/queue-5.4/net-phy-broadcom-fix-brcm_fet_config_init.patch b/queue-5.4/net-phy-broadcom-fix-brcm_fet_config_init.patch
new file mode 100644
index 00000000000..b2d94a23189
--- /dev/null
+++ b/queue-5.4/net-phy-broadcom-fix-brcm_fet_config_init.patch
@@ -0,0 +1,79 @@
+From 2e1bc2ad30cc26760931e6f30655d4f9196753dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 16:24:38 -0700
+Subject: net: phy: broadcom: Fix brcm_fet_config_init()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit bf8bfc4336f7a34e48b3bbd19b1542bf085bdc3d ]
+
+A Broadcom AC201 PHY (same entry as 5241) would be flagged by the
+Broadcom UniMAC MDIO controller as not completing the turn around
+properly since the PHY expects 65 MDC clock cycles to complete a write
+cycle, and the MDIO controller was only sending 64 MDC clock cycles as
+determined by looking at a scope shot.
+
+This would make the subsequent read fail with the UniMAC MDIO controller
+command field having MDIO_READ_FAIL set and we would abort the
+brcm_fet_config_init() function and thus not probe the PHY at all.
+
+After issuing a software reset, wait for at least 1ms which is well
+above the 1us reset delay advertised by the datasheet and issue a dummy
+read to let the PHY turn around the line properly. This read
+specifically ignores -EIO which would be returned by MDIO controllers
+checking for the line being turned around.
+
+If we have a genuine reaad failure, the next read of the interrupt
+status register would pick it up anyway.
+
+Fixes: d7a2ed9248a3 ("broadcom: Add AC131 phy support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20220324232438.1156812-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index c23fec34b50e..7be75a611e9e 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include "bcm-phy-lib.h"
++#include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ #include <linux/brcmphy.h>
+@@ -479,6 +480,26 @@ static int brcm_fet_config_init(struct phy_device *phydev)
+ 	if (err < 0)
+ 		return err;
+ 
++	/* The datasheet indicates the PHY needs up to 1us to complete a reset,
++	 * build some slack here.
++	 */
++	usleep_range(1000, 2000);
++
++	/* The PHY requires 65 MDC clock cycles to complete a write operation
++	 * and turnaround the line properly.
++	 *
++	 * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac)
++	 * may flag the lack of turn-around as a read failure. This is
++	 * particularly true with this combination since the MDIO controller
++	 * only used 64 MDC cycles. This is not a critical failure in this
++	 * specific case and it has no functional impact otherwise, so we let
++	 * that one go through. If there is a genuine bus error, the next read
++	 * of MII_BRCM_FET_INTREG will error out.
++	 */
++	err = phy_read(phydev, MII_BMCR);
++	if (err < 0 && err != -EIO)
++		return err;
++
+ 	reg = phy_read(phydev, MII_BRCM_FET_INTREG);
+ 	if (reg < 0)
+ 		return reg;
+-- 
+2.34.1
+
diff --git a/queue-5.4/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch b/queue-5.4/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
new file mode 100644
index 00000000000..67869cfdb1e
--- /dev/null
+++ b/queue-5.4/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
@@ -0,0 +1,65 @@
+From 2980aaba3f4753e4baa982ccf3418ff0d86c68fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 18:43:46 +0800
+Subject: net/x25: Fix null-ptr-deref caused by x25_disconnect
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ]
+
+When the link layer is terminating, x25->neighbour will be set to NULL
+in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in
+x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is
+shown below.
+
+    (Thread 1)                 |  (Thread 2)
+x25_link_terminated()          | x25_recvmsg()
+ x25_kill_by_neigh()           |  ...
+  x25_disconnect()             |  lock_sock(sk)
+   ...                         |  ...
+   x25->neighbour = NULL //(1) |
+   ...                         |  x25->neighbour->extended //(2)
+
+The code sets NULL to x25->neighbour in position (1) and dereferences
+x25->neighbour in position (2), which could cause null-ptr-deref bug.
+
+This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize
+with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the
+sock held by lock_sock() is not NULL, because it is extracted from x25_list
+and uses x25_list_lock to synchronize.
+
+Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index d8d603aa4887..c94aa587e0c9 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1767,10 +1767,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
+ 
+ 	write_lock_bh(&x25_list_lock);
+ 
+-	sk_for_each(s, &x25_list)
+-		if (x25_sk(s)->neighbour == nb)
++	sk_for_each(s, &x25_list) {
++		if (x25_sk(s)->neighbour == nb) {
++			write_unlock_bh(&x25_list_lock);
++			lock_sock(s);
+ 			x25_disconnect(s, ENETUNREACH, 0, 0);
+-
++			release_sock(s);
++			write_lock_bh(&x25_list_lock);
++		}
++	}
+ 	write_unlock_bh(&x25_list_lock);
+ 
+ 	/* Remove any related forwards */
+-- 
+2.34.1
+
diff --git a/queue-5.4/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch b/queue-5.4/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
new file mode 100644
index 00000000000..0201305b831
--- /dev/null
+++ b/queue-5.4/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
@@ -0,0 +1,71 @@
+From 3094346f165cfa866d113634dd5ba0cb0ca1366e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 11:38:32 +0100
+Subject: netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ]
+
+Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios
+coming before the TCP window tracking, otherwise such connections will
+fail in the window check.
+
+Update tcp_options() to leave this flag in place and add a new helper
+function to reset the tcp window state.
+
+Based on patch from Sven Auhagen.
+
+Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking")
+Tested-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 848b137151c2..b8cc3339a249 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb,
+ 				 length, buff);
+ 	BUG_ON(ptr == NULL);
+ 
+-	state->td_scale =
+-	state->flags = 0;
++	state->td_scale = 0;
++	state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
+ 
+ 	while (length > 0) {
+ 		int opcode=*ptr++;
+@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
+ 	       test_bit(IPS_ASSURED_BIT, &ct->status);
+ }
+ 
++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
++{
++	state->td_end		= 0;
++	state->td_maxend	= 0;
++	state->td_maxwin	= 0;
++	state->td_maxack	= 0;
++	state->td_scale		= 0;
++	state->flags		&= IP_CT_TCP_FLAG_BE_LIBERAL;
++}
++
+ /* Returns verdict for packet, or -1 for invalid. */
+ int nf_conntrack_tcp_packet(struct nf_conn *ct,
+ 			    struct sk_buff *skb,
+@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
+ 			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
+ 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
+ 				ct->proto.tcp.last_flags;
+-			memset(&ct->proto.tcp.seen[dir], 0,
+-			       sizeof(struct ip_ct_tcp_state));
++			nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
+ 			break;
+ 		}
+ 		ct->proto.tcp.last_index = index;
+-- 
+2.34.1
+
diff --git a/queue-5.4/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch b/queue-5.4/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
new file mode 100644
index 00000000000..edd3b28c32b
--- /dev/null
+++ b/queue-5.4/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
@@ -0,0 +1,74 @@
+From 72d5caebebd63eacf70a08467db758aaba6136ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:05 -0700
+Subject: netfilter: nf_nat_h323: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit fd4213929053bb58b0b2a080ca17f2dd1a9b6df4 ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_nat_h323.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
+index 3e2685c120c7..76a411ae9fe6 100644
+--- a/net/ipv4/netfilter/nf_nat_h323.c
++++ b/net/ipv4/netfilter/nf_nat_h323.c
+@@ -580,7 +580,7 @@ static struct nf_ct_helper_expectfn callforwarding_nat = {
+ };
+ 
+ /****************************************************************************/
+-static int __init init(void)
++static int __init nf_nat_h323_init(void)
+ {
+ 	BUG_ON(set_h245_addr_hook != NULL);
+ 	BUG_ON(set_h225_addr_hook != NULL);
+@@ -607,7 +607,7 @@ static int __init init(void)
+ }
+ 
+ /****************************************************************************/
+-static void __exit fini(void)
++static void __exit nf_nat_h323_fini(void)
+ {
+ 	RCU_INIT_POINTER(set_h245_addr_hook, NULL);
+ 	RCU_INIT_POINTER(set_h225_addr_hook, NULL);
+@@ -624,8 +624,8 @@ static void __exit fini(void)
+ }
+ 
+ /****************************************************************************/
+-module_init(init);
+-module_exit(fini);
++module_init(nf_nat_h323_init);
++module_exit(nf_nat_h323_fini);
+ 
+ MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
+ MODULE_DESCRIPTION("H.323 NAT helper");
+-- 
+2.34.1
+
diff --git a/queue-5.4/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch b/queue-5.4/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
new file mode 100644
index 00000000000..c2b2aba4aab
--- /dev/null
+++ b/queue-5.4/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
@@ -0,0 +1,39 @@
+From 696f24888efad8f2e0df0c14cb0cb349302d7a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 13:17:04 +0300
+Subject: NFS: remove unneeded check in decode_devicenotify_args()
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+[ Upstream commit cb8fac6d2727f79f211e745b16c9abbf4d8be652 ]
+
+[You don't often get email from khoroshilov@ispras.ru. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]
+
+Overflow check in not needed anymore after we switch to kmalloc_array().
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: a4f743a6bb20 ("NFSv4.1: Convert open-coded array allocation calls to kmalloc_array()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_xdr.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 90b5511c4c44..04d27f0ed39a 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ 	n = ntohl(*p++);
+ 	if (n == 0)
+ 		goto out;
+-	if (n > ULONG_MAX / sizeof(*args->devs)) {
+-		status = htonl(NFS4ERR_BADXDR);
+-		goto out;
+-	}
+ 
+ 	args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL);
+ 	if (!args->devs) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch b/queue-5.4/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
new file mode 100644
index 00000000000..fd5cebf3c0e
--- /dev/null
+++ b/queue-5.4/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
@@ -0,0 +1,106 @@
+From a731804790c9a9c458988a4f0097999dfcc13ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 10:59:37 -0500
+Subject: NFS: Return valid errors from nfs2/3_decode_dirent()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 64cfca85bacde54caa64e0ab855c48734894fa37 ]
+
+Valid return values for decode_dirent() callback functions are:
+ 0: Success
+ -EBADCOOKIE: End of directory
+ -EAGAIN: End of xdr_stream
+
+All errors need to map into one of those three values.
+
+Fixes: 573c4e1ef53a ("NFS: Simplify ->decode_dirent() calling sequence")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs2xdr.c |  2 +-
+ fs/nfs/nfs3xdr.c | 21 ++++++---------------
+ 2 files changed, 7 insertions(+), 16 deletions(-)
+
+diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
+index 887f9136a9db..af557dc2cfe1 100644
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 
+ 	error = decode_filename_inline(xdr, &entry->name, &entry->len);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	/*
+ 	 * The type (size and byte order) of nfscookie isn't defined in
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 23d75cddbb2e..84369d51353a 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -1968,7 +1968,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 		       bool plus)
+ {
+ 	struct user_namespace *userns = rpc_userns(entry->server->client);
+-	struct nfs_entry old = *entry;
+ 	__be32 *p;
+ 	int error;
+ 	u64 new_cookie;
+@@ -1988,15 +1987,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 
+ 	error = decode_fileid3(xdr, &entry->ino);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	error = decode_inline_filename3(xdr, &entry->name, &entry->len);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	error = decode_cookie3(xdr, &new_cookie);
+ 	if (unlikely(error))
+-		return error;
++		return -EAGAIN;
+ 
+ 	entry->d_type = DT_UNKNOWN;
+ 
+@@ -2004,7 +2003,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 		entry->fattr->valid = 0;
+ 		error = decode_post_op_attr(xdr, entry->fattr, userns);
+ 		if (unlikely(error))
+-			return error;
++			return -EAGAIN;
+ 		if (entry->fattr->valid & NFS_ATTR_FATTR_V3)
+ 			entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
+ 
+@@ -2019,11 +2018,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 			return -EAGAIN;
+ 		if (*p != xdr_zero) {
+ 			error = decode_nfs_fh3(xdr, entry->fh);
+-			if (unlikely(error)) {
+-				if (error == -E2BIG)
+-					goto out_truncated;
+-				return error;
+-			}
++			if (unlikely(error))
++				return -EAGAIN;
+ 		} else
+ 			zero_nfs_fh3(entry->fh);
+ 	}
+@@ -2032,11 +2028,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 	entry->cookie = new_cookie;
+ 
+ 	return 0;
+-
+-out_truncated:
+-	dprintk("NFS: directory entry contains invalid file handle\n");
+-	*entry = old;
+-	return -EAGAIN;
+ }
+ 
+ /*
+-- 
+2.34.1
+
diff --git a/queue-5.4/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch b/queue-5.4/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
new file mode 100644
index 00000000000..ffed19182d7
--- /dev/null
+++ b/queue-5.4/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
@@ -0,0 +1,120 @@
+From f2db0d9afa785a2f239e6fa076ee2ae01aad0e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Mar 2022 08:36:34 -0400
+Subject: NFSv4/pNFS: Fix another issue with a list iterator pointing to the
+ head
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ]
+
+In nfs4_callback_devicenotify(), if we don't find a matching entry for
+the deviceid, we're left with a pointer to 'struct nfs_server' that
+actually points to the list of super blocks associated with our struct
+nfs_client.
+Furthermore, even if we have a valid pointer, nothing pins the super
+block, and so the struct nfs_server could end up getting freed while
+we're using it.
+
+Since all we want is a pointer to the struct pnfs_layoutdriver_type,
+let's skip all the iteration over super blocks, and just use APIs to
+find the layout driver directly.
+
+Reported-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
+Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_proc.c | 27 +++++++++------------------
+ fs/nfs/pnfs.c          | 11 +++++++++++
+ fs/nfs/pnfs.h          |  2 ++
+ 3 files changed, 22 insertions(+), 18 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index b8a7b223b5b1..31922657e836 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ 				  struct cb_process_state *cps)
+ {
+ 	struct cb_devicenotifyargs *args = argp;
++	const struct pnfs_layoutdriver_type *ld = NULL;
+ 	uint32_t i;
+ 	__be32 res = 0;
+-	struct nfs_client *clp = cps->clp;
+-	struct nfs_server *server = NULL;
+ 
+-	if (!clp) {
++	if (!cps->clp) {
+ 		res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION);
+ 		goto out;
+ 	}
+@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ 	for (i = 0; i < args->ndevs; i++) {
+ 		struct cb_devicenotifyitem *dev = &args->devs[i];
+ 
+-		if (!server ||
+-		    server->pnfs_curr_ld->id != dev->cbd_layout_type) {
+-			rcu_read_lock();
+-			list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link)
+-				if (server->pnfs_curr_ld &&
+-				    server->pnfs_curr_ld->id == dev->cbd_layout_type) {
+-					rcu_read_unlock();
+-					goto found;
+-				}
+-			rcu_read_unlock();
+-			continue;
++		if (!ld || ld->id != dev->cbd_layout_type) {
++			pnfs_put_layoutdriver(ld);
++			ld = pnfs_find_layoutdriver(dev->cbd_layout_type);
++			if (!ld)
++				continue;
+ 		}
+-
+-	found:
+-		nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id);
++		nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id);
+ 	}
+-
++	pnfs_put_layoutdriver(ld);
+ out:
+ 	kfree(args->devs);
+ 	return res;
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 1b512df1003f..0471b6e0da16 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id)
+ 	return local;
+ }
+ 
++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id)
++{
++	return find_pnfs_driver(id);
++}
++
++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld)
++{
++	if (ld)
++		module_put(ld->owner);
++}
++
+ void
+ unset_pnfs_layoutdriver(struct nfs_server *nfss)
+ {
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 3d55edd6b25a..68339680bb7d 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -226,6 +226,8 @@ struct pnfs_devicelist {
+ 
+ extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *);
+ extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *);
++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id);
++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld);
+ 
+ /* nfs4proc.c */
+ extern size_t max_response_pages(struct nfs_server *server);
+-- 
+2.34.1
+
diff --git a/queue-5.4/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch b/queue-5.4/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
new file mode 100644
index 00000000000..6167e241c24
--- /dev/null
+++ b/queue-5.4/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
@@ -0,0 +1,35 @@
+From 4a1551e950c8dca7c5f05b70b286e5177d9dff95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 10:38:42 -0400
+Subject: NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 1d15d121cc2ad4d016a7dc1493132a9696f91fc5 ]
+
+There is no reason to retry the operation if a session error had
+occurred in such case result structure isn't filled out.
+
+Fixes: dff58530c4ca ("NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index fb3d1532f11d..76baf7b441f3 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7918,6 +7918,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata)
+ 	case -NFS4ERR_DEADSESSION:
+ 		nfs4_schedule_session_recovery(clp->cl_session,
+ 				task->tk_status);
++		return;
+ 	}
+ 	if (args->dir == NFS4_CDFC4_FORE_OR_BOTH &&
+ 			res->dir != NFS4_CDFS4_BOTH) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/ntfs-add-sanity-check-on-allocation-size.patch b/queue-5.4/ntfs-add-sanity-check-on-allocation-size.patch
new file mode 100644
index 00000000000..49fc11cad24
--- /dev/null
+++ b/queue-5.4/ntfs-add-sanity-check-on-allocation-size.patch
@@ -0,0 +1,43 @@
+From 3ae24d0cd07f2249ee10d9bd914f609cb26729bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:38:39 -0700
+Subject: ntfs: add sanity check on allocation size
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 714fbf2647b1a33d914edd695d4da92029c7e7c0 ]
+
+ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation
+size.  It triggers one BUG in the __ntfs_malloc function.
+
+Fix this by adding sanity check on ni->attr_list_size.
+
+Link: https://lkml.kernel.org/r/20220120094914.47736-1-dzm91@hust.edu.cn
+Reported-by: syzbot+3c765c5248797356edaa@syzkaller.appspotmail.com
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Acked-by: Anton Altaparmakov <anton@tuxera.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs/inode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index ea18e4a2a691..cf222c9225d6 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi)
+ 		}
+ 		/* Now allocate memory for the attribute list. */
+ 		ni->attr_list_size = (u32)ntfs_attr_size(a);
++		if (!ni->attr_list_size) {
++			ntfs_error(sb, "Attr_list_size is zero");
++			goto put_err_out;
++		}
+ 		ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
+ 		if (!ni->attr_list) {
+ 			ntfs_error(sb, "Not enough memory to allocate buffer "
+-- 
+2.34.1
+
diff --git a/queue-5.4/openvswitch-always-update-flow-key-after-nat.patch b/queue-5.4/openvswitch-always-update-flow-key-after-nat.patch
new file mode 100644
index 00000000000..c5e7f603339
--- /dev/null
+++ b/queue-5.4/openvswitch-always-update-flow-key-after-nat.patch
@@ -0,0 +1,200 @@
+From 3e8b6e8e69d1cdf10522e68bbfb3a358a0eab21d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 08:43:19 -0400
+Subject: openvswitch: always update flow key after nat
+
+From: Aaron Conole <aconole@redhat.com>
+
+[ Upstream commit 60b44ca6bd7518dd38fa2719bc9240378b6172c3 ]
+
+During NAT, a tuple collision may occur.  When this happens, openvswitch
+will make a second pass through NAT which will perform additional packet
+modification.  This will update the skb data, but not the flow key that
+OVS uses.  This means that future flow lookups, and packet matches will
+have incorrect data.  This has been supported since
+5d50aa83e2c8 ("openvswitch: support asymmetric conntrack").
+
+That commit failed to properly update the sw_flow_key attributes, since
+it only called the ovs_ct_nat_update_key once, rather than each time
+ovs_ct_nat_execute was called.  As these two operations are linked, the
+ovs_ct_nat_execute() function should always make sure that the
+sw_flow_key is updated after a successful call through NAT infrastructure.
+
+Fixes: 5d50aa83e2c8 ("openvswitch: support asymmetric conntrack")
+Cc: Dumitru Ceara <dceara@redhat.com>
+Cc: Numan Siddique <nusiddiq@redhat.com>
+Signed-off-by: Aaron Conole <aconole@redhat.com>
+Acked-by: Eelco Chaudron <echaudro@redhat.com>
+Link: https://lore.kernel.org/r/20220318124319.3056455-1-aconole@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/conntrack.c | 118 ++++++++++++++++++------------------
+ 1 file changed, 59 insertions(+), 59 deletions(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index b6f98eba71f1..816036b9c223 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -730,6 +730,57 @@ static bool skb_nfct_cached(struct net *net,
+ }
+ 
+ #if IS_ENABLED(CONFIG_NF_NAT)
++static void ovs_nat_update_key(struct sw_flow_key *key,
++			       const struct sk_buff *skb,
++			       enum nf_nat_manip_type maniptype)
++{
++	if (maniptype == NF_NAT_MANIP_SRC) {
++		__be16 src;
++
++		key->ct_state |= OVS_CS_F_SRC_NAT;
++		if (key->eth.type == htons(ETH_P_IP))
++			key->ipv4.addr.src = ip_hdr(skb)->saddr;
++		else if (key->eth.type == htons(ETH_P_IPV6))
++			memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
++			       sizeof(key->ipv6.addr.src));
++		else
++			return;
++
++		if (key->ip.proto == IPPROTO_UDP)
++			src = udp_hdr(skb)->source;
++		else if (key->ip.proto == IPPROTO_TCP)
++			src = tcp_hdr(skb)->source;
++		else if (key->ip.proto == IPPROTO_SCTP)
++			src = sctp_hdr(skb)->source;
++		else
++			return;
++
++		key->tp.src = src;
++	} else {
++		__be16 dst;
++
++		key->ct_state |= OVS_CS_F_DST_NAT;
++		if (key->eth.type == htons(ETH_P_IP))
++			key->ipv4.addr.dst = ip_hdr(skb)->daddr;
++		else if (key->eth.type == htons(ETH_P_IPV6))
++			memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
++			       sizeof(key->ipv6.addr.dst));
++		else
++			return;
++
++		if (key->ip.proto == IPPROTO_UDP)
++			dst = udp_hdr(skb)->dest;
++		else if (key->ip.proto == IPPROTO_TCP)
++			dst = tcp_hdr(skb)->dest;
++		else if (key->ip.proto == IPPROTO_SCTP)
++			dst = sctp_hdr(skb)->dest;
++		else
++			return;
++
++		key->tp.dst = dst;
++	}
++}
++
+ /* Modelled after nf_nat_ipv[46]_fn().
+  * range is only used for new, uninitialized NAT state.
+  * Returns either NF_ACCEPT or NF_DROP.
+@@ -737,7 +788,7 @@ static bool skb_nfct_cached(struct net *net,
+ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
+ 			      enum ip_conntrack_info ctinfo,
+ 			      const struct nf_nat_range2 *range,
+-			      enum nf_nat_manip_type maniptype)
++			      enum nf_nat_manip_type maniptype, struct sw_flow_key *key)
+ {
+ 	int hooknum, nh_off, err = NF_ACCEPT;
+ 
+@@ -810,58 +861,11 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
+ 	skb_push(skb, nh_off);
+ 	skb_postpush_rcsum(skb, skb->data, nh_off);
+ 
+-	return err;
+-}
+-
+-static void ovs_nat_update_key(struct sw_flow_key *key,
+-			       const struct sk_buff *skb,
+-			       enum nf_nat_manip_type maniptype)
+-{
+-	if (maniptype == NF_NAT_MANIP_SRC) {
+-		__be16 src;
+-
+-		key->ct_state |= OVS_CS_F_SRC_NAT;
+-		if (key->eth.type == htons(ETH_P_IP))
+-			key->ipv4.addr.src = ip_hdr(skb)->saddr;
+-		else if (key->eth.type == htons(ETH_P_IPV6))
+-			memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr,
+-			       sizeof(key->ipv6.addr.src));
+-		else
+-			return;
+-
+-		if (key->ip.proto == IPPROTO_UDP)
+-			src = udp_hdr(skb)->source;
+-		else if (key->ip.proto == IPPROTO_TCP)
+-			src = tcp_hdr(skb)->source;
+-		else if (key->ip.proto == IPPROTO_SCTP)
+-			src = sctp_hdr(skb)->source;
+-		else
+-			return;
+-
+-		key->tp.src = src;
+-	} else {
+-		__be16 dst;
+-
+-		key->ct_state |= OVS_CS_F_DST_NAT;
+-		if (key->eth.type == htons(ETH_P_IP))
+-			key->ipv4.addr.dst = ip_hdr(skb)->daddr;
+-		else if (key->eth.type == htons(ETH_P_IPV6))
+-			memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr,
+-			       sizeof(key->ipv6.addr.dst));
+-		else
+-			return;
+-
+-		if (key->ip.proto == IPPROTO_UDP)
+-			dst = udp_hdr(skb)->dest;
+-		else if (key->ip.proto == IPPROTO_TCP)
+-			dst = tcp_hdr(skb)->dest;
+-		else if (key->ip.proto == IPPROTO_SCTP)
+-			dst = sctp_hdr(skb)->dest;
+-		else
+-			return;
++	/* Update the flow key if NAT successful. */
++	if (err == NF_ACCEPT)
++		ovs_nat_update_key(key, skb, maniptype);
+ 
+-		key->tp.dst = dst;
+-	}
++	return err;
+ }
+ 
+ /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */
+@@ -903,7 +907,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 	} else {
+ 		return NF_ACCEPT; /* Connection is not NATed. */
+ 	}
+-	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
++	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key);
+ 
+ 	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
+ 		if (ct->status & IPS_SRC_NAT) {
+@@ -913,17 +917,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 				maniptype = NF_NAT_MANIP_SRC;
+ 
+ 			err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+-						 maniptype);
++						 maniptype, key);
+ 		} else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
+ 			err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
+-						 NF_NAT_MANIP_SRC);
++						 NF_NAT_MANIP_SRC, key);
+ 		}
+ 	}
+ 
+-	/* Mark NAT done if successful and update the flow key. */
+-	if (err == NF_ACCEPT)
+-		ovs_nat_update_key(key, skb, maniptype);
+-
+ 	return err;
+ }
+ #else /* !CONFIG_NF_NAT */
+-- 
+2.34.1
+
diff --git a/queue-5.4/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch b/queue-5.4/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
new file mode 100644
index 00000000000..b3f92b6a272
--- /dev/null
+++ b/queue-5.4/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
@@ -0,0 +1,55 @@
+From c3274fa359f2c789add1077271c582088dcf4092 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jan 2022 02:50:09 +0100
+Subject: PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 735f5ae49e1b44742cc63ca9b5c1ffde3e94ba91 ]
+
+The emulated bridge returns incorrect value for PCI_EXP_RTSTA register
+during readout in advk_pci_bridge_emul_pcie_conf_read() function: the
+correct bit is BIT(16), but we are setting BIT(23), because the code
+does
+  *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16
+where
+  PCIE_MSG_PM_PME_MASK
+is
+  BIT(7).
+
+The code should probably have been something like
+  *value = (!!(isr0 & PCIE_MSG_PM_PME_MASK)) << 16,
+but we are better of using an if() and using the proper macro for this
+bit.
+
+Link: https://lore.kernel.org/r/20220110015018.26359-15-kabel@kernel.org
+Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index d2f8cd3a9568..5958316651e4 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -835,7 +835,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
+ 	case PCI_EXP_RTSTA: {
+ 		u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG);
+ 		u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG);
+-		*value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16);
++		*value = msglog >> 16;
++		if (isr0 & PCIE_MSG_PM_PME_MASK)
++			*value |= PCI_EXP_RTSTA_PME;
+ 		return PCI_BRIDGE_EMUL_HANDLED;
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/pci-reduce-warnings-on-possible-rw1c-corruption.patch b/queue-5.4/pci-reduce-warnings-on-possible-rw1c-corruption.patch
new file mode 100644
index 00000000000..9c24a5de828
--- /dev/null
+++ b/queue-5.4/pci-reduce-warnings-on-possible-rw1c-corruption.patch
@@ -0,0 +1,71 @@
+From f1b9b5a0b42146a495ebaeb1c55fd47b5cc31cff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 16:14:55 +1200
+Subject: PCI: Reduce warnings on possible RW1C corruption
+
+From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+
+[ Upstream commit 92c45b63ce22c8898aa41806e8d6692bcd577510 ]
+
+For hardware that only supports 32-bit writes to PCI there is the
+possibility of clearing RW1C (write-one-to-clear) bits. A rate-limited
+messages was introduced by fb2659230120, but rate-limiting is not the best
+choice here. Some devices may not show the warnings they should if another
+device has just produced a bunch of warnings. Also, the number of messages
+can be a nuisance on devices which are otherwise working fine.
+
+Change the ratelimit to a single warning per bus. This ensures no bus is
+'starved' of emitting a warning and also that there isn't a continuous
+stream of warnings. It would be preferable to have a warning per device,
+but the pci_dev structure is not available here, and a lookup from devfn
+would be far too slow.
+
+Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
+Fixes: fb2659230120 ("PCI: Warn on possible RW1C corruption for sub-32 bit config writes")
+Link: https://lore.kernel.org/r/20200806041455.11070-1-mark.tomlinson@alliedtelesis.co.nz
+Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Acked-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/access.c | 9 ++++++---
+ include/linux/pci.h  | 1 +
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 0914ddeae17f..c909c66a63e2 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
+ 	 * write happen to have any RW1C (write-one-to-clear) bits set, we
+ 	 * just inadvertently cleared something we shouldn't have.
+ 	 */
+-	dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
+-			     size, pci_domain_nr(bus), bus->number,
+-			     PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++	if (!bus->unsafe_warn) {
++		dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
++			 size, pci_domain_nr(bus), bus->number,
++			 PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++		bus->unsafe_warn = 1;
++	}
+ 
+ 	mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
+ 	tmp = readl(addr) & mask;
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index bc35b15efadd..fc343d123127 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -604,6 +604,7 @@ struct pci_bus {
+ 	struct bin_attribute	*legacy_io;	/* Legacy I/O for this bus */
+ 	struct bin_attribute	*legacy_mem;	/* Legacy mem */
+ 	unsigned int		is_added:1;
++	unsigned int		unsafe_warn:1;	/* warned about RW1C config write */
+ };
+ 
+ #define to_pci_bus(n)	container_of(n, struct pci_bus, dev)
+-- 
+2.34.1
+
diff --git a/queue-5.4/perf-core-fix-address-filter-parser-for-multiple-fil.patch b/queue-5.4/perf-core-fix-address-filter-parser-for-multiple-fil.patch
new file mode 100644
index 00000000000..4526ec28ecf
--- /dev/null
+++ b/queue-5.4/perf-core-fix-address-filter-parser-for-multiple-fil.patch
@@ -0,0 +1,40 @@
+From e72809f074aa3cccfb6da898e2cca1a4fd55a119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 09:24:51 +0200
+Subject: perf/core: Fix address filter parser for multiple filters
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit d680ff24e9e14444c63945b43a37ede7cd6958f9 ]
+
+Reset appropriate variables in the parser loop between parsing separate
+filters, so that they do not interfere with parsing the next filter.
+
+Fixes: 375637bc524952 ("perf/core: Introduce address range filtering")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220131072453.2839535-4-adrian.hunter@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index f720a40ccaf5..52f4a9e46704 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9490,8 +9490,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ 			}
+ 
+ 			/* ready to consume more filters */
++			kfree(filename);
++			filename = NULL;
+ 			state = IF_STATE_ACTION;
+ 			filter = NULL;
++			kernel = 0;
+ 		}
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch b/queue-5.4/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
new file mode 100644
index 00000000000..0591f76337c
--- /dev/null
+++ b/queue-5.4/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
@@ -0,0 +1,37 @@
+From 1bb4edcc3f3397725c2dcb859f7d02eda80f0426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Jan 2022 09:24:52 +0200
+Subject: perf/x86/intel/pt: Fix address filter config for 32-bit kernel
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit e5524bf1047eb3b3f3f33b5f59897ba67b3ade87 ]
+
+Change from shifting 'unsigned long' to 'u64' to prevent the config bits
+being lost on a 32-bit kernel.
+
+Fixes: eadf48cab4b6b0 ("perf/x86/intel/pt: Add support for address range filtering in PT")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220131072453.2839535-5-adrian.hunter@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/pt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index da289a44d511..f4d2322f4c62 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event)
+ 			pt->filters.filter[range].msr_b = filter->msr_b;
+ 		}
+ 
+-		rtit_ctl |= filter->config << pt_address_ranges[range].reg_off;
++		rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off;
+ 	}
+ 
+ 	return rtit_ctl;
+-- 
+2.34.1
+
diff --git a/queue-5.4/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch b/queue-5.4/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
new file mode 100644
index 00000000000..9a6ac9356bf
--- /dev/null
+++ b/queue-5.4/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
@@ -0,0 +1,70 @@
+From b211fc7d39cd8b340d2edead23abb907f1b11fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Feb 2022 15:12:57 +0800
+Subject: phy: dphy: Correct lpx parameter and its
+ derivatives(ta_{get,go,sure})
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit 3153fa38e38af566cf6454a03b1dbadaf6f323c0 ]
+
+According to the comment of the function phy_mipi_dphy_get_default_config(),
+it uses minimum D-PHY timings based on MIPI D-PHY specification.  They are
+derived from the valid ranges specified in Section 6.9, Table 14, Page 41
+of the D-PHY specification (v1.2).  The table 14 explicitly mentions that
+the minimum T-LPX parameter is 50 nanoseconds and the minimum TA-SURE
+parameter is T-LPX nanoseconds.  Likewise, the kernel doc of the 'lpx' and
+'ta_sure' members of struct phy_configure_opts_mipi_dphy mentions that
+the minimum values are 50000 picoseconds and @lpx picoseconds respectively.
+Also, the function phy_mipi_dphy_config_validate() checks if cfg->lpx is
+less than 50000 picoseconds and if cfg->ta_sure is less than cfg->lpx,
+which hints the same minimum values.
+
+Without this patch, the function phy_mipi_dphy_get_default_config()
+wrongly sets cfg->lpx to 60000 picoseconds and cfg->ta_sure to 2 * cfg->lpx.
+So, let's correct them to 50000 picoseconds and cfg->lpx respectively.
+
+Note that I've only tested the patch with RM67191 DSI panel on i.MX8mq EVK.
+Help is needed to test with other i.MX8mq, Meson and Rockchip platforms,
+as I don't have the hardwares.
+
+Fixes: dddc97e82303 ("phy: dphy: Add configuration helpers")
+Cc: Andrzej Hajda <andrzej.hajda@intel.com>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Guido Günther <agx@sigxcpu.org>
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Link: https://lore.kernel.org/r/20220216071257.1647703-1-victor.liu@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/phy-core-mipi-dphy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c
+index 14e0551cd319..0aa740b73d0d 100644
+--- a/drivers/phy/phy-core-mipi-dphy.c
++++ b/drivers/phy/phy-core-mipi-dphy.c
+@@ -66,10 +66,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock,
+ 	cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui);
+ 
+ 	cfg->init = 100;
+-	cfg->lpx = 60000;
++	cfg->lpx = 50000;
+ 	cfg->ta_get = 5 * cfg->lpx;
+ 	cfg->ta_go = 4 * cfg->lpx;
+-	cfg->ta_sure = 2 * cfg->lpx;
++	cfg->ta_sure = cfg->lpx;
+ 	cfg->wakeup = 1000;
+ 
+ 	cfg->hs_clk_rate = hs_clk_rate;
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch b/queue-5.4/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
new file mode 100644
index 00000000000..d2db15a04a4
--- /dev/null
+++ b/queue-5.4/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
@@ -0,0 +1,45 @@
+From e13f44f15d1c64084699a8a577e7cd7c25c64035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 07:11:54 +0000
+Subject: pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit dab4df9ca919f59e5b9dd84385eaf34d4f20dbb0 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: a6df410d420a ("pinctrl: mediatek: Add Pinctrl/GPIO driver for mt8135.")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308071155.21114-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+index 53f52b9a0acd..c2df70712ca2 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+@@ -1038,6 +1038,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ 	node = of_parse_phandle(np, "mediatek,pctl-regmap", 0);
+ 	if (node) {
+ 		pctl->regmap1 = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(pctl->regmap1))
+ 			return PTR_ERR(pctl->regmap1);
+ 	} else if (regmap) {
+@@ -1051,6 +1052,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ 	node = of_parse_phandle(np, "mediatek,pctl-regmap", 1);
+ 	if (node) {
+ 		pctl->regmap2 = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(pctl->regmap2))
+ 			return PTR_ERR(pctl->regmap2);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch b/queue-5.4/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
new file mode 100644
index 00000000000..fb4e0374307
--- /dev/null
+++ b/queue-5.4/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
@@ -0,0 +1,45 @@
+From 2fea5d49ae92d8ae6d99006353636f3b05d8df21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:48 +0800
+Subject: pinctrl: mediatek: paris: Fix "argument" argument type for
+ mtk_pinconf_get()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 19bce7ce0a593c7024030a0cda9e23facea3c93d ]
+
+For mtk_pinconf_get(), the "argument" argument is typically returned by
+pinconf_to_config_argument(), which holds the value for a given pinconf
+parameter. It certainly should not have the type of "enum pin_config_param",
+which describes the type of the pinconf parameter itself.
+
+Change the type to u32, which matches the return type of
+pinconf_to_config_argument().
+
+Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-4-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index 923264d0e9ef..e8bfaaccca68 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -198,8 +198,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,
+ }
+ 
+ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+-			   enum pin_config_param param,
+-			   enum pin_config_param arg)
++			   enum pin_config_param param, u32 arg)
+ {
+ 	struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
+ 	const struct mtk_pin_desc *desc;
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch b/queue-5.4/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
new file mode 100644
index 00000000000..a0c5792f4e1
--- /dev/null
+++ b/queue-5.4/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
@@ -0,0 +1,61 @@
+From b1af3fa81d6703136cd5cd48a14055dd1fd1a8e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 18:09:49 +0800
+Subject: pinctrl: mediatek: paris: Fix pingroup pin config state readback
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 54fe55fb384ade630ef20b9a8b8f3b2a89ad97f2 ]
+
+mtk_pconf_group_get(), used to read back pingroup pin config state,
+simply returns a set of configs saved from a previous invocation of
+mtk_pconf_group_set(). This is an unfiltered, unvalidated set passed
+in from the pinconf core, which does not match the current hardware
+state.
+
+Since the driver library is designed to have one pin per group, pass
+through mtk_pconf_group_get() to mtk_pinconf_get(), to read back the
+current pin config state of the only pin in the group.
+
+Also drop the assignment of pin config state to the group.
+
+Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20220308100956.2750295-5-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-paris.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
+index e8bfaaccca68..31449514a8c0 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
+@@ -646,10 +646,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group,
+ 			       unsigned long *config)
+ {
+ 	struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
++	struct mtk_pinctrl_group *grp = &hw->groups[group];
+ 
+-	*config = hw->groups[group].config;
+-
+-	return 0;
++	 /* One pin per group only */
++	return mtk_pinconf_get(pctldev, grp->pin, config);
+ }
+ 
+ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+@@ -665,8 +665,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ 				      pinconf_to_config_argument(configs[i]));
+ 		if (ret < 0)
+ 			return ret;
+-
+-		grp->config = configs[i];
+ 	}
+ 
+ 	return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch b/queue-5.4/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
new file mode 100644
index 00000000000..232e28c470c
--- /dev/null
+++ b/queue-5.4/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
@@ -0,0 +1,41 @@
+From 62ba8aabb500d65292c8539aaaaf09466b076b87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 11:51:16 +0000
+Subject: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c09ac191b1f97cfa06f394dbfd7a5db07986cefc ]
+
+This node pointer is returned by of_parse_phandle() with refcount
+incremented in this function. Calling of_node_put() to avoid
+the refcount leak.
+
+Fixes: 32e67eee670e ("pinctrl: nomadik: Allow prcm_base to be extracted from Device Tree")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307115116.25316-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index 2a8190b11d10..9f00adfefba8 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1923,8 +1923,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	prcm_np = of_parse_phandle(np, "prcm", 0);
+-	if (prcm_np)
++	if (prcm_np) {
+ 		npct->prcm_base = of_iomap(prcm_np, 0);
++		of_node_put(prcm_np);
++	}
+ 	if (!npct->prcm_base) {
+ 		if (version == PINCTRL_NMK_STN8815) {
+ 			dev_info(&pdev->dev,
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch b/queue-5.4/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
new file mode 100644
index 00000000000..6f4293f117e
--- /dev/null
+++ b/queue-5.4/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
@@ -0,0 +1,125 @@
+From 993fe992512c1838e6e9dc0d1f8fbed739f5135d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Feb 2022 12:03:08 +0000
+Subject: pinctrl: npcm: Fix broken references to chip->parent_device
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit f7e53e2255808ca3abcc8f38d18ad0823425e771 ]
+
+The npcm driver has a bunch of references to the irq_chip parent_device
+field, but never sets it.
+
+Fix it by fishing that reference from somewhere else, but it is
+obvious that these debug statements were never used. Also remove
+an unused field in a local data structure.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Link: https://lore.kernel.org/r/20220201120310.878267-11-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 25 +++++++++++------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+index 17f909d8b63a..e7dc97e099f2 100644
+--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c
+@@ -78,7 +78,6 @@ struct npcm7xx_gpio {
+ 	struct gpio_chip	gc;
+ 	int			irqbase;
+ 	int			irq;
+-	void			*priv;
+ 	struct irq_chip		irq_chip;
+ 	u32			pinctrl_id;
+ 	int (*direction_input)(struct gpio_chip *chip, unsigned offset);
+@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc)
+ 	chained_irq_enter(chip, desc);
+ 	sts = ioread32(bank->base + NPCM7XX_GP_N_EVST);
+ 	en  = ioread32(bank->base + NPCM7XX_GP_N_EVEN);
+-	dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts,
++	dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts,
+ 		en);
+ 
+ 	sts &= en;
+@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type)
+ 		gpiochip_get_data(irq_data_get_irq_chip_data(d));
+ 	unsigned int gpio = BIT(d->hwirq);
+ 
+-	dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio,
++	dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio,
+ 		d->irq, type);
+ 	switch (type) {
+ 	case IRQ_TYPE_EDGE_RISING:
+-		dev_dbg(d->chip->parent_device, "edge.rising\n");
++		dev_dbg(bank->gc.parent, "edge.rising\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_EDGE_FALLING:
+-		dev_dbg(d->chip->parent_device, "edge.falling\n");
++		dev_dbg(bank->gc.parent, "edge.falling\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_EDGE_BOTH:
+-		dev_dbg(d->chip->parent_device, "edge.both\n");
++		dev_dbg(bank->gc.parent, "edge.both\n");
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio);
+ 		break;
+ 	case IRQ_TYPE_LEVEL_LOW:
+-		dev_dbg(d->chip->parent_device, "level.low\n");
++		dev_dbg(bank->gc.parent, "level.low\n");
+ 		npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	case IRQ_TYPE_LEVEL_HIGH:
+-		dev_dbg(d->chip->parent_device, "level.high\n");
++		dev_dbg(bank->gc.parent, "level.high\n");
+ 		npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio);
+ 		break;
+ 	default:
+-		dev_dbg(d->chip->parent_device, "invalid irq type\n");
++		dev_dbg(bank->gc.parent, "invalid irq type\n");
+ 		return -EINVAL;
+ 	}
+ 
+@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d)
+ 		gpiochip_get_data(irq_data_get_irq_chip_data(d));
+ 	unsigned int gpio = d->hwirq;
+ 
+-	dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST);
+ }
+ 
+@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* Clear events */
+-	dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC);
+ }
+ 
+@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* Enable events */
+-	dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq);
++	dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq);
+ 	iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS);
+ }
+ 
+@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d)
+ 	unsigned int gpio = d->hwirq;
+ 
+ 	/* active-high, input, clear interrupt, enable interrupt */
+-	dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq);
++	dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq);
+ 	npcmgpio_direction_input(gc, gpio);
+ 	npcmgpio_irq_ack(d);
+ 	npcmgpio_irq_unmask(d);
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch b/queue-5.4/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
new file mode 100644
index 00000000000..fe240f61550
--- /dev/null
+++ b/queue-5.4/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
@@ -0,0 +1,50 @@
+From 1f9d3f30e2de14527c405e491505d1738f51c52f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Dec 2021 15:41:11 +0100
+Subject: pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9e04a0eda84fccab0ac22a33825ad53f47c968c7 ]
+
+The second video-in channel on RZ/G1C has only 12 data lanes, but the
+pin control driver uses the vin_data union, which is meant for 24 data
+lanes, thus wasting space.
+
+Fix this by using the vin_data12 union instead.
+
+This reduces kernel size by 96 bytes.
+
+Fixes: 50f3f2d73e3426ba ("pinctrl: sh-pfc: Reduce kernel size for narrow VIN channels")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/52716fa89139f6f92592633edb52804d4c5e18f0.1640269757.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77470.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c
+index b3b116da1bb0..14005725a726 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c
+@@ -2121,7 +2121,7 @@ static const unsigned int vin0_clk_mux[] = {
+ 	VI0_CLK_MARK,
+ };
+ /* - VIN1 ------------------------------------------------------------------- */
+-static const union vin_data vin1_data_pins = {
++static const union vin_data12 vin1_data_pins = {
+ 	.data12 = {
+ 		RCAR_GP_PIN(3,  1), RCAR_GP_PIN(3, 2),
+ 		RCAR_GP_PIN(3,  3), RCAR_GP_PIN(3, 4),
+@@ -2131,7 +2131,7 @@ static const union vin_data vin1_data_pins = {
+ 		RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16),
+ 	},
+ };
+-static const union vin_data vin1_data_mux = {
++static const union vin_data12 vin1_data_mux = {
+ 	.data12 = {
+ 		VI1_DATA0_MARK, VI1_DATA1_MARK,
+ 		VI1_DATA2_MARK, VI1_DATA3_MARK,
+-- 
+2.34.1
+
diff --git a/queue-5.4/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch b/queue-5.4/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
new file mode 100644
index 00000000000..3eac6e11d74
--- /dev/null
+++ b/queue-5.4/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
@@ -0,0 +1,45 @@
+From 379ceeabfd5870ecca84c4c99cac9142b2f95ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:02:34 +0000
+Subject: pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 89388f8730699c259f8090ec435fb43569efe4ac ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: 1e747e59cc4d ("pinctrl: rockchip: base regmap supplied by a syscon")
+Fixes: 14dee8677e19 ("pinctrl: rockchip: let pmu registers be supplied by a syscon")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220307120234.28657-1-linmq006@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-rockchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index 59fe3204e965..4b972be3487f 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -3433,6 +3433,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ 	node = of_parse_phandle(np, "rockchip,grf", 0);
+ 	if (node) {
+ 		info->regmap_base = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(info->regmap_base))
+ 			return PTR_ERR(info->regmap_base);
+ 	} else {
+@@ -3469,6 +3470,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ 	node = of_parse_phandle(np, "rockchip,pmu", 0);
+ 	if (node) {
+ 		info->regmap_pmu = syscon_node_to_regmap(node);
++		of_node_put(node);
+ 		if (IS_ERR(info->regmap_pmu))
+ 			return PTR_ERR(info->regmap_pmu);
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch b/queue-5.4/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
new file mode 100644
index 00000000000..4b3073b8ca4
--- /dev/null
+++ b/queue-5.4/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
@@ -0,0 +1,107 @@
+From d2bcc7ca2ecff237280f2e6863a20968bb46a008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Mar 2022 14:02:14 +0300
+Subject: PM: core: keep irq flags in device_pm_check_callbacks()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 524bb1da785a7ae43dd413cd392b5071c6c367f8 ]
+
+The function device_pm_check_callbacks() can be called under the spin
+lock (in the reported case it happens from genpd_add_device() ->
+dev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes.
+
+However this function uncoditionally uses spin_lock_irq() /
+spin_unlock_irq(), thus not preserving the CPU flags. Use the
+irqsave/irqrestore instead.
+
+The backtrace for the reference:
+[    2.752010] ------------[ cut here ]------------
+[    2.756769] raw_local_irq_restore() called with IRQs enabled
+[    2.762596] WARNING: CPU: 4 PID: 1 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x50
+[    2.772338] Modules linked in:
+[    2.775487] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G S                5.17.0-rc6-00384-ge330d0d82eff-dirty #684
+[    2.781384] Freeing initrd memory: 46024K
+[    2.785839] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[    2.785841] pc : warn_bogus_irq_restore+0x34/0x50
+[    2.785844] lr : warn_bogus_irq_restore+0x34/0x50
+[    2.785846] sp : ffff80000805b7d0
+[    2.785847] x29: ffff80000805b7d0 x28: 0000000000000000 x27: 0000000000000002
+[    2.785850] x26: ffffd40e80930b18 x25: ffff7ee2329192b8 x24: ffff7edfc9f60800
+[    2.785853] x23: ffffd40e80930b18 x22: ffffd40e80930d30 x21: ffff7edfc0dffa00
+[    2.785856] x20: ffff7edfc09e3768 x19: 0000000000000000 x18: ffffffffffffffff
+[    2.845775] x17: 6572206f74206465 x16: 6c696166203a3030 x15: ffff80008805b4f7
+[    2.853108] x14: 0000000000000000 x13: ffffd40e809550b0 x12: 00000000000003d8
+[    2.860441] x11: 0000000000000148 x10: ffffd40e809550b0 x9 : ffffd40e809550b0
+[    2.867774] x8 : 00000000ffffefff x7 : ffffd40e809ad0b0 x6 : ffffd40e809ad0b0
+[    2.875107] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
+[    2.882440] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7edfc03a8000
+[    2.889774] Call trace:
+[    2.892290]  warn_bogus_irq_restore+0x34/0x50
+[    2.896770]  _raw_spin_unlock_irqrestore+0x94/0xa0
+[    2.901690]  genpd_unlock_spin+0x20/0x30
+[    2.905724]  genpd_add_device+0x100/0x2d0
+[    2.909850]  __genpd_dev_pm_attach+0xa8/0x23c
+[    2.914329]  genpd_dev_pm_attach_by_id+0xc4/0x190
+[    2.919167]  genpd_dev_pm_attach_by_name+0x3c/0xd0
+[    2.924086]  dev_pm_domain_attach_by_name+0x24/0x30
+[    2.929102]  psci_dt_attach_cpu+0x24/0x90
+[    2.933230]  psci_cpuidle_probe+0x2d4/0x46c
+[    2.937534]  platform_probe+0x68/0xe0
+[    2.941304]  really_probe.part.0+0x9c/0x2fc
+[    2.945605]  __driver_probe_device+0x98/0x144
+[    2.950085]  driver_probe_device+0x44/0x15c
+[    2.954385]  __device_attach_driver+0xb8/0x120
+[    2.958950]  bus_for_each_drv+0x78/0xd0
+[    2.962896]  __device_attach+0xd8/0x180
+[    2.966843]  device_initial_probe+0x14/0x20
+[    2.971144]  bus_probe_device+0x9c/0xa4
+[    2.975092]  device_add+0x380/0x88c
+[    2.978679]  platform_device_add+0x114/0x234
+[    2.983067]  platform_device_register_full+0x100/0x190
+[    2.988344]  psci_idle_init+0x6c/0xb0
+[    2.992113]  do_one_initcall+0x74/0x3a0
+[    2.996060]  kernel_init_freeable+0x2fc/0x384
+[    3.000543]  kernel_init+0x28/0x130
+[    3.004132]  ret_from_fork+0x10/0x20
+[    3.007817] irq event stamp: 319826
+[    3.011404] hardirqs last  enabled at (319825): [<ffffd40e7eda0268>] __up_console_sem+0x78/0x84
+[    3.020332] hardirqs last disabled at (319826): [<ffffd40e7fd6d9d8>] el1_dbg+0x24/0x8c
+[    3.028458] softirqs last  enabled at (318312): [<ffffd40e7ec90410>] _stext+0x410/0x588
+[    3.036678] softirqs last disabled at (318299): [<ffffd40e7ed1bf68>] __irq_exit_rcu+0x158/0x174
+[    3.045607] ---[ end trace 0000000000000000 ]---
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 23af54512053..ae382c4018fd 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -2121,7 +2121,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops)
+ 
+ void device_pm_check_callbacks(struct device *dev)
+ {
+-	spin_lock_irq(&dev->power.lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&dev->power.lock, flags);
+ 	dev->power.no_pm_callbacks =
+ 		(!dev->bus || (pm_ops_is_empty(dev->bus->pm) &&
+ 		 !dev->bus->suspend && !dev->bus->resume)) &&
+@@ -2130,7 +2132,7 @@ void device_pm_check_callbacks(struct device *dev)
+ 		(!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) &&
+ 		(!dev->driver || (pm_ops_is_empty(dev->driver->pm) &&
+ 		 !dev->driver->suspend && !dev->driver->resume));
+-	spin_unlock_irq(&dev->power.lock);
++	spin_unlock_irqrestore(&dev->power.lock, flags);
+ }
+ 
+ bool dev_pm_smart_suspend_and_suspended(struct device *dev)
+-- 
+2.34.1
+
diff --git a/queue-5.4/pm-hibernate-fix-__setup-handler-error-handling.patch b/queue-5.4/pm-hibernate-fix-__setup-handler-error-handling.patch
new file mode 100644
index 00000000000..f9ce580d451
--- /dev/null
+++ b/queue-5.4/pm-hibernate-fix-__setup-handler-error-handling.patch
@@ -0,0 +1,40 @@
+From d16fe9e5c0a571b5711ce9f2db3c32d22f82215d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:32 -0800
+Subject: PM: hibernate: fix __setup handler error handling
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ba7ffcd4c4da374b0f64666354eeeda7d3827131 ]
+
+If an invalid value is used in "resumedelay=<seconds>", it is
+silently ignored. Add a warning message and then let the __setup
+handler return 1 to indicate that the kernel command line option
+has been handled.
+
+Fixes: 317cf7e5e85e3 ("PM / hibernate: convert simple_strtoul to kstrtoul")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 6cafb2e910a1..406b4cbbec5e 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -1216,7 +1216,7 @@ static int __init resumedelay_setup(char *str)
+ 	int rc = kstrtouint(str, 0, &resume_delay);
+ 
+ 	if (rc)
+-		return rc;
++		pr_warn("resumedelay: bad option string '%s'\n", str);
+ 	return 1;
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/pm-suspend-fix-return-value-of-__setup-handler.patch b/queue-5.4/pm-suspend-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..5fde61de31f
--- /dev/null
+++ b/queue-5.4/pm-suspend-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,73 @@
+From cfa1ecfdb4842bbbf6420dd6a8c6952ba78f023c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:44 -0800
+Subject: PM: suspend: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7a64ca17e4dd50d5f910769167f3553902777844 ]
+
+If an invalid option is given for "test_suspend=<option>", the entire
+string is added to init's environment, so return 1 instead of 0 from
+the __setup handler.
+
+  Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5
+    test_suspend=invalid"
+
+and
+
+ Run /sbin/init as init process
+   with arguments:
+     /sbin/init
+   with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     test_suspend=invalid
+
+Fixes: 2ce986892faf ("PM / sleep: Enhance test_suspend option with repeat capability")
+Fixes: 27ddcc6596e5 ("PM / sleep: Add state field to pm_states[] entries")
+Fixes: a9d7052363a6 ("PM: Separate suspend to RAM functionality from core")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/suspend_test.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
+index 60564b58de07..bfd2a96c695c 100644
+--- a/kernel/power/suspend_test.c
++++ b/kernel/power/suspend_test.c
+@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value)
+ 	value++;
+ 	suspend_type = strsep(&value, ",");
+ 	if (!suspend_type)
+-		return 0;
++		return 1;
+ 
+ 	repeat = strsep(&value, ",");
+ 	if (repeat) {
+ 		if (kstrtou32(repeat, 0, &test_repeat_count_max))
+-			return 0;
++			return 1;
+ 	}
+ 
+ 	for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
+ 		if (!strcmp(pm_labels[i], suspend_type)) {
+ 			test_state_label = pm_labels[i];
+-			return 0;
++			return 1;
+ 		}
+ 
+ 	printk(warn_bad_state, suspend_type);
+-	return 0;
++	return 1;
+ }
+ __setup("test_suspend", setup_test_suspend);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch b/queue-5.4/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
new file mode 100644
index 00000000000..a8d3b81ad1e
--- /dev/null
+++ b/queue-5.4/power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
@@ -0,0 +1,45 @@
+From 961b31593c5ef618b6595ef59cc742150db7660f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jan 2022 10:46:54 +0000
+Subject: power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit ba18dad0fb880cd29aa97b6b75560ef14d1061ba ]
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+    int irq = platform_get_irq(pdev, 0);
+    if (irq < 0)
+        return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: f7a388d6cd1c ("power: reset: Add a driver for the Gemini poweroff")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/gemini-poweroff.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c
+index 90e35c07240a..b7f7a8225f22 100644
+--- a/drivers/power/reset/gemini-poweroff.c
++++ b/drivers/power/reset/gemini-poweroff.c
+@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev)
+ 		return PTR_ERR(gpw->base);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq)
+-		return -EINVAL;
++	if (irq < 0)
++		return irq;
+ 
+ 	gpw->dev = dev;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch b/queue-5.4/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
new file mode 100644
index 00000000000..b065bb12f03
--- /dev/null
+++ b/queue-5.4/power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
@@ -0,0 +1,47 @@
+From d95f22b9679f1cf0d64aede74e7dcc6fa34b37f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jan 2022 13:13:46 +0000
+Subject: power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6a4760463dbc6b603690938c468839985189ce0a ]
+
+kobject_init_and_add() takes reference even when it fails.
+According to the doc of kobject_init_and_add()：
+
+   If this function returns an error, kobject_put() must be called to
+   properly clean up the memory associated with the object.
+
+Fix memory leak by calling kobject_put().
+
+Fixes: 8c0984e5a753 ("power: move power supply drivers to power/supply")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_fg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 69452fc085b9..4c229e6fb750 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di)
+ 	ret = kobject_init_and_add(&di->fg_kobject,
+ 		&ab8500_fg_ktype,
+ 		NULL, "battery");
+-	if (ret < 0)
++	if (ret < 0) {
++		kobject_put(&di->fg_kobject);
+ 		dev_err(di->dev, "failed to create sysfs entry\n");
++	}
+ 
+ 	return ret;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch b/queue-5.4/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
new file mode 100644
index 00000000000..87e3ab0a561
--- /dev/null
+++ b/queue-5.4/power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
@@ -0,0 +1,58 @@
+From 8b0b348aaea7722c2bf3aa58d7ae53c3f1584c64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Feb 2022 17:48:16 +0100
+Subject: power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong
+ false return
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit f7731754fdce33dad19be746f647d6ac47c5d695 ]
+
+The datasheet says that the BQ24190_REG_POC_CHG_CONFIG bits can
+have a value of either 10(0x2) or 11(0x3) for OTG (5V boost regulator)
+mode.
+
+Sofar bq24190_vbus_is_enabled() was only checking for 10 but some BIOS-es
+uses 11 when enabling the regulator at boot.
+
+Make bq24190_vbus_is_enabled() also check for 11 so that it does not
+wrongly returns false when the bits are set to 11.
+
+Fixes: 66b6bef2c4e0 ("power: supply: bq24190_charger: Export 5V boost converter as regulator")
+Cc: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq24190_charger.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index 1ae5d6d42c9e..64d87dccea82 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -41,6 +41,7 @@
+ #define BQ24190_REG_POC_CHG_CONFIG_DISABLE		0x0
+ #define BQ24190_REG_POC_CHG_CONFIG_CHARGE		0x1
+ #define BQ24190_REG_POC_CHG_CONFIG_OTG			0x2
++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT		0x3
+ #define BQ24190_REG_POC_SYS_MIN_MASK		(BIT(3) | BIT(2) | BIT(1))
+ #define BQ24190_REG_POC_SYS_MIN_SHIFT		1
+ #define BQ24190_REG_POC_SYS_MIN_MIN			3000
+@@ -550,7 +551,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev)
+ 	pm_runtime_mark_last_busy(bdi->dev);
+ 	pm_runtime_put_autosuspend(bdi->dev);
+ 
+-	return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG;
++	if (ret)
++		return ret;
++
++	return (val == BQ24190_REG_POC_CHG_CONFIG_OTG ||
++		val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT);
+ }
+ 
+ static const struct regulator_ops bq24190_vbus_ops = {
+-- 
+2.34.1
+
diff --git a/queue-5.4/power-supply-wm8350-power-add-missing-free-in-free_c.patch b/queue-5.4/power-supply-wm8350-power-add-missing-free-in-free_c.patch
new file mode 100644
index 00000000000..f154637eb1f
--- /dev/null
+++ b/queue-5.4/power-supply-wm8350-power-add-missing-free-in-free_c.patch
@@ -0,0 +1,36 @@
+From c59fa48bf2860bceb6758c73b65a4db5813e2c2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 17:43:22 +0800
+Subject: power: supply: wm8350-power: Add missing free in free_charger_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 6dee930f6f6776d1e5a7edf542c6863b47d9f078 ]
+
+In free_charger_irq(), there is no free for 'WM8350_IRQ_CHG_FAST_RDY'.
+Therefore, it should be better to add it in order to avoid the memory leak.
+
+Fixes: 14431aa0c5a4 ("power_supply: Add support for WM8350 PMU")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/wm8350_power.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c
+index 0762ab13fa56..4fe9ea9721b3 100644
+--- a/drivers/power/supply/wm8350_power.c
++++ b/drivers/power/supply/wm8350_power.c
+@@ -524,6 +524,7 @@ static void free_charger_irq(struct wm8350 *wm8350)
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
+ 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
+-- 
+2.34.1
+
diff --git a/queue-5.4/power-supply-wm8350-power-handle-error-for-wm8350_re.patch b/queue-5.4/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
new file mode 100644
index 00000000000..d0fdf5d95d2
--- /dev/null
+++ b/queue-5.4/power-supply-wm8350-power-handle-error-for-wm8350_re.patch
@@ -0,0 +1,156 @@
+From 24c853d763c9f4efa050594f49711bb31079bad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 09:57:51 +0800
+Subject: power: supply: wm8350-power: Handle error for wm8350_register_irq
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit b0b14b5ba11bec56fad344a4a0b2e16449cc8b94 ]
+
+As the potential failure of the wm8350_register_irq(),
+it should be better to check it and return error if fails.
+Also, use 'free_' in order to avoid same code.
+
+Fixes: 14431aa0c5a4 ("power_supply: Add support for WM8350 PMU")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/wm8350_power.c | 96 ++++++++++++++++++++++++-----
+ 1 file changed, 82 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c
+index 26923af574f4..0762ab13fa56 100644
+--- a/drivers/power/supply/wm8350_power.c
++++ b/drivers/power/supply/wm8350_power.c
+@@ -408,44 +408,112 @@ static const struct power_supply_desc wm8350_usb_desc = {
+  *		Initialisation
+  *********************************************************************/
+ 
+-static void wm8350_init_charger(struct wm8350 *wm8350)
++static int wm8350_init_charger(struct wm8350 *wm8350)
+ {
++	int ret;
++
+ 	/* register our interest in charger events */
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
+ 			    wm8350_charger_handler, 0, "Battery hot", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
++	if (ret)
++		goto err;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
+ 			    wm8350_charger_handler, 0, "Battery cold", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
++	if (ret)
++		goto free_chg_bat_hot;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
+ 			    wm8350_charger_handler, 0, "Battery fail", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
++	if (ret)
++		goto free_chg_bat_cold;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charger timeout", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
++	if (ret)
++		goto free_chg_bat_fail;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charge end", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
++	if (ret)
++		goto free_chg_to;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
+ 			    wm8350_charger_handler, 0,
+ 			    "Charge start", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
++	if (ret)
++		goto free_chg_end;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
+ 			    wm8350_charger_handler, 0,
+ 			    "Fast charge ready", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
++	if (ret)
++		goto free_chg_start;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <3.9V", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
++	if (ret)
++		goto free_chg_fast_rdy;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <3.1V", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
++	if (ret)
++		goto free_chg_vbatt_lt_3p9;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
+ 			    wm8350_charger_handler, 0,
+ 			    "Battery <2.85V", wm8350);
++	if (ret)
++		goto free_chg_vbatt_lt_3p1;
+ 
+ 	/* and supply change events */
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
+ 			    wm8350_charger_handler, 0, "USB", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
++	if (ret)
++		goto free_chg_vbatt_lt_2p85;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
+ 			    wm8350_charger_handler, 0, "Wall", wm8350);
+-	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
++	if (ret)
++		goto free_ext_usb_fb;
++
++	ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
+ 			    wm8350_charger_handler, 0, "Battery", wm8350);
++	if (ret)
++		goto free_ext_wall_fb;
++
++	return 0;
++
++free_ext_wall_fb:
++	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350);
++free_ext_usb_fb:
++	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350);
++free_chg_vbatt_lt_2p85:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
++free_chg_vbatt_lt_3p1:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
++free_chg_vbatt_lt_3p9:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
++free_chg_fast_rdy:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
++free_chg_start:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++free_chg_end:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
++free_chg_to:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
++free_chg_bat_fail:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350);
++free_chg_bat_cold:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350);
++free_chg_bat_hot:
++	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350);
++err:
++	return ret;
+ }
+ 
+ static void free_charger_irq(struct wm8350 *wm8350)
+-- 
+2.34.1
+
diff --git a/queue-5.4/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch b/queue-5.4/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
new file mode 100644
index 00000000000..d6d67454c7f
--- /dev/null
+++ b/queue-5.4/powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
@@ -0,0 +1,38 @@
+From cc77b41e056a908b30d393a5850fe858dc481921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 15:02:23 +0800
+Subject: powerpc: 8xx: fix a return value error in mpc8xx_pic_init
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+[ Upstream commit 3fd46e551f67f4303c3276a0d6cd20baf2d192c4 ]
+
+mpc8xx_pic_init() should return -ENOMEM instead of 0 when
+irq_domain_add_linear() return NULL. This cause mpc8xx_pics_init to continue
+executing even if mpc8xx_pic_host is NULL.
+
+Fixes: cc76404feaed ("powerpc/8xx: Fix possible device node reference leak")
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220223070223.26845-1-hbh25y@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/8xx/pic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/8xx/pic.c b/arch/powerpc/platforms/8xx/pic.c
+index e9617d35fd1f..209b12323aa4 100644
+--- a/arch/powerpc/platforms/8xx/pic.c
++++ b/arch/powerpc/platforms/8xx/pic.c
+@@ -153,6 +153,7 @@ int mpc8xx_pic_init(void)
+ 	if (mpc8xx_pic_host == NULL) {
+ 		printk(KERN_ERR "MPC8xx PIC: failed to allocate irq host!\n");
+ 		ret = -ENOMEM;
++		goto out;
+ 	}
+ 
+ 	ret = 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch b/queue-5.4/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
new file mode 100644
index 00000000000..bb392f6595d
--- /dev/null
+++ b/queue-5.4/powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
@@ -0,0 +1,57 @@
+From 4409c9c0a8a33399fe6525d16037f67d7d894c9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 22:28:58 +1100
+Subject: powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 2863dd2db23e0407f6c50b8ba5c0e55abef894f1 ]
+
+When CONFIG_GENERIC_CPU=y (true for all our defconfigs) we pass
+-mcpu=powerpc64 to the compiler, even when we're building a 32-bit
+kernel.
+
+This happens because we have an ifdef CONFIG_PPC_BOOK3S_64/else block in
+the Makefile that was written before 32-bit supported GENERIC_CPU. Prior
+to that the else block only applied to 64-bit Book3E.
+
+The GCC man page says -mcpu=powerpc64 "[specifies] a pure ... 64-bit big
+endian PowerPC ... architecture machine [type], with an appropriate,
+generic processor model assumed for scheduling purposes."
+
+It's unclear how that interacts with -m32, which we are also passing,
+although obviously -m32 is taking precedence in some sense, as the
+32-bit kernel only contains 32-bit instructions.
+
+This was noticed by inspection, not via any bug reports, but it does
+affect code generation. Comparing before/after code generation, there
+are some changes to instruction scheduling, and the after case (with
+-mcpu=powerpc64 removed) the compiler seems more keen to use r8.
+
+Fix it by making the else case only apply to Book3E 64, which excludes
+32-bit.
+
+Fixes: 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220215112858.304779-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 9f73fb6b1cc9..b9d2fcf030d0 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -174,7 +174,7 @@ else
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5))
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4)
+ endif
+-else
++else ifdef CONFIG_PPC_BOOK3E_64
+ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+ endif
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch b/queue-5.4/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
new file mode 100644
index 00000000000..b832b69c9b8
--- /dev/null
+++ b/queue-5.4/powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
@@ -0,0 +1,52 @@
+From 770e13e2e6441df0eaa2dc149a0eb3ad44e30807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 09:48:37 +0530
+Subject: powerpc/perf: Don't use perf_hw_context for trace IMC PMU
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 0198322379c25215b2778482bf1221743a76e2b5 ]
+
+Trace IMC (In-Memory collection counters) in powerpc is useful for
+application level profiling.
+
+For trace_imc, presently task context (task_ctx_nr) is set to
+perf_hw_context. But perf_hw_context should only be used for CPU PMU.
+See commit 26657848502b ("perf/core: Verify we have a single
+perf_hw_context PMU").
+
+So for trace_imc, even though it is per thread PMU, it is preferred to
+use sw_context in order to be able to do application level monitoring.
+Hence change the task_ctx_nr to use perf_sw_context.
+
+Fixes: 012ae244845f ("powerpc/perf: Trace imc PMU functions")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+[mpe: Update subject & incorporate notes into change log, reflow comment]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220202041837.65968-1-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index eb82dda884e5..d76e800a1f33 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -1441,7 +1441,11 @@ static int trace_imc_event_init(struct perf_event *event)
+ 	event->hw.idx = -1;
+ 	target = event->hw.target;
+ 
+-	event->pmu->task_ctx_nr = perf_hw_context;
++	/*
++	 * There can only be a single PMU for perf_hw_context events which is assigned to
++	 * core PMU. Hence use "perf_sw_context" for trace_imc.
++	 */
++	event->pmu->task_ctx_nr = perf_sw_context;
+ 	event->destroy = reset_global_refc;
+ 	return 0;
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch b/queue-5.4/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
new file mode 100644
index 00000000000..9cd44380f0d
--- /dev/null
+++ b/queue-5.4/powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
@@ -0,0 +1,50 @@
+From 7d4b8b61c08074d75644941d3e6b3d99828ee2f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 15:24:33 +0100
+Subject: powerpc/sysdev: fix incorrect use to determine if list is empty
+
+From: Jakob Koschel <jakobkoschel@gmail.com>
+
+[ Upstream commit fa1321b11bd01752f5be2415e74a0e1a7c378262 ]
+
+'gtm' will *always* be set by list_for_each_entry().
+It is incorrect to assume that the iterator value will be NULL if the
+list is empty.
+
+Instead of checking the pointer it should be checked if
+the list is empty.
+
+Fixes: 83ff9dcf375c ("powerpc/sysdev: implement FSL GTM support")
+Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220228142434.576226-1-jakobkoschel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/fsl_gtm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c
+index 8963eaffb1b7..39186ad6b3c3 100644
+--- a/arch/powerpc/sysdev/fsl_gtm.c
++++ b/arch/powerpc/sysdev/fsl_gtm.c
+@@ -86,7 +86,7 @@ static LIST_HEAD(gtms);
+  */
+ struct gtm_timer *gtm_get_timer16(void)
+ {
+-	struct gtm *gtm = NULL;
++	struct gtm *gtm;
+ 	int i;
+ 
+ 	list_for_each_entry(gtm, &gtms, list_node) {
+@@ -103,7 +103,7 @@ struct gtm_timer *gtm_get_timer16(void)
+ 		spin_unlock_irq(&gtm->lock);
+ 	}
+ 
+-	if (gtm)
++	if (!list_empty(&gtms))
+ 		return ERR_PTR(-EBUSY);
+ 	return ERR_PTR(-ENODEV);
+ }
+-- 
+2.34.1
+
diff --git a/queue-5.4/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch b/queue-5.4/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
new file mode 100644
index 00000000000..c46a0bdada6
--- /dev/null
+++ b/queue-5.4/printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
@@ -0,0 +1,70 @@
+From afd681b988978d0e3748cc8170fa92ebaf24e517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Feb 2022 14:05:56 -0800
+Subject: printk: fix return value of printk.devkmsg __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b665eae7a788c5e2bc10f9ac3c0137aa0ad1fc97 ]
+
+If an invalid option value is used with "printk.devkmsg=<value>",
+it is silently ignored.
+If a valid option value is used, it is honored but the wrong return
+value (0) is used, indicating that the command line option had an
+error and was not handled. This string is not added to init's
+environment strings due to init/main.c::unknown_bootoption()
+checking for a '.' in the boot option string and then considering
+that string to be an "Unused module parameter".
+
+Print a warning message if a bad option string is used.
+Always return 1 from the __setup handler to indicate that the command
+line option has been handled.
+
+Fixes: 750afe7babd1 ("printk: add kernel parameter to control writes to /dev/kmsg")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20220228220556.23484-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 23e26a203a9e..bb2198b40756 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -146,8 +146,10 @@ static int __control_devkmsg(char *str)
+ 
+ static int __init control_devkmsg(char *str)
+ {
+-	if (__control_devkmsg(str) < 0)
++	if (__control_devkmsg(str) < 0) {
++		pr_warn("printk.devkmsg: bad option string '%s'\n", str);
+ 		return 1;
++	}
+ 
+ 	/*
+ 	 * Set sysctl string accordingly:
+@@ -166,7 +168,7 @@ static int __init control_devkmsg(char *str)
+ 	 */
+ 	devkmsg_log |= DEVKMSG_LOG_MASK_LOCK;
+ 
+-	return 0;
++	return 1;
+ }
+ __setup("printk.devkmsg=", control_devkmsg);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch b/queue-5.4/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
new file mode 100644
index 00000000000..aeb33e69312
--- /dev/null
+++ b/queue-5.4/pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
@@ -0,0 +1,83 @@
+From 16caa7943e2b1278f77d86bdff0c9b79e4950162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Nov 2021 09:49:48 +0100
+Subject: pwm: lpc18xx-sct: Initialize driver data and hardware before
+ pwmchip_add()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 0401f24cd238ae200a23a13925f98de3d2c883b8 ]
+
+When a driver calls pwmchip_add() it has to be prepared to immediately
+get its callbacks called. So move allocation of driver data and hardware
+initialization before the call to pwmchip_add().
+
+This fixes a potential NULL pointer exception and a race condition on
+register writes.
+
+Fixes: 841e6f90bb78 ("pwm: NXP LPC18xx PWM/SCT driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpc18xx-sct.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c
+index 5ff11145c1a3..9b15b6a79082 100644
+--- a/drivers/pwm/pwm-lpc18xx-sct.c
++++ b/drivers/pwm/pwm-lpc18xx-sct.c
+@@ -400,12 +400,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 	lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT,
+ 			   BIT(lpc18xx_pwm->period_event));
+ 
+-	ret = pwmchip_add(&lpc18xx_pwm->chip);
+-	if (ret < 0) {
+-		dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
+-		goto disable_pwmclk;
+-	}
+-
+ 	for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) {
+ 		struct lpc18xx_pwm_data *data;
+ 
+@@ -415,14 +409,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 				    GFP_KERNEL);
+ 		if (!data) {
+ 			ret = -ENOMEM;
+-			goto remove_pwmchip;
++			goto disable_pwmclk;
+ 		}
+ 
+ 		pwm_set_chip_data(pwm, data);
+ 	}
+ 
+-	platform_set_drvdata(pdev, lpc18xx_pwm);
+-
+ 	val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL);
+ 	val &= ~LPC18XX_PWM_BIDIR;
+ 	val &= ~LPC18XX_PWM_CTRL_HALT;
+@@ -430,10 +422,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ 	val |= LPC18XX_PWM_PRE(0);
+ 	lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val);
+ 
++	ret = pwmchip_add(&lpc18xx_pwm->chip);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
++		goto disable_pwmclk;
++	}
++
++	platform_set_drvdata(pdev, lpc18xx_pwm);
++
+ 	return 0;
+ 
+-remove_pwmchip:
+-	pwmchip_remove(&lpc18xx_pwm->chip);
+ disable_pwmclk:
+ 	clk_disable_unprepare(lpc18xx_pwm->pwm_clk);
+ 	return ret;
+-- 
+2.34.1
+
diff --git a/queue-5.4/qlcnic-dcb-default-to-returning-eopnotsupp.patch b/queue-5.4/qlcnic-dcb-default-to-returning-eopnotsupp.patch
new file mode 100644
index 00000000000..460b800221c
--- /dev/null
+++ b/queue-5.4/qlcnic-dcb-default-to-returning-eopnotsupp.patch
@@ -0,0 +1,81 @@
+From 5a6bcc50ad901e4871a421f090088bf40b0352a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Mar 2022 10:20:03 -0700
+Subject: qlcnic: dcb: default to returning -EOPNOTSUPP
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 1521db37f0d42334a88e8ff28198a27d1ed5cd7b ]
+
+Clang static analysis reports this issue
+qlcnic_dcb.c:382:10: warning: Assigned value is
+  garbage or undefined
+  mbx_out = *val;
+          ^ ~~~~
+
+val is set in the qlcnic_dcb_query_hw_capability() wrapper.
+If there is no query_hw_capability op in dcp, success is
+returned without setting the val.
+
+For this and similar wrappers, return -EOPNOTSUPP.
+
+Fixes: 14d385b99059 ("qlcnic: dcb: Query adapter DCB capabilities.")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+index f4aa6331b367..0a9d24e86715 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->get_hw_capability)
+ 		return dcb->ops->get_hw_capability(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb)
+@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->attach)
+ 		return dcb->ops->attach(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline int
+@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf)
+ 	if (dcb && dcb->ops->query_hw_capability)
+ 		return dcb->ops->query_hw_capability(dcb, buf);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb)
+@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type)
+ 	if (dcb && dcb->ops->query_cee_param)
+ 		return dcb->ops->query_cee_param(dcb, buf, type);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+ 	if (dcb && dcb->ops->get_cee_cfg)
+ 		return dcb->ops->get_cee_cfg(dcb);
+ 
+-	return 0;
++	return -EOPNOTSUPP;
+ }
+ 
+ static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg)
+-- 
+2.34.1
+
diff --git a/queue-5.4/ray_cs-check-ioremap-return-value.patch b/queue-5.4/ray_cs-check-ioremap-return-value.patch
new file mode 100644
index 00000000000..4110fe53bc5
--- /dev/null
+++ b/queue-5.4/ray_cs-check-ioremap-return-value.patch
@@ -0,0 +1,57 @@
+From 10ecf1fe52bf79d1283b2e9dceac02594033a3f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 10:29:26 +0800
+Subject: ray_cs: Check ioremap return value
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 7e4760713391ee46dc913194b33ae234389a174e ]
+
+As the possible failure of the ioremap(), the 'local->sram' and other
+two could be NULL.
+Therefore it should be better to check it in order to avoid the later
+dev_dbg.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20211230022926.1846757-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ray_cs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index cf372684b681..3836d6ac5304 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -382,6 +382,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->sram = ioremap(link->resource[2]->start,
+ 			resource_size(link->resource[2]));
++	if (!local->sram)
++		goto failed;
+ 
+ /*** Set up 16k window for shared memory (receive buffer) ***************/
+ 	link->resource[3]->flags |=
+@@ -396,6 +398,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->rmem = ioremap(link->resource[3]->start,
+ 			resource_size(link->resource[3]));
++	if (!local->rmem)
++		goto failed;
+ 
+ /*** Set up window for attribute memory ***********************************/
+ 	link->resource[4]->flags |=
+@@ -410,6 +414,8 @@ static int ray_config(struct pcmcia_device *link)
+ 		goto failed;
+ 	local->amem = ioremap(link->resource[4]->start,
+ 			resource_size(link->resource[4]));
++	if (!local->amem)
++		goto failed;
+ 
+ 	dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram);
+ 	dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem);
+-- 
+2.34.1
+
diff --git a/queue-5.4/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch b/queue-5.4/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
new file mode 100644
index 00000000000..bb5753bc263
--- /dev/null
+++ b/queue-5.4/rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
@@ -0,0 +1,40 @@
+From 35e07315cbd0afdc31179d3f24c66b4ac5a2127f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 09:06:01 -0800
+Subject: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
+
+From: Yongzhi Liu <lyz_cs@pku.edu.cn>
+
+[ Upstream commit 087f9c3f2309ed183f7e4b85ae57121d8663224d ]
+
+In case the second xa_insert() fails, the obj_event is not released.  Fix
+the error unwind flow to free that memory to avoid a memory leak.
+
+Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
+Link: https://lore.kernel.org/r/1647018361-18266-1-git-send-email-lyz_cs@pku.edu.cn
+Signed-off-by: Yongzhi Liu <lyz_cs@pku.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 664e0f374ac0..747f42855b7b 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -1844,8 +1844,10 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table,
+ 				key_level2,
+ 				obj_event,
+ 				GFP_KERNEL);
+-		if (err)
++		if (err) {
++			kfree(obj_event);
+ 			return err;
++		}
+ 		INIT_LIST_HEAD(&obj_event->obj_sub_list);
+ 	}
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch b/queue-5.4/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
new file mode 100644
index 00000000000..d65b83ebc33
--- /dev/null
+++ b/queue-5.4/regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
@@ -0,0 +1,48 @@
+From 8f5cc104b0a2aab3e055f4f3e9ff8eb76404b27f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jan 2022 12:11:38 +0100
+Subject: regulator: qcom_smd: fix for_each_child.cocci warnings
+
+From: kernel test robot <lkp@intel.com>
+
+[ Upstream commit 6390d42c21efff0b4c10956a38e341f4e84ecd3d ]
+
+drivers/regulator/qcom_smd-regulator.c:1318:1-33: WARNING: Function "for_each_available_child_of_node" should have of_node_put() before return around line 1321.
+
+Semantic patch information:
+ False positives can be due to function calls within the for_each
+ loop that may encapsulate an of_node_put.
+
+Generated by: scripts/coccinelle/iterators/for_each_child.cocci
+
+Fixes: 14e2976fbabd ("regulator: qcom_smd: Align probe function with rpmh-regulator")
+CC: Konrad Dybcio <konrad.dybcio@somainline.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2201151210170.3051@hadrien
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom_smd-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
+index e6601c28ab43..a4c82f5e2dae 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -854,8 +854,10 @@ static int rpm_reg_probe(struct platform_device *pdev)
+ 
+ 	for_each_available_child_of_node(dev->of_node, node) {
+ 		vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL);
+-		if (!vreg)
++		if (!vreg) {
++			of_node_put(node);
+ 			return -ENOMEM;
++		}
+ 
+ 		ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch b/queue-5.4/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
new file mode 100644
index 00000000000..c35e94a216a
--- /dev/null
+++ b/queue-5.4/remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
@@ -0,0 +1,36 @@
+From fc8b76aab161801e5e5e5d2bdfba3ce169ef1d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 03:12:19 +0000
+Subject: remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 505b5b1616e200042999de715dbe7c1e2735cd65 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220308031219.4718-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_adsp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
+index 24e8b7e27177..6b131a490ebf 100644
+--- a/drivers/remoteproc/qcom_q6v5_adsp.c
++++ b/drivers/remoteproc/qcom_q6v5_adsp.c
+@@ -389,6 +389,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp)
+ 	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch b/queue-5.4/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
new file mode 100644
index 00000000000..496aa9aea5d
--- /dev/null
+++ b/queue-5.4/remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
@@ -0,0 +1,37 @@
+From 33127db7ae5d4f83e98d22e7c5d82b5fe7ef8486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 06:31:02 +0000
+Subject: remoteproc: qcom_wcnss: Add missing of_node_put() in
+ wcnss_alloc_memory_region
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 8f90161a66bc3d6b9fe8dde4d9028d20eae1b62a ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image loader")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220308063102.10049-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_wcnss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c
+index dc135754bb9c..c72f1b3b6085 100644
+--- a/drivers/remoteproc/qcom_wcnss.c
++++ b/drivers/remoteproc/qcom_wcnss.c
+@@ -440,6 +440,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss)
+ 	}
+ 
+ 	ret = of_address_to_resource(node, 0, &r);
++	of_node_put(node);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/revert-revert-block-bfq-honor-already-setup-queue-me.patch b/queue-5.4/revert-revert-block-bfq-honor-already-setup-queue-me.patch
new file mode 100644
index 00000000000..da2cc823fa7
--- /dev/null
+++ b/queue-5.4/revert-revert-block-bfq-honor-already-setup-queue-me.patch
@@ -0,0 +1,78 @@
+From bf0805370ea5378a5eef6a80ff95549f6147f18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Nov 2021 19:15:10 +0100
+Subject: Revert "Revert "block, bfq: honor already-setup queue merges""
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit 15729ff8143f8135b03988a100a19e66d7cb7ecd ]
+
+A crash [1] happened to be triggered in conjunction with commit
+2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The
+latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq:
+honor already-setup queue merges""). Yet, the reverted commit was not
+the one introducing the bug. In fact, it actually triggered a UAF
+introduced by a different commit, and now fixed by commit d29bd41428cf
+("block, bfq: reset last_bfqq_created on group change").
+
+So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq:
+honor already-setup queue merges") out. This commit restores it.
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
+
+Reported-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20211125181510.15004-1-paolo.valente@linaro.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 38c39d50ae04..1d443d17cf7c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2523,6 +2523,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ 	 * are likely to increase the throughput.
+ 	 */
+ 	bfqq->new_bfqq = new_bfqq;
++	/*
++	 * The above assignment schedules the following redirections:
++	 * each time some I/O for bfqq arrives, the process that
++	 * generated that I/O is disassociated from bfqq and
++	 * associated with new_bfqq. Here we increases new_bfqq->ref
++	 * in advance, adding the number of processes that are
++	 * expected to be associated with new_bfqq as they happen to
++	 * issue I/O.
++	 */
+ 	new_bfqq->ref += process_refs;
+ 	return new_bfqq;
+ }
+@@ -2582,6 +2591,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ 	struct bfq_queue *in_service_bfqq, *new_bfqq;
+ 
++	/* if a merge has already been setup, then proceed with that first */
++	if (bfqq->new_bfqq)
++		return bfqq->new_bfqq;
++
+ 	/*
+ 	 * Do not perform queue merging if the device is non
+ 	 * rotational and performs internal queueing. In fact, such a
+@@ -2636,9 +2649,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ 	if (bfq_too_late_for_merging(bfqq))
+ 		return NULL;
+ 
+-	if (bfqq->new_bfqq)
+-		return bfqq->new_bfqq;
+-
+ 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ 		return NULL;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch b/queue-5.4/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
new file mode 100644
index 00000000000..a7379553326
--- /dev/null
+++ b/queue-5.4/sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
@@ -0,0 +1,60 @@
+From 154f7cc535b6dfc8d43adcb622f324110138f27d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jan 2022 10:35:15 +0530
+Subject: sched/debug: Remove mpol_get/put and task_lock/unlock from
+ sched_show_numa
+
+From: Bharata B Rao <bharata@amd.com>
+
+[ Upstream commit 28c988c3ec29db74a1dda631b18785958d57df4f ]
+
+The older format of /proc/pid/sched printed home node info which
+required the mempolicy and task lock around mpol_get(). However
+the format has changed since then and there is no need for
+sched_show_numa() any more to have mempolicy argument,
+asssociated mpol_get/put and task_lock/unlock. Remove them.
+
+Fixes: 397f2378f1361 ("sched/numa: Fix numa balancing stats in /proc/pid/sched")
+Signed-off-by: Bharata B Rao <bharata@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Link: https://lore.kernel.org/r/20220118050515.2973-1-bharata@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index faada713cfae..d5f7fc7099bc 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -847,25 +847,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf,
+ static void sched_show_numa(struct task_struct *p, struct seq_file *m)
+ {
+ #ifdef CONFIG_NUMA_BALANCING
+-	struct mempolicy *pol;
+-
+ 	if (p->mm)
+ 		P(mm->numa_scan_seq);
+ 
+-	task_lock(p);
+-	pol = p->mempolicy;
+-	if (pol && !(pol->flags & MPOL_F_MORON))
+-		pol = NULL;
+-	mpol_get(pol);
+-	task_unlock(p);
+-
+ 	P(numa_pages_migrated);
+ 	P(numa_preferred_nid);
+ 	P(total_numa_faults);
+ 	SEQ_printf(m, "current_node=%d, numa_group_id=%d\n",
+ 			task_node(p), task_numa_group_id(p));
+ 	show_numa_stats(p, m);
+-	mpol_put(pol);
+ #endif
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch b/queue-5.4/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
new file mode 100644
index 00000000000..98db41b566d
--- /dev/null
+++ b/queue-5.4/scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
@@ -0,0 +1,42 @@
+From 5d6302b31c4f55ae7328ea3e0dcd2677f660dc7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Feb 2022 19:51:24 +0800
+Subject: scsi: hisi_sas: Change permission of parameter prot_mask
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit c4e070457a93705e56ed06b3910d9e5fe56d3be3 ]
+
+Currently the permission of parameter prot_mask is 0x0, which means that
+the member does not appear in sysfs. Change it as other module parameters
+to 0444 for world-readable.
+
+[mkp: s/v3/v2/]
+
+Link: https://lore.kernel.org/r/1645703489-87194-2-git-send-email-john.garry@huawei.com
+Fixes: d6a9000b81be ("scsi: hisi_sas: Add support for DIF feature for v2 hw")
+Reported-by: Yihang Li <liyihang6@hisilicon.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 13f314fa757e..a86aae52d94f 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -504,7 +504,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt converge enable (0-1)");
+ 
+ /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */
+ static int prot_mask;
+-module_param(prot_mask, int, 0);
++module_param(prot_mask, int, 0444);
+ MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 ");
+ 
+ static bool auto_affine_msi_experimental;
+-- 
+2.34.1
+
diff --git a/queue-5.4/scsi-pm8001-fix-abort-all-task-initialization.patch b/queue-5.4/scsi-pm8001-fix-abort-all-task-initialization.patch
new file mode 100644
index 00000000000..29a32e2e4b7
--- /dev/null
+++ b/queue-5.4/scsi-pm8001-fix-abort-all-task-initialization.patch
@@ -0,0 +1,97 @@
+From 0e6f0a1f2dd0cc63230bec0732bb4162495e6fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:55 +0900
+Subject: scsi: pm8001: Fix abort all task initialization
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 7f12845c8389855dbcc67baa068b6832dc4a396e ]
+
+In pm80xx_send_abort_all(), the n_elem field of the ccb used is not
+initialized to 0. This missing initialization sometimes lead to the task
+completion path seeing the ccb with a non-zero n_elem resulting in the
+execution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(),
+causing a crash such as:
+
+[  197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280
+[  197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012
+[  197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0
+[  197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0
+[  197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b
+[  197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000
+[  197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000
+[  197.741493] FS:  0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000
+[  197.749659] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0
+[  197.762656] Call Trace:
+[  197.765127]  <IRQ>
+[  197.767162]  pm8001_ccb_task_free+0x5f1/0x820 [pm80xx]
+[  197.772364]  ? do_raw_spin_unlock+0x54/0x220
+[  197.776680]  pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx]
+[  197.782406]  process_oq+0xe85/0x7890 [pm80xx]
+[  197.786817]  ? lock_acquire+0x194/0x490
+[  197.790697]  ? handle_irq_event+0x10e/0x1b0
+[  197.794920]  ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx]
+[  197.800378]  ? __wake_up_bit+0x100/0x100
+[  197.804340]  ? lock_is_held_type+0x98/0x110
+[  197.808565]  pm80xx_chip_isr+0x94/0x130 [pm80xx]
+[  197.813243]  tasklet_action_common.constprop.0+0x24b/0x2f0
+[  197.818785]  __do_softirq+0x1b5/0x82d
+[  197.822485]  ? do_raw_spin_unlock+0x54/0x220
+[  197.826799]  __irq_exit_rcu+0x17e/0x1e0
+[  197.830678]  irq_exit_rcu+0xa/0x20
+[  197.834114]  common_interrupt+0x78/0x90
+[  197.840051]  </IRQ>
+[  197.844236]  <TASK>
+[  197.848397]  asm_common_interrupt+0x1e/0x40
+
+Avoid this issue by always initializing the ccb n_elem field to 0 in
+pm8001_send_abort_all(), pm8001_send_read_log() and
+pm80xx_send_abort_all().
+
+Link: https://lore.kernel.org/r/20220220031810.738362-17-damien.lemoal@opensource.wdc.com
+Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 ++
+ drivers/scsi/pm8001/pm80xx_hwi.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index a51fbb902366..fe5d996bf069 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1750,6 +1750,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 
+@@ -1812,6 +1813,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 	pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG;
+ 	pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG;
+ 
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 564be9754859..ce67965a504f 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1437,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ 	ccb->device = pm8001_ha_dev;
+ 	ccb->ccb_tag = ccb_tag;
+ 	ccb->task = task;
++	ccb->n_elem = 0;
+ 
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch b/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
new file mode 100644
index 00000000000..38843ad8438
--- /dev/null
+++ b/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
@@ -0,0 +1,43 @@
+From b462d49ae3fff66e986cb226ba5834675b04e546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:45 +0900
+Subject: scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit cd2268a180117aa8ebb23e090ba204324b2d0e93 ]
+
+The ds_ads_m field of struct ssp_ini_tm_start_req has the type __le32.
+Assigning a value to it should thus use cpu_to_le32(). This fixes the
+sparse warning:
+
+warning: incorrect type in assignment (different base types)
+   expected restricted __le32 [addressable] [assigned] [usertype] ds_ads_m
+   got int
+
+Link: https://lore.kernel.org/r/20220220031810.738362-7-damien.lemoal@opensource.wdc.com
+Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver")
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 7dbf0289e350..a51fbb902366 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4727,7 +4727,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha,
+ 	memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8);
+ 	sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag);
+ 	if (pm8001_ha->chip_id != chip_8001)
+-		sspTMCmd.ds_ads_m = 0x08;
++		sspTMCmd.ds_ads_m = cpu_to_le32(0x08);
+ 	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ 	ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0);
+ 	return ret;
+-- 
+2.34.1
+
diff --git a/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch b/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
new file mode 100644
index 00000000000..9dd505b5cb2
--- /dev/null
+++ b/queue-5.4/scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
@@ -0,0 +1,59 @@
+From cfe88f27b96be42520a59d9fe4a9eec41ac41251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:43 +0900
+Subject: scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 1a37b6738b58d86f6b144b3fc754ace0f2e0166d ]
+
+Since the sata_cmd struct is zeroed out before its fields are initialized,
+there is no need for using "|=" to initialize the ncqtag_atap_dir_m
+field. Using a standard assignment removes the sparse warning:
+
+warning: invalid assignment: |=
+
+Also, since the ncqtag_atap_dir_m field has type __le32, use cpu_to_le32()
+to generate the assigned value.
+
+Link: https://lore.kernel.org/r/20220220031810.738362-5-damien.lemoal@opensource.wdc.com
+Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes")
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 68a8217032d0..7dbf0289e350 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1828,7 +1828,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 
+ 	sata_cmd.tag = cpu_to_le32(ccb_tag);
+ 	sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+-	sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9));
++	sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9));
+ 	memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+ 
+ 	res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0);
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 161bf4760eac..5bf897188f4f 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -1516,7 +1516,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ 
+ 	sata_cmd.tag = cpu_to_le32(ccb_tag);
+ 	sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+-	sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9));
++	sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9)));
+ 	memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+ 
+ 	res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0);
+-- 
+2.34.1
+
diff --git a/queue-5.4/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch b/queue-5.4/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
new file mode 100644
index 00000000000..1c9bf4ad9e3
--- /dev/null
+++ b/queue-5.4/scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
@@ -0,0 +1,51 @@
+From 3e79aa81c26e1ad7047695094c7b026eb940234a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Feb 2022 12:17:46 +0900
+Subject: scsi: pm8001: Fix payload initialization in
+ pm80xx_set_thermal_config()
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit bb225b12dbcc82d53d637d10b8d70b64494f8c16 ]
+
+The fields of the set_ctrl_cfg_req structure have the __le32 type, so use
+cpu_to_le32() to assign them. This removes the sparse warnings:
+
+warning: incorrect type in assignment (different base types)
+    expected restricted __le32
+    got unsigned int
+
+Link: https://lore.kernel.org/r/20220220031810.738362-8-damien.lemoal@opensource.wdc.com
+Fixes: 842784e0d15b ("pm80xx: Update For Thermal Page Code")
+Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files")
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 5bf897188f4f..564be9754859 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha)
+ 	else
+ 		page_code = THERMAL_PAGE_CODE_8H;
+ 
+-	payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) |
+-				(THERMAL_ENABLE << 8) | page_code;
+-	payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8);
++	payload.cfg_pg[0] =
++		cpu_to_le32((THERMAL_LOG_ENABLE << 9) |
++			    (THERMAL_ENABLE << 8) | page_code);
++	payload.cfg_pg[1] =
++		cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8));
+ 
+ 	rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0);
+ 	if (rc)
+-- 
+2.34.1
+
diff --git a/queue-5.4/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch b/queue-5.4/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
new file mode 100644
index 00000000000..1989e59b6f1
--- /dev/null
+++ b/queue-5.4/selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
@@ -0,0 +1,75 @@
+From c69c345cd3586ba5a6162516be8e89a54fffe7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Mar 2022 12:15:26 +0100
+Subject: selftests/bpf: Make test_lwt_ip_encap more stable and faster
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+[ Upstream commit d23a8720327d33616f584d76c80824bfa4699be6 ]
+
+In test_lwt_ip_encap, the ingress IPv6 encap test failed from time to
+time. The failure occured when an IPv4 ping through the IPv6 GRE
+encapsulation did not receive a reply within the timeout. The IPv4 ping
+and the IPv6 ping in the test used different timeouts (1 sec for IPv4
+and 6 sec for IPv6), probably taking into account that IPv6 might need
+longer to successfully complete. However, when IPv4 pings (with the
+short timeout) are encapsulated into the IPv6 tunnel, the delays of IPv6
+apply.
+
+The actual reason for the long delays with IPv6 was that the IPv6
+neighbor discovery sometimes did not complete in time. This was caused
+by the outgoing interface only having a tentative link local address,
+i.e., not having completed DAD for that lladdr. The ND was successfully
+retried after 1 sec but that was too late for the ping timeout.
+
+The IPv6 addresses for the test were already added with nodad. However,
+for the lladdrs, DAD was still performed. We now disable DAD in the test
+netns completely and just assume that the two lladdrs on each veth pair
+do not collide. This removes all the delays for IPv6 traffic in the
+test.
+
+Without the delays, we can now also reduce the delay of the IPv6 ping to
+1 sec. This makes the whole test complete faster because we don't need
+to wait for the excessive timeout for each IPv6 ping that is supposed
+to fail.
+
+Fixes: 0fde56e4385b0 ("selftests: bpf: add test_lwt_ip_encap selftest")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/4987d549d48b4e316cd5b3936de69c8d4bc75a4f.1646305899.git.fmaurer@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+index b497bb85b667..6c69c42b1d60 100755
+--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
++++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+@@ -120,6 +120,14 @@ setup()
+ 	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0
+ 	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0
+ 
++	# disable IPv6 DAD because it sometimes takes too long and fails tests
++	ip netns exec ${NS1} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS2} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS3} sysctl -wq net.ipv6.conf.all.accept_dad=0
++	ip netns exec ${NS1} sysctl -wq net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${NS2} sysctl -wq net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${NS3} sysctl -wq net.ipv6.conf.default.accept_dad=0
++
+ 	ip link add veth1 type veth peer name veth2
+ 	ip link add veth3 type veth peer name veth4
+ 	ip link add veth5 type veth peer name veth6
+@@ -289,7 +297,7 @@ test_ping()
+ 		ip netns exec ${NS1} ping  -c 1 -W 1 -I veth1 ${IPv4_DST} 2>&1 > /dev/null
+ 		RET=$?
+ 	elif [ "${PROTO}" == "IPv6" ] ; then
+-		ip netns exec ${NS1} ping6 -c 1 -W 6 -I veth1 ${IPv6_DST} 2>&1 > /dev/null
++		ip netns exec ${NS1} ping6 -c 1 -W 1 -I veth1 ${IPv6_DST} 2>&1 > /dev/null
+ 		RET=$?
+ 	else
+ 		echo "    test_ping: unknown PROTO: ${PROTO}"
+-- 
+2.34.1
+
diff --git a/queue-5.4/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch b/queue-5.4/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
new file mode 100644
index 00000000000..cef1217a3f1
--- /dev/null
+++ b/queue-5.4/selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
@@ -0,0 +1,55 @@
+From c991d30d4eaaf79fcf533235b39a6a27049721b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 10:41:49 +0800
+Subject: selftests/bpf/test_lirc_mode2.sh: Exit with proper code
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit ec80906b0fbd7be11e3e960813b977b1ffe5f8fe ]
+
+When test_lirc_mode2_user exec failed, the test report failed but still
+exit with 0. Fix it by exiting with an error code.
+
+Another issue is for the LIRCDEV checking. With bash -n, we need to quote
+the variable, or it will always be true. So if test_lirc_mode2_user was
+not run, just exit with skip code.
+
+Fixes: 6bdd533cee9a ("bpf: add selftest for lirc_mode2 type program")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220321024149.157861-1-liuhangbin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_lirc_mode2.sh | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+index ec4e15948e40..5252b91f48a1 100755
+--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh
++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+@@ -3,6 +3,7 @@
+ 
+ # Kselftest framework requirement - SKIP code is 4.
+ ksft_skip=4
++ret=$ksft_skip
+ 
+ msg="skip all tests:"
+ if [ $UID != 0 ]; then
+@@ -25,7 +26,7 @@ do
+ 	fi
+ done
+ 
+-if [ -n $LIRCDEV ];
++if [ -n "$LIRCDEV" ];
+ then
+ 	TYPE=lirc_mode2
+ 	./test_lirc_mode2_user $LIRCDEV $INPUTDEV
+@@ -36,3 +37,5 @@ then
+ 		echo -e ${GREEN}"PASS: $TYPE"${NC}
+ 	fi
+ fi
++
++exit $ret
+-- 
+2.34.1
+
diff --git a/queue-5.4/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch b/queue-5.4/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
new file mode 100644
index 00000000000..d365e86d15e
--- /dev/null
+++ b/queue-5.4/selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
@@ -0,0 +1,69 @@
+From 65e5d94bbe3494e5b055c3b72ad844654739e093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 22:05:14 +0200
+Subject: selftests: test_vxlan_under_vrf: Fix broken test case
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit b50d3b46f84282d795ae3076111acb75ae1031f3 ]
+
+The purpose of the last test case is to test VXLAN encapsulation and
+decapsulation when the underlay lookup takes place in a non-default VRF.
+This is achieved by enslaving the physical device of the tunnel to a
+VRF.
+
+The binding of the VXLAN UDP socket to the VRF happens when the VXLAN
+device itself is opened, not when its physical device is opened. This
+was also mentioned in the cited commit ("tests that moving the underlay
+from a VRF to another works when down/up the VXLAN interface"), but the
+test did something else.
+
+Fix it by reopening the VXLAN device instead of its physical device.
+
+Before:
+
+ # ./test_vxlan_under_vrf.sh
+ Checking HV connectivity                                           [ OK ]
+ Check VM connectivity through VXLAN (underlay in the default VRF)  [ OK ]
+ Check VM connectivity through VXLAN (underlay in a VRF)            [FAIL]
+
+After:
+
+ # ./test_vxlan_under_vrf.sh
+ Checking HV connectivity                                           [ OK ]
+ Check VM connectivity through VXLAN (underlay in the default VRF)  [ OK ]
+ Check VM connectivity through VXLAN (underlay in a VRF)            [ OK ]
+
+Fixes: 03f1c26b1c56 ("test/net: Add script for VXLAN underlay in a VRF")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20220324200514.1638326-1-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/test_vxlan_under_vrf.sh | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/net/test_vxlan_under_vrf.sh b/tools/testing/selftests/net/test_vxlan_under_vrf.sh
+index 09f9ed92cbe4..a44b9aca7427 100755
+--- a/tools/testing/selftests/net/test_vxlan_under_vrf.sh
++++ b/tools/testing/selftests/net/test_vxlan_under_vrf.sh
+@@ -118,11 +118,11 @@ echo "[ OK ]"
+ 
+ # Move the underlay to a non-default VRF
+ ip -netns hv-1 link set veth0 vrf vrf-underlay
+-ip -netns hv-1 link set veth0 down
+-ip -netns hv-1 link set veth0 up
++ip -netns hv-1 link set vxlan0 down
++ip -netns hv-1 link set vxlan0 up
+ ip -netns hv-2 link set veth0 vrf vrf-underlay
+-ip -netns hv-2 link set veth0 down
+-ip -netns hv-2 link set veth0 up
++ip -netns hv-2 link set vxlan0 down
++ip -netns hv-2 link set vxlan0 up
+ 
+ echo -n "Check VM connectivity through VXLAN (underlay in a VRF)            "
+ ip netns exec vm-1 ping -c 1 -W 1 10.0.0.2 &> /dev/null || (echo "[FAIL]"; false)
+-- 
+2.34.1
+
diff --git a/queue-5.4/selftests-x86-add-validity-check-and-allow-field-spl.patch b/queue-5.4/selftests-x86-add-validity-check-and-allow-field-spl.patch
new file mode 100644
index 00000000000..96bb8a416d2
--- /dev/null
+++ b/queue-5.4/selftests-x86-add-validity-check-and-allow-field-spl.patch
@@ -0,0 +1,40 @@
+From 673ad6b674517076b203b69a489922f7dfe329a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 23:41:08 +0500
+Subject: selftests/x86: Add validity check and allow field splitting
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit b06e15ebd5bfb670f93c7f11a29b8299c1178bc6 ]
+
+Add check to test if CC has a string. CC can have multiple sub-strings
+like "ccache gcc". Erorr pops up if it is treated as single string and
+double quotes are used around it. This can be fixed by removing the
+quotes and not treating CC as a single string.
+
+Fixes: e9886ace222e ("selftests, x86: Rework x86 target architecture detection")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20220214184109.3739179-2-usama.anjum@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/x86/check_cc.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh
+index 3e2089c8cf54..8c669c0d662e 100755
+--- a/tools/testing/selftests/x86/check_cc.sh
++++ b/tools/testing/selftests/x86/check_cc.sh
+@@ -7,7 +7,7 @@ CC="$1"
+ TESTPROG="$2"
+ shift 2
+ 
+-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
+     echo 1
+ else
+     echo 0
+-- 
+2.34.1
+
diff --git a/queue-5.4/selinux-use-correct-type-for-context-length.patch b/queue-5.4/selinux-use-correct-type-for-context-length.patch
new file mode 100644
index 00000000000..547396e5d99
--- /dev/null
+++ b/queue-5.4/selinux-use-correct-type-for-context-length.patch
@@ -0,0 +1,47 @@
+From a080d2984005f5cde708b523c2c70c4c7afc7ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Feb 2022 15:21:25 +0100
+Subject: selinux: use correct type for context length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Göttsche <cgzones@googlemail.com>
+
+[ Upstream commit b97df7c098c531010e445da88d02b7bf7bf59ef6 ]
+
+security_sid_to_context() expects a pointer to an u32 as the address
+where to store the length of the computed context.
+
+Reported by sparse:
+
+    security/selinux/xfrm.c:359:39: warning: incorrect type in arg 4
+                                    (different signedness)
+    security/selinux/xfrm.c:359:39:    expected unsigned int
+                                       [usertype] *scontext_len
+    security/selinux/xfrm.c:359:39:    got int *
+
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+[PM: wrapped commit description]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/xfrm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
+index 7314196185d1..00e95f8bd7c7 100644
+--- a/security/selinux/xfrm.c
++++ b/security/selinux/xfrm.c
+@@ -346,7 +346,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
+ 	int rc;
+ 	struct xfrm_sec_ctx *ctx;
+ 	char *ctx_str = NULL;
+-	int str_len;
++	u32 str_len;
+ 
+ 	if (!polsec)
+ 		return 0;
+-- 
+2.34.1
+
diff --git a/queue-5.4/serial-8250-fix-race-condition-in-rts-after-send-han.patch b/queue-5.4/serial-8250-fix-race-condition-in-rts-after-send-han.patch
new file mode 100644
index 00000000000..97f06921c8f
--- /dev/null
+++ b/queue-5.4/serial-8250-fix-race-condition-in-rts-after-send-han.patch
@@ -0,0 +1,63 @@
+From 6d6f84f5cf7627159c69185c3a8d5451cbbb8003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 17:02:36 +0100
+Subject: serial: 8250: Fix race condition in RTS-after-send handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit dedab69fd650ea74710b2e626e63fd35584ef773 ]
+
+Set em485->active_timer = NULL isn't always enough to take out the stop
+timer. While there is a check that it acts in the right state (i.e.
+waiting for RTS-after-send to pass after sending some chars) but the
+following might happen:
+
+ - CPU1: some chars send, shifter becomes empty, stop tx timer armed
+ - CPU0: more chars send before RTS-after-send expired
+ - CPU0: shifter empty irq, port lock taken
+ - CPU1: tx timer triggers, waits for port lock
+ - CPU0: em485->active_timer = &em485->stop_tx_timer, hrtimer_start(),
+   releases lock()
+ - CPU1: get lock, see em485->active_timer == &em485->stop_tx_timer,
+   tear down RTS too early
+
+This fix bases on research done by Steffen Trumtrar.
+
+Fixes: b86f86e8e7c5 ("serial: 8250: fix potential deadlock in rs485-mode")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20220215160236.344236-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 777ef1a9591c..87567515591e 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1545,6 +1545,18 @@ static inline void start_tx_rs485(struct uart_port *port)
+ 	if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX))
+ 		serial8250_stop_rx(&up->port);
+ 
++	/*
++	 * While serial8250_em485_handle_stop_tx() is a noop if
++	 * em485->active_timer != &em485->stop_tx_timer, it might happen that
++	 * the timer is still armed and triggers only after the current bunch of
++	 * chars is send and em485->active_timer == &em485->stop_tx_timer again.
++	 * So cancel the timer. There is still a theoretical race condition if
++	 * the timer is already running and only comes around to check for
++	 * em485->active_timer when &em485->stop_tx_timer is armed again.
++	 */
++	if (em485->active_timer == &em485->stop_tx_timer)
++		hrtimer_try_to_cancel(&em485->stop_tx_timer);
++
+ 	em485->active_timer = NULL;
+ 
+ 	mcr = serial8250_in_MCR(up);
+-- 
+2.34.1
+
diff --git a/queue-5.4/serial-8250_mid-balance-reference-count-for-pci-dma-.patch b/queue-5.4/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
new file mode 100644
index 00000000000..4fefd003a69
--- /dev/null
+++ b/queue-5.4/serial-8250_mid-balance-reference-count-for-pci-dma-.patch
@@ -0,0 +1,93 @@
+From 8a8f512f2840fa04828a9fdc33803b8bf42f38a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 12:09:20 +0200
+Subject: serial: 8250_mid: Balance reference count for PCI DMA device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 67ec6dd0b257bd81b4e9fcac89b29da72f6265e5 ]
+
+The pci_get_slot() increases its reference count, the caller
+must decrement the reference count by calling pci_dev_put().
+
+Fixes: 90b9aacf912a ("serial: 8250_pci: add Intel Tangier support")
+Fixes: f549e94effa1 ("serial: 8250_pci: add Intel Penwell ports")
+Reported-by: Qing Wang <wangqing@vivo.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Depends-on: d9eda9bab237 ("serial: 8250_pci: Intel MID UART support to its own driver")
+Link: https://lore.kernel.org/r/20220215100920.41984-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_mid.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
+index efa0515139f8..e6c1791609dd 100644
+--- a/drivers/tty/serial/8250/8250_mid.c
++++ b/drivers/tty/serial/8250/8250_mid.c
+@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p)
+ 	return 0;
+ }
+ 
++static void pnw_exit(struct mid8250 *mid)
++{
++	pci_dev_put(mid->dma_dev);
++}
++
+ static int tng_handle_irq(struct uart_port *p)
+ {
+ 	struct mid8250 *mid = p->private_data;
+@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p)
+ 	return 0;
+ }
+ 
++static void tng_exit(struct mid8250 *mid)
++{
++	pci_dev_put(mid->dma_dev);
++}
++
+ static int dnv_handle_irq(struct uart_port *p)
+ {
+ 	struct mid8250 *mid = p->private_data;
+@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	pci_set_drvdata(pdev, mid);
+ 	return 0;
++
+ err:
+-	if (mid->board->exit)
+-		mid->board->exit(mid);
++	mid->board->exit(mid);
+ 	return ret;
+ }
+ 
+@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev)
+ 
+ 	serial8250_unregister_port(mid->line);
+ 
+-	if (mid->board->exit)
+-		mid->board->exit(mid);
++	mid->board->exit(mid);
+ }
+ 
+ static const struct mid8250_board pnw_board = {
+@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = {
+ 	.freq = 50000000,
+ 	.base_baud = 115200,
+ 	.setup = pnw_setup,
++	.exit = pnw_exit,
+ };
+ 
+ static const struct mid8250_board tng_board = {
+@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = {
+ 	.freq = 38400000,
+ 	.base_baud = 1843200,
+ 	.setup = tng_setup,
++	.exit = tng_exit,
+ };
+ 
+ static const struct mid8250_board dnv_board = {
+-- 
+2.34.1
+
diff --git a/queue-5.4/series b/queue-5.4/series
index d83d87e5c87..a0d8fe07e10 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -54,3 +54,232 @@ riscv-fix-fill_callchain-return-value.patch
 revert-input-clear-btn_right-middle-on-buttonpads.patch
 alsa-cs4236-fix-an-incorrect-null-check-on-list-iterator.patch
 alsa-hda-realtek-fix-audio-regression-on-mi-notebook-pro-2020.patch
+regulator-qcom_smd-fix-for_each_child.cocci-warnings.patch
+crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch
+crypto-mxs-dcp-fix-scatterlist-processing.patch
+spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
+selftests-x86-add-validity-check-and-allow-field-spl.patch
+audit-log-audit_time_-records-only-from-rules.patch
+crypto-ccree-don-t-attempt-0-len-dma-mappings.patch
+spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
+hwmon-pmbus-add-mutex-to-regulator-ops.patch
+hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch
+block-don-t-delete-queue-kobject-before-its-children.patch
+pm-hibernate-fix-__setup-handler-error-handling.patch
+pm-suspend-fix-return-value-of-__setup-handler.patch
+hwrng-atmel-disable-trng-on-failure-path.patch
+crypto-vmx-add-missing-dependencies.patch
+clocksource-drivers-timer-of-check-return-value-of-o.patch
+acpi-apei-fix-return-value-of-__setup-handlers.patch
+crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch
+virtio_blk-eliminate-anonymous-module_init-module_ex.patch
+hwmon-pmbus-add-vin-unit-off-handling.patch
+clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch
+sched-debug-remove-mpol_get-put-and-task_lock-unlock.patch
+perf-core-fix-address-filter-parser-for-multiple-fil.patch
+perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch
+f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch
+f2fs-fix-to-avoid-potential-deadlock.patch
+media-bttv-fix-warning-regression-on-tunerless-devic.patch
+media-coda-fix-missing-put_device-call-in-coda_get_v.patch
+media-hantro-fix-overfill-bottom-register-field-name.patch
+media-aspeed-correct-value-for-h-total-pixels.patch
+video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
+video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
+video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
+arm-dts-qcom-ipq4019-fix-sleep-clock.patch
+soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
+soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
+arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch
+soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
+arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch
+arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch
+media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch
+media-em28xx-initialize-refcount-before-kref_get.patch
+media-usb-go7007-s2250-board-fix-leak-in-probe.patch
+uaccess-fix-nios2-and-microblaze-get_user_8.patch
+asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch
+asoc-ti-davinci-i2s-add-check-for-clk_enable.patch
+alsa-spi-add-check-for-clk_enable.patch
+arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch
+arm64-dts-broadcom-fix-sata-nodename.patch
+printk-fix-return-value-of-printk.devkmsg-__setup-ha.patch
+asoc-mxs-saif-handle-errors-for-clk_enable.patch
+asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch
+asoc-soc-compress-prevent-the-potentially-use-of-nul.patch
+memory-emif-add-check-for-setup_interrupts.patch
+memory-emif-check-the-pointer-temp-in-get_device_det.patch
+alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch
+arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch
+media-stk1160-if-start-stream-fails-return-buffers-w.patch
+asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch
+asoc-wm8350-handle-error-for-wm8350_register_irq.patch
+asoc-fsi-add-check-for-clk_enable.patch
+video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
+ivtv-fix-incorrect-device_caps-for-ivtvfb.patch
+asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch
+asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch
+asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch
+asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch
+mmc-davinci_mmc-handle-error-for-clk_enable.patch
+asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch
+drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch
+drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch
+ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch
+udmabuf-validate-ubuf-pagecount.patch
+bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch
+mtd-onenand-check-for-error-irq.patch
+mtd-rawnand-gpmi-fix-controller-timings-setting.patch
+drm-edid-don-t-clear-formats-if-using-deep-color.patch
+drm-amd-display-fix-a-null-pointer-dereference-in-am.patch
+ath9k_htc-fix-uninit-value-bugs.patch
+kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch
+i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch
+power-reset-gemini-poweroff-fix-irq-check-in-gemini_.patch
+ray_cs-check-ioremap-return-value.patch
+powerpc-perf-don-t-use-perf_hw_context-for-trace-imc.patch
+mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch
+mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch
+net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch
+pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch
+power-supply-ab8500-fix-memory-leak-in-ab8500_fg_sys.patch
+hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch
+iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch
+drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch
+ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch
+dax-make-sure-inodes-are-flushed-before-destroy-cach.patch
+iwlwifi-fix-eio-error-code-that-is-never-returned.patch
+iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch
+dm-crypt-fix-get_key_size-compiler-warning-if-config.patch
+scsi-pm8001-fix-command-initialization-in-pm80xx_sen.patch
+scsi-pm8001-fix-command-initialization-in-pm8001_chi.patch
+scsi-pm8001-fix-payload-initialization-in-pm80xx_set.patch
+scsi-pm8001-fix-abort-all-task-initialization.patch
+drm-amd-display-remove-vupdate_int_entry-definition.patch
+tomoyo-fix-__setup-handlers-return-values.patch
+ext2-correct-max-file-size-computing.patch
+drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch
+power-supply-bq24190_charger-fix-bq24190_vbus_is_ena.patch
+scsi-hisi_sas-change-permission-of-parameter-prot_ma.patch
+drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch
+bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch
+bpf-arm64-feed-byte-offset-into-bpf-line-info.patch
+libbpf-skip-forward-declaration-when-counting-duplic.patch
+powerpc-makefile-don-t-pass-mcpu-powerpc64-when-buil.patch
+kvm-x86-fix-emulation-in-writing-cr8.patch
+kvm-x86-emulator-defer-not-present-segment-check-in-.patch
+hv_balloon-rate-limit-unhandled-message-warning.patch
+i2c-xiic-make-bus-names-unique.patch
+power-supply-wm8350-power-handle-error-for-wm8350_re.patch
+power-supply-wm8350-power-add-missing-free-in-free_c.patch
+pci-reduce-warnings-on-possible-rw1c-corruption.patch
+mips-dec-honor-config_mips_fp_support-n.patch
+powerpc-sysdev-fix-incorrect-use-to-determine-if-lis.patch
+mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch
+selftests-bpf-make-test_lwt_ip_encap-more-stable-and.patch
+powerpc-8xx-fix-a-return-value-error-in-mpc8xx_pic_i.patch
+vxcan-enable-local-echo-for-sent-can-frames.patch
+mips-rb532-fix-return-value-of-__setup-handler.patch
+mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
+rdma-mlx5-fix-memory-leak-in-error-flow-for-subscrib.patch
+bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch
+bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch
+bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch
+usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
+usb-usbip-eliminate-anonymous-module_init-module_exi.patch
+bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch
+af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch
+netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch
+i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch
+selftests-bpf-test_lirc_mode2.sh-exit-with-proper-co.patch
+net-bcmgenet-use-stronger-register-read-writes-to-as.patch
+tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
+openvswitch-always-update-flow-key-after-nat.patch
+tipc-fix-the-timer-expires-after-interval-100ms.patch
+mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch
+mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch
+pwm-lpc18xx-sct-initialize-driver-data-and-hardware-.patch
+misc-alcor_pci-fix-an-error-handling-path.patch
+staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
+pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch
+clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch
+phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch
+serial-8250_mid-balance-reference-count-for-pci-dma-.patch
+serial-8250-fix-race-condition-in-rts-after-send-han.patch
+iio-adc-add-check-for-devm_request_threaded_irq.patch
+nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch
+dma-debug-fix-return-value-of-__setup-handlers.patch
+clk-imx7d-remove-audio_mclk_root_clk.patch
+clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch
+clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch
+remoteproc-qcom-fix-missing-of_node_put-in-adsp_allo.patch
+remoteproc-qcom_wcnss-add-missing-of_node_put-in-wcn.patch
+clk-actions-terminate-clk_div_table-with-sentinel-el.patch
+clk-loongson1-terminate-clk_div_table-with-sentinel-.patch
+clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch
+clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch
+nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch
+staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
+pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch
+pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch
+pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch
+pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch
+pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch
+tty-hvc-fix-return-value-of-__setup-handler.patch
+kgdboc-fix-return-value-of-__setup-handler.patch
+kgdbts-fix-return-value-of-__setup-handler.patch
+firmware-google-properly-state-iomem-dependency.patch
+driver-core-dd-fix-return-value-of-__setup-handler.patch
+jfs-fix-divide-error-in-dbnextag.patch
+netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch
+nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch
+clk-qcom-gcc-msm8994-fix-gpll4-width.patch
+clk-initialize-orphan-req_rate.patch
+xen-fix-is_xen_pmu.patch
+net-phy-broadcom-fix-brcm_fet_config_init.patch
+selftests-test_vxlan_under_vrf-fix-broken-test-case.patch
+qlcnic-dcb-default-to-returning-eopnotsupp.patch
+net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch
+nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch
+net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch
+lib-test-use-after-free-in-register_test_dev_kmod.patch
+lsm-general-protection-fault-in-legacy_parse_param.patch
+gcc-plugins-stackleak-exactly-match-strings-instead-.patch
+pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch
+block-bfq-don-t-move-oom_bfqq.patch
+selinux-use-correct-type-for-context-length.patch
+loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch
+fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch
+irqchip-qcom-pdc-fix-broken-locking.patch
+irqchip-nvic-release-nvic_base-upon-failure.patch
+bfq-fix-use-after-free-in-bfq_dispatch_request.patch
+acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch
+lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch
+revert-revert-block-bfq-honor-already-setup-queue-me.patch
+acpi-apei-limit-printable-size-of-bert-table-data.patch
+pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch
+spi-tegra20-use-of_device_get_match_data.patch
+ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch
+ntfs-add-sanity-check-on-allocation-size.patch
+asoc-sof-intel-hda-remove-link-assignment-limitation.patch
+video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
+video-fbdev-w100fb-reset-global-state.patch
+video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
+video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
+arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch
+arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch
+asoc-madera-add-dependencies-on-mfd.patch
+arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch
+video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
+video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
+video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
+asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch
+media-cx88-mpeg-clear-interrupt-status-register-befo.patch
+arm-tegra-tamonten-fix-i2c3-pad-setting.patch
+arm-mmp-fix-failure-to-remove-sram-device.patch
+video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
+media-revert-media-em28xx-add-missing-em28xx_close_e.patch
+media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch
+tracing-have-trace_define_enum-affect-trace-event-ty.patch
+mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch
+alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch
diff --git a/queue-5.4/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch b/queue-5.4/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
new file mode 100644
index 00000000000..ad237de2714
--- /dev/null
+++ b/queue-5.4/soc-qcom-aoss-remove-spurious-irqf_oneshot-flags.patch
@@ -0,0 +1,50 @@
+From d809a98b59d7ad5364fd0f77198923470d4dc5e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jan 2022 17:35:54 +0000
+Subject: soc: qcom: aoss: remove spurious IRQF_ONESHOT flags
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 8030cb9a55688c1339edd284d9d6ce5f9fc75160 ]
+
+Quoting the header comments, IRQF_ONESHOT is "Used by threaded interrupts
+which need to keep the irq line disabled until the threaded handler has
+been run.". When applied to an interrupt that doesn't request a threaded
+irq then IRQF_ONESHOT has a lesser known (undocumented?) side effect,
+which it to disable the forced threading of the irq. For "normal" kernels
+(without forced threading) then, if there is no thread_fn, then
+IRQF_ONESHOT is a nop.
+
+In this case disabling forced threading is not appropriate for this driver
+because it calls wake_up_all() and this API cannot be called from
+no-thread interrupt handlers on PREEMPT_RT systems (deadlock risk, triggers
+sleeping-while-atomic warnings).
+
+Fix this by removing IRQF_ONESHOT.
+
+Fixes: 2209481409b7 ("soc: qcom: Add AOSS QMP driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+[bjorn: Added Fixes tag]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220127173554.158111-1-daniel.thompson@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom_aoss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c
+index 45c5aa712eda..f16d6ec78064 100644
+--- a/drivers/soc/qcom/qcom_aoss.c
++++ b/drivers/soc/qcom/qcom_aoss.c
+@@ -544,7 +544,7 @@ static int qmp_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	ret = devm_request_irq(&pdev->dev, irq, qmp_intr, IRQF_ONESHOT,
++	ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0,
+ 			       "aoss-qmp", qmp);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to request interrupt\n");
+-- 
+2.34.1
+
diff --git a/queue-5.4/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch b/queue-5.4/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
new file mode 100644
index 00000000000..520011ec6b1
--- /dev/null
+++ b/queue-5.4/soc-qcom-rpmpd-check-for-null-return-of-devm_kcalloc.patch
@@ -0,0 +1,43 @@
+From c35f9fe80b090a594b77654422138491ccf87bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Dec 2021 17:44:19 +0800
+Subject: soc: qcom: rpmpd: Check for null return of devm_kcalloc
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 5a811126d38f9767a20cc271b34db7c8efc5a46c ]
+
+Because of the possible failure of the allocation, data->domains might
+be NULL pointer and will cause the dereference of the NULL pointer
+later.
+Therefore, it might be better to check it and directly return -ENOMEM
+without releasing data manually if fails, because the comment of the
+devm_kmalloc() says "Memory allocated with this function is
+automatically freed on driver detach.".
+
+Fixes: bbe3a66c3f5a ("soc: qcom: rpmpd: Add a Power domain driver to model corners")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211231094419.1941054-1-jiasheng@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmpd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/soc/qcom/rpmpd.c b/drivers/soc/qcom/rpmpd.c
+index 3c1a55cf25d6..4715acfecff4 100644
+--- a/drivers/soc/qcom/rpmpd.c
++++ b/drivers/soc/qcom/rpmpd.c
+@@ -362,6 +362,9 @@ static int rpmpd_probe(struct platform_device *pdev)
+ 
+ 	data->domains = devm_kcalloc(&pdev->dev, num, sizeof(*data->domains),
+ 				     GFP_KERNEL);
++	if (!data->domains)
++		return -ENOMEM;
++
+ 	data->num_domains = num;
+ 
+ 	for (i = 0; i < num; i++) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch b/queue-5.4/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
new file mode 100644
index 00000000000..7cc80e91525
--- /dev/null
+++ b/queue-5.4/soc-ti-wkup_m3_ipc-fix-irq-check-in-wkup_m3_ipc_prob.patch
@@ -0,0 +1,47 @@
+From 502cb56f9ea838a2300729d70c065be789e64a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 06:28:40 +0000
+Subject: soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c3d66a164c726cc3b072232d3b6d87575d194084 ]
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+    int irq = platform_get_irq(pdev, 0);
+    if (irq < 0)
+        return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: cdd5de500b2c ("soc: ti: Add wkup_m3_ipc driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Acked-by: Dave Gerlach <d-gerlach@ti.com>
+Link: https://lore.kernel.org/r/20220114062840.16620-1-linmq006@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/wkup_m3_ipc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index e9ece45d7a33..ef3f95fefab5 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -447,9 +447,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
++	if (irq < 0) {
+ 		dev_err(&pdev->dev, "no irq resource\n");
+-		return -ENXIO;
++		return irq;
+ 	}
+ 
+ 	ret = devm_request_irq(dev, irq, wkup_m3_txev_handler,
+-- 
+2.34.1
+
diff --git a/queue-5.4/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch b/queue-5.4/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
new file mode 100644
index 00000000000..21ea4bb6ac6
--- /dev/null
+++ b/queue-5.4/spi-pxa2xx-pci-balance-reference-count-for-pci-dma-d.patch
@@ -0,0 +1,77 @@
+From 938fbe118a4628304421c291698f2cfc67cd5a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Feb 2022 21:16:37 +0200
+Subject: spi: pxa2xx-pci: Balance reference count for PCI DMA device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 609d7ffdc42199a0ec949db057e3b4be6745d6c5 ]
+
+The pci_get_slot() increases its reference count, the caller
+must decrement the reference count by calling pci_dev_put().
+
+Fixes: 743485ea3bee ("spi: pxa2xx-pci: Do a specific setup in a separate function")
+Fixes: 25014521603f ("spi: pxa2xx-pci: Enable DMA for Intel Merrifield")
+Reported-by: Wang Qing <wangqing@vivo.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20220223191637.31147-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx-pci.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index aafac128bb5f..4eb979a096c7 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -74,14 +74,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ 	return true;
+ }
+ 
++static void lpss_dma_put_device(void *dma_dev)
++{
++	pci_dev_put(dma_dev);
++}
++
+ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+ 	struct pci_dev *dma_dev;
++	int ret;
+ 
+ 	c->num_chipselect = 1;
+ 	c->max_clk_rate = 50000000;
+ 
+ 	dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++	ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++	if (ret)
++		return ret;
+ 
+ 	if (c->tx_param) {
+ 		struct dw_dma_slave *slave = c->tx_param;
+@@ -105,8 +114,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ 
+ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+-	struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
+ 	struct dw_dma_slave *tx, *rx;
++	struct pci_dev *dma_dev;
++	int ret;
+ 
+ 	switch (PCI_FUNC(dev->devfn)) {
+ 	case 0:
+@@ -131,6 +141,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ 		return -ENODEV;
+ 	}
+ 
++	dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
++	ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++	if (ret)
++		return ret;
++
+ 	tx = c->tx_param;
+ 	tx->dma_dev = &dma_dev->dev;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch b/queue-5.4/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
new file mode 100644
index 00000000000..05f1f510843
--- /dev/null
+++ b/queue-5.4/spi-tegra114-add-missing-irq-check-in-tegra_spi_prob.patch
@@ -0,0 +1,41 @@
+From d4d5c18a07b68234122d10151a6946cacb290fe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jan 2022 16:52:38 +0000
+Subject: spi: tegra114: Add missing IRQ check in tegra_spi_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 4f92724d4b92c024e721063f520d66e11ca4b54b ]
+
+This func misses checking for platform_get_irq()'s call and may passes the
+negative error codes to request_threaded_irq(), which takes unsigned IRQ #,
+causing it to fail with -EINVAL, overriding an original error code.
+Stop calling request_threaded_irq() with invalid IRQ #s.
+
+Fixes: f333a331adfa ("spi/tegra114: add spi driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20220128165238.25615-1-linmq006@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 594905bf89aa..3f7a64b2a5d0 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -1352,6 +1352,10 @@ static int tegra_spi_probe(struct platform_device *pdev)
+ 	tspi->phys = r->start;
+ 
+ 	spi_irq = platform_get_irq(pdev, 0);
++	if (spi_irq < 0) {
++		ret = spi_irq;
++		goto exit_free_master;
++	}
+ 	tspi->irq = spi_irq;
+ 
+ 	tspi->clk = devm_clk_get(&pdev->dev, "spi");
+-- 
+2.34.1
+
diff --git a/queue-5.4/spi-tegra20-use-of_device_get_match_data.patch b/queue-5.4/spi-tegra20-use-of_device_get_match_data.patch
new file mode 100644
index 00000000000..77248dc2d3a
--- /dev/null
+++ b/queue-5.4/spi-tegra20-use-of_device_get_match_data.patch
@@ -0,0 +1,43 @@
+From 6e3cf3e92c3821da50bbffb296a7aebdaaebcebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 02:31:38 +0000
+Subject: spi: tegra20: Use of_device_get_match_data()
+
+From: Minghao Chi <chi.minghao@zte.com.cn>
+
+[ Upstream commit c9839acfcbe20ce43d363c2a9d0772472d9921c0 ]
+
+Use of_device_get_match_data() to simplify the code.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
+Link: https://lore.kernel.org/r/20220315023138.2118293-1-chi.minghao@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 9b59539c8735..e6b12f78c8f0 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1011,14 +1011,8 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ 	struct resource		*r;
+ 	int ret, spi_irq;
+ 	const struct tegra_slink_chip_data *cdata = NULL;
+-	const struct of_device_id *match;
+ 
+-	match = of_match_device(tegra_slink_of_match, &pdev->dev);
+-	if (!match) {
+-		dev_err(&pdev->dev, "Error: No device match found\n");
+-		return -ENODEV;
+-	}
+-	cdata = match->data;
++	cdata = of_device_get_match_data(&pdev->dev);
+ 
+ 	master = spi_alloc_master(&pdev->dev, sizeof(*tspi));
+ 	if (!master) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch b/queue-5.4/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
new file mode 100644
index 00000000000..c04e26f89bb
--- /dev/null
+++ b/queue-5.4/staging-iio-adc-ad7280a-fix-handing-of-device-addres.patch
@@ -0,0 +1,44 @@
+From 6e0b57fe9470cb36c7ffaec576d0c2dc4a07d6f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Feb 2022 19:03:09 +0000
+Subject: staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit f281e4ddbbc0b60f061bc18a2834e9363ba85f9f ]
+
+The bit reversal was wrong for bits 1 and 3 of the 5 bits.
+Result is driver failure to probe if you have more than 2 daisy-chained
+devices.  Discovered via QEMU based device emulation.
+
+Fixes tag is for when this moved from a macro to a function, but it
+was broken before that.
+
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Fixes: 065a7c0b1fec ("Staging: iio: adc: ad7280a.c: Fixed Macro argument reuse")
+Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com>
+Link: https://lore.kernel.org/r/20220206190328.333093-2-jic23@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/adc/ad7280a.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
+index 19a5f244dcae..d8886c5c0d1f 100644
+--- a/drivers/staging/iio/adc/ad7280a.c
++++ b/drivers/staging/iio/adc/ad7280a.c
+@@ -107,9 +107,9 @@
+ static unsigned int ad7280a_devaddr(unsigned int addr)
+ {
+ 	return ((addr & 0x1) << 4) |
+-	       ((addr & 0x2) << 3) |
++	       ((addr & 0x2) << 2) |
+ 	       (addr & 0x4) |
+-	       ((addr & 0x8) >> 3) |
++	       ((addr & 0x8) >> 2) |
+ 	       ((addr & 0x10) >> 4);
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch b/queue-5.4/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
new file mode 100644
index 00000000000..d07ee48f3e0
--- /dev/null
+++ b/queue-5.4/staging-mt7621-dts-fix-leds-and-pinctrl-on-gb-pc1-de.patch
@@ -0,0 +1,139 @@
+From 14c420763eda9b3f7d163c31c203cfab386b2244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Mar 2022 12:03:19 +0300
+Subject: staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 6256e18686158fa49e019297f990f1c1817aabf1 ]
+
+Fix LED and pinctrl definitions on the GB-PC1 devicetree. Refer to the
+schematics of the device for more information.
+
+LED fixes:
+- Change GPIO6 LED label from system to power as GPIO6 is connected to
+PLED.
+- Add default-on default-trigger to power LED.
+- Change GPIO8 LED label from status to system as GPIO8 is connected to
+SYS_LED.
+- Add disk-activity default-trigger to system LED.
+- Switch to the color:function naming scheme.
+- Remove lan1 and lan2 LEDs as they don't exist.
+
+Pinctrl fixes:
+- Claim state_default node under pinctrl node.
+- Change pinctrl0 node name to state-default.
+- Change gpio node name to gpio-pinmux to respect
+Documentation/devicetree/bindings/pinctrl/ralink,rt2880-pinmux.yaml.
+- Sort pin groups alphabetically.
+
+Misc fixes:
+- Fix formatting.
+- Use the status value "okay".
+- Define hexadecimal addresses in lower case.
+- Make hexadecimal addresses for memory easier to read.
+
+Link: https://github.com/ngiger/GnuBee_Docs/blob/master/GB-PCx/Documents/GB-PC1_V1.0_Schematic.pdf
+Tested-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20220311090320.3068-1-arinc.unal@arinc9.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/mt7621-dts/gbpc1.dts | 40 +++++++++++++---------------
+ 1 file changed, 18 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts
+index 1fb560ff059c..1713283e60d4 100644
+--- a/drivers/staging/mt7621-dts/gbpc1.dts
++++ b/drivers/staging/mt7621-dts/gbpc1.dts
+@@ -11,7 +11,8 @@
+ 
+ 	memory@0 {
+ 		device_type = "memory";
+-		reg = <0x0 0x1c000000>, <0x20000000 0x4000000>;
++		reg = <0x00000000 0x1c000000>,
++		      <0x20000000 0x04000000>;
+ 	};
+ 
+ 	chosen {
+@@ -37,24 +38,16 @@
+ 	gpio-leds {
+ 		compatible = "gpio-leds";
+ 
+-		system {
+-			label = "gb-pc1:green:system";
++		power {
++			label = "green:power";
+ 			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "default-on";
+ 		};
+ 
+-		status {
+-			label = "gb-pc1:green:status";
++		system {
++			label = "green:system";
+ 			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+-		};
+-
+-		lan1 {
+-			label = "gb-pc1:green:lan1";
+-			gpios = <&gpio 24 GPIO_ACTIVE_LOW>;
+-		};
+-
+-		lan2 {
+-			label = "gb-pc1:green:lan2";
+-			gpios = <&gpio 25 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "disk-activity";
+ 		};
+ 	};
+ };
+@@ -94,9 +87,8 @@
+ 
+ 		partition@50000 {
+ 			label = "firmware";
+-			reg = <0x50000 0x1FB0000>;
++			reg = <0x50000 0x1fb0000>;
+ 		};
+-
+ 	};
+ };
+ 
+@@ -118,9 +110,12 @@
+ };
+ 
+ &pinctrl {
+-	state_default: pinctrl0 {
+-		default_gpio: gpio {
+-			groups = "wdt", "rgmii2", "uart3";
++	pinctrl-names = "default";
++	pinctrl-0 = <&state_default>;
++
++	state_default: state-default {
++		gpio-pinmux {
++			groups = "rgmii2", "uart3", "wdt";
+ 			function = "gpio";
+ 		};
+ 	};
+@@ -129,12 +124,13 @@
+ &switch0 {
+ 	ports {
+ 		port@0 {
++			status = "okay";
+ 			label = "ethblack";
+-			status = "ok";
+ 		};
++
+ 		port@4 {
++			status = "okay";
+ 			label = "ethblue";
+-			status = "ok";
+ 		};
+ 	};
+ };
+-- 
+2.34.1
+
diff --git a/queue-5.4/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch b/queue-5.4/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
new file mode 100644
index 00000000000..2798a54ce8e
--- /dev/null
+++ b/queue-5.4/tcp-ensure-pmtu-updates-are-processed-during-fastope.patch
@@ -0,0 +1,68 @@
+From c760af5f65c2390b713fd54c4bddffd470b278eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 09:59:57 -0700
+Subject: tcp: ensure PMTU updates are processed during fastopen
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit ed0c99dc0f499ff8b6e75b5ae6092ab42be1ad39 ]
+
+tp->rx_opt.mss_clamp is not populated, yet, during TFO send so we
+rise it to the local MSS. tp->mss_cache is not updated, however:
+
+tcp_v6_connect():
+  tp->rx_opt.mss_clamp = IPV6_MIN_MTU - headers;
+  tcp_connect():
+     tcp_connect_init():
+       tp->mss_cache = min(mtu, tp->rx_opt.mss_clamp)
+     tcp_send_syn_data():
+       tp->rx_opt.mss_clamp = tp->advmss
+
+After recent fixes to ICMPv6 PTB handling we started dropping
+PMTU updates higher than tp->mss_cache. Because of the stale
+tp->mss_cache value PMTU updates during TFO are always dropped.
+
+Thanks to Wei for helping zero in on the problem and the fix!
+
+Fixes: c7bb4b89033b ("ipv6: tcp: drop silly ICMPv6 packet too big messages")
+Reported-by: Andre Nash <alnash@fb.com>
+Reported-by: Neil Spring <ntspring@fb.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20220321165957.1769954-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 638d7b49ad71..139e962d1aef 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3492,6 +3492,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
+  */
+ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ {
++	struct inet_connection_sock *icsk = inet_csk(sk);
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct tcp_fastopen_request *fo = tp->fastopen_req;
+ 	int space, err = 0;
+@@ -3506,8 +3507,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ 	 * private TCP options. The cost is reduced data space in SYN :(
+ 	 */
+ 	tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp);
++	/* Sync mss_cache after updating the mss_clamp */
++	tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
+ 
+-	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
++	space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) -
+ 		MAX_TCP_OPTION_SPACE;
+ 
+ 	space = min_t(size_t, space, fo->size);
+-- 
+2.34.1
+
diff --git a/queue-5.4/tipc-fix-the-timer-expires-after-interval-100ms.patch b/queue-5.4/tipc-fix-the-timer-expires-after-interval-100ms.patch
new file mode 100644
index 00000000000..050a6b2be65
--- /dev/null
+++ b/queue-5.4/tipc-fix-the-timer-expires-after-interval-100ms.patch
@@ -0,0 +1,45 @@
+From 5ac22024e20d0adc0725a546521fc6fbce4eee71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 11:22:29 +0700
+Subject: tipc: fix the timer expires after interval 100ms
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 6a7d8cff4a3301087dd139293e9bddcf63827282 ]
+
+In the timer callback function tipc_sk_timeout(), we're trying to
+reschedule another timeout to retransmit a setup request if destination
+link is congested. But we use the incorrect timeout value
+(msecs_to_jiffies(100)) instead of (jiffies + msecs_to_jiffies(100)),
+so that the timer expires immediately, it's irrelevant for original
+description.
+
+In this commit we correct the timeout value in sk_reset_timer()
+
+Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket")
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Link: https://lore.kernel.org/r/20220321042229.314288-1-hoang.h.le@dektech.com.au
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index f4217673eee7..d543c4556df2 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2698,7 +2698,8 @@ static void tipc_sk_retry_connect(struct sock *sk, struct sk_buff_head *list)
+ 
+ 	/* Try again later if dest link is congested */
+ 	if (tsk->cong_link_cnt) {
+-		sk_reset_timer(sk, &sk->sk_timer, msecs_to_jiffies(100));
++		sk_reset_timer(sk, &sk->sk_timer,
++			       jiffies + msecs_to_jiffies(100));
+ 		return;
+ 	}
+ 	/* Prepare SYN for retransmit */
+-- 
+2.34.1
+
diff --git a/queue-5.4/tomoyo-fix-__setup-handlers-return-values.patch b/queue-5.4/tomoyo-fix-__setup-handlers-return-values.patch
new file mode 100644
index 00000000000..00fb80bbc04
--- /dev/null
+++ b/queue-5.4/tomoyo-fix-__setup-handlers-return-values.patch
@@ -0,0 +1,72 @@
+From 00158234f1ab72050e19336fb5ff9e463b73c44a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 13:45:33 -0800
+Subject: TOMOYO: fix __setup handlers return values
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 39844b7e3084baecef52d1498b5fa81afa2cefa9 ]
+
+__setup() handlers should return 1 if the parameter is handled.
+Returning 0 causes the entire string to be added to init's
+environment strings (limited to 32 strings), unnecessarily polluting it.
+
+Using the documented strings "TOMOYO_loader=string1" and
+"TOMOYO_trigger=string2" causes an Unknown parameter message:
+  Unknown kernel command line parameters
+    "BOOT_IMAGE=/boot/bzImage-517rc5 TOMOYO_loader=string1 \
+     TOMOYO_trigger=string2", will be passed to user space.
+
+and these strings are added to init's environment string space:
+  Run /sbin/init as init process
+    with arguments:
+     /sbin/init
+    with environment:
+     HOME=/
+     TERM=linux
+     BOOT_IMAGE=/boot/bzImage-517rc5
+     TOMOYO_loader=string1
+     TOMOYO_trigger=string2
+
+With this change, these __setup handlers act as expected,
+and init's environment is not polluted with these strings.
+
+Fixes: 0e4ae0e0dec63 ("TOMOYO: Make several options configurable.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Link: https://lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Cc: James Morris <jmorris@namei.org>
+Cc: Kentaro Takeda <takedakn@nttdata.co.jp>
+Cc: tomoyo-dev-en@lists.osdn.me
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/tomoyo/load_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
+index 3445ae6fd479..363b65be87ab 100644
+--- a/security/tomoyo/load_policy.c
++++ b/security/tomoyo/load_policy.c
+@@ -24,7 +24,7 @@ static const char *tomoyo_loader;
+ static int __init tomoyo_loader_setup(char *str)
+ {
+ 	tomoyo_loader = str;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("TOMOYO_loader=", tomoyo_loader_setup);
+@@ -64,7 +64,7 @@ static const char *tomoyo_trigger;
+ static int __init tomoyo_trigger_setup(char *str)
+ {
+ 	tomoyo_trigger = str;
+-	return 0;
++	return 1;
+ }
+ 
+ __setup("TOMOYO_trigger=", tomoyo_trigger_setup);
+-- 
+2.34.1
+
diff --git a/queue-5.4/tracing-have-trace_define_enum-affect-trace-event-ty.patch b/queue-5.4/tracing-have-trace_define_enum-affect-trace-event-ty.patch
new file mode 100644
index 00000000000..e440113fbc9
--- /dev/null
+++ b/queue-5.4/tracing-have-trace_define_enum-affect-trace-event-ty.patch
@@ -0,0 +1,83 @@
+From 05104d572f67024cc22041ad30ffbd521a97eec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Mar 2022 23:27:38 -0500
+Subject: tracing: Have TRACE_DEFINE_ENUM affect trace event types as well
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit b3bc8547d3be60898818885f5bf22d0a62e2eb48 ]
+
+The macro TRACE_DEFINE_ENUM is used to convert enums in the kernel to
+their actual value when they are exported to user space via the trace
+event format file.
+
+Currently only the enums in the "print fmt" (TP_printk in the TRACE_EVENT
+macro) have the enums converted. But the enums can be used to denote array
+size:
+
+        field:unsigned int fc_ineligible_rc[EXT4_FC_REASON_MAX]; offset:12;      size:36;        signed:0;
+
+The EXT4_FC_REASON_MAX has no meaning to userspace but it needs to know
+that information to know how to parse the array.
+
+Have the array indexes also be parsed as well.
+
+Link: https://lore.kernel.org/all/cover.1646922487.git.riteshh@linux.ibm.com/
+
+Reported-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Tested-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 4acc77e049e5..c1363f9d8d48 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2202,6 +2202,33 @@ static void update_event_printk(struct trace_event_call *call,
+ 	}
+ }
+ 
++static void update_event_fields(struct trace_event_call *call,
++				struct trace_eval_map *map)
++{
++	struct ftrace_event_field *field;
++	struct list_head *head;
++	char *ptr;
++	int len = strlen(map->eval_string);
++
++	head = trace_get_fields(call);
++	list_for_each_entry(field, head, link) {
++		ptr = strchr(field->type, '[');
++		if (!ptr)
++			continue;
++		ptr++;
++
++		if (!isalpha(*ptr) && *ptr != '_')
++			continue;
++
++		if (strncmp(map->eval_string, ptr, len) != 0)
++			continue;
++
++		ptr = eval_replace(ptr, map, len);
++		/* enum/sizeof string smaller than value */
++		WARN_ON_ONCE(!ptr);
++	}
++}
++
+ void trace_event_eval_update(struct trace_eval_map **map, int len)
+ {
+ 	struct trace_event_call *call, *p;
+@@ -2237,6 +2264,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
+ 					first = false;
+ 				}
+ 				update_event_printk(call, map[i]);
++				update_event_fields(call, map[i]);
+ 			}
+ 		}
+ 	}
+-- 
+2.34.1
+
diff --git a/queue-5.4/tty-hvc-fix-return-value-of-__setup-handler.patch b/queue-5.4/tty-hvc-fix-return-value-of-__setup-handler.patch
new file mode 100644
index 00000000000..73a84ce2461
--- /dev/null
+++ b/queue-5.4/tty-hvc-fix-return-value-of-__setup-handler.patch
@@ -0,0 +1,50 @@
+From 3123a7596c27e7bbaff75b3cb38b26746057f2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 18:42:28 -0800
+Subject: tty: hvc: fix return value of __setup handler
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 53819a0d97aace1425bb042829e3446952a9e8a9 ]
+
+__setup() handlers should return 1 to indicate that the boot option
+has been handled or 0 to indicate that it was not handled.
+Add a pr_warn() message if the option value is invalid and then
+always return 1.
+
+Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
+Fixes: 86b40567b917 ("tty: replace strict_strtoul() with kstrtoul()")
+Cc: Jingoo Han <jg1.han@samsung.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Julian Wiedmann <jwi@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20220308024228.20477-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/hvc/hvc_iucv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
+index 2af1e5751bd6..796fbff623f6 100644
+--- a/drivers/tty/hvc/hvc_iucv.c
++++ b/drivers/tty/hvc/hvc_iucv.c
+@@ -1470,7 +1470,9 @@ static int __init hvc_iucv_init(void)
+  */
+ static	int __init hvc_iucv_config(char *val)
+ {
+-	 return kstrtoul(val, 10, &hvc_iucv_devices);
++	if (kstrtoul(val, 10, &hvc_iucv_devices))
++		pr_warn("hvc_iucv= invalid parameter value '%s'\n", val);
++	return 1;
+ }
+ 
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/uaccess-fix-nios2-and-microblaze-get_user_8.patch b/queue-5.4/uaccess-fix-nios2-and-microblaze-get_user_8.patch
new file mode 100644
index 00000000000..10c67635c8c
--- /dev/null
+++ b/queue-5.4/uaccess-fix-nios2-and-microblaze-get_user_8.patch
@@ -0,0 +1,144 @@
+From 3fdfe117fab30223d0d41ec9994d0232d295d9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Feb 2022 15:37:37 +0100
+Subject: uaccess: fix nios2 and microblaze get_user_8()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a97b693c3712f040c5802f32b2d685352e08cefa ]
+
+These two architectures implement 8-byte get_user() through
+a memcpy() into a four-byte variable, which won't fit.
+
+Use a temporary 64-bit variable instead here, and use a double
+cast the way that risc-v and openrisc do to avoid compile-time
+warnings.
+
+Fixes: 6a090e97972d ("arch/microblaze: support get_user() of size 8 bytes")
+Fixes: 5ccc6af5e88e ("nios2: Memory management")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/include/asm/uaccess.h | 18 +++++++++---------
+ arch/nios2/include/asm/uaccess.h      | 26 ++++++++++++++++----------
+ 2 files changed, 25 insertions(+), 19 deletions(-)
+
+diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
+index a1f206b90753..c8cd66c8d257 100644
+--- a/arch/microblaze/include/asm/uaccess.h
++++ b/arch/microblaze/include/asm/uaccess.h
+@@ -171,27 +171,27 @@ extern long __user_bad(void);
+ 
+ #define __get_user(x, ptr)						\
+ ({									\
+-	unsigned long __gu_val = 0;					\
+ 	long __gu_err;							\
+ 	switch (sizeof(*(ptr))) {					\
+ 	case 1:								\
+-		__get_user_asm("lbu", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lbu", (ptr), x, __gu_err);		\
+ 		break;							\
+ 	case 2:								\
+-		__get_user_asm("lhu", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lhu", (ptr), x, __gu_err);		\
+ 		break;							\
+ 	case 4:								\
+-		__get_user_asm("lw", (ptr), __gu_val, __gu_err);	\
++		__get_user_asm("lw", (ptr), x, __gu_err);		\
+ 		break;							\
+-	case 8:								\
+-		__gu_err = __copy_from_user(&__gu_val, ptr, 8);		\
+-		if (__gu_err)						\
+-			__gu_err = -EFAULT;				\
++	case 8: {							\
++		__u64 __x = 0;						\
++		__gu_err = raw_copy_from_user(&__x, ptr, 8) ?		\
++							-EFAULT : 0;	\
++		(x) = (typeof(x))(typeof((x) - (x)))__x;		\
+ 		break;							\
++	}								\
+ 	default:							\
+ 		/* __gu_val = 0; __gu_err = -EINVAL;*/ __gu_err = __user_bad();\
+ 	}								\
+-	x = (__force __typeof__(*(ptr))) __gu_val;			\
+ 	__gu_err;							\
+ })
+ 
+diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
+index e83f831a76f9..6be5e913c42e 100644
+--- a/arch/nios2/include/asm/uaccess.h
++++ b/arch/nios2/include/asm/uaccess.h
+@@ -89,6 +89,7 @@ extern __must_check long strnlen_user(const char __user *s, long n);
+ /* Optimized macros */
+ #define __get_user_asm(val, insn, addr, err)				\
+ {									\
++	unsigned long __gu_val;						\
+ 	__asm__ __volatile__(						\
+ 	"       movi    %0, %3\n"					\
+ 	"1:   " insn " %1, 0(%2)\n"					\
+@@ -97,14 +98,20 @@ extern __must_check long strnlen_user(const char __user *s, long n);
+ 	"       .section __ex_table,\"a\"\n"				\
+ 	"       .word 1b, 2b\n"						\
+ 	"       .previous"						\
+-	: "=&r" (err), "=r" (val)					\
++	: "=&r" (err), "=r" (__gu_val)					\
+ 	: "r" (addr), "i" (-EFAULT));					\
++	val = (__force __typeof__(*(addr)))__gu_val;			\
+ }
+ 
+-#define __get_user_unknown(val, size, ptr, err) do {			\
++extern void __get_user_unknown(void);
++
++#define __get_user_8(val, ptr, err) do {				\
++	u64 __val = 0;							\
+ 	err = 0;							\
+-	if (__copy_from_user(&(val), ptr, size)) {			\
++	if (raw_copy_from_user(&(__val), ptr, sizeof(val))) {		\
+ 		err = -EFAULT;						\
++	} else {							\
++		val = (typeof(val))(typeof((val) - (val)))__val;	\
+ 	}								\
+ 	} while (0)
+ 
+@@ -120,8 +127,11 @@ do {									\
+ 	case 4:								\
+ 		__get_user_asm(val, "ldw", ptr, err);			\
+ 		break;							\
++	case 8:								\
++		__get_user_8(val, ptr, err);				\
++		break;							\
+ 	default:							\
+-		__get_user_unknown(val, size, ptr, err);		\
++		__get_user_unknown();					\
+ 		break;							\
+ 	}								\
+ } while (0)
+@@ -130,9 +140,7 @@ do {									\
+ 	({								\
+ 	long __gu_err = -EFAULT;					\
+ 	const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);		\
+-	unsigned long __gu_val = 0;					\
+-	__get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
+-	(x) = (__force __typeof__(x))__gu_val;				\
++	__get_user_common(x, sizeof(*(ptr)), __gu_ptr, __gu_err);	\
+ 	__gu_err;							\
+ 	})
+ 
+@@ -140,11 +148,9 @@ do {									\
+ ({									\
+ 	long __gu_err = -EFAULT;					\
+ 	const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);		\
+-	unsigned long __gu_val = 0;					\
+ 	if (access_ok( __gu_ptr, sizeof(*__gu_ptr)))	\
+-		__get_user_common(__gu_val, sizeof(*__gu_ptr),		\
++		__get_user_common(x, sizeof(*__gu_ptr),			\
+ 			__gu_ptr, __gu_err);				\
+-	(x) = (__force __typeof__(x))__gu_val;				\
+ 	__gu_err;							\
+ })
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/udmabuf-validate-ubuf-pagecount.patch b/queue-5.4/udmabuf-validate-ubuf-pagecount.patch
new file mode 100644
index 00000000000..ac81ebbe121
--- /dev/null
+++ b/queue-5.4/udmabuf-validate-ubuf-pagecount.patch
@@ -0,0 +1,47 @@
+From 243c54418ceb5cb8e9940d1b6d82cb7f5a195ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 17:26:49 +0300
+Subject: udmabuf: validate ubuf->pagecount
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 2b6dd600dd72573c23ea180b5b0b2f1813405882 ]
+
+Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
+problem was in ubuf->pages == ZERO_PTR.
+
+ubuf->pagecount is calculated from arguments passed from user-space. If
+user creates udmabuf with list.size == 0 then ubuf->pagecount will be
+also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
+
+Fix it by validating ubuf->pagecount before passing it to
+kmalloc_array().
+
+Fixes: fbb0de795078 ("Add udmabuf misc device")
+Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/udmabuf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index 9635897458a0..e553c6a937f6 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -145,6 +145,10 @@ static long udmabuf_create(const struct udmabuf_create_list *head,
+ 		if (ubuf->pagecount > pglimit)
+ 			goto err;
+ 	}
++
++	if (!ubuf->pagecount)
++		goto err;
++
+ 	ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
+ 				    GFP_KERNEL);
+ 	if (!ubuf->pages) {
+-- 
+2.34.1
+
diff --git a/queue-5.4/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch b/queue-5.4/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
new file mode 100644
index 00000000000..ad0c1a0985c
--- /dev/null
+++ b/queue-5.4/usb-storage-ums-realtek-fix-error-code-in-rts51x_rea.patch
@@ -0,0 +1,39 @@
+From 53d443376120fec1bf28572370e0760f25224664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Mar 2022 10:35:04 +0300
+Subject: USB: storage: ums-realtek: fix error code in rts51x_read_mem()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b07cabb8361dc692522538205552b1b9dab134be ]
+
+The rts51x_read_mem() function should return negative error codes.
+Currently if the kmalloc() fails it returns USB_STOR_TRANSPORT_ERROR (3)
+which is treated as success by the callers.
+
+Fixes: 065e60964e29 ("ums_realtek: do not use stack memory for DMA")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20220304073504.GA26464@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/realtek_cr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 3789698d9d3c..0c423916d7bf 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -365,7 +365,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len)
+ 
+ 	buf = kmalloc(len, GFP_NOIO);
+ 	if (buf == NULL)
+-		return USB_STOR_TRANSPORT_ERROR;
++		return -ENOMEM;
+ 
+ 	usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/usb-usbip-eliminate-anonymous-module_init-module_exi.patch b/queue-5.4/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
new file mode 100644
index 00000000000..07fdd974333
--- /dev/null
+++ b/queue-5.4/usb-usbip-eliminate-anonymous-module_init-module_exi.patch
@@ -0,0 +1,81 @@
+From 2ce030a6c6c9bafc05fa95ae366125e9c9db41b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:08 -0700
+Subject: usb: usbip: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 393dcd1f2b75e50783c805814a96bf6c8e11fe03 ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: 80fd9cd52de6 ("usbip: vudc: Add VUDC main file")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Krzysztof Opasiak <k.opasiak@samsung.com>
+Cc: Igor Kotrasinski <i.kotrasinsk@samsung.com>
+Cc: Valentina Manea <valentina.manea.m@gmail.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Shuah Khan <skhan@linuxfoundation.org>
+Cc: linux-usb@vger.kernel.org
+Link: https://lore.kernel.org/r/20220316192010.19001-8-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vudc_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c
+index 678faa82598c..1ff277764093 100644
+--- a/drivers/usb/usbip/vudc_main.c
++++ b/drivers/usb/usbip/vudc_main.c
+@@ -28,7 +28,7 @@ static struct platform_driver vudc_driver = {
+ 
+ static struct list_head vudc_devices = LIST_HEAD_INIT(vudc_devices);
+ 
+-static int __init init(void)
++static int __init vudc_init(void)
+ {
+ 	int retval = -ENOMEM;
+ 	int i;
+@@ -86,9 +86,9 @@ static int __init init(void)
+ out:
+ 	return retval;
+ }
+-module_init(init);
++module_init(vudc_init);
+ 
+-static void __exit cleanup(void)
++static void __exit vudc_cleanup(void)
+ {
+ 	struct vudc_device *udc_dev = NULL, *udc_dev2 = NULL;
+ 
+@@ -103,7 +103,7 @@ static void __exit cleanup(void)
+ 	}
+ 	platform_driver_unregister(&vudc_driver);
+ }
+-module_exit(cleanup);
++module_exit(vudc_cleanup);
+ 
+ MODULE_DESCRIPTION("USB over IP Device Controller");
+ MODULE_AUTHOR("Krzysztof Opasiak, Karol Kosik, Igor Kotrasinski");
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch b/queue-5.4/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
new file mode 100644
index 00000000000..12c2fbb1454
--- /dev/null
+++ b/queue-5.4/video-fbdev-atmel_lcdfb-fix-an-error-code-in-atmel_l.patch
@@ -0,0 +1,50 @@
+From 3d71bb6d99f00a25f26036b68ca12073f4b5cad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Dec 2021 12:58:08 +0300
+Subject: video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fee5c1e4b789e41719af9fee0e2dd397cd31988f ]
+
+If "sinfo->config" is not found, then return -ENODEV.  Don't
+return success.
+
+Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/atmel_lcdfb.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index cf2bfff2efbf..b91919861075 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1062,15 +1062,16 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
+ 
+ 	INIT_LIST_HEAD(&info->modelist);
+ 
+-	if (pdev->dev.of_node) {
+-		ret = atmel_lcdfb_of_init(sinfo);
+-		if (ret)
+-			goto free_info;
+-	} else {
++	if (!pdev->dev.of_node) {
+ 		dev_err(dev, "cannot get default configuration\n");
+ 		goto free_info;
+ 	}
+ 
++	ret = atmel_lcdfb_of_init(sinfo);
++	if (ret)
++		goto free_info;
++
++	ret = -ENODEV;
+ 	if (!sinfo->config)
+ 		goto free_info;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch b/queue-5.4/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
new file mode 100644
index 00000000000..b37f5d30245
--- /dev/null
+++ b/queue-5.4/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
@@ -0,0 +1,83 @@
+From 668cd2900cd107d61d8edf21e64f7171f66bb48e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 15:30:13 -0500
+Subject: video: fbdev: cirrusfb: check pixclock to avoid divide by zero
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ]
+
+Do a sanity check on pixclock value to avoid divide by zero.
+
+If the pixclock value is zero, the cirrusfb driver will round up
+pixclock to get the derived frequency as close to maxclock as
+possible.
+
+Syzkaller reported a divide error in cirrusfb_check_pixclock.
+
+divide error: 0000 [#1] SMP KASAN PTI
+CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2
+RIP: 0010:cirrusfb_check_var+0x6f1/0x1260
+
+Call Trace:
+ fb_set_var+0x398/0xf90
+ do_fb_ioctl+0x4b8/0x6f0
+ fb_ioctl+0xeb/0x130
+ __x64_sys_ioctl+0x19d/0x220
+ do_syscall_64+0x3a/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/cirrusfb.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
+index e4ce5667b125..1b0a58f96af2 100644
+--- a/drivers/video/fbdev/cirrusfb.c
++++ b/drivers/video/fbdev/cirrusfb.c
+@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq)
+ 	return 0;
+ }
+ 
+-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var,
+ 				   struct fb_info *info)
+ {
+ 	long freq;
+@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ 	unsigned maxclockidx = var->bits_per_pixel >> 3;
+ 
+ 	/* convert from ps to kHz */
+-	freq = PICOS2KHZ(var->pixclock);
+-
+-	dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++	freq = PICOS2KHZ(var->pixclock ? : 1);
+ 
+ 	maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx];
+ 	cinfo->multiplexing = 0;
+@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ 	/* If the frequency is greater than we can support, we might be able
+ 	 * to use multiplexing for the video mode */
+ 	if (freq > maxclock) {
+-		dev_err(info->device,
+-			"Frequency greater than maxclock (%ld kHz)\n",
+-			maxclock);
+-		return -EINVAL;
++		var->pixclock = KHZ2PICOS(maxclock);
++
++		while ((freq = PICOS2KHZ(var->pixclock)) > maxclock)
++			var->pixclock++;
+ 	}
++	dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++
+ 	/*
+ 	 * Additional constraint: 8bpp uses DAC clock doubling to allow maximum
+ 	 * pixel clock
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch b/queue-5.4/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
new file mode 100644
index 00000000000..490aeee8778
--- /dev/null
+++ b/queue-5.4/video-fbdev-fbcvt.c-fix-printing-in-fb_cvt_print_nam.patch
@@ -0,0 +1,111 @@
+From 8b8c5072a5346b230e1b1bf60ab23101d3932ac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 16:29:19 +0300
+Subject: video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 78482af095abd9f4f29f1aa3fe575d25c6ae3028 ]
+
+This code has two bugs:
+1) "cnt" is 255 but the size of the buffer is 256 so the last byte is
+   not used.
+2) If we try to print more than 255 characters then "cnt" will be
+   negative and that will trigger a WARN() in snprintf(). The fix for
+   this is to use scnprintf() instead of snprintf().
+
+We can re-write this code to be cleaner:
+1) Rename "offset" to "off" because that's shorter.
+2) Get rid of the "cnt" variable and just use "size - off" directly.
+3) Get rid of the "read" variable and just increment "off" directly.
+
+Fixes: 96fe6a2109db ("fbdev: Add VESA Coordinated Video Timings (CVT) support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbcvt.c | 53 +++++++++++++-------------------
+ 1 file changed, 21 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c
+index 55d2bd0ce5c0..64843464c661 100644
+--- a/drivers/video/fbdev/core/fbcvt.c
++++ b/drivers/video/fbdev/core/fbcvt.c
+@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt)
+ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ {
+ 	u32 pixcount, pixcount_mod;
+-	int cnt = 255, offset = 0, read = 0;
+-	u8 *buf = kzalloc(256, GFP_KERNEL);
++	int size = 256;
++	int off = 0;
++	u8 *buf;
+ 
++	buf = kzalloc(size, GFP_KERNEL);
+ 	if (!buf)
+ 		return;
+ 
+@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ 	pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000;
+ 	pixcount_mod /= 1000;
+ 
+-	read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ",
+-			cvt->xres, cvt->yres, cvt->refresh);
+-	offset += read;
+-	cnt -= read;
++	off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ",
++			    cvt->xres, cvt->yres, cvt->refresh);
+ 
+-	if (cvt->status)
+-		snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega "
+-			 "Pixel Image\n", pixcount, pixcount_mod);
+-	else {
+-		if (pixcount) {
+-			read = snprintf(buf+offset, cnt, "%d", pixcount);
+-			cnt -= read;
+-			offset += read;
+-		}
++	if (cvt->status) {
++		off += scnprintf(buf + off, size - off,
++				 "Not a CVT standard - %d.%03d Mega Pixel Image\n",
++				 pixcount, pixcount_mod);
++	} else {
++		if (pixcount)
++			off += scnprintf(buf + off, size - off, "%d", pixcount);
+ 
+-		read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod);
+-		cnt -= read;
+-		offset += read;
++		off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod);
+ 
+ 		if (cvt->aspect_ratio == 0)
+-			read = snprintf(buf+offset, cnt, "3");
++			off += scnprintf(buf + off, size - off, "3");
+ 		else if (cvt->aspect_ratio == 3)
+-			read = snprintf(buf+offset, cnt, "4");
++			off += scnprintf(buf + off, size - off, "4");
+ 		else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4)
+-			read = snprintf(buf+offset, cnt, "9");
++			off += scnprintf(buf + off, size - off, "9");
+ 		else if (cvt->aspect_ratio == 2)
+-			read = snprintf(buf+offset, cnt, "A");
+-		else
+-			read = 0;
+-		cnt -= read;
+-		offset += read;
+-
+-		if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) {
+-			read = snprintf(buf+offset, cnt, "-R");
+-			cnt -= read;
+-			offset += read;
+-		}
++			off += scnprintf(buf + off, size - off, "A");
++
++		if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK)
++			off += scnprintf(buf + off, size - off, "-R");
+ 	}
+ 
+ 	printk(KERN_INFO "%s\n", buf);
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch b/queue-5.4/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
new file mode 100644
index 00000000000..90a08224c2b
--- /dev/null
+++ b/queue-5.4/video-fbdev-nvidiafb-use-strscpy-to-prevent-buffer-o.patch
@@ -0,0 +1,51 @@
+From 6337b4d9e097ee4546531084a3f12e4ac0e8f455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 09:45:02 -0600
+Subject: video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
+
+From: Tim Gardner <tim.gardner@canonical.com>
+
+[ Upstream commit 37a1a2e6eeeb101285cd34e12e48a881524701aa ]
+
+Coverity complains of a possible buffer overflow. However,
+given the 'static' scope of nvidia_setup_i2c_bus() it looks
+like that can't happen after examiniing the call sites.
+
+CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
+1. fixed_size_dest: You might overrun the 48-character fixed-size string
+  chan->adapter.name by copying name without checking the length.
+2. parameter_as_source: Note: This defect has an elevated risk because the
+  source argument is a parameter of the current function.
+ 89        strcpy(chan->adapter.name, name);
+
+Fix this warning by using strscpy() which will silence the warning and
+prevent any future buffer overflows should the names used to identify the
+channel become much longer.
+
+Cc: Antonino Daplas <adaplas@gmail.com>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/nvidia/nv_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c
+index d7994a173245..0b48965a6420 100644
+--- a/drivers/video/fbdev/nvidia/nv_i2c.c
++++ b/drivers/video/fbdev/nvidia/nv_i2c.c
+@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name,
+ {
+ 	int rc;
+ 
+-	strcpy(chan->adapter.name, name);
++	strscpy(chan->adapter.name, name, sizeof(chan->adapter.name));
+ 	chan->adapter.owner = THIS_MODULE;
+ 	chan->adapter.class = i2c_class;
+ 	chan->adapter.algo_data = &chan->algo;
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch b/queue-5.4/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
new file mode 100644
index 00000000000..bf57552360e
--- /dev/null
+++ b/queue-5.4/video-fbdev-omapfb-acx565akm-replace-snprintf-with-s.patch
@@ -0,0 +1,39 @@
+From a7587d7ec2d8c14fc0b73046676a4531e3b38324 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Nov 2021 08:06:03 +0800
+Subject: video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
+
+From: Yang Guang <yang.guang5@zte.com.cn>
+
+[ Upstream commit 24565bc4115961db7ee64fcc7ad2a7437c0d0a49 ]
+
+coccinelle report:
+./drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c:
+479:9-17: WARNING: use scnprintf or sprintf
+
+Use sysfs_emit instead of scnprintf or sprintf makes more sense.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Yang Guang <yang.guang5@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c    | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+index 1293515e4b16..0cbc5b9183f8 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+@@ -476,7 +476,7 @@ static ssize_t show_cabc_available_modes(struct device *dev,
+ 	int i;
+ 
+ 	if (!ddata->has_cabc)
+-		return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]);
++		return sysfs_emit(buf, "%s\n", cabc_modes[0]);
+ 
+ 	for (i = 0, len = 0;
+ 	     len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++)
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch b/queue-5.4/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
new file mode 100644
index 00000000000..2aa0c3f109f
--- /dev/null
+++ b/queue-5.4/video-fbdev-omapfb-add-missing-of_node_put-in-dvic_p.patch
@@ -0,0 +1,35 @@
+From b94d5c3519bacbbe5d0e6a022814b21a31cfc785 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:38:12 +0000
+Subject: video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit a58c22cfbbf62fefca090334bbd35fd132e92a23 ]
+
+The device_node pointer is returned by of_parse_phandle()  with refcount
+incremented. We should use of_node_put() on it when done.
+
+Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+index b4a1aefff766..777f6d66c28c 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+@@ -251,6 +251,7 @@ static int dvic_probe_of(struct platform_device *pdev)
+ 	adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0);
+ 	if (adapter_node) {
+ 		adapter = of_get_i2c_adapter_by_node(adapter_node);
++		of_node_put(adapter_node);
+ 		if (adapter == NULL) {
+ 			dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n");
+ 			omap_dss_put_device(ddata->in);
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch b/queue-5.4/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
new file mode 100644
index 00000000000..4aab80a3ddb
--- /dev/null
+++ b/queue-5.4/video-fbdev-omapfb-panel-dsi-cm-use-sysfs_emit-inste.patch
@@ -0,0 +1,63 @@
+From a216bceae1c2ffff8954488f79facf70f5d33bd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Nov 2021 08:13:33 +0000
+Subject: video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of
+ snprintf()
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit f63658a59c3d439c8ad7b290f8ec270980e0f384 ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+index 4b0793abdd84..a2c7c5cb1523 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+@@ -409,7 +409,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev,
+ 	if (r)
+ 		return r;
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", errors);
++	return sysfs_emit(buf, "%d\n", errors);
+ }
+ 
+ static ssize_t dsicm_hw_revision_show(struct device *dev,
+@@ -439,7 +439,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev,
+ 	if (r)
+ 		return r;
+ 
+-	return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3);
++	return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3);
+ }
+ 
+ static ssize_t dsicm_store_ulps(struct device *dev,
+@@ -487,7 +487,7 @@ static ssize_t dsicm_show_ulps(struct device *dev,
+ 	t = ddata->ulps_enabled;
+ 	mutex_unlock(&ddata->lock);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%u\n", t);
++	return sysfs_emit(buf, "%u\n", t);
+ }
+ 
+ static ssize_t dsicm_store_ulps_timeout(struct device *dev,
+@@ -532,7 +532,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev,
+ 	t = ddata->ulps_timeout;
+ 	mutex_unlock(&ddata->lock);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%u\n", t);
++	return sysfs_emit(buf, "%u\n", t);
+ }
+ 
+ static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL);
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch b/queue-5.4/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
new file mode 100644
index 00000000000..72dceb09268
--- /dev/null
+++ b/queue-5.4/video-fbdev-omapfb-panel-tpo-td043mtea1-use-sysfs_em.patch
@@ -0,0 +1,45 @@
+From 3edcc05cb1993c662ff18548cf640ba383e3a34f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Nov 2021 08:20:44 +0000
+Subject: video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead
+ of snprintf()
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit c07a039cbb96748f54c02995bae8131cc9a73b0a ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c  | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+index bb85b21f0724..9f6ef9e04d9c 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+@@ -169,7 +169,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev,
+ {
+ 	struct panel_drv_data *ddata = dev_get_drvdata(dev);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror);
++	return sysfs_emit(buf, "%d\n", ddata->vmirror);
+ }
+ 
+ static ssize_t tpo_td043_vmirror_store(struct device *dev,
+@@ -199,7 +199,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev,
+ {
+ 	struct panel_drv_data *ddata = dev_get_drvdata(dev);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode);
++	return sysfs_emit(buf, "%d\n", ddata->mode);
+ }
+ 
+ static ssize_t tpo_td043_mode_store(struct device *dev,
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch b/queue-5.4/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
new file mode 100644
index 00000000000..e3931f608bf
--- /dev/null
+++ b/queue-5.4/video-fbdev-sm712fb-fix-crash-in-smtcfb_write.patch
@@ -0,0 +1,75 @@
+From fba3f0b8f786b9c80a1ee4b43d3612610c9e9747 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Mar 2022 22:33:11 +0800
+Subject: video: fbdev: sm712fb: Fix crash in smtcfb_write()
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 4f01d09b2bbfbcb47b3eb305560a7f4857a32260 ]
+
+When the sm712fb driver writes three bytes to the framebuffer, the
+driver will crash:
+
+    BUG: unable to handle page fault for address: ffffc90001ffffff
+    RIP: 0010:smtcfb_write+0x454/0x5b0
+    Call Trace:
+     vfs_write+0x291/0xd60
+     ? do_sys_openat2+0x27d/0x350
+     ? __fget_light+0x54/0x340
+     ksys_write+0xce/0x190
+     do_syscall_64+0x43/0x90
+     entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Fix it by removing the open-coded endianness fixup-code.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sm712fb.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 246681414577..86ce99de5f27 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1130,7 +1130,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ 		count = total_size - p;
+ 	}
+ 
+-	buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
++	buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 	if (!buffer)
+ 		return -ENOMEM;
+ 
+@@ -1148,24 +1148,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ 			break;
+ 		}
+ 
+-		for (i = c >> 2; i--;) {
+-			fb_writel(big_swap(*src), dst++);
++		for (i = (c + 3) >> 2; i--;) {
++			fb_writel(big_swap(*src), dst);
++			dst++;
+ 			src++;
+ 		}
+-		if (c & 3) {
+-			u8 *src8 = (u8 *)src;
+-			u8 __iomem *dst8 = (u8 __iomem *)dst;
+-
+-			for (i = c & 3; i--;) {
+-				if (i & 1) {
+-					fb_writeb(*src8++, ++dst8);
+-				} else {
+-					fb_writeb(*src8++, --dst8);
+-					dst8 += 2;
+-				}
+-			}
+-			dst = (u32 __iomem *)dst8;
+-		}
+ 
+ 		*ppos += c;
+ 		buf += c;
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch b/queue-5.4/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
new file mode 100644
index 00000000000..79cea37c6b4
--- /dev/null
+++ b/queue-5.4/video-fbdev-smscufx-fix-null-ptr-deref-in-ufx_usb_pr.patch
@@ -0,0 +1,62 @@
+From 1276469797d06daccceb2846a6a7a1c15454b9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 21:22:31 +0800
+Subject: video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ]
+
+I got a null-ptr-deref report:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+...
+RIP: 0010:fb_destroy_modelist+0x38/0x100
+...
+Call Trace:
+ ufx_usb_probe.cold+0x2b5/0xac1 [smscufx]
+ usb_probe_interface+0x1aa/0x3c0 [usbcore]
+ really_probe+0x167/0x460
+...
+ ret_from_fork+0x1f/0x30
+
+If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will
+be called to destroy modelist in the error handling path. But modelist
+has not been initialized yet, so it will result in null-ptr-deref.
+
+Initialize modelist before calling fb_alloc_cmap() to fix this bug.
+
+Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/smscufx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
+index 0e0f5bbfc5ef..ad60f739c6a1 100644
+--- a/drivers/video/fbdev/smscufx.c
++++ b/drivers/video/fbdev/smscufx.c
+@@ -1657,6 +1657,7 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ 	info->par = dev;
+ 	info->pseudo_palette = dev->pseudo_palette;
+ 	info->fbops = &ufx_ops;
++	INIT_LIST_HEAD(&info->modelist);
+ 
+ 	retval = fb_alloc_cmap(&info->cmap, 256, 0);
+ 	if (retval < 0) {
+@@ -1667,8 +1668,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ 	INIT_DELAYED_WORK(&dev->free_framebuffer_work,
+ 			  ufx_free_framebuffer_work);
+ 
+-	INIT_LIST_HEAD(&info->modelist);
+-
+ 	retval = ufx_reg_read(dev, 0x3000, &id_rev);
+ 	check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
+ 	dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch b/queue-5.4/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
new file mode 100644
index 00000000000..e5d009b0888
--- /dev/null
+++ b/queue-5.4/video-fbdev-udlfb-replace-snprintf-in-show-functions.patch
@@ -0,0 +1,63 @@
+From 28694365bab3a55104b86bef044296be5d809862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Nov 2021 11:52:29 +0000
+Subject: video: fbdev: udlfb: replace snprintf in show functions with
+ sysfs_emit
+
+From: Jing Yao <yao.jing2@zte.com.cn>
+
+[ Upstream commit 81a998288956d09d7a7a2303d47e4d60ad55c401 ]
+
+Use sysfs_emit instead of scnprintf, snprintf or sprintf.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Jing Yao <yao.jing2@zte.com.cn>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/udlfb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index ecbfbbf1c1a7..e269b1391e14 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1427,7 +1427,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_rendered));
+ }
+ 
+@@ -1435,7 +1435,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_identical));
+ }
+ 
+@@ -1443,7 +1443,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->bytes_sent));
+ }
+ 
+@@ -1451,7 +1451,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+ 				   struct device_attribute *a, char *buf) {
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dlfb = fb_info->par;
+-	return snprintf(buf, PAGE_SIZE, "%u\n",
++	return sysfs_emit(buf, "%u\n",
+ 			atomic_read(&dlfb->cpu_kcycles_used));
+ }
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/video-fbdev-w100fb-reset-global-state.patch b/queue-5.4/video-fbdev-w100fb-reset-global-state.patch
new file mode 100644
index 00000000000..318e21ec950
--- /dev/null
+++ b/queue-5.4/video-fbdev-w100fb-reset-global-state.patch
@@ -0,0 +1,68 @@
+From 2dfc1065f5bbf96843fa27f398b72266d42f82b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 19:58:26 +0300
+Subject: video: fbdev: w100fb: Reset global state
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 8738ddcac644964ae128ccd3d80d48773c8d528e ]
+
+w100fb_probe() did not reset the global state to its initial state. This
+can result in invocation of iounmap() even when there was not the
+appropriate successful call of ioremap(). For instance, this may be the
+case if first probe fails after two successful ioremap() while second
+probe fails when first ioremap() fails. The similar issue is with
+w100fb_remove(). The patch fixes both bugs.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/w100fb.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
+index e30f9427b335..52ec80bbfe5e 100644
+--- a/drivers/video/fbdev/w100fb.c
++++ b/drivers/video/fbdev/w100fb.c
+@@ -770,12 +770,18 @@ int w100fb_probe(struct platform_device *pdev)
+ 		fb_dealloc_cmap(&info->cmap);
+ 		kfree(info->pseudo_palette);
+ 	}
+-	if (remapped_fbuf != NULL)
++	if (remapped_fbuf != NULL) {
+ 		iounmap(remapped_fbuf);
+-	if (remapped_regs != NULL)
++		remapped_fbuf = NULL;
++	}
++	if (remapped_regs != NULL) {
+ 		iounmap(remapped_regs);
+-	if (remapped_base != NULL)
++		remapped_regs = NULL;
++	}
++	if (remapped_base != NULL) {
+ 		iounmap(remapped_base);
++		remapped_base = NULL;
++	}
+ 	if (info)
+ 		framebuffer_release(info);
+ 	return err;
+@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev)
+ 	fb_dealloc_cmap(&info->cmap);
+ 
+ 	iounmap(remapped_base);
++	remapped_base = NULL;
+ 	iounmap(remapped_regs);
++	remapped_regs = NULL;
+ 	iounmap(remapped_fbuf);
++	remapped_fbuf = NULL;
+ 
+ 	framebuffer_release(info);
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/virtio_blk-eliminate-anonymous-module_init-module_ex.patch b/queue-5.4/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
new file mode 100644
index 00000000000..ed2ad6b8bdf
--- /dev/null
+++ b/queue-5.4/virtio_blk-eliminate-anonymous-module_init-module_ex.patch
@@ -0,0 +1,82 @@
+From 17987cbb9cdd58a6509a14b3906c48ba9894b05a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Mar 2022 12:20:02 -0700
+Subject: virtio_blk: eliminate anonymous module_init & module_exit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bcfe9b6cbb4438b8c1cc4bd475221652c8f9301b ]
+
+Eliminate anonymous module_init() and module_exit(), which can lead to
+confusion or ambiguity when reading System.map, crashes/oops/bugs,
+or an initcall_debug log.
+
+Give each of these init and exit functions unique driver-specific
+names to eliminate the anonymous names.
+
+Example 1: (System.map)
+ ffffffff832fc78c t init
+ ffffffff832fc79e t init
+ ffffffff832fc8f8 t init
+
+Example 2: (initcall_debug log)
+ calling  init+0x0/0x12 @ 1
+ initcall init+0x0/0x12 returned 0 after 15 usecs
+ calling  init+0x0/0x60 @ 1
+ initcall init+0x0/0x60 returned 0 after 2 usecs
+ calling  init+0x0/0x9a @ 1
+ initcall init+0x0/0x9a returned 0 after 74 usecs
+
+Fixes: e467cde23818 ("Block driver using virtio.")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: virtualization@lists.linux-foundation.org
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: linux-block@vger.kernel.org
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Link: https://lore.kernel.org/r/20220316192010.19001-2-rdunlap@infradead.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 2a5cd502feae..c3a9808a2ffb 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -1131,7 +1131,7 @@ static struct virtio_driver virtio_blk = {
+ #endif
+ };
+ 
+-static int __init init(void)
++static int __init virtio_blk_init(void)
+ {
+ 	int error;
+ 
+@@ -1157,14 +1157,14 @@ static int __init init(void)
+ 	return error;
+ }
+ 
+-static void __exit fini(void)
++static void __exit virtio_blk_fini(void)
+ {
+ 	unregister_virtio_driver(&virtio_blk);
+ 	unregister_blkdev(major, "virtblk");
+ 	destroy_workqueue(virtblk_wq);
+ }
+-module_init(init);
+-module_exit(fini);
++module_init(virtio_blk_init);
++module_exit(virtio_blk_fini);
+ 
+ MODULE_DEVICE_TABLE(virtio, id_table);
+ MODULE_DESCRIPTION("Virtio block driver");
+-- 
+2.34.1
+
diff --git a/queue-5.4/vxcan-enable-local-echo-for-sent-can-frames.patch b/queue-5.4/vxcan-enable-local-echo-for-sent-can-frames.patch
new file mode 100644
index 00000000000..532963e754f
--- /dev/null
+++ b/queue-5.4/vxcan-enable-local-echo-for-sent-can-frames.patch
@@ -0,0 +1,46 @@
+From ce24947994d8a8cc8aaac87ffa7eafb068ff7044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 13:04:16 +0100
+Subject: vxcan: enable local echo for sent CAN frames
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 259bdba27e32368b4404f69d613b1c1014c07cbf ]
+
+The vxcan driver provides a pair of virtual CAN interfaces to exchange
+CAN traffic between different namespaces - analogue to veth.
+
+In opposite to the vcan driver the local sent CAN traffic on this interface
+is not echo'ed back but only sent to the remote peer. This is unusual and
+can be easily fixed by removing IFF_ECHO from the netdevice flags that
+are set for vxcan interfaces by default at startup.
+
+Without IFF_ECHO set on driver level, the local sent CAN frames are echo'ed
+in af_can.c in can_send(). This patch makes vxcan interfaces adopt the
+same local echo behavior and procedures as known from the vcan interfaces.
+
+Fixes: a8f820a380a2 ("can: add Virtual CAN Tunnel driver (vxcan)")
+Link: https://lore.kernel.org/all/20220309120416.83514-5-socketcan@hartkopp.net
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/vxcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
+index 7000c6cd1e48..282c53ef76d2 100644
+--- a/drivers/net/can/vxcan.c
++++ b/drivers/net/can/vxcan.c
+@@ -148,7 +148,7 @@ static void vxcan_setup(struct net_device *dev)
+ 	dev->hard_header_len	= 0;
+ 	dev->addr_len		= 0;
+ 	dev->tx_queue_len	= 0;
+-	dev->flags		= (IFF_NOARP|IFF_ECHO);
++	dev->flags		= IFF_NOARP;
+ 	dev->netdev_ops		= &vxcan_netdev_ops;
+ 	dev->needs_free_netdev	= true;
+ 
+-- 
+2.34.1
+
diff --git a/queue-5.4/xen-fix-is_xen_pmu.patch b/queue-5.4/xen-fix-is_xen_pmu.patch
new file mode 100644
index 00000000000..ad93dde80b5
--- /dev/null
+++ b/queue-5.4/xen-fix-is_xen_pmu.patch
@@ -0,0 +1,127 @@
+From 2bdca9f9f67e71cb7a89701bb4b99759f8cb6cf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Mar 2022 15:20:02 +0100
+Subject: xen: fix is_xen_pmu()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit de2ae403b4c0e79a3410e63bc448542fbb9f9bfc ]
+
+is_xen_pmu() is taking the cpu number as parameter, but it is not using
+it. Instead it just tests whether the Xen PMU initialization on the
+current cpu did succeed. As this test is done by checking a percpu
+pointer, preemption needs to be disabled in order to avoid switching
+the cpu while doing the test. While resuming from suspend() this seems
+not to be the case:
+
+[   88.082751] ACPI: PM: Low-level resume complete
+[   88.087933] ACPI: EC: EC started
+[   88.091464] ACPI: PM: Restoring platform NVS memory
+[   88.097166] xen_acpi_processor: Uploading Xen processor PM info
+[   88.103850] Enabling non-boot CPUs ...
+[   88.108128] installing Xen timer for CPU 1
+[   88.112763] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-sleep/7138
+[   88.122256] caller is is_xen_pmu+0x12/0x30
+[   88.126937] CPU: 0 PID: 7138 Comm: systemd-sleep Tainted: G        W         5.16.13-2.fc32.qubes.x86_64 #1
+[   88.137939] Hardware name: Star Labs StarBook/StarBook, BIOS 7.97 03/21/2022
+[   88.145930] Call Trace:
+[   88.148757]  <TASK>
+[   88.151193]  dump_stack_lvl+0x48/0x5e
+[   88.155381]  check_preemption_disabled+0xde/0xe0
+[   88.160641]  is_xen_pmu+0x12/0x30
+[   88.164441]  xen_smp_intr_init_pv+0x75/0x100
+
+Fix that by replacing is_xen_pmu() by a simple boolean variable which
+reflects the Xen PMU initialization state on cpu 0.
+
+Modify xen_pmu_init() to return early in case it is being called for a
+cpu other than cpu 0 and the boolean variable not being set.
+
+Fixes: bf6dfb154d93 ("xen/PMU: PMU emulation code")
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Link: https://lore.kernel.org/r/20220325142002.31789-1-jgross@suse.com
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/pmu.c    | 10 ++++------
+ arch/x86/xen/pmu.h    |  3 ++-
+ arch/x86/xen/smp_pv.c |  2 +-
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
+index e13b0b49fcdf..d7249f4c90f1 100644
+--- a/arch/x86/xen/pmu.c
++++ b/arch/x86/xen/pmu.c
+@@ -512,10 +512,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
+ 	return ret;
+ }
+ 
+-bool is_xen_pmu(int cpu)
+-{
+-	return (get_xenpmu_data() != NULL);
+-}
++bool is_xen_pmu;
+ 
+ void xen_pmu_init(int cpu)
+ {
+@@ -526,7 +523,7 @@ void xen_pmu_init(int cpu)
+ 
+ 	BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE);
+ 
+-	if (xen_hvm_domain())
++	if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu))
+ 		return;
+ 
+ 	xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL);
+@@ -547,7 +544,8 @@ void xen_pmu_init(int cpu)
+ 	per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data;
+ 	per_cpu(xenpmu_shared, cpu).flags = 0;
+ 
+-	if (cpu == 0) {
++	if (!is_xen_pmu) {
++		is_xen_pmu = true;
+ 		perf_register_guest_info_callbacks(&xen_guest_cbs);
+ 		xen_pmu_arch_init();
+ 	}
+diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h
+index 0e83a160589b..65c58894fc79 100644
+--- a/arch/x86/xen/pmu.h
++++ b/arch/x86/xen/pmu.h
+@@ -4,6 +4,8 @@
+ 
+ #include <xen/interface/xenpmu.h>
+ 
++extern bool is_xen_pmu;
++
+ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id);
+ #ifdef CONFIG_XEN_HAVE_VPMU
+ void xen_pmu_init(int cpu);
+@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu);
+ static inline void xen_pmu_init(int cpu) {}
+ static inline void xen_pmu_finish(int cpu) {}
+ #endif
+-bool is_xen_pmu(int cpu);
+ bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err);
+ bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err);
+ int pmu_apic_update(uint32_t reg);
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 0cebe5db691d..64e6ec2c32a7 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -129,7 +129,7 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ 	per_cpu(xen_irq_work, cpu).irq = rc;
+ 	per_cpu(xen_irq_work, cpu).name = callfunc_name;
+ 
+-	if (is_xen_pmu(cpu)) {
++	if (is_xen_pmu) {
+ 		pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu);
+ 		rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu,
+ 					     xen_pmu_irq_handler,
+-- 
+2.34.1
+
-- 
2.47.3