From 9c467af2cb9e1cd9fdc5ffc8ab92d3575201a98c Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sun, 28 Feb 2021 22:19:07 -0500
Subject: [PATCH] Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...pica-fix-exception-code-class-checks.patch |  62 ++
 ...rce-leak-for-drivers-without-.remove.patch |  83 +++
 ...pressor-do-not-clear-sctlr.ntlsmd-fo.patch |  75 +++
 ...8-helios4-assign-pinctrl-to-each-fan.patch |  59 ++
 ...da388-helios4-assign-pinctrl-to-leds.patch |  64 ++
 ...e-missing-thermal-interrupt-for-4430.patch |  52 ++
 ...orrect-pmic-interrupt-trigger-level-.patch |  39 ++
 ...-pmic-interrupt-trigger-level-.patch-15427 |  39 ++
 ...-pmic-interrupt-trigger-level-.patch-17107 |  38 ++
 ...-pmic-interrupt-trigger-level-.patch-18208 |  39 ++
 ...t-pmic-interrupt-trigger-level-.patch-3724 |  38 ++
 ...t-pmic-interrupt-trigger-level-.patch-4737 |  39 ++
 queue-5.4/arm-s3c-fix-fiq-for-clang-ias.patch |  93 +++
 ...g-isb-after-invalidating-tlb-in-__pr.patch |  49 ++
 ...ner-a64-limit-mmc2-bus-frequency-to-.patch |  61 ++
 ...ner-a64-properly-connect-usb-phy-to-.patch |  84 +++
 ...ner-drop-non-removable-from-sopine-l.patch |  46 ++
 ...ner-h6-allow-up-to-150-mhz-mmc-bus-f.patch |  61 ++
 ...ner-h6-properly-connect-usb-phy-to-p.patch |  60 ++
 ...-3720-turris-mox-rename-u-boot-mtd-p.patch |  50 ++
 ...-correct-pmic-interrupt-trigger-leve.patch |  39 ++
 ...ct-pmic-interrupt-trigger-leve.patch-21413 |  38 ++
 ...6-fix-reserved-and-rfsa-nodes-unit-a.patch |  46 ++
 ...c-cpcap-fix-microphone-timeslot-mask.patch |  65 ++
 ...42l56-fix-up-error-handling-in-probe.patch |  46 ++
 ...e-card-utils-fix-device-module-clock.patch |  57 ++
 ...ix-a-potential-issue-on-string-buffe.patch |  40 ++
 ..._brcm-add-back-regulators-management.patch |  79 +++
 ...-handling-in-case-of-ce-pipe-init-fa.patch |  50 ++
 ...us-crash-when-setting-nf_override-vi.patch |  96 +++
 ...ay-ht16k33-fix-refresh-rate-handling.patch |  37 ++
 ...e-update-of-coef-for-the-phy-revisio.patch |  50 ++
 ...smd-fix-a-resource-leak-in-error-han.patch |  78 +++
 ...fix-memory-leak-in-btusb_mtk_wmt_rec.patch |  78 +++
 ...p-hci-device-reference-before-return.patch |  35 ++
 ...itializing-response-id-after-clearin.patch |  39 ++
 ...rt-fix-a-race-for-write_work-schedul.patch |  82 +++
 ...i-device-if-inquiry-procedure-interr.patch |  40 ++
 ...-order-of-tx-disable-and-carrier-off.patch |  42 ++
 ...h_call_args-prototype-to-include-lin.patch |  42 ++
 ...g-when-re-casting-__bpf_call_base-in.patch |  41 ++
 ..._lookup-helper-mtu-check-for-skb-ctx.patch |  86 +++
 ...d-double-checked-variable-once-witho.patch |  65 ++
 ...the-request-before-return-error-code.patch |  39 ++
 ...ror-returns-values-in-__load_free_sp.patch |  60 ++
 ...-t-allow-writing-ambiguous-v3-file-c.patch |  62 ++
 ...ts-fix-blacklist-flag-type-confusion.patch | 107 ++++
 ...pll-calculate-formula-from-ast2600-a.patch |  83 +++
 ...l-fix-initializing-the-old-rate-fall.patch |  39 ++
 ...on-clk-pll-make-ret-a-signed-integer.patch |  41 ++
 ...l-propagate-the-error-from-meson_clk.patch |  48 ++
 ...8998-fix-alpha-pll-type-for-all-gpll.patch | 387 ++++++++++++
 queue-5.4/clk-sunxi-ng-h6-fix-cec-clock.patch |  42 ++
 ...fix-clock-divider-range-on-some-cloc.patch |  67 ++
 ...ers-ixp4xx-select-timer_of-when-need.patch |  55 ++
 ...ers-mxs_timer-add-missing-semicolon-.patch |  49 ++
 ...avs-cpufreq-fix-resource-leaks-in-re.patch |  38 ++
 ...avs-cpufreq-free-resources-in-error-.patch |  77 +++
 ...-ce-really-hide-slower-algos-when-fa.patch |  50 ++
 ...e-struct-device_private-to-bcm_devic.patch |  83 +++
 ...er-ensure-len-secret.len-in-decode_k.patch |  41 ++
 .../crypto-sun4i-ss-fix-kmap-usage.patch      | 254 ++++++++
 ...linearize-buffers-content-must-be-ke.patch |  93 +++
 ...ork-around-sec6-errata-aes-ctr-mode-.patch | 160 +++++
 ...it-keeping-the-max-ofld-immediate-da.patch | 105 ++++
 ...-fix-a-resource-leak-in-an-error-han.patch |  51 ++
 ...-fix-a-resource-leak-in-the-remove-f.patch |  42 ++
 ...ngine-hsu-disable-spurious-interrupt.patch |  76 +++
 ...a-fix-a-resource-leak-in-the-remove-.patch |  38 ++
 ...-avoid-use-after-free-in-vmbus_onoff.patch |  45 ++
 ...fix-10-12-bpc-setup-in-dce-output-bi.patch |  59 ++
 ...fix-hdmi-deep-color-output-for-dce-6.patch | 194 ++++++
 ...acro-name-_amdgpu_trace_h_-in-prepro.patch |  38 ++
 ...nt-shift-wrapping-in-amdgpu_read_mas.patch |  48 ++
 ...add-missed-unlocks-in-setcmap_legacy.patch |  59 ++
 ...error-return-code-in-psb_driver_load.patch |  38 ++
 ...orrect-io_start-for-msm8994-20nm-phy.patch |  37 ++
 ...5-fix-wait-for-commit-for-cmd-panels.patch |  43 ++
 ...-out-of-nouveau_channel_new-if-chann.patch | 127 ++++
 ...un4i-tcon-fix-inverted-dclk-polarity.patch |  85 +++
 queue-5.4/evm-fix-memleak-in-init_desc.patch  |  55 ++
 ...tial-htree-index-checksum-corruption.patch |  55 ++
 ...ix-a-wrong-condition-in-__submit_bio.patch |  37 ++
 ...fix-to-avoid-inconsistent-quota-data.patch | 100 +++
 ...fbdev-aty-sparc64-requires-fb_aty_ct.patch |  62 ++
 ...dle-no-map-field-in-the-memory-regio.patch |  42 ++
 ...tial-integer-overflow-on-shift-of-a-.patch |  39 ++
 ...a500-clean-up-error-handling-in-init.patch |  73 +++
 ...ct-and-skip-invalid-inputs-to-snto32.patch |  51 ++
 ...age-counter-unbalance-in-ssi_hw_init.patch |  39 ++
 ...omem-fix-cooldown-period-calculation.patch |  35 ++
 ...b-fix-brcmstd_send_i2c_cmd-condition.patch |  40 ++
 ...m-geni-add-shutdown-callback-for-i2c.patch |  89 +++
 ...i2c-iproc-handle-master-read-request.patch | 321 ++++++++++
 ...-only-slave-interrupts-which-are-ena.patch |  54 ++
 ...update-slave-isr-mask-isr_mask_slave.patch |  38 ++
 ...ore-dma-mapping-data-in-geni_i2c_dev.patch | 154 +++++
 ...itialization-of-aq-command-structure.patch |  62 ++
 .../i40e-fix-add-tc-filter-for-ipv6.patch     |  51 ++
 ...n-of-rx-filters-after-enabling-fw-ll.patch | 108 ++++
 ...or-ipv6-next-header-extension-header.patch |  63 ++
 ...ting-flow-control-settings-during-dr.patch |  87 +++
 queue-5.4/i40e-fix-vfs-not-created.patch      |  52 ++
 ...oid-a-loop-when-device-has-255-ports.patch |  67 ++
 ...ppropriate-error-code-instead-of-eno.patch |  39 ++
 ...io-in-case-of-when-device-disassocia.patch |  54 ++
 ...pollerr-in-case-of-when-device-disas.patch |  66 ++
 ...ry-barrier-to-protect-long-term-buff.patch |  48 ++
 ...ic-set-to-closed-state-even-on-error.patch |  42 ++
 ...send_request_unmap-for-timeout-reset.patch |  45 ++
 ...asurement-buffer-after-kexec-syscall.patch |  80 +++
 ...free-ima-measurement-buffer-on-error.patch |  41 ++
 ...elo-fix-an-error-code-in-elo_connect.patch |  40 ++
 ...r40-fix-an-error-code-in-sur40_probe.patch |  36 ++
 ...fs-release-buffer-head-before-return.patch |  49 ++
 ...e-after-free-in-jffs2_sum_write_data.patch |  58 ++
 ...-vmx-instruction-emulation-routines-.patch |  79 +++
 ...ential-overflow-when-multiplying-to-.patch |  40 ++
 ...-error-return-code-in-aspeed_video_s.patch |  45 ++
 ...ing-error-code-in-msm_video_register.patch |  36 ++
 ...x-a-bug-when-reallocating-some-dma-m.patch |  46 ++
 ...-use-after-free-in-em28xx_alloc_urbs.patch |  46 ++
 ...-ov5670-fix-pixel_rate-minimum-value.patch |  43 ++
 .../media-imx-fix-csc-scaler-unregister.patch |  52 ++
 ...gister-csc-scaler-only-if-registered.patch |  58 ++
 .../media-lmedm04-fix-misuse-of-comma.patch   |  40 ++
 ...edia-pci-fix-memleak-in-empress_init.patch |  42 ++
 ...-declare-variable-when-debug-is-defi.patch |  46 ++
 ...-fix-error-return-code-in-qm1d1c0042.patch |  43 ++
 ...ode-fix-refcounts-in-software_node_g.patch |  55 ++
 ...0-fix-memleak-in-tm6000_start_stream.patch |  40 ++
 ...ccept-invalid-bformatindex-and-bfram.patch |  82 +++
 ...n-error-handling-path-in-the-probe-f.patch |  43 ++
 ...ei_set_devstate-on-hbm-stop-response.patch |  38 ++
 ...ix-pm-usage-counter-unbalance-in-mtk.patch |  49 ++
 ...drop-child-node-when-jumping-out-loo.patch |  55 ++
 ...d-bd9571mwv-use-devm_mfd_add_devices.patch |  43 ++
 ...c-prevent-use-after-free-in-wm831x_a.patch |  44 ++
 ...ection-mismatch-for-loongson2_sc_ini.patch |  45 ++
 ...icitly-compare-ltq_ebu_pcc_istat-aga.patch |  55 ++
 ...s-properly-stop-.eh_frame-generation.patch |  84 +++
 ...46-add-module-alias-to-avoid-breakin.patch |  38 ++
 ...46-fix-module-alias-to-enable-module.patch |  34 ++
 ...x-misbehaviors-of-fast_find_migrateb.patch | 113 ++++
 ...otential-double-free-in-hugetlb_regi.patch |  46 ++
 ...potential-pte_unmap_unlock-pte-error.patch |  66 ++
 ...ntial-pte_unmap-on-an-not-mapped-pte.patch |  56 ++
 ..._internal_dmac-fix-dma-buffer-alignm.patch |  44 ++
 ...ix-some-resource-leaks-in-the-remove.patch |  51 ++
 ...ix-a-resource-leak-in-the-error-hand.patch |  46 ++
 ...tag-fix-error-codes-in-bcm963xx_pars.patch |  61 ++
 ...fix-freeing-the-part-name-memory-in-.patch |  44 ++
 ...-netdev-watchdog-transmit-queue-time.patch |  78 +++
 ...-network-fluctuations-when-using-1g-.patch |  41 ++
 ...et-link-when-the-link-never-comes-ba.patch |  66 ++
 ...et-the-phy-rx-data-path-when-mailbox.patch | 128 ++++
 ...dle-deferred-probe-on-clock-properly.patch |  76 +++
 ...ore-add-missed-mlx4_free_cmd_mailbox.patch |  39 ++
 ...e-per-cpu-queue-mapping-for-armada-3.patch |  55 ++
 ...ter-pernet-ops-last-unregister-first.patch |  87 +++
 ...-resource-leak-on-error-in-nvmem_add.patch |  38 ++
 ...kip-child-nodes-not-matching-binding.patch |  67 ++
 ...d-section-suffix-check-for-newer-ver.patch |  42 ++
 ...-error-handling-for-std-cld-warnings.patch |  49 ++
 .../ocfs2-fix-a-use-after-free-on-error.patch |  60 ++
 ...-no-map-does-not-remove-already-rese.patch |  80 +++
 ...ing-of-syscall-user-config-accessors.patch |  80 +++
 ...pt-fix-missing-cyc-processing-in-psb.patch |  41 ++
 .../perf-intel-pt-fix-premature-ipc.patch     | 108 ++++
 ...aligned-access-in-sample-parsing-tes.patch |  73 +++
 ...so-filtering-when-not-finding-a-map-.patch | 101 +++
 ...nts-arm64-fix-ampere-emag-event-typo.patch |  48 ++
 ...p-emmc-emmc_phy_init-always-return-0.patch |  52 ++
 ...-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch |  36 ++
 .../powerpc-47x-disable-256k-page-size.patch  |  41 ++
 ...8xx-fix-software-emulation-interrupt.patch |  40 ++
 ...dlpar-handle-ibm-configure-connector.patch |  65 ++
 ...x-incorrect-return-from-analyze_inst.patch |  57 ++
 ...kchip_pwm_probe-remove-superfluous-c.patch |  43 ++
 ...-leak-when-handling-corrupted-quota-.patch |  55 ++
 ...ix-jumbo-packet-handling-on-rtl8168e.patch |  54 ++
 .../rdma-hns-fix-type-of-sq_signal_bits.patch |  38 ++
 ...d-wrong-judgments-in-the-goto-branch.patch |  39 ++
 ...hns-fixes-missing-error-code-of-cmdq.patch |  56 ++
 ...e-correct-obj_id-upon-devx-tir-creat.patch |  40 ++
 ...dma-rxe-correct-skb-on-loopback-path.patch |  43 ++
 ...ix-coding-error-in-rxe_rcv_mcast_pkt.patch |  75 +++
 ...a-rxe-fix-coding-error-in-rxe_recv.c.patch |  67 ++
 ...ix-calculation-of-tx_valid_cpus-size.patch |  75 +++
 ...dling-of-zero-sized-read-and-receive.patch | 574 ++++++++++++++++++
 ...no_pm-functions-in-regmap_read-write.patch |  60 ++
 ...lator-axp20x-fix-reference-cout-leak.patch |  52 ++
 ...void-debugfs-directory-.-already-pre.patch |  70 +++
 .../regulator-qcom-rpmh-fix-pm8009-ldo7.patch |  37 ++
 ...67-drop-regulators-of-node-reference.patch |  49 ++
 ...tor-s5m8767-fix-reference-count-leak.patch |  45 ++
 queue-5.4/rtc-s5m-select-regmap_i2c.patch     |  37 ++
 ...update-misfit-status-if-the-task-is-.patch |  53 ++
 ...ix-kconfig-warning-cnic-build-errors.patch |  57 ++
 ...c-make-the-test-check-in-eeh-basic.s.patch |  42 ++
 queue-5.4/series                              | 222 +++++++
 ...aspeed-snoop-add-clock-control-logic.patch | 110 ++++
 ...undwire-cadence-fix-ack-nak-handling.patch |  54 ++
 ...ect-compat_binfmt_elf-if-binfmt_elf-.patch |  47 ++
 ...l-put-allocated-master-before-return.patch |  39 ++
 ...spi-abort-read-if-dummy-cycles-requi.patch |  41 ++
 ...he-controller-numbering-for-wildcat-.patch |  87 +++
 ...tm32-properly-handle-0-byte-transfer.patch |  39 ++
 ...s-wifi_regd.c-fix-incorrect-number-o.patch |  93 +++
 ...take-mmap-lock-in-cacheflush-syscall.patch |  61 ++
 ...wat-related-hangs-under-mem-pressure.patch |  67 ++
 ...t-fail-unregistering-a-probe-due-to-.patch | 205 +++++++
 ...fix-error-return-code-in-alloc_wbufs.patch |  40 ++
 ...memleak-in-ubifs_init_authentication.patch |  38 ++
 ...ransaction-after-errors-with-unknown.patch |  84 +++
 ...update-data-length-if-it-is-0-on-inb.patch |  63 ++
 ...trimming-xfer-length-a-debug-message.patch |  48 ++
 ...io-free-requests-only-after-callback.patch |  72 +++
 ...-fix-some-sanity-checks-in-detach-gr.patch | 101 +++
 queue-5.4/vfio-type1-use-follow_pte.patch     |  70 +++
 ...e_dirty_lock-when-unregistering-gues.patch |  43 ++
 ...-debug-check-after-netdev-unregister.patch | 106 ++++
 ...spurious-event-detection-for-common-.patch |  56 ++
 223 files changed, 14677 insertions(+)
 create mode 100644 queue-5.4/acpica-fix-exception-code-class-checks.patch
 create mode 100644 queue-5.4/amba-fix-resource-leak-for-drivers-without-.remove.patch
 create mode 100644 queue-5.4/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch
 create mode 100644 queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch
 create mode 100644 queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch
 create mode 100644 queue-5.4/arm-dts-configure-missing-thermal-interrupt-for-4430.patch
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-15427
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-17107
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18208
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3724
 create mode 100644 queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-4737
 create mode 100644 queue-5.4/arm-s3c-fix-fiq-for-clang-ias.patch
 create mode 100644 queue-5.4/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch
 create mode 100644 queue-5.4/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch
 create mode 100644 queue-5.4/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch
 create mode 100644 queue-5.4/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch
 create mode 100644 queue-5.4/arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch
 create mode 100644 queue-5.4/arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch
 create mode 100644 queue-5.4/arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch
 create mode 100644 queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch
 create mode 100644 queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-21413
 create mode 100644 queue-5.4/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch
 create mode 100644 queue-5.4/asoc-cpcap-fix-microphone-timeslot-mask.patch
 create mode 100644 queue-5.4/asoc-cs42l56-fix-up-error-handling-in-probe.patch
 create mode 100644 queue-5.4/asoc-simple-card-utils-fix-device-module-clock.patch
 create mode 100644 queue-5.4/asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch
 create mode 100644 queue-5.4/ata-ahci_brcm-add-back-regulators-management.patch
 create mode 100644 queue-5.4/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch
 create mode 100644 queue-5.4/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch
 create mode 100644 queue-5.4/auxdisplay-ht16k33-fix-refresh-rate-handling.patch
 create mode 100644 queue-5.4/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch
 create mode 100644 queue-5.4/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch
 create mode 100644 queue-5.4/bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch
 create mode 100644 queue-5.4/bluetooth-drop-hci-device-reference-before-return.patch
 create mode 100644 queue-5.4/bluetooth-fix-initializing-response-id-after-clearin.patch
 create mode 100644 queue-5.4/bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
 create mode 100644 queue-5.4/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch
 create mode 100644 queue-5.4/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch
 create mode 100644 queue-5.4/bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch
 create mode 100644 queue-5.4/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch
 create mode 100644 queue-5.4/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch
 create mode 100644 queue-5.4/bpf_lru_list-read-double-checked-variable-once-witho.patch
 create mode 100644 queue-5.4/bsg-free-the-request-before-return-error-code.patch
 create mode 100644 queue-5.4/btrfs-clarify-error-returns-values-in-__load_free_sp.patch
 create mode 100644 queue-5.4/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch
 create mode 100644 queue-5.4/certs-fix-blacklist-flag-type-confusion.patch
 create mode 100644 queue-5.4/clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch
 create mode 100644 queue-5.4/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch
 create mode 100644 queue-5.4/clk-meson-clk-pll-make-ret-a-signed-integer.patch
 create mode 100644 queue-5.4/clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch
 create mode 100644 queue-5.4/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch
 create mode 100644 queue-5.4/clk-sunxi-ng-h6-fix-cec-clock.patch
 create mode 100644 queue-5.4/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch
 create mode 100644 queue-5.4/clocksource-drivers-ixp4xx-select-timer_of-when-need.patch
 create mode 100644 queue-5.4/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch
 create mode 100644 queue-5.4/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch
 create mode 100644 queue-5.4/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch
 create mode 100644 queue-5.4/crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch
 create mode 100644 queue-5.4/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch
 create mode 100644 queue-5.4/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch
 create mode 100644 queue-5.4/crypto-sun4i-ss-fix-kmap-usage.patch
 create mode 100644 queue-5.4/crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch
 create mode 100644 queue-5.4/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch
 create mode 100644 queue-5.4/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch
 create mode 100644 queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch
 create mode 100644 queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch
 create mode 100644 queue-5.4/dmaengine-hsu-disable-spurious-interrupt.patch
 create mode 100644 queue-5.4/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch
 create mode 100644 queue-5.4/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch
 create mode 100644 queue-5.4/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch
 create mode 100644 queue-5.4/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch
 create mode 100644 queue-5.4/drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch
 create mode 100644 queue-5.4/drm-gma500-fix-error-return-code-in-psb_driver_load.patch
 create mode 100644 queue-5.4/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch
 create mode 100644 queue-5.4/drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch
 create mode 100644 queue-5.4/drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch
 create mode 100644 queue-5.4/drm-sun4i-tcon-fix-inverted-dclk-polarity.patch
 create mode 100644 queue-5.4/evm-fix-memleak-in-init_desc.patch
 create mode 100644 queue-5.4/ext4-fix-potential-htree-index-checksum-corruption.patch
 create mode 100644 queue-5.4/f2fs-fix-a-wrong-condition-in-__submit_bio.patch
 create mode 100644 queue-5.4/f2fs-fix-to-avoid-inconsistent-quota-data.patch
 create mode 100644 queue-5.4/fbdev-aty-sparc64-requires-fb_aty_ct.patch
 create mode 100644 queue-5.4/fdt-properly-handle-no-map-field-in-the-memory-regio.patch
 create mode 100644 queue-5.4/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch
 create mode 100644 queue-5.4/gma500-clean-up-error-handling-in-init.patch
 create mode 100644 queue-5.4/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch
 create mode 100644 queue-5.4/hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch
 create mode 100644 queue-5.4/hwrng-timeriomem-fix-cooldown-period-calculation.patch
 create mode 100644 queue-5.4/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch
 create mode 100644 queue-5.4/i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch
 create mode 100644 queue-5.4/i2c-iproc-handle-master-read-request.patch
 create mode 100644 queue-5.4/i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch
 create mode 100644 queue-5.4/i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch
 create mode 100644 queue-5.4/i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch
 create mode 100644 queue-5.4/i40e-add-zero-initialization-of-aq-command-structure.patch
 create mode 100644 queue-5.4/i40e-fix-add-tc-filter-for-ipv6.patch
 create mode 100644 queue-5.4/i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch
 create mode 100644 queue-5.4/i40e-fix-flow-for-ipv6-next-header-extension-header.patch
 create mode 100644 queue-5.4/i40e-fix-overwriting-flow-control-settings-during-dr.patch
 create mode 100644 queue-5.4/i40e-fix-vfs-not-created.patch
 create mode 100644 queue-5.4/ib-cm-avoid-a-loop-when-device-has-255-ports.patch
 create mode 100644 queue-5.4/ib-mlx5-return-appropriate-error-code-instead-of-eno.patch
 create mode 100644 queue-5.4/ib-umad-return-eio-in-case-of-when-device-disassocia.patch
 create mode 100644 queue-5.4/ib-umad-return-epollerr-in-case-of-when-device-disas.patch
 create mode 100644 queue-5.4/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch
 create mode 100644 queue-5.4/ibmvnic-set-to-closed-state-even-on-error.patch
 create mode 100644 queue-5.4/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch
 create mode 100644 queue-5.4/ima-free-ima-measurement-buffer-after-kexec-syscall.patch
 create mode 100644 queue-5.4/ima-free-ima-measurement-buffer-on-error.patch
 create mode 100644 queue-5.4/input-elo-fix-an-error-code-in-elo_connect.patch
 create mode 100644 queue-5.4/input-sur40-fix-an-error-code-in-sur40_probe.patch
 create mode 100644 queue-5.4/isofs-release-buffer-head-before-return.patch
 create mode 100644 queue-5.4/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch
 create mode 100644 queue-5.4/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch
 create mode 100644 queue-5.4/mac80211-fix-potential-overflow-when-multiplying-to-.patch
 create mode 100644 queue-5.4/media-aspeed-fix-error-return-code-in-aspeed_video_s.patch
 create mode 100644 queue-5.4/media-camss-missing-error-code-in-msm_video_register.patch
 create mode 100644 queue-5.4/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch
 create mode 100644 queue-5.4/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch
 create mode 100644 queue-5.4/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch
 create mode 100644 queue-5.4/media-imx-fix-csc-scaler-unregister.patch
 create mode 100644 queue-5.4/media-imx-unregister-csc-scaler-only-if-registered.patch
 create mode 100644 queue-5.4/media-lmedm04-fix-misuse-of-comma.patch
 create mode 100644 queue-5.4/media-media-pci-fix-memleak-in-empress_init.patch
 create mode 100644 queue-5.4/media-pxa_camera-declare-variable-when-debug-is-defi.patch
 create mode 100644 queue-5.4/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch
 create mode 100644 queue-5.4/media-software_node-fix-refcounts-in-software_node_g.patch
 create mode 100644 queue-5.4/media-tm6000-fix-memleak-in-tm6000_start_stream.patch
 create mode 100644 queue-5.4/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch
 create mode 100644 queue-5.4/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch
 create mode 100644 queue-5.4/mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch
 create mode 100644 queue-5.4/memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch
 create mode 100644 queue-5.4/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch
 create mode 100644 queue-5.4/mfd-bd9571mwv-use-devm_mfd_add_devices.patch
 create mode 100644 queue-5.4/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch
 create mode 100644 queue-5.4/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch
 create mode 100644 queue-5.4/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch
 create mode 100644 queue-5.4/mips-properly-stop-.eh_frame-generation.patch
 create mode 100644 queue-5.4/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch
 create mode 100644 queue-5.4/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch
 create mode 100644 queue-5.4/mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch
 create mode 100644 queue-5.4/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch
 create mode 100644 queue-5.4/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch
 create mode 100644 queue-5.4/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
 create mode 100644 queue-5.4/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch
 create mode 100644 queue-5.4/mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch
 create mode 100644 queue-5.4/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch
 create mode 100644 queue-5.4/mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch
 create mode 100644 queue-5.4/mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch
 create mode 100644 queue-5.4/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch
 create mode 100644 queue-5.4/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch
 create mode 100644 queue-5.4/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch
 create mode 100644 queue-5.4/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch
 create mode 100644 queue-5.4/net-axienet-handle-deferred-probe-on-clock-properly.patch
 create mode 100644 queue-5.4/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch
 create mode 100644 queue-5.4/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch
 create mode 100644 queue-5.4/nfsd-register-pernet-ops-last-unregister-first.patch
 create mode 100644 queue-5.4/nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch
 create mode 100644 queue-5.4/nvmem-core-skip-child-nodes-not-matching-binding.patch
 create mode 100644 queue-5.4/objtool-fix-.cold-section-suffix-check-for-newer-ver.patch
 create mode 100644 queue-5.4/objtool-fix-error-handling-for-std-cld-warnings.patch
 create mode 100644 queue-5.4/ocfs2-fix-a-use-after-free-on-error.patch
 create mode 100644 queue-5.4/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch
 create mode 100644 queue-5.4/pci-align-checking-of-syscall-user-config-accessors.patch
 create mode 100644 queue-5.4/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch
 create mode 100644 queue-5.4/perf-intel-pt-fix-premature-ipc.patch
 create mode 100644 queue-5.4/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch
 create mode 100644 queue-5.4/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch
 create mode 100644 queue-5.4/perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch
 create mode 100644 queue-5.4/phy-rockchip-emmc-emmc_phy_init-always-return-0.patch
 create mode 100644 queue-5.4/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch
 create mode 100644 queue-5.4/powerpc-47x-disable-256k-page-size.patch
 create mode 100644 queue-5.4/powerpc-8xx-fix-software-emulation-interrupt.patch
 create mode 100644 queue-5.4/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch
 create mode 100644 queue-5.4/powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch
 create mode 100644 queue-5.4/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch
 create mode 100644 queue-5.4/quota-fix-memory-leak-when-handling-corrupted-quota-.patch
 create mode 100644 queue-5.4/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch
 create mode 100644 queue-5.4/rdma-hns-fix-type-of-sq_signal_bits.patch
 create mode 100644 queue-5.4/rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch
 create mode 100644 queue-5.4/rdma-hns-fixes-missing-error-code-of-cmdq.patch
 create mode 100644 queue-5.4/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch
 create mode 100644 queue-5.4/rdma-rxe-correct-skb-on-loopback-path.patch
 create mode 100644 queue-5.4/rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch
 create mode 100644 queue-5.4/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch
 create mode 100644 queue-5.4/rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch
 create mode 100644 queue-5.4/rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch
 create mode 100644 queue-5.4/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch
 create mode 100644 queue-5.4/regulator-axp20x-fix-reference-cout-leak.patch
 create mode 100644 queue-5.4/regulator-core-avoid-debugfs-directory-.-already-pre.patch
 create mode 100644 queue-5.4/regulator-qcom-rpmh-fix-pm8009-ldo7.patch
 create mode 100644 queue-5.4/regulator-s5m8767-drop-regulators-of-node-reference.patch
 create mode 100644 queue-5.4/regulator-s5m8767-fix-reference-count-leak.patch
 create mode 100644 queue-5.4/rtc-s5m-select-regmap_i2c.patch
 create mode 100644 queue-5.4/sched-eas-don-t-update-misfit-status-if-the-task-is-.patch
 create mode 100644 queue-5.4/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch
 create mode 100644 queue-5.4/selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch
 create mode 100644 queue-5.4/soc-aspeed-snoop-add-clock-control-logic.patch
 create mode 100644 queue-5.4/soundwire-cadence-fix-ack-nak-handling.patch
 create mode 100644 queue-5.4/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch
 create mode 100644 queue-5.4/spi-atmel-put-allocated-master-before-return.patch
 create mode 100644 queue-5.4/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch
 create mode 100644 queue-5.4/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch
 create mode 100644 queue-5.4/spi-stm32-properly-handle-0-byte-transfer.patch
 create mode 100644 queue-5.4/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch
 create mode 100644 queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch
 create mode 100644 queue-5.4/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch
 create mode 100644 queue-5.4/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch
 create mode 100644 queue-5.4/ubifs-fix-error-return-code-in-alloc_wbufs.patch
 create mode 100644 queue-5.4/ubifs-fix-memleak-in-ubifs_init_authentication.patch
 create mode 100644 queue-5.4/usb-dwc2-abort-transaction-after-errors-with-unknown.patch
 create mode 100644 queue-5.4/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch
 create mode 100644 queue-5.4/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch
 create mode 100644 queue-5.4/usb-gadget-u_audio-free-requests-only-after-callback.patch
 create mode 100644 queue-5.4/vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch
 create mode 100644 queue-5.4/vfio-type1-use-follow_pte.patch
 create mode 100644 queue-5.4/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch
 create mode 100644 queue-5.4/vxlan-move-debug-check-after-netdev-unregister.patch
 create mode 100644 queue-5.4/xen-netback-fix-spurious-event-detection-for-common-.patch

diff --git a/queue-5.4/acpica-fix-exception-code-class-checks.patch b/queue-5.4/acpica-fix-exception-code-class-checks.patch
new file mode 100644
index 00000000000..4d19709fc25
--- /dev/null
+++ b/queue-5.4/acpica-fix-exception-code-class-checks.patch
@@ -0,0 +1,62 @@
+From 505d619d3db083d6f94600abd9c19efb84aab3cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 10:48:18 -0800
+Subject: ACPICA: Fix exception code class checks
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 3dfaea3811f8b6a89a347e8da9ab862cdf3e30fe ]
+
+ACPICA commit 1a3a549286ea9db07d7ec700e7a70dd8bcc4354e
+
+The macros to classify different AML exception codes are broken. For
+instance,
+
+  ACPI_ENV_EXCEPTION(Status)
+
+will always evaluate to zero due to
+
+  #define AE_CODE_ENVIRONMENTAL      0x0000
+  #define ACPI_ENV_EXCEPTION(Status) (Status & AE_CODE_ENVIRONMENTAL)
+
+Similarly, ACPI_AML_EXCEPTION(Status) will evaluate to a non-zero
+value for error codes of type AE_CODE_PROGRAMMER, AE_CODE_ACPI_TABLES,
+as well as AE_CODE_AML, and not just AE_CODE_AML as the name suggests.
+
+This commit fixes those checks.
+
+Fixes: d46b6537f0ce ("ACPICA: AML Parser: ignore all exceptions resulting from incorrect AML during table load")
+Link: https://github.com/acpica/acpica/commit/1a3a5492
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/acexcep.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
+index 233a72f169bb7..e1de0fe281644 100644
+--- a/include/acpi/acexcep.h
++++ b/include/acpi/acexcep.h
+@@ -59,11 +59,11 @@ struct acpi_exception_info {
+ 
+ #define AE_OK                           (acpi_status) 0x0000
+ 
+-#define ACPI_ENV_EXCEPTION(status)      (status & AE_CODE_ENVIRONMENTAL)
+-#define ACPI_AML_EXCEPTION(status)      (status & AE_CODE_AML)
+-#define ACPI_PROG_EXCEPTION(status)     (status & AE_CODE_PROGRAMMER)
+-#define ACPI_TABLE_EXCEPTION(status)    (status & AE_CODE_ACPI_TABLES)
+-#define ACPI_CNTL_EXCEPTION(status)     (status & AE_CODE_CONTROL)
++#define ACPI_ENV_EXCEPTION(status)      (((status) & AE_CODE_MASK) == AE_CODE_ENVIRONMENTAL)
++#define ACPI_AML_EXCEPTION(status)      (((status) & AE_CODE_MASK) == AE_CODE_AML)
++#define ACPI_PROG_EXCEPTION(status)     (((status) & AE_CODE_MASK) == AE_CODE_PROGRAMMER)
++#define ACPI_TABLE_EXCEPTION(status)    (((status) & AE_CODE_MASK) == AE_CODE_ACPI_TABLES)
++#define ACPI_CNTL_EXCEPTION(status)     (((status) & AE_CODE_MASK) == AE_CODE_CONTROL)
+ 
+ /*
+  * Environmental exceptions
+-- 
+2.27.0
+
diff --git a/queue-5.4/amba-fix-resource-leak-for-drivers-without-.remove.patch b/queue-5.4/amba-fix-resource-leak-for-drivers-without-.remove.patch
new file mode 100644
index 00000000000..a69010eba0b
--- /dev/null
+++ b/queue-5.4/amba-fix-resource-leak-for-drivers-without-.remove.patch
@@ -0,0 +1,83 @@
+From e0a220bc8e9c01f0f125a197eb84e9c7608ce3c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 17:58:31 +0100
+Subject: amba: Fix resource leak for drivers without .remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit de5d7adb89367bbc87b4e5ce7afe7ae9bd86dc12 ]
+
+Consider an amba driver with a .probe but without a .remove callback (e.g.
+pl061_gpio_driver). The function amba_probe() is called to bind a device
+and so dev_pm_domain_attach() and others are called. As there is no remove
+callback amba_remove() isn't called at unbind time however and so calling
+dev_pm_domain_detach() is missed and the pm domain keeps active.
+
+To fix this always use the core driver callbacks and handle missing amba
+callbacks there. For probe refuse registration as a driver without probe
+doesn't make sense.
+
+Fixes: 7cfe249475fd ("ARM: AMBA: Add pclk support to AMBA bus infrastructure")
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210126165835.687514-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/amba/bus.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index fe1523664816a..af58768a03937 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -299,10 +299,11 @@ static int amba_remove(struct device *dev)
+ {
+ 	struct amba_device *pcdev = to_amba_device(dev);
+ 	struct amba_driver *drv = to_amba_driver(dev->driver);
+-	int ret;
++	int ret = 0;
+ 
+ 	pm_runtime_get_sync(dev);
+-	ret = drv->remove(pcdev);
++	if (drv->remove)
++		ret = drv->remove(pcdev);
+ 	pm_runtime_put_noidle(dev);
+ 
+ 	/* Undo the runtime PM settings in amba_probe() */
+@@ -319,7 +320,9 @@ static int amba_remove(struct device *dev)
+ static void amba_shutdown(struct device *dev)
+ {
+ 	struct amba_driver *drv = to_amba_driver(dev->driver);
+-	drv->shutdown(to_amba_device(dev));
++
++	if (drv->shutdown)
++		drv->shutdown(to_amba_device(dev));
+ }
+ 
+ /**
+@@ -332,12 +335,13 @@ static void amba_shutdown(struct device *dev)
+  */
+ int amba_driver_register(struct amba_driver *drv)
+ {
+-	drv->drv.bus = &amba_bustype;
++	if (!drv->probe)
++		return -EINVAL;
+ 
+-#define SETFN(fn)	if (drv->fn) drv->drv.fn = amba_##fn
+-	SETFN(probe);
+-	SETFN(remove);
+-	SETFN(shutdown);
++	drv->drv.bus = &amba_bustype;
++	drv->drv.probe = amba_probe;
++	drv->drv.remove = amba_remove;
++	drv->drv.shutdown = amba_shutdown;
+ 
+ 	return driver_register(&drv->drv);
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch b/queue-5.4/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch
new file mode 100644
index 00000000000..835c48eeea0
--- /dev/null
+++ b/queue-5.4/arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch
@@ -0,0 +1,75 @@
+From 88fa3140217d96d88474241f8e6c84211a277896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 10:47:24 +0100
+Subject: ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 2acb909750431030b65a0a2a17fd8afcbd813a84 ]
+
+It was observed that decompressor running on hardware implementing ARM v8.2
+Load/Store Multiple Atomicity and Ordering Control (LSMAOC), say, as guest,
+would stuck just after:
+
+Uncompressing Linux... done, booting the kernel.
+
+The reason is that it clears nTLSMD bit when disabling caches:
+
+  nTLSMD, bit [3]
+
+  When ARMv8.2-LSMAOC is implemented:
+
+    No Trap Load Multiple and Store Multiple to
+    Device-nGRE/Device-nGnRE/Device-nGnRnE memory.
+
+    0b0 All memory accesses by A32 and T32 Load Multiple and Store
+        Multiple at EL1 or EL0 that are marked at stage 1 as
+        Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and
+        generate a stage 1 Alignment fault.
+
+    0b1 All memory accesses by A32 and T32 Load Multiple and Store
+        Multiple at EL1 or EL0 that are marked at stage 1 as
+        Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.
+
+  This bit is permitted to be cached in a TLB.
+
+  This field resets to 1.
+
+  Otherwise:
+
+  Reserved, RES1
+
+So as effect we start getting traps we are not quite ready for.
+
+Looking into history it seems that mask used for SCTLR clear came from
+the similar code for ARMv4, where bit[3] is the enable/disable bit for
+the write buffer. That not applicable to ARMv7 and onwards, so retire
+that bit from the masks.
+
+Fixes: 7d09e85448dfa78e3e58186c934449aaf6d49b50 ("[ARM] 4393/2: ARMv7: Add uncompressing code for the new CPU Id format")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 93dffed0ac6e0..cbe126297f549 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1142,9 +1142,9 @@ __armv4_mmu_cache_off:
+ __armv7_mmu_cache_off:
+ 		mrc	p15, 0, r0, c1, c0
+ #ifdef CONFIG_MMU
+-		bic	r0, r0, #0x000d
++		bic	r0, r0, #0x0005
+ #else
+-		bic	r0, r0, #0x000c
++		bic	r0, r0, #0x0004
+ #endif
+ 		mcr	p15, 0, r0, c1, c0	@ turn MMU and cache off
+ 		mov	r12, lr
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch b/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch
new file mode 100644
index 00000000000..de918d15970
--- /dev/null
+++ b/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch
@@ -0,0 +1,59 @@
+From 7d99fd220a149ba3f382393a98638e0f539e66ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:23:21 -0800
+Subject: ARM: dts: armada388-helios4: assign pinctrl to each fan
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit 46ecdfc1830eaa40a11d7f832089c82b0e67ea96 ]
+
+Split up the pins for each fan. This is needed in order to control them
+
+Fixes: ced8025b569e ("ARM: dts: armada388-helios4")
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-helios4.dts | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
+index e0fa1391948c1..a94758090fb0d 100644
+--- a/arch/arm/boot/dts/armada-388-helios4.dts
++++ b/arch/arm/boot/dts/armada-388-helios4.dts
+@@ -127,11 +127,15 @@
+ 	fan1: j10-pwm {
+ 		compatible = "pwm-fan";
+ 		pwms = <&gpio1 9 40000>;	/* Target freq:25 kHz */
++		pinctrl-names = "default";
++		pinctrl-0 = <&helios_fan1_pins>;
+ 	};
+ 
+ 	fan2: j17-pwm {
+ 		compatible = "pwm-fan";
+ 		pwms = <&gpio1 23 40000>;	/* Target freq:25 kHz */
++		pinctrl-names = "default";
++		pinctrl-0 = <&helios_fan2_pins>;
+ 	};
+ 
+ 	usb2_phy: usb2-phy {
+@@ -307,9 +311,12 @@
+ 						       "mpp54";
+ 					marvell,function = "gpio";
+ 				};
+-				helios_fan_pins: helios-fan-pins {
+-					marvell,pins = "mpp41", "mpp43",
+-						       "mpp48", "mpp55";
++				helios_fan1_pins: helios_fan1_pins {
++					marvell,pins = "mpp41", "mpp43";
++					marvell,function = "gpio";
++				};
++				helios_fan2_pins: helios_fan2_pins {
++					marvell,pins = "mpp48", "mpp55";
+ 					marvell,function = "gpio";
+ 				};
+ 				microsom_spi1_cs_pins: spi1-cs-pins {
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch b/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch
new file mode 100644
index 00000000000..3c9316dbcca
--- /dev/null
+++ b/queue-5.4/arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch
@@ -0,0 +1,64 @@
+From 677a9d85d50ed2fc100df60c1632e53dc440157f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:23:20 -0800
+Subject: ARM: dts: armada388-helios4: assign pinctrl to LEDs
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit e011c9025a4691b5c734029577a920bd6c320994 ]
+
+Split up the pins to match earlier definitions. Allows LEDs to flash
+properly.
+
+Fixes: ced8025b569e ("ARM: dts: armada388-helios4")
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-helios4.dts | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
+index 705adfa8c680f..e0fa1391948c1 100644
+--- a/arch/arm/boot/dts/armada-388-helios4.dts
++++ b/arch/arm/boot/dts/armada-388-helios4.dts
+@@ -70,6 +70,9 @@
+ 
+ 	system-leds {
+ 		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&helios_system_led_pins>;
++
+ 		status-led {
+ 			label = "helios4:green:status";
+ 			gpios = <&gpio0 24 GPIO_ACTIVE_LOW>;
+@@ -86,6 +89,9 @@
+ 
+ 	io-leds {
+ 		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&helios_io_led_pins>;
++
+ 		sata1-led {
+ 			label = "helios4:green:ata1";
+ 			gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
+@@ -291,9 +297,12 @@
+ 						       "mpp39", "mpp40";
+ 					marvell,function = "sd0";
+ 				};
+-				helios_led_pins: helios-led-pins {
+-					marvell,pins = "mpp24", "mpp25",
+-						       "mpp49", "mpp50",
++				helios_system_led_pins: helios-system-led-pins {
++					marvell,pins = "mpp24", "mpp25";
++					marvell,function = "gpio";
++				};
++				helios_io_led_pins: helios-io-led-pins {
++					marvell,pins = "mpp49", "mpp50",
+ 						       "mpp52", "mpp53",
+ 						       "mpp54";
+ 					marvell,function = "gpio";
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-configure-missing-thermal-interrupt-for-4430.patch b/queue-5.4/arm-dts-configure-missing-thermal-interrupt-for-4430.patch
new file mode 100644
index 00000000000..b76b9299f71
--- /dev/null
+++ b/queue-5.4/arm-dts-configure-missing-thermal-interrupt-for-4430.patch
@@ -0,0 +1,52 @@
+From d69ad11c541bc4927fb51264f7775396ece25f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 10:42:30 +0200
+Subject: ARM: dts: Configure missing thermal interrupt for 4430
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 44f416879a442600b006ef7dec3a6dc98bcf59c6 ]
+
+We have gpio_86 wired internally to the bandgap thermal shutdown
+interrupt on 4430 like we have it on 4460 according to the TRM.
+This can be found easily by searching for TSHUT.
+
+For some reason the thermal shutdown interrupt was never added
+for 4430, let's add it. I believe this is needed for the thermal
+shutdown interrupt handler ti_bandgap_tshut_irq_handler() to call
+orderly_poweroff().
+
+Fixes: aa9bb4bb8878 ("arm: dts: add omap4430 thermal data")
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Eduardo Valentin <edubezval@gmail.com>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap443x.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi
+index 86b9caf461dfa..6e320efd9fc1d 100644
+--- a/arch/arm/boot/dts/omap443x.dtsi
++++ b/arch/arm/boot/dts/omap443x.dtsi
+@@ -33,10 +33,12 @@
+ 	};
+ 
+ 	ocp {
++		/* 4430 has only gpio_86 tshut and no talert interrupt */
+ 		bandgap: bandgap@4a002260 {
+ 			reg = <0x4a002260 0x4
+ 			       0x4a00232C 0x4>;
+ 			compatible = "ti,omap4430-bandgap";
++			gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+ 
+ 			#thermal-sensor-cells = <0>;
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
new file mode 100644
index 00000000000..0aeb693eb04
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
@@ -0,0 +1,39 @@
+From 1c4aa7f4cac0f54acbebb91ad4c4f78264633e79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:55 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit cb31334687db31c691901269d65074a7ffaecb18 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: b004a34bd0ff ("ARM: dts: exynos: Add exynos3250-artik5 dtsi file for ARTIK5 module")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-1-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+index dee35e3a5c4ba..69d134db6e94e 100644
+--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+@@ -75,7 +75,7 @@
+ 	s2mps14_pmic@66 {
+ 		compatible = "samsung,s2mps14-pmic";
+ 		interrupt-parent = <&gpx3>;
+-		interrupts = <5 IRQ_TYPE_NONE>;
++		interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&s2mps14_irq>;
+ 		reg = <0x66>;
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-15427 b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-15427
new file mode 100644
index 00000000000..85598ccbd70
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-15427
@@ -0,0 +1,39 @@
+From 9e03cc9f4639c5b2a44881fb881e6463d230401f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:57 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 437ae60947716bb479e2f32466f49445c0509b1e ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: faaf348ef468 ("ARM: dts: Add board dts file for exynos3250-rinato")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-3-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
+index 86c26a4edfd72..468932f452895 100644
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -260,7 +260,7 @@
+ 	s2mps14_pmic@66 {
+ 		compatible = "samsung,s2mps14-pmic";
+ 		interrupt-parent = <&gpx0>;
+-		interrupts = <7 IRQ_TYPE_NONE>;
++		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ 		reg = <0x66>;
+ 		wakeup-source;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-17107 b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-17107
new file mode 100644
index 00000000000..846ab44edc9
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-17107
@@ -0,0 +1,38 @@
+From 4f35a83e826d0bc1deb1505303472f7fdab725ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:56 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Monk
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8528cda2b7c667e9cd173aef1a677c71b7d5a096 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: e0cefb3f79d3 ("ARM: dts: add board dts file for Exynos3250-based Monk board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-2-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-monk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts
+index 248bd372fe705..a23a8749c94e4 100644
+--- a/arch/arm/boot/dts/exynos3250-monk.dts
++++ b/arch/arm/boot/dts/exynos3250-monk.dts
+@@ -195,7 +195,7 @@
+ 	s2mps14_pmic@66 {
+ 		compatible = "samsung,s2mps14-pmic";
+ 		interrupt-parent = <&gpx0>;
+-		interrupts = <7 IRQ_TYPE_NONE>;
++		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ 		reg = <0x66>;
+ 		wakeup-source;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18208 b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18208
new file mode 100644
index 00000000000..0e2f30b2527
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18208
@@ -0,0 +1,39 @@
+From 0e4e1444ac2c7d297ca6614ca1d6ad92dac04326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:59 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale
+ Octa
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+index 592d7b45ecc87..53bf988855e0d 100644
+--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+@@ -349,7 +349,7 @@
+ 		reg = <0x66>;
+ 
+ 		interrupt-parent = <&gpx3>;
+-		interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
++		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&s2mps11_irq>;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3724 b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3724
new file mode 100644
index 00000000000..f6f1ff739d3
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3724
@@ -0,0 +1,38 @@
+From 84266ccb6f81cd432aacf24c81c506ab552d4229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:58 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
+index 3d501926c2278..2355c53164840 100644
+--- a/arch/arm/boot/dts/exynos5250-spring.dts
++++ b/arch/arm/boot/dts/exynos5250-spring.dts
+@@ -108,7 +108,7 @@
+ 		compatible = "samsung,s5m8767-pmic";
+ 		reg = <0x66>;
+ 		interrupt-parent = <&gpx3>;
+-		interrupts = <2 IRQ_TYPE_NONE>;
++		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
+ 		wakeup-source;
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-4737 b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-4737
new file mode 100644
index 00000000000..b3f88105e94
--- /dev/null
+++ b/queue-5.4/arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-4737
@@ -0,0 +1,39 @@
+From 568d66bb19e50e079df02acee7f71856673279c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:00 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 3e7d9a583a24f7582c6bc29a0d4d624feedbc2f9 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: aac4e0615341 ("ARM: dts: odroidxu3: Enable wake alarm of S2MPS11 RTC")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-6-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index 829147e320e08..9e64a4ab94940 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -141,7 +141,7 @@
+ 		samsung,s2mps11-acokb-ground;
+ 
+ 		interrupt-parent = <&gpx0>;
+-		interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++		interrupts = <4 IRQ_TYPE_LEVEL_LOW>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&s2mps11_irq>;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm-s3c-fix-fiq-for-clang-ias.patch b/queue-5.4/arm-s3c-fix-fiq-for-clang-ias.patch
new file mode 100644
index 00000000000..23f8b48efb2
--- /dev/null
+++ b/queue-5.4/arm-s3c-fix-fiq-for-clang-ias.patch
@@ -0,0 +1,93 @@
+From 05db8406429ccefbc6233385686faa887fda6999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 17:23:42 +0100
+Subject: ARM: s3c: fix fiq for clang IAS
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ]
+
+Building with the clang integrated assembler produces a couple of
+errors for the s3c24xx fiq support:
+
+  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified
+    subnes pc, lr, #4 @@ return, still have work to do
+
+  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition
+    s3c24xx_spi_fiq_txrx:
+
+There are apparently two problems: one with extraneous or duplicate
+labels, and one with old-style opcode mnemonics. Stefan Agner has
+previously fixed other problems like this, but missed this particular
+file.
+
+Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support")
+Cc: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-s3c24xx-fiq.S | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-s3c24xx-fiq.S b/drivers/spi/spi-s3c24xx-fiq.S
+index e95d6282109e7..68ea12bead227 100644
+--- a/drivers/spi/spi-s3c24xx-fiq.S
++++ b/drivers/spi/spi-s3c24xx-fiq.S
+@@ -33,7 +33,6 @@
+ 	@ and an offset to the irq acknowledgment word
+ 
+ ENTRY(s3c24xx_spi_fiq_rx)
+-s3c24xx_spi_fix_rx:
+ 	.word	fiq_rx_end - fiq_rx_start
+ 	.word	fiq_rx_irq_ack - fiq_rx_start
+ fiq_rx_start:
+@@ -47,7 +46,7 @@ fiq_rx_start:
+ 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+ 
+ 	subs	fiq_rcount, fiq_rcount, #1
+-	subnes	pc, lr, #4		@@ return, still have work to do
++	subsne	pc, lr, #4		@@ return, still have work to do
+ 
+ 	@@ set IRQ controller so that next op will trigger IRQ
+ 	mov	fiq_rtmp, #0
+@@ -59,7 +58,6 @@ fiq_rx_irq_ack:
+ fiq_rx_end:
+ 
+ ENTRY(s3c24xx_spi_fiq_txrx)
+-s3c24xx_spi_fiq_txrx:
+ 	.word	fiq_txrx_end - fiq_txrx_start
+ 	.word	fiq_txrx_irq_ack - fiq_txrx_start
+ fiq_txrx_start:
+@@ -74,7 +72,7 @@ fiq_txrx_start:
+ 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+ 
+ 	subs	fiq_rcount, fiq_rcount, #1
+-	subnes	pc, lr, #4		@@ return, still have work to do
++	subsne	pc, lr, #4		@@ return, still have work to do
+ 
+ 	mov	fiq_rtmp, #0
+ 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
+@@ -86,7 +84,6 @@ fiq_txrx_irq_ack:
+ fiq_txrx_end:
+ 
+ ENTRY(s3c24xx_spi_fiq_tx)
+-s3c24xx_spi_fix_tx:
+ 	.word	fiq_tx_end - fiq_tx_start
+ 	.word	fiq_tx_irq_ack - fiq_tx_start
+ fiq_tx_start:
+@@ -99,7 +96,7 @@ fiq_tx_start:
+ 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+ 
+ 	subs	fiq_rcount, fiq_rcount, #1
+-	subnes	pc, lr, #4		@@ return, still have work to do
++	subsne	pc, lr, #4		@@ return, still have work to do
+ 
+ 	mov	fiq_rtmp, #0
+ 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch b/queue-5.4/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch
new file mode 100644
index 00000000000..f839120fca1
--- /dev/null
+++ b/queue-5.4/arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch
@@ -0,0 +1,49 @@
+From b1abc0a7d60d8f80181a571b25e52eab5742a0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 09:37:37 +0000
+Subject: arm64: Add missing ISB after invalidating TLB in __primary_switch
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 9d41053e8dc115c92b8002c3db5f545d7602498b ]
+
+Although there has been a bit of back and forth on the subject, it
+appears that invalidating TLBs requires an ISB instruction when FEAT_ETS
+is not implemented by the CPU.
+
+From the bible:
+
+  | In an implementation that does not implement FEAT_ETS, a TLB
+  | maintenance instruction executed by a PE, PEx, can complete at any
+  | time after it is issued, but is only guaranteed to be finished for a
+  | PE, PEx, after the execution of DSB by the PEx followed by a Context
+  | synchronization event
+
+Add the missing ISB in __primary_switch, just in case.
+
+Fixes: 3c5e9f238bc4 ("arm64: head.S: move KASLR processing out of __enable_mmu()")
+Suggested-by: Will Deacon <will@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/20210224093738.3629662-3-maz@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index bdb5ec3419006..438de2301cfe3 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -970,6 +970,7 @@ __primary_switch:
+ 
+ 	tlbi	vmalle1				// Remove any stale TLB entries
+ 	dsb	nsh
++	isb
+ 
+ 	msr	sctlr_el1, x19			// re-enable the MMU
+ 	isb
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch b/queue-5.4/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch
new file mode 100644
index 00000000000..88894ea2d6e
--- /dev/null
+++ b/queue-5.4/arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch
@@ -0,0 +1,61 @@
+From a0a0a2efd49bb90549b45f3e9806ea5562fac41b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:28 +0000
+Subject: arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 948c657cc45e8ce48cb533d4e2106145fa765759 ]
+
+In contrast to the H6 (and later) manuals, the A64 datasheet does not
+specify any limitations in the maximum possible frequency for eMMC
+controllers.
+However experimentation has found that a 150 MHz limit similar to other
+SoCs and also the MMC0 and MMC1 controllers on the A64 seems to exist
+for the MMC2 controller.
+
+Limit the frequency for the MMC2 controller to 150 MHz in the SoC .dtsi.
+The Pinebook seems to be the an odd exception, since it apparently seems
+to work with 200 MHz as well, so overwrite this in its board .dts file.
+
+Tested on a Pine64-LTS: 200 MHz HS-200 fails, 150 MHz HS-200 works.
+
+Fixes: 22be992faea7 ("arm64: allwinner: a64: Increase the MMC max frequency")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-7-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 1 +
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi         | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index b0f81802d334b..bb1de8217b86d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -140,6 +140,7 @@
+ 	pinctrl-0 = <&mmc2_pins>, <&mmc2_ds_pin>;
+ 	vmmc-supply = <&reg_dcdc1>;
+ 	vqmmc-supply = <&reg_eldo1>;
++	max-frequency = <200000000>;
+ 	bus-width = <8>;
+ 	non-removable;
+ 	cap-mmc-hw-reset;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 4c85dfc811c80..cf9e3234afaf8 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -476,7 +476,7 @@
+ 			resets = <&ccu RST_BUS_MMC2>;
+ 			reset-names = "ahb";
+ 			interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
+-			max-frequency = <200000000>;
++			max-frequency = <150000000>;
+ 			status = "disabled";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch b/queue-5.4/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch
new file mode 100644
index 00000000000..4f26af80087
--- /dev/null
+++ b/queue-5.4/arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch
@@ -0,0 +1,84 @@
+From 47654ee9dab2e2b2c8c050f04c3a536b527e02fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:23 +0000
+Subject: arm64: dts: allwinner: A64: properly connect USB PHY to port 0
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit cc72570747e43335f4933a24dd74d5653639176a ]
+
+In recent Allwinner SoCs the first USB host controller (HCI0) shares
+the first PHY with the MUSB controller. Probably to make this sharing
+work, we were avoiding to declare this in the DT. This has two
+shortcomings:
+- U-Boot (which uses the same .dts) cannot use this port in host mode
+  without a PHY linked, so we were loosing one USB port there.
+- It requires the MUSB driver to be enabled and loaded, although we
+  don't actually use it.
+
+To avoid those issues, let's add this PHY link to the A64 .dtsi file.
+After all PHY port 0 *is* connected to HCI0, so we should describe
+it as this. Remove the part from the Pinebook DTS which already had
+this property.
+
+This makes it work in U-Boot, also improves compatiblity when no MUSB
+driver is loaded (for instance in distribution installers).
+
+Fixes: dc03a047df1d ("arm64: allwinner: a64: add EHCI0/OHCI0 nodes to A64 DTSI")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-2-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 4 ----
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi         | 4 ++++
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index 78c82a665c84a..b0f81802d334b 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -103,8 +103,6 @@
+ };
+ 
+ &ehci0 {
+-	phys = <&usbphy 0>;
+-	phy-names = "usb";
+ 	status = "okay";
+ };
+ 
+@@ -150,8 +148,6 @@
+ };
+ 
+ &ohci0 {
+-	phys = <&usbphy 0>;
+-	phy-names = "usb";
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 367699c8c9028..4c85dfc811c80 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -530,6 +530,8 @@
+ 				 <&ccu CLK_USB_OHCI0>;
+ 			resets = <&ccu RST_BUS_OHCI0>,
+ 				 <&ccu RST_BUS_EHCI0>;
++			phys = <&usbphy 0>;
++			phy-names = "usb";
+ 			status = "disabled";
+ 		};
+ 
+@@ -540,6 +542,8 @@
+ 			clocks = <&ccu CLK_BUS_OHCI0>,
+ 				 <&ccu CLK_USB_OHCI0>;
+ 			resets = <&ccu RST_BUS_OHCI0>;
++			phys = <&usbphy 0>;
++			phy-names = "usb";
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch b/queue-5.4/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch
new file mode 100644
index 00000000000..aa6dd9dc173
--- /dev/null
+++ b/queue-5.4/arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch
@@ -0,0 +1,46 @@
+From ba6f72459b5f5343db0037cf6bc41831a6f11d7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:26 +0000
+Subject: arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 941432d007689f3774646e41a1439228b6c6ee0e ]
+
+The SD card on the SoPine SoM module is somewhat concealed, so was
+originally defined as "non-removable".
+However there is a working card-detect pin (tested on two different
+SoM versions), and in certain SoM base boards it might be actually
+accessible at runtime.
+Also the Pine64-LTS shares the SoPine base .dtsi, so inherited the
+non-removable flag, even though the SD card slot is perfectly accessible
+and usable there. (It turns out that just *my* board has a broken card
+detect switch, so I originally thought CD wouldn't work on the LTS.)
+
+Drop the "non-removable" flag to describe the SD card slot properly.
+
+Fixes: c3904a269891 ("arm64: allwinner: a64: add DTSI file for SoPine SoM")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-5-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+index 9d20e13f0c02b..d935e3028fcb6 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+@@ -55,7 +55,6 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins>;
+ 	vmmc-supply = <&reg_dcdc1>;
+-	non-removable;
+ 	disable-wp;
+ 	bus-width = <4>;
+ 	cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch b/queue-5.4/arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch
new file mode 100644
index 00000000000..771c9cdc421
--- /dev/null
+++ b/queue-5.4/arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch
@@ -0,0 +1,61 @@
+From 5e0f116feb2fc80a2e22d6c4bf2c14116b26a7d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:27 +0000
+Subject: arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit cfe6c487b9a1abc6197714ec5605716a5428cf03 ]
+
+The H6 manual explicitly lists a frequency limit of 150 MHz for the bus
+frequency of the MMC controllers. So far we had no explicit limits in the
+DT, which limited eMMC to the spec defined frequencies, or whatever the
+driver defines (both Linux and FreeBSD use 52 MHz here).
+
+Put those maximum frequencies in the SoC .dtsi, to allow higher speed
+modes (which still would need to be explicitly enabled, per board).
+
+Tested with an eMMC using HS-200 on a Pine H64. Running at the spec'ed
+200 MHz indeed fails with I/O errors, but 150 MHz seems to work stably.
+
+Fixes: 8f54bd1595b3 ("arm64: allwinner: h6: add device tree nodes for MMC controllers")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-6-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 8b77bd5a3c017..1583cd5915214 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -332,6 +332,7 @@
+ 			interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&mmc0_pins>;
++			max-frequency = <150000000>;
+ 			status = "disabled";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -348,6 +349,7 @@
+ 			interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&mmc1_pins>;
++			max-frequency = <150000000>;
+ 			status = "disabled";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -364,6 +366,7 @@
+ 			interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&mmc2_pins>;
++			max-frequency = <150000000>;
+ 			status = "disabled";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch b/queue-5.4/arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch
new file mode 100644
index 00000000000..3a9607dde6e
--- /dev/null
+++ b/queue-5.4/arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch
@@ -0,0 +1,60 @@
+From 5da4ef370f620a5a8b0ac746bb56b720ff716d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:24 +0000
+Subject: arm64: dts: allwinner: H6: properly connect USB PHY to port 0
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit da2fb8457f71138d455cba82edec0d34f858e506 ]
+
+In recent Allwinner SoCs the first USB host controller (HCI0) shares
+the first PHY with the MUSB controller. Probably to make this sharing
+work, we were avoiding to declare this in the DT. This has two
+shortcomings:
+- U-Boot (which uses the same .dts) cannot use this port in host mode
+  without a PHY linked, so we were loosing one USB port there.
+- It requires the MUSB driver to be enabled and loaded, although we
+  don't actually use it.
+
+To avoid those issues, let's add this PHY link to the H6 .dtsi file.
+After all PHY port 0 *is* connected to HCI0, so we should describe
+it as this.
+
+This makes it work in U-Boot, also improves compatiblity when no MUSB
+driver is loaded (for instance in distribution installers).
+
+Fixes: eabb3d424b6d ("arm64: dts: allwinner: h6: add USB2-related device nodes")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-3-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index ab081efd59718..8b77bd5a3c017 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -533,6 +533,8 @@
+ 				 <&ccu CLK_USB_OHCI0>;
+ 			resets = <&ccu RST_BUS_OHCI0>,
+ 				 <&ccu RST_BUS_EHCI0>;
++			phys = <&usb2phy 0>;
++			phy-names = "usb";
+ 			status = "disabled";
+ 		};
+ 
+@@ -543,6 +545,8 @@
+ 			clocks = <&ccu CLK_BUS_OHCI0>,
+ 				 <&ccu CLK_USB_OHCI0>;
+ 			resets = <&ccu RST_BUS_OHCI0>;
++			phys = <&usb2phy 0>;
++			phy-names = "usb";
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch b/queue-5.4/arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch
new file mode 100644
index 00000000000..5ec7ec216a9
--- /dev/null
+++ b/queue-5.4/arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch
@@ -0,0 +1,50 @@
+From 0d36cf65e250f83e5ef77ac2ebf040bed82675cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 03:12:43 +0100
+Subject: arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to
+ a53-firmware
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit a9d9bfcadfb43b856dbcf9419de75f7420d5a225 ]
+
+The partition called "u-boot" in reality contains TF-A and U-Boot, and
+TF-A is before U-Boot.
+
+Rename this parition to "a53-firmware" to avoid confusion for users,
+since they cannot simply build U-Boot from U-Boot repository and flash
+the resulting image there. Instead they have to build the firmware with
+the sources from the mox-boot-builder repository [1] and flash the
+a53-firmware.bin binary there.
+
+[1] https://gitlab.nic.cz/turris/mox-boot-builder
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
+Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index aa52927e2e9c2..fad70c2df7bc0 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -202,7 +202,7 @@
+ 			};
+ 
+ 			partition@20000 {
+-				label = "u-boot";
++				label = "a53-firmware";
+ 				reg = <0x20000 0x160000>;
+ 			};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch b/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch
new file mode 100644
index 00000000000..04780508017
--- /dev/null
+++ b/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch
@@ -0,0 +1,39 @@
+From d3465e0e510a07d61f01aae4cdb053bfd8b97a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:01 +0100
+Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on TM2
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e98e2367dfb4b6d7a80c8ce795c644124eff5f36 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 01e5d2352152 ("arm64: dts: exynos: Add dts file for Exynos5433-based TM2 board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-7-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+index 6f90b0e62cba6..148bdca8d9c96 100644
+--- a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+@@ -389,7 +389,7 @@
+ 	s2mps13-pmic@66 {
+ 		compatible = "samsung,s2mps13-pmic";
+ 		interrupt-parent = <&gpa0>;
+-		interrupts = <7 IRQ_TYPE_NONE>;
++		interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ 		reg = <0x66>;
+ 		samsung,s2mps11-wrstbi-ground;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-21413 b/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-21413
new file mode 100644
index 00000000000..293ce554c54
--- /dev/null
+++ b/queue-5.4/arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-21413
@@ -0,0 +1,38 @@
+From 72be67e02bfe1a92c06e31d9e144f6e4f4f029cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:02 +0100
+Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1fea2eb2f5bbd3fbbe2513d2386b5f6e6db17fd7 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU.  Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 9589f7721e16 ("arm64: dts: Add S2MPS15 PMIC node on exynos7-espresso")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-8-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+index 61ee7b6a31594..09aead2be000c 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+@@ -90,7 +90,7 @@
+ 	s2mps15_pmic@66 {
+ 		compatible = "samsung,s2mps15-pmic";
+ 		reg = <0x66>;
+-		interrupts = <2 IRQ_TYPE_NONE>;
++		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ 		interrupt-parent = <&gpa0>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pmic_irq>;
+-- 
+2.27.0
+
diff --git a/queue-5.4/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch b/queue-5.4/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch
new file mode 100644
index 00000000000..b3d8305a0ba
--- /dev/null
+++ b/queue-5.4/arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch
@@ -0,0 +1,46 @@
+From c4612fa28096653f1fcac8ea7443bd6a220de590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 11:44:16 +0100
+Subject: arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
+
+From: Vincent Knecht <vincent.knecht@mailoo.org>
+
+[ Upstream commit d5ae2528b0b56cf054b27d48b0cb85330900082f ]
+
+Fix `reserved` and `rfsa` unit address according to their reg address
+
+Fixes: 7258e10e6a0b ("ARM: dts: msm8916: Update reserved-memory")
+
+Signed-off-by: Vincent Knecht <vincent.knecht@mailoo.org>
+Link: https://lore.kernel.org/r/20210123104417.518105-1-vincent.knecht@mailoo.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index d95273af9f1e4..449843f2184d8 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -53,7 +53,7 @@
+ 			no-map;
+ 		};
+ 
+-		reserved@8668000 {
++		reserved@86680000 {
+ 			reg = <0x0 0x86680000 0x0 0x80000>;
+ 			no-map;
+ 		};
+@@ -66,7 +66,7 @@
+ 			qcom,client-id = <1>;
+ 		};
+ 
+-		rfsa@867e00000 {
++		rfsa@867e0000 {
+ 			reg = <0x0 0x867e0000 0x0 0x20000>;
+ 			no-map;
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.4/asoc-cpcap-fix-microphone-timeslot-mask.patch b/queue-5.4/asoc-cpcap-fix-microphone-timeslot-mask.patch
new file mode 100644
index 00000000000..1547dccb21d
--- /dev/null
+++ b/queue-5.4/asoc-cpcap-fix-microphone-timeslot-mask.patch
@@ -0,0 +1,65 @@
+From 9d2d02be320a894333f1e11573eadcc441c7ff6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 18:29:45 +0100
+Subject: ASoC: cpcap: fix microphone timeslot mask
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit de5bfae2fd962a9da99f56382305ec7966a604b9 ]
+
+The correct mask is 0x1f8 (Bit 3-8), but due to missing BIT() 0xf (Bit
+0-3) was set instead. This means setting of CPCAP_BIT_MIC1_RX_TIMESLOT0
+(Bit 3) still worked (part of both masks). On the other hand the code
+does not properly clear the other MIC timeslot bits. I think this
+is not a problem, since they are probably initialized to 0 and not
+touched by the driver anywhere else. But the mask also contains some
+wrong bits, that will be cleared. Bit 0 (CPCAP_BIT_SMB_CDC) should be
+safe, since the driver enforces it to be 0 anyways.
+
+Bit 1-2 are CPCAP_BIT_FS_INV and CPCAP_BIT_CLK_INV. This means enabling
+audio recording forces the codec into SND_SOC_DAIFMT_NB_NF mode, which
+is obviously bad.
+
+The bug probably remained undetected, because there are not many use
+cases for routing microphone to the CPU on platforms using cpcap and
+user base is small. I do remember having some issues with bad sound
+quality when testing voice recording back when I wrote the driver.
+It probably was this bug.
+
+Fixes: f6cdf2d3445d ("ASoC: cpcap: new codec")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210123172945.3958622-1-sre@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cpcap.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c
+index d7f05b384f1fb..1902689c5ea2c 100644
+--- a/sound/soc/codecs/cpcap.c
++++ b/sound/soc/codecs/cpcap.c
+@@ -1263,12 +1263,12 @@ static int cpcap_voice_hw_params(struct snd_pcm_substream *substream,
+ 
+ 	if (direction == SNDRV_PCM_STREAM_CAPTURE) {
+ 		mask = 0x0000;
+-		mask |= CPCAP_BIT_MIC1_RX_TIMESLOT0;
+-		mask |= CPCAP_BIT_MIC1_RX_TIMESLOT1;
+-		mask |= CPCAP_BIT_MIC1_RX_TIMESLOT2;
+-		mask |= CPCAP_BIT_MIC2_TIMESLOT0;
+-		mask |= CPCAP_BIT_MIC2_TIMESLOT1;
+-		mask |= CPCAP_BIT_MIC2_TIMESLOT2;
++		mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
++		mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT1);
++		mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT2);
++		mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT0);
++		mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT1);
++		mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT2);
+ 		val = 0x0000;
+ 		if (channels >= 2)
+ 			val = BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
+-- 
+2.27.0
+
diff --git a/queue-5.4/asoc-cs42l56-fix-up-error-handling-in-probe.patch b/queue-5.4/asoc-cs42l56-fix-up-error-handling-in-probe.patch
new file mode 100644
index 00000000000..18c14d84bf2
--- /dev/null
+++ b/queue-5.4/asoc-cs42l56-fix-up-error-handling-in-probe.patch
@@ -0,0 +1,46 @@
+From 244a129a0e637ee14aa565a5f63948c68d7e01c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 13:07:59 +0300
+Subject: ASoC: cs42l56: fix up error handling in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ]
+
+There are two issues with this code.  The first error path forgot to set
+the error code and instead returns success.  The second error path
+doesn't clean up.
+
+Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l56.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index ac569ab3d30f4..51d7a87ab4c3b 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -1248,6 +1248,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ 		dev_err(&i2c_client->dev,
+ 			"CS42L56 Device ID (%X). Expected %X\n",
+ 			devid, CS42L56_DEVID);
++		ret = -EINVAL;
+ 		goto err_enable;
+ 	}
+ 	alpha_rev = reg & CS42L56_AREV_MASK;
+@@ -1305,7 +1306,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ 	ret =  devm_snd_soc_register_component(&i2c_client->dev,
+ 			&soc_component_dev_cs42l56, &cs42l56_dai, 1);
+ 	if (ret < 0)
+-		return ret;
++		goto err_enable;
+ 
+ 	return 0;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/asoc-simple-card-utils-fix-device-module-clock.patch b/queue-5.4/asoc-simple-card-utils-fix-device-module-clock.patch
new file mode 100644
index 00000000000..7199128c0b6
--- /dev/null
+++ b/queue-5.4/asoc-simple-card-utils-fix-device-module-clock.patch
@@ -0,0 +1,57 @@
+From f71cd49824e302d7605641d52ad02f7812c4b527 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 12:13:39 +0530
+Subject: ASoC: simple-card-utils: Fix device module clock
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+[ Upstream commit 1e30f642cf2939bbdac82ea0dd3071232670b5ab ]
+
+If "clocks = <&xxx>" is specified from the CPU or Codec component
+device node, the clock is not getting enabled. Thus audio playback
+or capture fails.
+
+Fix this by populating "simple_dai->clk" field when clocks property
+is specified from device node as well. Also tidy up by re-organising
+conditional statements of parsing logic.
+
+Fixes: bb6fc620c2ed ("ASoC: simple-card-utils: add asoc_simple_card_parse_clk()")
+Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/1612939421-19900-2-git-send-email-spujar@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card-utils.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
+index 9b794775df537..edad6721251f4 100644
+--- a/sound/soc/generic/simple-card-utils.c
++++ b/sound/soc/generic/simple-card-utils.c
+@@ -172,16 +172,15 @@ int asoc_simple_parse_clk(struct device *dev,
+ 	 *  or device's module clock.
+ 	 */
+ 	clk = devm_get_clk_from_child(dev, node, NULL);
+-	if (!IS_ERR(clk)) {
+-		simple_dai->sysclk = clk_get_rate(clk);
++	if (IS_ERR(clk))
++		clk = devm_get_clk_from_child(dev, dlc->of_node, NULL);
+ 
++	if (!IS_ERR(clk)) {
+ 		simple_dai->clk = clk;
+-	} else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
++		simple_dai->sysclk = clk_get_rate(clk);
++	} else if (!of_property_read_u32(node, "system-clock-frequency",
++					 &val)) {
+ 		simple_dai->sysclk = val;
+-	} else {
+-		clk = devm_get_clk_from_child(dev, dlc->of_node, NULL);
+-		if (!IS_ERR(clk))
+-			simple_dai->sysclk = clk_get_rate(clk);
+ 	}
+ 
+ 	if (of_property_read_bool(node, "system-clock-direction-out"))
+-- 
+2.27.0
+
diff --git a/queue-5.4/asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch b/queue-5.4/asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch
new file mode 100644
index 00000000000..840f710e35d
--- /dev/null
+++ b/queue-5.4/asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch
@@ -0,0 +1,40 @@
+From 46b205eb527e7c46784b569433050b55f11d241e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 18:38:57 +0800
+Subject: ASoC: SOF: debug: Fix a potential issue on string buffer termination
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 9037c3bde65d339017ef41d81cb58069ffc321d4 ]
+
+The function simple_write_to_buffer() doesn't add string termination
+at the end of buf, we need to handle it on our own. This change refers
+to the function tokenize_input() in debug.c and the function
+sof_dfsentry_trace_filter_write() in trace.c.
+
+Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20210208103857.75705-1-hui.wang@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
+index 5529e8eeca462..08726034ff090 100644
+--- a/sound/soc/sof/debug.c
++++ b/sound/soc/sof/debug.c
+@@ -135,7 +135,7 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer,
+ 	char *string;
+ 	int ret;
+ 
+-	string = kzalloc(count, GFP_KERNEL);
++	string = kzalloc(count+1, GFP_KERNEL);
+ 	if (!string)
+ 		return -ENOMEM;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/ata-ahci_brcm-add-back-regulators-management.patch b/queue-5.4/ata-ahci_brcm-add-back-regulators-management.patch
new file mode 100644
index 00000000000..5c19e918e12
--- /dev/null
+++ b/queue-5.4/ata-ahci_brcm-add-back-regulators-management.patch
@@ -0,0 +1,79 @@
+From 97370f1478617be9adc629161c39bb8ccf443cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 10:28:45 -0800
+Subject: ata: ahci_brcm: Add back regulators management
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 10340f8d7b6dd54e616339c8ccb2f397133ebea0 ]
+
+While reworking the resources management and departing from using
+ahci_platform_enable_resources() which did not allow a proper step
+separation like we need, we unfortunately lost the ability to control
+AHCI regulators. This broke some Broadcom STB systems that do expect
+regulators to be turned on to link up with attached hard drives.
+
+Fixes: c0cdf2ac4b5b ("ata: ahci_brcm: Fix AHCI resources management")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_brcm.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c
+index 66a570d0da837..067b55cc157ef 100644
+--- a/drivers/ata/ahci_brcm.c
++++ b/drivers/ata/ahci_brcm.c
+@@ -361,6 +361,10 @@ static int brcm_ahci_resume(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = ahci_platform_enable_regulators(hpriv);
++	if (ret)
++		goto out_disable_clks;
++
+ 	brcm_sata_init(priv);
+ 	brcm_sata_phys_enable(priv);
+ 	brcm_sata_alpm_init(hpriv);
+@@ -390,6 +394,8 @@ out_disable_platform_phys:
+ 	ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ 	brcm_sata_phys_disable(priv);
++	ahci_platform_disable_regulators(hpriv);
++out_disable_clks:
+ 	ahci_platform_disable_clks(hpriv);
+ 	return ret;
+ }
+@@ -463,6 +469,10 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		goto out_reset;
+ 
++	ret = ahci_platform_enable_regulators(hpriv);
++	if (ret)
++		goto out_disable_clks;
++
+ 	/* Must be first so as to configure endianness including that
+ 	 * of the standard AHCI register space.
+ 	 */
+@@ -472,7 +482,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ 	priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
+ 	if (!priv->port_mask) {
+ 		ret = -ENODEV;
+-		goto out_disable_clks;
++		goto out_disable_regulators;
+ 	}
+ 
+ 	/* Must be done before ahci_platform_enable_phys() */
+@@ -497,6 +507,8 @@ out_disable_platform_phys:
+ 	ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ 	brcm_sata_phys_disable(priv);
++out_disable_regulators:
++	ahci_platform_disable_regulators(hpriv);
+ out_disable_clks:
+ 	ahci_platform_disable_clks(hpriv);
+ out_reset:
+-- 
+2.27.0
+
diff --git a/queue-5.4/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch b/queue-5.4/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch
new file mode 100644
index 00000000000..349849d492b
--- /dev/null
+++ b/queue-5.4/ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch
@@ -0,0 +1,50 @@
+From 44bd659dc6c5c34c481dee4b3f4bbd67c0ee2816 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 00:30:10 +0530
+Subject: ath10k: Fix error handling in case of CE pipe init failure
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 31561e8557cd1eeba5806ac9ce820f8323b2201b ]
+
+Currently if the copy engine pipe init fails for snoc based
+chipsets, the rri is not freed.
+
+Fix this error handling for copy engine pipe init
+failure.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1
+
+Fixes: 4945af5b264f ("ath10k: enable SRRI/DRRI support on ddr for WCN3990")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1607713210-18320-1-git-send-email-pillair@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/snoc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index 63607c3b8e818..d4589b2ab3b6d 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1039,12 +1039,13 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar,
+ 	ret = ath10k_snoc_init_pipes(ar);
+ 	if (ret) {
+ 		ath10k_err(ar, "failed to initialize CE: %d\n", ret);
+-		goto err_wlan_enable;
++		goto err_free_rri;
+ 	}
+ 
+ 	return 0;
+ 
+-err_wlan_enable:
++err_free_rri:
++	ath10k_ce_free_rri(ar);
+ 	ath10k_snoc_wlan_disable(ar);
+ 
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch b/queue-5.4/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch
new file mode 100644
index 00000000000..dba15dc7b88
--- /dev/null
+++ b/queue-5.4/ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch
@@ -0,0 +1,96 @@
+From 95c8898548207138749972c50e6c3adf9f5f7742 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 09:53:44 +0200
+Subject: ath9k: fix data bus crash when setting nf_override via debugfs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Lüssing <ll@simonwunderlich.de>
+
+[ Upstream commit 12c8f3d1cdd84f01ee777b756db9dddc1f1c9d17 ]
+
+When trying to set the noise floor via debugfs, a "data bus error"
+crash like the following can happen:
+
+[   88.433133] Data bus error, epc == 80221c28, ra == 83314e60
+[   88.438895] Oops[#1]:
+[   88.441246] CPU: 0 PID: 7263 Comm: sh Not tainted 4.14.195 #0
+[   88.447174] task: 838a1c20 task.stack: 82d5e000
+[   88.451847] $ 0   : 00000000 00000030 deadc0de 83141de4
+[   88.457248] $ 4   : b810a2c4 0000a2c4 83230fd4 00000000
+[   88.462652] $ 8   : 0000000a 00000000 00000001 00000000
+[   88.468055] $12   : 7f8ef318 00000000 00000000 77f802a0
+[   88.473457] $16   : 83230080 00000002 0000001b 83230080
+[   88.478861] $20   : 83a1c3f8 00841000 77f7adb0 ffffff92
+[   88.484263] $24   : 00000fa4 77edd860
+[   88.489665] $28   : 82d5e000 82d5fda8 00000000 83314e60
+[   88.495070] Hi    : 00000000
+[   88.498044] Lo    : 00000000
+[   88.501040] epc   : 80221c28 ioread32+0x8/0x10
+[   88.505671] ra    : 83314e60 ath9k_hw_loadnf+0x88/0x520 [ath9k_hw]
+[   88.512049] Status: 1000fc03 KERNEL EXL IE
+[   88.516369] Cause : 5080801c (ExcCode 07)
+[   88.520508] PrId  : 00019374 (MIPS 24Kc)
+[   88.524556] Modules linked in: ath9k ath9k_common pppoe ppp_async l2tp_ppp cdc_mbim batman_adv ath9k_hw ath sr9700 smsc95xx sierra_net rndis_host qmi_wwan pppox ppp_generic pl2303 nf_conntrack_ipv6 mcs7830 mac80211 kalmia iptable_nat ipt_REJECT ipt_MASQUERADE huawei_cdc_ncm ftdi_sio dm9601 cfg80211 cdc_subset cdc_ncm cdc_ether cdc_eem ax88179_178a asix xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_NETMAP xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CLASSIFY usbserial usbnet usbhid slhc rtl8150 r8152 pegasus nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack
+[   88.597894]  libcrc32c kaweth iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hso hid_generic crc_ccitt compat cdc_wdm cdc_acm br_netfilter hid evdev input_core nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_beet ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel xfrm4_mode_tunnel xfrm4_mode_transport xfrm4_mode_beet ipcomp esp4 ah4 tunnel6 tunnel4 tun xfrm_user xfrm_ipcomp af_key xfrm_algo sha256_generic sha1_generic jitterentropy_rng drbg md5 hmac echainiv des_generic deflate zlib_inflate zlib_deflate cbc authenc crypto_acompress ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic
+[   88.671671]  crypto_hash
+[   88.674292] Process sh (pid: 7263, threadinfo=82d5e000, task=838a1c20, tls=77f81efc)
+[   88.682279] Stack : 00008060 00000008 00000200 00000000 00000000 00000000 00000000 00000002
+[   88.690916]         80500000 83230080 82d5fe22 00841000 77f7adb0 00000000 00000000 83156858
+[   88.699553]         00000000 8352fa00 83ad62b0 835302a8 00000000 300a00f8 00000003 82d5fe38
+[   88.708190]         82d5fef4 00000001 77f54dc4 77f80000 77f7adb0 c79fe901 00000000 00000000
+[   88.716828]         80510000 00000002 00841000 77f54dc4 77f80000 801ce4cc 0000000b 41824292
+[   88.725465]         ...
+[   88.727994] Call Trace:
+[   88.730532] [<80221c28>] ioread32+0x8/0x10
+[   88.734765] Code: 00000000  8c820000  0000000f <03e00008> 00000000  08088708  00000000  aca40000  03e00008
+[   88.744846]
+[   88.746464] ---[ end trace db226b2de1b69b9e ]---
+[   88.753477] Kernel panic - not syncing: Fatal exception
+[   88.759981] Rebooting in 3 seconds..
+
+The "REG_READ(ah, AR_PHY_AGC_CONTROL)" in ath9k_hw_loadnf() does not
+like being called when the hardware is asleep, leading to this crash.
+
+The easiest way to reproduce this is trying to set nf_override while
+the hardware is down:
+
+  $ ip link set down dev wlan0
+  $ echo "-85" > /sys/kernel/debug/ieee80211/phy0/ath9k/nf_override
+
+Fixing this crash by waking the hardware up before trying to set the
+noise floor. Similar to what other ath9k debugfs files do.
+
+Tested on a Lima board from 8devices, which has a QCA 4531 chipset.
+
+Fixes: b90189759a7f ("ath9k: add noise floor override option")
+Cc: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210209184352.4272-1-linus.luessing@c0d3.blue
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/debug.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index 26ea51a721564..859a865c59950 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -1223,8 +1223,11 @@ static ssize_t write_file_nf_override(struct file *file,
+ 
+ 	ah->nf_override = val;
+ 
+-	if (ah->curchan)
++	if (ah->curchan) {
++		ath9k_ps_wakeup(sc);
+ 		ath9k_hw_loadnf(ah, ah->curchan);
++		ath9k_ps_restore(sc);
++	}
+ 
+ 	return count;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/auxdisplay-ht16k33-fix-refresh-rate-handling.patch b/queue-5.4/auxdisplay-ht16k33-fix-refresh-rate-handling.patch
new file mode 100644
index 00000000000..867a29e07e8
--- /dev/null
+++ b/queue-5.4/auxdisplay-ht16k33-fix-refresh-rate-handling.patch
@@ -0,0 +1,37 @@
+From e2f6fb5006d6ae8f0bf9e1cabde9e17a5248ad36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 16:39:40 +0100
+Subject: auxdisplay: ht16k33: Fix refresh rate handling
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit e89b0a426721a8ca5971bc8d70aa5ea35c020f90 ]
+
+Drop the call to msecs_to_jiffies(), as "HZ / fbdev->refresh_rate" is
+already the number of jiffies to wait.
+
+Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/ht16k33.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index a2fcde582e2a1..33b887b389061 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -117,8 +117,7 @@ static void ht16k33_fb_queue(struct ht16k33_priv *priv)
+ {
+ 	struct ht16k33_fbdev *fbdev = &priv->fbdev;
+ 
+-	schedule_delayed_work(&fbdev->work,
+-			      msecs_to_jiffies(HZ / fbdev->refresh_rate));
++	schedule_delayed_work(&fbdev->work, HZ / fbdev->refresh_rate);
+ }
+ 
+ /*
+-- 
+2.27.0
+
diff --git a/queue-5.4/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch b/queue-5.4/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch
new file mode 100644
index 00000000000..95ada9befbd
--- /dev/null
+++ b/queue-5.4/b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch
@@ -0,0 +1,50 @@
+From fd205547ff461f73a317bf204da438a938df6e23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 12:05:32 +0000
+Subject: b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ]
+
+The documentation for the PHY update [1] states:
+
+Loop 4 times with index i
+
+    If PHY Revision >= 3
+        Copy table[i] to coef[i]
+    Otherwise
+        Set coef[i] to 0
+
+the copy of the table to coef is currently implemented the wrong way
+around, table is being updated from uninitialized values in coeff.
+Fix this by swapping the assignment around.
+
+[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/
+
+Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration")
+Addresses-Coverity: ("Uninitialized scalar variable")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
+index d3c001fa8eb46..32ce1b42ce08b 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_n.c
++++ b/drivers/net/wireless/broadcom/b43/phy_n.c
+@@ -5308,7 +5308,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
+ 
+ 	for (i = 0; i < 4; i++) {
+ 		if (dev->phy.rev >= 3)
+-			table[i] = coef[i];
++			coef[i] = table[i];
+ 		else
+ 			coef[i] = 0;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch b/queue-5.4/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch
new file mode 100644
index 00000000000..2c3f535ae93
--- /dev/null
+++ b/queue-5.4/bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch
@@ -0,0 +1,78 @@
+From e63558b455f56bd09bb3d4e13f170e2d0ec0303f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 10:46:58 +0100
+Subject: Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in
+ the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9a39a927be01d89e53f04304ab99a8761e08910d ]
+
+Some resource should be released in the error handling path of the probe
+function, as already done in the remove function.
+
+The remove function was fixed in commit 5052de8deff5 ("soc: qcom: smd:
+Transition client drivers from smd to rpmsg")
+
+Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btqcomsmd.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index 98d53764871f5..2acb719e596f5 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -142,12 +142,16 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ 
+ 	btq->cmd_channel = qcom_wcnss_open_channel(wcnss, "APPS_RIVA_BT_CMD",
+ 						   btqcomsmd_cmd_callback, btq);
+-	if (IS_ERR(btq->cmd_channel))
+-		return PTR_ERR(btq->cmd_channel);
++	if (IS_ERR(btq->cmd_channel)) {
++		ret = PTR_ERR(btq->cmd_channel);
++		goto destroy_acl_channel;
++	}
+ 
+ 	hdev = hci_alloc_dev();
+-	if (!hdev)
+-		return -ENOMEM;
++	if (!hdev) {
++		ret = -ENOMEM;
++		goto destroy_cmd_channel;
++	}
+ 
+ 	hci_set_drvdata(hdev, btq);
+ 	btq->hdev = hdev;
+@@ -161,14 +165,21 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ 	hdev->set_bdaddr = qca_set_bdaddr_rome;
+ 
+ 	ret = hci_register_dev(hdev);
+-	if (ret < 0) {
+-		hci_free_dev(hdev);
+-		return ret;
+-	}
++	if (ret < 0)
++		goto hci_free_dev;
+ 
+ 	platform_set_drvdata(pdev, btq);
+ 
+ 	return 0;
++
++hci_free_dev:
++	hci_free_dev(hdev);
++destroy_cmd_channel:
++	rpmsg_destroy_ept(btq->cmd_channel);
++destroy_acl_channel:
++	rpmsg_destroy_ept(btq->acl_channel);
++
++	return ret;
+ }
+ 
+ static int btqcomsmd_remove(struct platform_device *pdev)
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch b/queue-5.4/bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch
new file mode 100644
index 00000000000..38057f494a4
--- /dev/null
+++ b/queue-5.4/bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch
@@ -0,0 +1,78 @@
+From 352657aa00e477219187ff2511ace551cb6b238b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 09:39:13 +0800
+Subject: Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jupeng Zhong <zhongjupeng@yulong.com>
+
+[ Upstream commit de71a6cb4bf24d8993b9ca90d1ddb131b60251a1 ]
+
+In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should be
+released.
+
+Omit the labels “err_out” and “err_free_skb” in this function
+implementation so that the desired exception handling code
+would be directly specified in the affected if branches.
+
+Fixes: a1c49c434e15 ("btusb: Add protocol support for MediaTek MT7668U USB devices")
+Signed-off-by: Jupeng Zhong <zhongjupeng@yulong.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b92bd97b1c399..b467fd05c5e82 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2568,7 +2568,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ 		skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
+ 		if (!skb) {
+ 			hdev->stat.err_rx++;
+-			goto err_out;
++			return;
+ 		}
+ 
+ 		hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
+@@ -2586,13 +2586,18 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ 		 */
+ 		if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
+ 			data->evt_skb = skb_clone(skb, GFP_ATOMIC);
+-			if (!data->evt_skb)
+-				goto err_out;
++			if (!data->evt_skb) {
++				kfree_skb(skb);
++				return;
++			}
+ 		}
+ 
+ 		err = hci_recv_frame(hdev, skb);
+-		if (err < 0)
+-			goto err_free_skb;
++		if (err < 0) {
++			kfree_skb(data->evt_skb);
++			data->evt_skb = NULL;
++			return;
++		}
+ 
+ 		if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
+ 				       &data->flags)) {
+@@ -2601,11 +2606,6 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ 			wake_up_bit(&data->flags,
+ 				    BTUSB_TX_WAIT_VND_EVT);
+ 		}
+-err_out:
+-		return;
+-err_free_skb:
+-		kfree_skb(data->evt_skb);
+-		data->evt_skb = NULL;
+ 		return;
+ 	} else if (urb->status == -ENOENT) {
+ 		/* Avoid suspend failed when usb_kill_urb */
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-drop-hci-device-reference-before-return.patch b/queue-5.4/bluetooth-drop-hci-device-reference-before-return.patch
new file mode 100644
index 00000000000..c8c1dc323b7
--- /dev/null
+++ b/queue-5.4/bluetooth-drop-hci-device-reference-before-return.patch
@@ -0,0 +1,35 @@
+From df06514aaf4b8e608314036fb2a0027373fdd9f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 23:34:19 -0800
+Subject: Bluetooth: drop HCI device reference before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ]
+
+Call hci_dev_put() to decrement reference count of HCI device hdev if
+fails to duplicate memory.
+
+Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/a2mp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index cc26e4c047ad0..463bad58478b2 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -512,6 +512,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ 		assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
+ 		if (!assoc) {
+ 			amp_ctrl_put(ctrl);
++			hci_dev_put(hdev);
+ 			return -ENOMEM;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-fix-initializing-response-id-after-clearin.patch b/queue-5.4/bluetooth-fix-initializing-response-id-after-clearin.patch
new file mode 100644
index 00000000000..0df95c7be09
--- /dev/null
+++ b/queue-5.4/bluetooth-fix-initializing-response-id-after-clearin.patch
@@ -0,0 +1,39 @@
+From 8edc5c6ac2bfbc74fca4a933703ff3eca213c5c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 19:12:32 -0800
+Subject: Bluetooth: Fix initializing response id after clearing struct
+
+From: Christopher William Snowhill <chris@kode54.net>
+
+[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ]
+
+Looks like this was missed when patching the source to clear the structures
+throughout, causing this one instance to clear the struct after the response
+id is assigned.
+
+Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members")
+Signed-off-by: Christopher William Snowhill <chris@kode54.net>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/a2mp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index da7fd7c8c2dc0..cc26e4c047ad0 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -381,9 +381,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ 	hdev = hci_dev_get(req->id);
+ 	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
+ 		struct a2mp_amp_assoc_rsp rsp;
+-		rsp.id = req->id;
+ 
+ 		memset(&rsp, 0, sizeof(rsp));
++		rsp.id = req->id;
+ 
+ 		if (tmp) {
+ 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch b/queue-5.4/bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
new file mode 100644
index 00000000000..76ec5d9e9b9
--- /dev/null
+++ b/queue-5.4/bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
@@ -0,0 +1,82 @@
+From 18be0b28464f4fed8f96c7c53c85865567cd0d16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 15:29:21 +0800
+Subject: Bluetooth: hci_uart: Fix a race for write_work scheduling
+
+From: Claire Chang <tientzu@chromium.org>
+
+[ Upstream commit afe0b1c86458f121b085271e4f3034017a90d4a3 ]
+
+In hci_uart_write_work, there is a loop/goto checking the value of
+HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
+hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.
+
+In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
+HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
+hci_uart_write_work worker will do hci_uart_dequeue properly.
+
+However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
+the loop breaks, but before HCI_UART_SENDING is cleared in
+hci_uart_write_work, the schedule_work is skipped incorrectly.
+
+Fix this race by changing the order of HCI_UART_SENDING and
+HCI_UART_TX_WAKEUP modification.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Fixes: 82f5169bf3d3 ("Bluetooth: hci_uart: add serdev driver support library")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_ldisc.c  | 7 +++----
+ drivers/bluetooth/hci_serdev.c | 4 ++--
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index f83d67eafc9f0..8be4d807d1370 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -127,10 +127,9 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
+ 	if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
+ 		goto no_schedule;
+ 
+-	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
+-		set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
++	set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
++	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state))
+ 		goto no_schedule;
+-	}
+ 
+ 	BT_DBG("");
+ 
+@@ -174,10 +173,10 @@ restart:
+ 		kfree_skb(skb);
+ 	}
+ 
++	clear_bit(HCI_UART_SENDING, &hu->tx_state);
+ 	if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
+ 		goto restart;
+ 
+-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
+ 	wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
+ }
+ 
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 5b9aa73ff2b7f..1b4ad231e6ed3 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -85,9 +85,9 @@ static void hci_uart_write_work(struct work_struct *work)
+ 			hci_uart_tx_complete(hu, hci_skb_pkt_type(skb));
+ 			kfree_skb(skb);
+ 		}
+-	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
+ 
+-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
++		clear_bit(HCI_UART_SENDING, &hu->tx_state);
++	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
+ }
+ 
+ /* ------- Interface to HCI layer ------ */
+-- 
+2.27.0
+
diff --git a/queue-5.4/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch b/queue-5.4/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch
new file mode 100644
index 00000000000..d67d31dd7af
--- /dev/null
+++ b/queue-5.4/bluetooth-put-hci-device-if-inquiry-procedure-interr.patch
@@ -0,0 +1,40 @@
+From 85493cf73a0815cd274d540b6415a02901fe0ce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 00:10:45 -0800
+Subject: Bluetooth: Put HCI device if inquiry procedure interrupts
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ]
+
+Jump to the label done to decrement the reference count of HCI device
+hdev on path that the Inquiry procedure is interrupted.
+
+Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 9e19d5a3aac87..83b324419ad3d 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1317,8 +1317,10 @@ int hci_inquiry(void __user *arg)
+ 		 * cleared). If it is interrupted by a signal, return -EINTR.
+ 		 */
+ 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
+-				TASK_INTERRUPTIBLE))
+-			return -EINTR;
++				TASK_INTERRUPTIBLE)) {
++			err = -EINTR;
++			goto done;
++		}
+ 	}
+ 
+ 	/* for unlimited number of responses we will use buffer with
+-- 
+2.27.0
+
diff --git a/queue-5.4/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch b/queue-5.4/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch
new file mode 100644
index 00000000000..6deaf809759
--- /dev/null
+++ b/queue-5.4/bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch
@@ -0,0 +1,42 @@
+From 34fc83fa8acb5263e4736bc7e597a1009a9c7e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 02:24:23 -0500
+Subject: bnxt_en: reverse order of TX disable and carrier off
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ]
+
+A TX queue can potentially immediately timeout after it is stopped
+and the last TX timestamp on that queue was more than 5 seconds ago with
+carrier still up.  Prevent these intermittent false TX timeouts
+by bringing down carrier first before calling netif_tx_disable().
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 7c8187d386756..4ae49d92c1eed 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8347,9 +8347,10 @@ void bnxt_tx_disable(struct bnxt *bp)
+ 			txr->dev_state = BNXT_DEV_STATE_CLOSING;
+ 		}
+ 	}
++	/* Drop carrier first to prevent TX timeout */
++	netif_carrier_off(bp->dev);
+ 	/* Stop all TX queues */
+ 	netif_tx_disable(bp->dev);
+-	netif_carrier_off(bp->dev);
+ }
+ 
+ void bnxt_tx_enable(struct bnxt *bp)
+-- 
+2.27.0
+
diff --git a/queue-5.4/bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch b/queue-5.4/bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch
new file mode 100644
index 00000000000..34ee464b88b
--- /dev/null
+++ b/queue-5.4/bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch
@@ -0,0 +1,42 @@
+From f935cad3ca5b0b05a32561cf3c10bd685682ca31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:14 -0800
+Subject: bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit a643bff752dcf72a07e1b2ab2f8587e4f51118be ]
+
+Add bpf_patch_call_args() prototype. This function is called from BPF verifier
+and only if CONFIG_BPF_JIT_ALWAYS_ON is not defined. This fixes compiler
+warning about missing prototype in some kernel configurations.
+
+Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 7aa0d8b5aaf0c..007147f643908 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -711,7 +711,10 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
+ /* verify correctness of eBPF program */
+ int bpf_check(struct bpf_prog **fp, union bpf_attr *attr,
+ 	      union bpf_attr __user *uattr);
++
++#ifndef CONFIG_BPF_JIT_ALWAYS_ON
+ void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
++#endif
+ 
+ /* Map specifics */
+ struct xdp_buff;
+-- 
+2.27.0
+
diff --git a/queue-5.4/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch b/queue-5.4/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch
new file mode 100644
index 00000000000..3ad5f0ef910
--- /dev/null
+++ b/queue-5.4/bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch
@@ -0,0 +1,41 @@
+From d3f7149f3e33224dec428be0c69c7a10dfd81f89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:15 -0800
+Subject: bpf: Avoid warning when re-casting __bpf_call_base into
+ __bpf_call_base_args
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 6943c2b05bf09fd5c5729f7d7d803bf3f126cb9a ]
+
+BPF interpreter uses extra input argument, so re-casts __bpf_call_base into
+__bpf_call_base_args. Avoid compiler warning about incompatible function
+prototypes by casting to void * first.
+
+Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-3-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 79830bc9e45cf..c53e2fe3c8f7f 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -846,7 +846,7 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);
+ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
+ #define __bpf_call_base_args \
+ 	((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \
+-	 __bpf_call_base)
++	 (void *)__bpf_call_base)
+ 
+ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog);
+ void bpf_jit_compile(struct bpf_prog *prog);
+-- 
+2.27.0
+
diff --git a/queue-5.4/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch b/queue-5.4/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch
new file mode 100644
index 00000000000..43ff259c390
--- /dev/null
+++ b/queue-5.4/bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch
@@ -0,0 +1,86 @@
+From d08c1f1b25b4265072c2616a28211481416770a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 14:38:14 +0100
+Subject: bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 2c0a10af688c02adcf127aad29e923e0056c6b69 ]
+
+BPF end-user on Cilium slack-channel (Carlo Carraro) wants to use
+bpf_fib_lookup for doing MTU-check, but *prior* to extending packet size,
+by adjusting fib_params 'tot_len' with the packet length plus the expected
+encap size. (Just like the bpf_check_mtu helper supports). He discovered
+that for SKB ctx the param->tot_len was not used, instead skb->len was used
+(via MTU check in is_skb_forwardable() that checks against netdev MTU).
+
+Fix this by using fib_params 'tot_len' for MTU check. If not provided (e.g.
+zero) then keep existing TC behaviour intact. Notice that 'tot_len' for MTU
+check is done like XDP code-path, which checks against FIB-dst MTU.
+
+V16:
+- Revert V13 optimization, 2nd lookup is against egress/resulting netdev
+
+V13:
+- Only do ifindex lookup one time, calling dev_get_by_index_rcu().
+
+V10:
+- Use same method as XDP for 'tot_len' MTU check
+
+Fixes: 4c79579b44b1 ("bpf: Change bpf_fib_lookup to return lookup status")
+Reported-by: Carlo Carraro <colrack@gmail.com>
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/161287789444.790810.15247494756551413508.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 2fa10fdcf6b1d..524f3364f8a05 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4880,6 +4880,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ {
+ 	struct net *net = dev_net(skb->dev);
+ 	int rc = -EAFNOSUPPORT;
++	bool check_mtu = false;
+ 
+ 	if (plen < sizeof(*params))
+ 		return -EINVAL;
+@@ -4887,22 +4888,28 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ 	if (flags & ~(BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT))
+ 		return -EINVAL;
+ 
++	if (params->tot_len)
++		check_mtu = true;
++
+ 	switch (params->family) {
+ #if IS_ENABLED(CONFIG_INET)
+ 	case AF_INET:
+-		rc = bpf_ipv4_fib_lookup(net, params, flags, false);
++		rc = bpf_ipv4_fib_lookup(net, params, flags, check_mtu);
+ 		break;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	case AF_INET6:
+-		rc = bpf_ipv6_fib_lookup(net, params, flags, false);
++		rc = bpf_ipv6_fib_lookup(net, params, flags, check_mtu);
+ 		break;
+ #endif
+ 	}
+ 
+-	if (!rc) {
++	if (rc == BPF_FIB_LKUP_RET_SUCCESS && !check_mtu) {
+ 		struct net_device *dev;
+ 
++		/* When tot_len isn't provided by user, check skb
++		 * against MTU of FIB lookup resulting net_device
++		 */
+ 		dev = dev_get_by_index_rcu(net, params->ifindex);
+ 		if (!is_skb_forwardable(dev, skb))
+ 			rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
+-- 
+2.27.0
+
diff --git a/queue-5.4/bpf_lru_list-read-double-checked-variable-once-witho.patch b/queue-5.4/bpf_lru_list-read-double-checked-variable-once-witho.patch
new file mode 100644
index 00000000000..767e4ff2b7c
--- /dev/null
+++ b/queue-5.4/bpf_lru_list-read-double-checked-variable-once-witho.patch
@@ -0,0 +1,65 @@
+From 4458d878659efb4360f88e7bcd8ca5bd7bc1a0b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 12:27:01 +0100
+Subject: bpf_lru_list: Read double-checked variable once without lock
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 6df8fb83301d68ea0a0c0e1cbcc790fcc333ed12 ]
+
+For double-checked locking in bpf_common_lru_push_free(), node->type is
+read outside the critical section and then re-checked under the lock.
+However, concurrent writes to node->type result in data races.
+
+For example, the following concurrent access was observed by KCSAN:
+
+  write to 0xffff88801521bc22 of 1 bytes by task 10038 on cpu 1:
+   __bpf_lru_node_move_in        kernel/bpf/bpf_lru_list.c:91
+   __local_list_flush            kernel/bpf/bpf_lru_list.c:298
+   ...
+  read to 0xffff88801521bc22 of 1 bytes by task 10043 on cpu 0:
+   bpf_common_lru_push_free      kernel/bpf/bpf_lru_list.c:507
+   bpf_lru_push_free             kernel/bpf/bpf_lru_list.c:555
+   ...
+
+Fix the data races where node->type is read outside the critical section
+(for double-checked locking) by marking the access with READ_ONCE() as
+well as ensuring the variable is only accessed once.
+
+Fixes: 3a08c2fd7634 ("bpf: LRU List")
+Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
+Reported-by: syzbot+516acdb03d3e27d91bcd@syzkaller.appspotmail.com
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20210209112701.3341724-1-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/bpf_lru_list.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
+index 1b6b9349cb857..d99e89f113c43 100644
+--- a/kernel/bpf/bpf_lru_list.c
++++ b/kernel/bpf/bpf_lru_list.c
+@@ -502,13 +502,14 @@ struct bpf_lru_node *bpf_lru_pop_free(struct bpf_lru *lru, u32 hash)
+ static void bpf_common_lru_push_free(struct bpf_lru *lru,
+ 				     struct bpf_lru_node *node)
+ {
++	u8 node_type = READ_ONCE(node->type);
+ 	unsigned long flags;
+ 
+-	if (WARN_ON_ONCE(node->type == BPF_LRU_LIST_T_FREE) ||
+-	    WARN_ON_ONCE(node->type == BPF_LRU_LOCAL_LIST_T_FREE))
++	if (WARN_ON_ONCE(node_type == BPF_LRU_LIST_T_FREE) ||
++	    WARN_ON_ONCE(node_type == BPF_LRU_LOCAL_LIST_T_FREE))
+ 		return;
+ 
+-	if (node->type == BPF_LRU_LOCAL_LIST_T_PENDING) {
++	if (node_type == BPF_LRU_LOCAL_LIST_T_PENDING) {
+ 		struct bpf_lru_locallist *loc_l;
+ 
+ 		loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu);
+-- 
+2.27.0
+
diff --git a/queue-5.4/bsg-free-the-request-before-return-error-code.patch b/queue-5.4/bsg-free-the-request-before-return-error-code.patch
new file mode 100644
index 00000000000..b49d2d5490f
--- /dev/null
+++ b/queue-5.4/bsg-free-the-request-before-return-error-code.patch
@@ -0,0 +1,39 @@
+From 4309d13d086306629d3f655c4a20bfd30a9540fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 04:33:11 -0800
+Subject: bsg: free the request before return error code
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 0f7b4bc6bb1e57c48ef14f1818df947c1612b206 ]
+
+Free the request rq before returning error code.
+
+Fixes: 972248e9111e ("scsi: bsg-lib: handle bidi requests without block layer help")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bsg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/bsg.c b/block/bsg.c
+index 833c44b3d458e..0d012efef5274 100644
+--- a/block/bsg.c
++++ b/block/bsg.c
+@@ -157,8 +157,10 @@ static int bsg_sg_io(struct request_queue *q, fmode_t mode, void __user *uarg)
+ 		return PTR_ERR(rq);
+ 
+ 	ret = q->bsg_dev.ops->fill_hdr(rq, &hdr, mode);
+-	if (ret)
++	if (ret) {
++		blk_put_request(rq);
+ 		return ret;
++	}
+ 
+ 	rq->timeout = msecs_to_jiffies(hdr.timeout);
+ 	if (!rq->timeout)
+-- 
+2.27.0
+
diff --git a/queue-5.4/btrfs-clarify-error-returns-values-in-__load_free_sp.patch b/queue-5.4/btrfs-clarify-error-returns-values-in-__load_free_sp.patch
new file mode 100644
index 00000000000..daad0091452
--- /dev/null
+++ b/queue-5.4/btrfs-clarify-error-returns-values-in-__load_free_sp.patch
@@ -0,0 +1,60 @@
+From d1711e861da4d2b1133610e116e7bf2165d792fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:08:04 +0800
+Subject: btrfs: clarify error returns values in __load_free_space_cache
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 3cc64e7ebfb0d7faaba2438334c43466955a96e8 ]
+
+Return value in __load_free_space_cache is not properly set after
+(unlikely) memory allocation failures and 0 is returned instead.
+This is not a problem for the caller load_free_space_cache because only
+value 1 is considered as 'cache loaded' but for clarity it's better
+to set the errors accordingly.
+
+Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/free-space-cache.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 6e6be922b937d..23f59d463e24e 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -744,8 +744,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ 	while (num_entries) {
+ 		e = kmem_cache_zalloc(btrfs_free_space_cachep,
+ 				      GFP_NOFS);
+-		if (!e)
++		if (!e) {
++			ret = -ENOMEM;
+ 			goto free_cache;
++		}
+ 
+ 		ret = io_ctl_read_entry(&io_ctl, e, &type);
+ 		if (ret) {
+@@ -754,6 +756,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ 		}
+ 
+ 		if (!e->bytes) {
++			ret = -1;
+ 			kmem_cache_free(btrfs_free_space_cachep, e);
+ 			goto free_cache;
+ 		}
+@@ -774,6 +777,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ 			e->bitmap = kmem_cache_zalloc(
+ 					btrfs_free_space_bitmap_cachep, GFP_NOFS);
+ 			if (!e->bitmap) {
++				ret = -ENOMEM;
+ 				kmem_cache_free(
+ 					btrfs_free_space_cachep, e);
+ 				goto free_cache;
+-- 
+2.27.0
+
diff --git a/queue-5.4/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch b/queue-5.4/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch
new file mode 100644
index 00000000000..21bf8d8717e
--- /dev/null
+++ b/queue-5.4/capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch
@@ -0,0 +1,62 @@
+From 1a140830157b4e80fa362267862cc1beee888bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 09:42:00 -0600
+Subject: capabilities: Don't allow writing ambiguous v3 file capabilities
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 95ebabde382c371572297915b104e55403674e73 ]
+
+The v3 file capabilities have a uid field that records the filesystem
+uid of the root user of the user namespace the file capabilities are
+valid in.
+
+When someone is silly enough to have the same underlying uid as the
+root uid of multiple nested containers a v3 filesystem capability can
+be ambiguous.
+
+In the spirit of don't do that then, forbid writing a v3 filesystem
+capability if it is ambiguous.
+
+Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
+Reviewed-by: Andrew G. Morgan <morgan@kernel.org>
+Reviewed-by: Serge Hallyn <serge@hallyn.com>
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 28a6939bcc4e5..ed89a6dd4f83d 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -500,7 +500,8 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ 	__u32 magic, nsmagic;
+ 	struct inode *inode = d_backing_inode(dentry);
+ 	struct user_namespace *task_ns = current_user_ns(),
+-		*fs_ns = inode->i_sb->s_user_ns;
++		*fs_ns = inode->i_sb->s_user_ns,
++		*ancestor;
+ 	kuid_t rootid;
+ 	size_t newsize;
+ 
+@@ -523,6 +524,15 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ 	if (nsrootid == -1)
+ 		return -EINVAL;
+ 
++	/*
++	 * Do not allow allow adding a v3 filesystem capability xattr
++	 * if the rootid field is ambiguous.
++	 */
++	for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
++		if (from_kuid(ancestor, rootid) == 0)
++			return -EINVAL;
++	}
++
+ 	newsize = sizeof(struct vfs_ns_cap_data);
+ 	nscap = kmalloc(newsize, GFP_ATOMIC);
+ 	if (!nscap)
+-- 
+2.27.0
+
diff --git a/queue-5.4/certs-fix-blacklist-flag-type-confusion.patch b/queue-5.4/certs-fix-blacklist-flag-type-confusion.patch
new file mode 100644
index 00000000000..8ead9b4357e
--- /dev/null
+++ b/queue-5.4/certs-fix-blacklist-flag-type-confusion.patch
@@ -0,0 +1,107 @@
+From ea12f4f496d90d710b95356fb82e265cfda48482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 19:04:23 +0100
+Subject: certs: Fix blacklist flag type confusion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4993e1f9479a4161fd7d93e2b8b30b438f00cb0f ]
+
+KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(),
+as these only take KEY_ALLOC_* flags.  KEY_FLAG_KEEP has the same value as
+KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update()
+uses it.  LSMs using the key_alloc hook don't check that flag.
+
+KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot
+write to the blacklist keyring, so it is not possible to remove a key/hash
+from it.
+
+Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set
+KEY_FLAG_KEEP on the new key.  blacklist_init() can then, correctly, pass
+this to keyring_alloc().
+
+We can also use this in ima_mok_init() rather than setting the flag
+manually.
+
+Note that this doesn't fix an observable bug with the current
+implementation but it is required to allow addition of new hashes to the
+blacklist in the future without making it possible for them to be removed.
+
+Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
+Reported-by: Mickaël Salaün <mic@linux.microsoft.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Mickaël Salaün <mic@linux.microsoft.com>
+cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ certs/blacklist.c                | 2 +-
+ include/linux/key.h              | 1 +
+ security/integrity/ima/ima_mok.c | 5 ++---
+ security/keys/key.c              | 2 ++
+ 4 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/certs/blacklist.c b/certs/blacklist.c
+index ec00bf337eb67..025a41de28fda 100644
+--- a/certs/blacklist.c
++++ b/certs/blacklist.c
+@@ -153,7 +153,7 @@ static int __init blacklist_init(void)
+ 			      KEY_USR_VIEW | KEY_USR_READ |
+ 			      KEY_USR_SEARCH,
+ 			      KEY_ALLOC_NOT_IN_QUOTA |
+-			      KEY_FLAG_KEEP,
++			      KEY_ALLOC_SET_KEEP,
+ 			      NULL, NULL);
+ 	if (IS_ERR(blacklist_keyring))
+ 		panic("Can't allocate system blacklist keyring\n");
+diff --git a/include/linux/key.h b/include/linux/key.h
+index 6cf8e71cf8b7c..9c26cc9b802a0 100644
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -269,6 +269,7 @@ extern struct key *key_alloc(struct key_type *type,
+ #define KEY_ALLOC_BUILT_IN		0x0004	/* Key is built into kernel */
+ #define KEY_ALLOC_BYPASS_RESTRICTION	0x0008	/* Override the check on restricted keyrings */
+ #define KEY_ALLOC_UID_KEYRING		0x0010	/* allocating a user or user session keyring */
++#define KEY_ALLOC_SET_KEEP		0x0020	/* Set the KEEP flag on the key/keyring */
+ 
+ extern void key_revoke(struct key *key);
+ extern void key_invalidate(struct key *key);
+diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
+index 36cadadbfba47..1e5c019161738 100644
+--- a/security/integrity/ima/ima_mok.c
++++ b/security/integrity/ima/ima_mok.c
+@@ -38,13 +38,12 @@ __init int ima_mok_init(void)
+ 				(KEY_POS_ALL & ~KEY_POS_SETATTR) |
+ 				KEY_USR_VIEW | KEY_USR_READ |
+ 				KEY_USR_WRITE | KEY_USR_SEARCH,
+-				KEY_ALLOC_NOT_IN_QUOTA,
++				KEY_ALLOC_NOT_IN_QUOTA |
++				KEY_ALLOC_SET_KEEP,
+ 				restriction, NULL);
+ 
+ 	if (IS_ERR(ima_blacklist_keyring))
+ 		panic("Can't allocate IMA blacklist keyring.");
+-
+-	set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
+ 	return 0;
+ }
+ device_initcall(ima_mok_init);
+diff --git a/security/keys/key.c b/security/keys/key.c
+index e9845d0d8d349..623fcb4094dd4 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -302,6 +302,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ 		key->flags |= 1 << KEY_FLAG_BUILTIN;
+ 	if (flags & KEY_ALLOC_UID_KEYRING)
+ 		key->flags |= 1 << KEY_FLAG_UID_KEYRING;
++	if (flags & KEY_ALLOC_SET_KEEP)
++		key->flags |= 1 << KEY_FLAG_KEEP;
+ 
+ #ifdef KEY_DEBUGGING
+ 	key->magic = KEY_DEBUG_MAGIC;
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch b/queue-5.4/clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch
new file mode 100644
index 00000000000..61b2412d538
--- /dev/null
+++ b/queue-5.4/clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch
@@ -0,0 +1,83 @@
+From 98d4fa7b5b82ab883eab86ad267b3f3028c87e98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 14:17:15 +0800
+Subject: clk: aspeed: Fix APLL calculate formula from ast2600-A2
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit 6286ce1e3ece54799f12775f8ce2a1cba9cbcfc5 ]
+
+Starting from A2, the A-PLL calculation has changed. Use the
+existing formula for A0/A1 and the new formula for A2 onwards.
+
+Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC")
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://lore.kernel.org/r/20210119061715.6043-1-ryan_chen@aspeedtech.com
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-ast2600.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
+index 7015974f24b43..84ca38450d021 100644
+--- a/drivers/clk/clk-ast2600.c
++++ b/drivers/clk/clk-ast2600.c
+@@ -17,7 +17,8 @@
+ 
+ #define ASPEED_G6_NUM_CLKS		67
+ 
+-#define ASPEED_G6_SILICON_REV		0x004
++#define ASPEED_G6_SILICON_REV		0x014
++#define CHIP_REVISION_ID			GENMASK(23, 16)
+ 
+ #define ASPEED_G6_RESET_CTRL		0x040
+ #define ASPEED_G6_RESET_CTRL2		0x050
+@@ -189,18 +190,34 @@ static struct clk_hw *ast2600_calc_pll(const char *name, u32 val)
+ static struct clk_hw *ast2600_calc_apll(const char *name, u32 val)
+ {
+ 	unsigned int mult, div;
++	u32 chip_id = readl(scu_g6_base + ASPEED_G6_SILICON_REV);
+ 
+-	if (val & BIT(20)) {
+-		/* Pass through mode */
+-		mult = div = 1;
++	if (((chip_id & CHIP_REVISION_ID) >> 16) >= 2) {
++		if (val & BIT(24)) {
++			/* Pass through mode */
++			mult = div = 1;
++		} else {
++			/* F = 25Mhz * [(m + 1) / (n + 1)] / (p + 1) */
++			u32 m = val & 0x1fff;
++			u32 n = (val >> 13) & 0x3f;
++			u32 p = (val >> 19) & 0xf;
++
++			mult = (m + 1);
++			div = (n + 1) * (p + 1);
++		}
+ 	} else {
+-		/* F = 25Mhz * (2-od) * [(m + 2) / (n + 1)] */
+-		u32 m = (val >> 5) & 0x3f;
+-		u32 od = (val >> 4) & 0x1;
+-		u32 n = val & 0xf;
++		if (val & BIT(20)) {
++			/* Pass through mode */
++			mult = div = 1;
++		} else {
++			/* F = 25Mhz * (2-od) * [(m + 2) / (n + 1)] */
++			u32 m = (val >> 5) & 0x3f;
++			u32 od = (val >> 4) & 0x1;
++			u32 n = val & 0xf;
+ 
+-		mult = (2 - od) * (m + 2);
+-		div = n + 1;
++			mult = (2 - od) * (m + 2);
++			div = n + 1;
++		}
+ 	}
+ 	return clk_hw_register_fixed_factor(NULL, name, "clkin", 0,
+ 			mult, div);
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch b/queue-5.4/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch
new file mode 100644
index 00000000000..e3cb8e01d63
--- /dev/null
+++ b/queue-5.4/clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch
@@ -0,0 +1,39 @@
+From f0f580e114da9a874ee72718bc99d0b467a9f54e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:54 +0100
+Subject: clk: meson: clk-pll: fix initializing the old rate (fallback) for a
+ PLL
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 2f290b7c67adf6459a17a4c978102af35cd62e4a ]
+
+The "rate" parameter in meson_clk_pll_set_rate() contains the new rate.
+Retrieve the old rate with clk_hw_get_rate() so we don't inifinitely try
+to switch from the new rate to the same rate again.
+
+Fixes: 7a29a869434e8b ("clk: meson: Add support for Meson clock controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index 3a5853ca98c6c..fb0bc8c0ad4d4 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -369,7 +369,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ 	if (parent_rate == 0 || rate == 0)
+ 		return -EINVAL;
+ 
+-	old_rate = rate;
++	old_rate = clk_hw_get_rate(hw);
+ 
+ 	ret = meson_clk_get_pll_settings(rate, parent_rate, &m, &n, pll);
+ 	if (ret)
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-meson-clk-pll-make-ret-a-signed-integer.patch b/queue-5.4/clk-meson-clk-pll-make-ret-a-signed-integer.patch
new file mode 100644
index 00000000000..f24bd2c2837
--- /dev/null
+++ b/queue-5.4/clk-meson-clk-pll-make-ret-a-signed-integer.patch
@@ -0,0 +1,41 @@
+From 885c41878ec2b981bd4a0053e7d19d4d09009a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:55 +0100
+Subject: clk: meson: clk-pll: make "ret" a signed integer
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 9e717285f0bd591d716fa0e7418f2cdaf756dd25 ]
+
+The error codes returned by meson_clk_get_pll_settings() are all
+negative. Make "ret" a signed integer in meson_clk_pll_set_rate() to
+make it match with the clk_ops.set_rate API as well as the data type
+returned by meson_clk_get_pll_settings().
+
+Fixes: 8eed1db1adec6a ("clk: meson: pll: update driver for the g12a")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index fb0bc8c0ad4d4..a92f44fa5a24e 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -363,8 +363,9 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ {
+ 	struct clk_regmap *clk = to_clk_regmap(hw);
+ 	struct meson_clk_pll_data *pll = meson_clk_pll_data(clk);
+-	unsigned int enabled, m, n, frac = 0, ret;
++	unsigned int enabled, m, n, frac = 0;
+ 	unsigned long old_rate;
++	int ret;
+ 
+ 	if (parent_rate == 0 || rate == 0)
+ 		return -EINVAL;
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch b/queue-5.4/clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch
new file mode 100644
index 00000000000..6d1f84d403f
--- /dev/null
+++ b/queue-5.4/clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch
@@ -0,0 +1,48 @@
+From 58a98ac3db75db3c819213b25bf0c2148f2bfe03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:56 +0100
+Subject: clk: meson: clk-pll: propagate the error from
+ meson_clk_pll_set_rate()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit ccdc1f0836f8e37b558a424f1e491f929b2e7ede ]
+
+Popagate the error code from meson_clk_pll_set_rate() when the PLL does
+not lock with the new settings.
+
+Fixes: 722825dcd54b2e ("clk: meson: migrate plls clocks to clk_regmap")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-4-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index a92f44fa5a24e..e8df254f8085b 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -392,7 +392,8 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ 	if (!enabled)
+ 		return 0;
+ 
+-	if (meson_clk_pll_enable(hw)) {
++	ret = meson_clk_pll_enable(hw);
++	if (ret) {
+ 		pr_warn("%s: pll did not lock, trying to restore old rate %lu\n",
+ 			__func__, old_rate);
+ 		/*
+@@ -404,7 +405,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ 		meson_clk_pll_set_rate(hw, old_rate, parent_rate);
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /*
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch b/queue-5.4/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch
new file mode 100644
index 00000000000..3d54a68783a
--- /dev/null
+++ b/queue-5.4/clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch
@@ -0,0 +1,387 @@
+From 50ecc278a17be4a52dfbc357e840f114e2b2dba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 23:10:54 +0100
+Subject: clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 292f75ecff07e8a07fe2e3e19b4b567d0b698842 ]
+
+All of the GPLLs in the MSM8998 Global Clock Controller are Fabia PLLs
+and not generic alphas: this was producing bad effects over the entire
+clock tree of MSM8998, where any GPLL child clock was declaring a false
+clock rate, due to their parent also showing the same.
+
+The issue resides in the calculation of the clock rate for the specific
+Alpha PLL type, where Fabia has a different register layout; switching
+the MSM8998 GPLLs to the correct Alpha Fabia PLL type fixes the rate
+(calculation) reading. While at it, also make these PLLs fixed since
+their rate is supposed to *never* be changed while the system runs, as
+this would surely crash the entire SoC.
+
+Now all the children of all the PLLs are also complying with their
+specified clock table and system stability is improved.
+
+Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210114221059.483390-7-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c | 100 ++++++++++++++++-----------------
+ 1 file changed, 50 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 091acd59c1d64..752f267b2881a 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -135,7 +135,7 @@ static struct pll_vco fabia_vco[] = {
+ 
+ static struct clk_alpha_pll gpll0 = {
+ 	.offset = 0x0,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.vco_table = fabia_vco,
+ 	.num_vco = ARRAY_SIZE(fabia_vco),
+ 	.clkr = {
+@@ -145,58 +145,58 @@ static struct clk_alpha_pll gpll0 = {
+ 			.name = "gpll0",
+ 			.parent_names = (const char *[]){ "xo" },
+ 			.num_parents = 1,
+-			.ops = &clk_alpha_pll_ops,
++			.ops = &clk_alpha_pll_fixed_fabia_ops,
+ 		}
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll0_out_even = {
+ 	.offset = 0x0,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0_out_even",
+ 		.parent_names = (const char *[]){ "gpll0" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll0_out_main = {
+ 	.offset = 0x0,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0_out_main",
+ 		.parent_names = (const char *[]){ "gpll0" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll0_out_odd = {
+ 	.offset = 0x0,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0_out_odd",
+ 		.parent_names = (const char *[]){ "gpll0" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll0_out_test = {
+ 	.offset = 0x0,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll0_out_test",
+ 		.parent_names = (const char *[]){ "gpll0" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll gpll1 = {
+ 	.offset = 0x1000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.vco_table = fabia_vco,
+ 	.num_vco = ARRAY_SIZE(fabia_vco),
+ 	.clkr = {
+@@ -206,58 +206,58 @@ static struct clk_alpha_pll gpll1 = {
+ 			.name = "gpll1",
+ 			.parent_names = (const char *[]){ "xo" },
+ 			.num_parents = 1,
+-			.ops = &clk_alpha_pll_ops,
++			.ops = &clk_alpha_pll_fixed_fabia_ops,
+ 		}
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll1_out_even = {
+ 	.offset = 0x1000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll1_out_even",
+ 		.parent_names = (const char *[]){ "gpll1" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll1_out_main = {
+ 	.offset = 0x1000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll1_out_main",
+ 		.parent_names = (const char *[]){ "gpll1" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll1_out_odd = {
+ 	.offset = 0x1000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll1_out_odd",
+ 		.parent_names = (const char *[]){ "gpll1" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll1_out_test = {
+ 	.offset = 0x1000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll1_out_test",
+ 		.parent_names = (const char *[]){ "gpll1" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll gpll2 = {
+ 	.offset = 0x2000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.vco_table = fabia_vco,
+ 	.num_vco = ARRAY_SIZE(fabia_vco),
+ 	.clkr = {
+@@ -267,58 +267,58 @@ static struct clk_alpha_pll gpll2 = {
+ 			.name = "gpll2",
+ 			.parent_names = (const char *[]){ "xo" },
+ 			.num_parents = 1,
+-			.ops = &clk_alpha_pll_ops,
++			.ops = &clk_alpha_pll_fixed_fabia_ops,
+ 		}
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll2_out_even = {
+ 	.offset = 0x2000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll2_out_even",
+ 		.parent_names = (const char *[]){ "gpll2" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll2_out_main = {
+ 	.offset = 0x2000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll2_out_main",
+ 		.parent_names = (const char *[]){ "gpll2" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll2_out_odd = {
+ 	.offset = 0x2000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll2_out_odd",
+ 		.parent_names = (const char *[]){ "gpll2" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll2_out_test = {
+ 	.offset = 0x2000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll2_out_test",
+ 		.parent_names = (const char *[]){ "gpll2" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll gpll3 = {
+ 	.offset = 0x3000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.vco_table = fabia_vco,
+ 	.num_vco = ARRAY_SIZE(fabia_vco),
+ 	.clkr = {
+@@ -328,58 +328,58 @@ static struct clk_alpha_pll gpll3 = {
+ 			.name = "gpll3",
+ 			.parent_names = (const char *[]){ "xo" },
+ 			.num_parents = 1,
+-			.ops = &clk_alpha_pll_ops,
++			.ops = &clk_alpha_pll_fixed_fabia_ops,
+ 		}
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll3_out_even = {
+ 	.offset = 0x3000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll3_out_even",
+ 		.parent_names = (const char *[]){ "gpll3" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll3_out_main = {
+ 	.offset = 0x3000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll3_out_main",
+ 		.parent_names = (const char *[]){ "gpll3" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll3_out_odd = {
+ 	.offset = 0x3000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll3_out_odd",
+ 		.parent_names = (const char *[]){ "gpll3" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll3_out_test = {
+ 	.offset = 0x3000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll3_out_test",
+ 		.parent_names = (const char *[]){ "gpll3" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll gpll4 = {
+ 	.offset = 0x77000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.vco_table = fabia_vco,
+ 	.num_vco = ARRAY_SIZE(fabia_vco),
+ 	.clkr = {
+@@ -389,52 +389,52 @@ static struct clk_alpha_pll gpll4 = {
+ 			.name = "gpll4",
+ 			.parent_names = (const char *[]){ "xo" },
+ 			.num_parents = 1,
+-			.ops = &clk_alpha_pll_ops,
++			.ops = &clk_alpha_pll_fixed_fabia_ops,
+ 		}
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll4_out_even = {
+ 	.offset = 0x77000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4_out_even",
+ 		.parent_names = (const char *[]){ "gpll4" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll4_out_main = {
+ 	.offset = 0x77000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4_out_main",
+ 		.parent_names = (const char *[]){ "gpll4" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll4_out_odd = {
+ 	.offset = 0x77000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4_out_odd",
+ 		.parent_names = (const char *[]){ "gpll4" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+ static struct clk_alpha_pll_postdiv gpll4_out_test = {
+ 	.offset = 0x77000,
+-	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++	.regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ 	.clkr.hw.init = &(struct clk_init_data){
+ 		.name = "gpll4_out_test",
+ 		.parent_names = (const char *[]){ "gpll4" },
+ 		.num_parents = 1,
+-		.ops = &clk_alpha_pll_postdiv_ops,
++		.ops = &clk_alpha_pll_postdiv_fabia_ops,
+ 	},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-sunxi-ng-h6-fix-cec-clock.patch b/queue-5.4/clk-sunxi-ng-h6-fix-cec-clock.patch
new file mode 100644
index 00000000000..8023c796fc7
--- /dev/null
+++ b/queue-5.4/clk-sunxi-ng-h6-fix-cec-clock.patch
@@ -0,0 +1,42 @@
+From 993108ac40b25592a30c8050648f0141761c9665 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 14:32:46 +0000
+Subject: clk: sunxi-ng: h6: Fix CEC clock
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 756650820abd4770c4200763505b634a3c04e05e ]
+
+The CEC clock on the H6 SoC is a bit special, since it uses a fixed
+pre-dividier for one source clock (the PLL), but conveys the other clock
+(32K OSC) directly.
+We are using a fixed predivider array for that, but fail to use the right
+flag to actually activate that.
+
+Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU")
+Reported-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210106143246.11255-1-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index d89353a3cdec7..183dd350cce95 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -673,7 +673,7 @@ static struct ccu_mux hdmi_cec_clk = {
+ 
+ 	.common		= {
+ 		.reg		= 0xb10,
+-		.features	= CCU_FEATURE_VARIABLE_PREDIV,
++		.features	= CCU_FEATURE_FIXED_PREDIV,
+ 		.hw.init	= CLK_HW_INIT_PARENTS("hdmi-cec",
+ 						      hdmi_cec_parents,
+ 						      &ccu_mux_ops,
+-- 
+2.27.0
+
diff --git a/queue-5.4/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch b/queue-5.4/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch
new file mode 100644
index 00000000000..87ff2f71891
--- /dev/null
+++ b/queue-5.4/clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch
@@ -0,0 +1,67 @@
+From a837571d58d0a8e3d5644b4d2d7570cf919e52a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 00:09:12 +0000
+Subject: clk: sunxi-ng: h6: Fix clock divider range on some clocks
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 04ef679591c76571a9e7d5ca48316cc86fa0ef12 ]
+
+While comparing clocks between the H6 and H616, some of the M factor
+ranges were found to be wrong: the manual says they are only covering
+two bits [1:0], but our code had "5" in the number-of-bits field.
+
+By writing 0xff into that register in U-Boot and via FEL, it could be
+confirmed that bits [4:2] are indeed masked off, so the manual is right.
+
+Change to number of bits in the affected clock's description.
+
+Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210118000912.28116-1-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index 183dd350cce95..2f00f1b7b9c00 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -228,7 +228,7 @@ static const char * const psi_ahb1_ahb2_parents[] = { "osc24M", "osc32k",
+ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2",
+ 			     psi_ahb1_ahb2_parents,
+ 			     0x510,
+-			     0, 5,	/* M */
++			     0, 2,	/* M */
+ 			     8, 2,	/* P */
+ 			     24, 2,	/* mux */
+ 			     0);
+@@ -237,19 +237,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k",
+ 						       "psi-ahb1-ahb2",
+ 						       "pll-periph0" };
+ static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,
+-			     0, 5,	/* M */
++			     0, 2,	/* M */
+ 			     8, 2,	/* P */
+ 			     24, 2,	/* mux */
+ 			     0);
+ 
+ static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,
+-			     0, 5,	/* M */
++			     0, 2,	/* M */
+ 			     8, 2,	/* P */
+ 			     24, 2,	/* mux */
+ 			     0);
+ 
+ static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,
+-			     0, 5,	/* M */
++			     0, 2,	/* M */
+ 			     8, 2,	/* P */
+ 			     24, 2,	/* mux */
+ 			     0);
+-- 
+2.27.0
+
diff --git a/queue-5.4/clocksource-drivers-ixp4xx-select-timer_of-when-need.patch b/queue-5.4/clocksource-drivers-ixp4xx-select-timer_of-when-need.patch
new file mode 100644
index 00000000000..e7809b2e87f
--- /dev/null
+++ b/queue-5.4/clocksource-drivers-ixp4xx-select-timer_of-when-need.patch
@@ -0,0 +1,55 @@
+From 232feea3806da40dbebc0ccf0f5d4a6442b489c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 14:59:24 +0100
+Subject: clocksource/drivers/ixp4xx: Select TIMER_OF when needed
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7a3b8758bd6e45f7b671723b5c9fa2b69d0787ae ]
+
+Compile-testing the ixp4xx timer with CONFIG_OF enabled but
+CONFIG_TIMER_OF disabled leads to a harmless warning:
+
+arm-linux-gnueabi-ld: warning: orphan section `__timer_of_table' from `drivers/clocksource/timer-ixp4xx.o' being placed in section `__timer_of_table'
+
+Move the select statement from the platform code into the driver
+so it always gets enabled in configurations that rely on it.
+
+Fixes: 40df14cc5cc0 ("clocksource/drivers/ixp4xx: Add OF initialization support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210103135955.3808976-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ixp4xx/Kconfig | 1 -
+ drivers/clocksource/Kconfig  | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig
+index f7211b57b1e78..165c184801e19 100644
+--- a/arch/arm/mach-ixp4xx/Kconfig
++++ b/arch/arm/mach-ixp4xx/Kconfig
+@@ -13,7 +13,6 @@ config MACH_IXP4XX_OF
+ 	select I2C
+ 	select I2C_IOP3XX
+ 	select PCI
+-	select TIMER_OF
+ 	select USE_OF
+ 	help
+ 	  Say 'Y' here to support Device Tree-based IXP4xx platforms.
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index f35a53ce8988a..3bb5625504e2f 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -79,6 +79,7 @@ config IXP4XX_TIMER
+ 	bool "Intel XScale IXP4xx timer driver" if COMPILE_TEST
+ 	depends on HAS_IOMEM
+ 	select CLKSRC_MMIO
++	select TIMER_OF if OF
+ 	help
+ 	  Enables support for the Intel XScale IXP4xx SoC timer.
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch b/queue-5.4/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch
new file mode 100644
index 00000000000..accff6e118d
--- /dev/null
+++ b/queue-5.4/clocksource-drivers-mxs_timer-add-missing-semicolon-.patch
@@ -0,0 +1,49 @@
+From d53005cc0b2ba39fe68720dd403e2610f58bf3d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:19:55 -0800
+Subject: clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is
+ defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 7da390694afbaed8e0f05717a541dfaf1077ba51 ]
+
+When DEBUG is defined this error occurs
+
+drivers/clocksource/mxs_timer.c:138:1: error:
+  expected ‘;’ before ‘}’ token
+
+The preceding statement needs a semicolon.
+Replace pr_info() with pr_debug() and remove the unneeded ifdef.
+
+Fixes: eb8703e2ef7c ("clockevents/drivers/mxs: Migrate to new 'set-state' interface")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210118211955.763609-1-trix@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/mxs_timer.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c
+index f6ddae30933f7..dae8c0c2e606f 100644
+--- a/drivers/clocksource/mxs_timer.c
++++ b/drivers/clocksource/mxs_timer.c
+@@ -138,10 +138,7 @@ static void mxs_irq_clear(char *state)
+ 
+ 	/* Clear pending interrupt */
+ 	timrot_irq_acknowledge();
+-
+-#ifdef DEBUG
+-	pr_info("%s: changing mode to %s\n", __func__, state)
+-#endif /* DEBUG */
++	pr_debug("%s: changing mode to %s\n", __func__, state);
+ }
+ 
+ static int mxs_shutdown(struct clock_event_device *evt)
+-- 
+2.27.0
+
diff --git a/queue-5.4/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch b/queue-5.4/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch
new file mode 100644
index 00000000000..399878b11b9
--- /dev/null
+++ b/queue-5.4/cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch
@@ -0,0 +1,38 @@
+From b989e7323023b784db45689f3e8d6f4cb68fcd07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 15:26:44 +0100
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3657f729b6fb5f2c0bf693742de2dcd49c572aa1 ]
+
+If 'cpufreq_unregister_driver()' fails, just WARN and continue, so that
+other resources are freed.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[ Viresh: Updated Subject ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 1514c9846c5d5..a3c82f530d608 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -723,8 +723,7 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
+ 	int ret;
+ 
+ 	ret = cpufreq_unregister_driver(&brcm_avs_driver);
+-	if (ret)
+-		return ret;
++	WARN_ON(ret);
+ 
+ 	brcm_avs_prepare_uninit(pdev);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch b/queue-5.4/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch
new file mode 100644
index 00000000000..9e573cfbe2b
--- /dev/null
+++ b/queue-5.4/cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch
@@ -0,0 +1,77 @@
+From 21dd33da7656618d0adc7dfff5d64ef7322e32f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 15:26:35 +0100
+Subject: cpufreq: brcmstb-avs-cpufreq: Free resources in error path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 05f456286fd489558c72a4711d22a5612c965685 ]
+
+If 'cpufreq_register_driver()' fails, we must release the resources
+allocated in 'brcm_avs_prepare_init()' as already done in the remove
+function.
+
+To do that, introduce a new function 'brcm_avs_prepare_uninit()' in order
+to avoid code duplication. This also makes the code more readable (IMHO).
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[ Viresh: Updated Subject ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 77b0e5d0fb134..1514c9846c5d5 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -566,6 +566,16 @@ unmap_base:
+ 	return ret;
+ }
+ 
++static void brcm_avs_prepare_uninit(struct platform_device *pdev)
++{
++	struct private_data *priv;
++
++	priv = platform_get_drvdata(pdev);
++
++	iounmap(priv->avs_intr_base);
++	iounmap(priv->base);
++}
++
+ static int brcm_avs_cpufreq_init(struct cpufreq_policy *policy)
+ {
+ 	struct cpufreq_frequency_table *freq_table;
+@@ -701,21 +711,22 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
+ 
+ 	brcm_avs_driver.driver_data = pdev;
+ 
+-	return cpufreq_register_driver(&brcm_avs_driver);
++	ret = cpufreq_register_driver(&brcm_avs_driver);
++	if (ret)
++		brcm_avs_prepare_uninit(pdev);
++
++	return ret;
+ }
+ 
+ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
+ {
+-	struct private_data *priv;
+ 	int ret;
+ 
+ 	ret = cpufreq_unregister_driver(&brcm_avs_driver);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv = platform_get_drvdata(pdev);
+-	iounmap(priv->base);
+-	iounmap(priv->avs_intr_base);
++	brcm_avs_prepare_uninit(pdev);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch b/queue-5.4/crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch
new file mode 100644
index 00000000000..07a80947a56
--- /dev/null
+++ b/queue-5.4/crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch
@@ -0,0 +1,50 @@
+From 9146a0e7c4495a3edf72881ecc080a6048080233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 19:55:15 +0100
+Subject: crypto: arm64/aes-ce - really hide slower algos when faster ones are
+ enabled
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 15deb4333cd6d4e1e3216582e4c531ec40a6b060 ]
+
+Commit 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if
+faster driver is enabled") intended to hide modes from the plain NEON
+driver that are also implemented by the faster bit sliced NEON one if
+both are enabled. However, the defined() CPP function does not detect
+if the bit sliced NEON driver is enabled as a module. So instead, let's
+use IS_ENABLED() here.
+
+Fixes: 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if ...")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/crypto/aes-glue.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
+index aa57dc639f77f..aa13344a3a5e8 100644
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -55,7 +55,7 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 Crypto Extensions");
+ #define aes_mac_update		neon_aes_mac_update
+ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 NEON");
+ #endif
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
+ MODULE_ALIAS_CRYPTO("ecb(aes)");
+ MODULE_ALIAS_CRYPTO("cbc(aes)");
+ MODULE_ALIAS_CRYPTO("ctr(aes)");
+@@ -668,7 +668,7 @@ static int __maybe_unused xts_decrypt(struct skcipher_request *req)
+ }
+ 
+ static struct skcipher_alg aes_algs[] = { {
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
+ 	.base = {
+ 		.cra_name		= "__ecb(aes)",
+ 		.cra_driver_name	= "__ecb-aes-" MODE,
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch b/queue-5.4/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch
new file mode 100644
index 00000000000..2710e038904
--- /dev/null
+++ b/queue-5.4/crypto-bcm-rename-struct-device_private-to-bcm_devic.patch
@@ -0,0 +1,83 @@
+From a5596d77fa047dfd4ff97d38d48a141ef229f30e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 00:02:37 +0100
+Subject: crypto: bcm - Rename struct device_private to bcm_device_private
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit f7f2b43eaf6b4cfe54c75100709be31d5c4b52c8 ]
+
+Renaming 'struct device_private' to 'struct bcm_device_private',
+because it clashes with 'struct device_private' from
+'drivers/base/base.h'.
+
+While it's not a functional problem, it's causing two distinct
+type hierarchies in BTF data. It also breaks build with options:
+  CONFIG_DEBUG_INFO_BTF=y
+  CONFIG_CRYPTO_DEV_BCM_SPU=y
+
+as reported by Qais Yousef [1].
+
+[1] https://lore.kernel.org/lkml/20201229151352.6hzmjvu3qh6p2qgg@e107158-lin/
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 2 +-
+ drivers/crypto/bcm/cipher.h | 4 ++--
+ drivers/crypto/bcm/util.c   | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index ec4b5033013eb..98b8483577ce2 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -41,7 +41,7 @@
+ 
+ /* ================= Device Structure ================== */
+ 
+-struct device_private iproc_priv;
++struct bcm_device_private iproc_priv;
+ 
+ /* ==================== Parameters ===================== */
+ 
+diff --git a/drivers/crypto/bcm/cipher.h b/drivers/crypto/bcm/cipher.h
+index 766452b24d0ab..01feed268a0d4 100644
+--- a/drivers/crypto/bcm/cipher.h
++++ b/drivers/crypto/bcm/cipher.h
+@@ -418,7 +418,7 @@ struct spu_hw {
+ 	u32 num_chan;
+ };
+ 
+-struct device_private {
++struct bcm_device_private {
+ 	struct platform_device *pdev;
+ 
+ 	struct spu_hw spu;
+@@ -465,6 +465,6 @@ struct device_private {
+ 	struct mbox_chan **mbox;
+ };
+ 
+-extern struct device_private iproc_priv;
++extern struct bcm_device_private iproc_priv;
+ 
+ #endif
+diff --git a/drivers/crypto/bcm/util.c b/drivers/crypto/bcm/util.c
+index cd7504101acde..7227dbf8f46c7 100644
+--- a/drivers/crypto/bcm/util.c
++++ b/drivers/crypto/bcm/util.c
+@@ -348,7 +348,7 @@ char *spu_alg_name(enum spu_cipher_alg alg, enum spu_cipher_mode mode)
+ static ssize_t spu_debugfs_read(struct file *filp, char __user *ubuf,
+ 				size_t count, loff_t *offp)
+ {
+-	struct device_private *ipriv;
++	struct bcm_device_private *ipriv;
+ 	char *buf;
+ 	ssize_t ret, out_offset, out_count;
+ 	int i;
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch b/queue-5.4/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch
new file mode 100644
index 00000000000..f012185f418
--- /dev/null
+++ b/queue-5.4/crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch
@@ -0,0 +1,41 @@
+From 35f9f257a30f0fb5074a4ed455e01daa55310790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 11:28:37 +0000
+Subject: crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
+
+From: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+
+[ Upstream commit a53ab94eb6850c3657392e2d2ce9b38c387a2633 ]
+
+The length ('len' parameter) passed to crypto_ecdh_decode_key() is never
+checked against the length encoded in the passed buffer ('buf'
+parameter). This could lead to an out-of-bounds access when the passed
+length is less than the encoded length.
+
+Add a check to prevent that.
+
+Fixes: 3c4b23901a0c7 ("crypto: ecdh - Add ECDH software support")
+Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecdh_helper.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/crypto/ecdh_helper.c b/crypto/ecdh_helper.c
+index 66fcb2ea81544..fca63b559f655 100644
+--- a/crypto/ecdh_helper.c
++++ b/crypto/ecdh_helper.c
+@@ -67,6 +67,9 @@ int crypto_ecdh_decode_key(const char *buf, unsigned int len,
+ 	if (secret.type != CRYPTO_KPP_SECRET_TYPE_ECDH)
+ 		return -EINVAL;
+ 
++	if (unlikely(len < secret.len))
++		return -EINVAL;
++
+ 	ptr = ecdh_unpack_data(&params->curve_id, ptr, sizeof(params->curve_id));
+ 	ptr = ecdh_unpack_data(&params->key_size, ptr, sizeof(params->key_size));
+ 	if (secret.len != crypto_ecdh_key_len(params))
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-sun4i-ss-fix-kmap-usage.patch b/queue-5.4/crypto-sun4i-ss-fix-kmap-usage.patch
new file mode 100644
index 00000000000..91a5ced6ed6
--- /dev/null
+++ b/queue-5.4/crypto-sun4i-ss-fix-kmap-usage.patch
@@ -0,0 +1,254 @@
+From eb84d86296562d19f5440a21781ba2b79573e168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 20:02:30 +0000
+Subject: crypto: sun4i-ss - fix kmap usage
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 9bc3dd24e7dccd50757db743a3635ad5b0497e6e ]
+
+With the recent kmap change, some tests which were conditional on
+CONFIG_DEBUG_HIGHMEM now are enabled by default.
+This permit to detect a problem in sun4i-ss usage of kmap.
+
+sun4i-ss uses two kmap via sg_miter (one for input, one for output), but
+using two kmap at the same time is hard:
+"the ordering has to be correct and with sg_miter that's probably hard to get
+right." (quoting Tlgx)
+
+So the easiest solution is to never have two sg_miter/kmap open at the same time.
+After each use of sg_miter, I store the current index, for being able to
+resume sg_miter to the right place.
+
+Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 109 +++++++++++++---------
+ 1 file changed, 65 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+index 4145a046274e5..f17551d4fa7e4 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+@@ -30,6 +30,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 	unsigned int ileft = areq->cryptlen;
+ 	unsigned int oleft = areq->cryptlen;
+ 	unsigned int todo;
++	unsigned long pi = 0, po = 0; /* progress for in and out */
++	bool miter_err;
+ 	struct sg_mapping_iter mi, mo;
+ 	unsigned int oi, oo; /* offset for in and out */
+ 	unsigned long flags;
+@@ -55,39 +57,51 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 	}
+ 	writel(mode, ss->base + SS_CTL);
+ 
+-	sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+-		       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+-	sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+-		       SG_MITER_TO_SG | SG_MITER_ATOMIC);
+-	sg_miter_next(&mi);
+-	sg_miter_next(&mo);
+-	if (!mi.addr || !mo.addr) {
+-		dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+-		err = -EINVAL;
+-		goto release_ss;
+-	}
+ 
+ 	ileft = areq->cryptlen / 4;
+ 	oleft = areq->cryptlen / 4;
+ 	oi = 0;
+ 	oo = 0;
+ 	do {
+-		todo = min(rx_cnt, ileft);
+-		todo = min_t(size_t, todo, (mi.length - oi) / 4);
+-		if (todo) {
+-			ileft -= todo;
+-			writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+-			oi += todo * 4;
+-		}
+-		if (oi == mi.length) {
+-			sg_miter_next(&mi);
+-			oi = 0;
++		if (ileft) {
++			sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++					SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++			if (pi)
++				sg_miter_skip(&mi, pi);
++			miter_err = sg_miter_next(&mi);
++			if (!miter_err || !mi.addr) {
++				dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++				err = -EINVAL;
++				goto release_ss;
++			}
++			todo = min(rx_cnt, ileft);
++			todo = min_t(size_t, todo, (mi.length - oi) / 4);
++			if (todo) {
++				ileft -= todo;
++				writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
++				oi += todo * 4;
++			}
++			if (oi == mi.length) {
++				pi += mi.length;
++				oi = 0;
++			}
++			sg_miter_stop(&mi);
+ 		}
+ 
+ 		spaces = readl(ss->base + SS_FCSR);
+ 		rx_cnt = SS_RXFIFO_SPACES(spaces);
+ 		tx_cnt = SS_TXFIFO_SPACES(spaces);
+ 
++		sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++			       SG_MITER_TO_SG | SG_MITER_ATOMIC);
++		if (po)
++			sg_miter_skip(&mo, po);
++		miter_err = sg_miter_next(&mo);
++		if (!miter_err || !mo.addr) {
++			dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++			err = -EINVAL;
++			goto release_ss;
++		}
+ 		todo = min(tx_cnt, oleft);
+ 		todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ 		if (todo) {
+@@ -96,9 +110,10 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 			oo += todo * 4;
+ 		}
+ 		if (oo == mo.length) {
+-			sg_miter_next(&mo);
+ 			oo = 0;
++			po += mo.length;
+ 		}
++		sg_miter_stop(&mo);
+ 	} while (oleft);
+ 
+ 	if (areq->iv) {
+@@ -109,8 +124,6 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 	}
+ 
+ release_ss:
+-	sg_miter_stop(&mi);
+-	sg_miter_stop(&mo);
+ 	writel(0, ss->base + SS_CTL);
+ 	spin_unlock_irqrestore(&ss->slock, flags);
+ 	return err;
+@@ -164,6 +177,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 	unsigned int oleft = areq->cryptlen;
+ 	unsigned int todo;
+ 	struct sg_mapping_iter mi, mo;
++	unsigned long pi = 0, po = 0; /* progress for in and out */
++	bool miter_err;
+ 	unsigned int oi, oo;	/* offset for in and out */
+ 	unsigned int ob = 0;	/* offset in buf */
+ 	unsigned int obo = 0;	/* offset in bufo*/
+@@ -217,17 +232,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 	}
+ 	writel(mode, ss->base + SS_CTL);
+ 
+-	sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+-		       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+-	sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+-		       SG_MITER_TO_SG | SG_MITER_ATOMIC);
+-	sg_miter_next(&mi);
+-	sg_miter_next(&mo);
+-	if (!mi.addr || !mo.addr) {
+-		dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+-		err = -EINVAL;
+-		goto release_ss;
+-	}
+ 	ileft = areq->cryptlen;
+ 	oleft = areq->cryptlen;
+ 	oi = 0;
+@@ -235,6 +239,16 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 
+ 	while (oleft) {
+ 		if (ileft) {
++			sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++				       SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++			if (pi)
++				sg_miter_skip(&mi, pi);
++			miter_err = sg_miter_next(&mi);
++			if (!miter_err || !mi.addr) {
++				dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++				err = -EINVAL;
++				goto release_ss;
++			}
+ 			/*
+ 			 * todo is the number of consecutive 4byte word that we
+ 			 * can read from current SG
+@@ -267,31 +281,38 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				}
+ 			}
+ 			if (oi == mi.length) {
+-				sg_miter_next(&mi);
++				pi += mi.length;
+ 				oi = 0;
+ 			}
++			sg_miter_stop(&mi);
+ 		}
+ 
+ 		spaces = readl(ss->base + SS_FCSR);
+ 		rx_cnt = SS_RXFIFO_SPACES(spaces);
+ 		tx_cnt = SS_TXFIFO_SPACES(spaces);
+-		dev_dbg(ss->dev,
+-			"%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
+-			mode,
+-			oi, mi.length, ileft, areq->cryptlen, rx_cnt,
+-			oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
+ 
+ 		if (!tx_cnt)
+ 			continue;
++		sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++			       SG_MITER_TO_SG | SG_MITER_ATOMIC);
++		if (po)
++			sg_miter_skip(&mo, po);
++		miter_err = sg_miter_next(&mo);
++		if (!miter_err || !mo.addr) {
++			dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++			err = -EINVAL;
++			goto release_ss;
++		}
+ 		/* todo in 4bytes word */
+ 		todo = min(tx_cnt, oleft / 4);
+ 		todo = min_t(size_t, todo, (mo.length - oo) / 4);
++
+ 		if (todo) {
+ 			readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+ 			oleft -= todo * 4;
+ 			oo += todo * 4;
+ 			if (oo == mo.length) {
+-				sg_miter_next(&mo);
++				po += mo.length;
+ 				oo = 0;
+ 			}
+ 		} else {
+@@ -316,12 +337,14 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				obo += todo;
+ 				oo += todo;
+ 				if (oo == mo.length) {
++					po += mo.length;
+ 					sg_miter_next(&mo);
+ 					oo = 0;
+ 				}
+ 			} while (obo < obl);
+ 			/* bufo must be fully used here */
+ 		}
++		sg_miter_stop(&mo);
+ 	}
+ 	if (areq->iv) {
+ 		for (i = 0; i < 4 && i < ivsize / 4; i++) {
+@@ -331,8 +354,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 	}
+ 
+ release_ss:
+-	sg_miter_stop(&mi);
+-	sg_miter_stop(&mo);
+ 	writel(0, ss->base + SS_CTL);
+ 	spin_unlock_irqrestore(&ss->slock, flags);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch b/queue-5.4/crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch
new file mode 100644
index 00000000000..2e157a0626c
--- /dev/null
+++ b/queue-5.4/crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch
@@ -0,0 +1,93 @@
+From fa69a026bc0d0d803dadf2ee980b4de444658ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 20:02:25 +0000
+Subject: crypto: sun4i-ss - linearize buffers content must be kept
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 583513510a7acd2306787865bcd19ebb2f629d42 ]
+
+When running the non-optimized cipher function, SS produce partial random
+output.
+This is due to linearize buffers being reseted after each loop.
+
+For preserving stack, instead of moving them back to start of function,
+I move them in sun4i_ss_ctx.
+
+Fixes: 8d3bcb9900ca ("crypto: sun4i-ss - reduce stack usage")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 12 ++++--------
+ drivers/crypto/sunxi-ss/sun4i-ss.h        |  2 ++
+ 2 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+index 7e5e092a23b3c..4145a046274e5 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+@@ -235,8 +235,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 
+ 	while (oleft) {
+ 		if (ileft) {
+-			char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
+-
+ 			/*
+ 			 * todo is the number of consecutive 4byte word that we
+ 			 * can read from current SG
+@@ -258,12 +256,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				 */
+ 				todo = min(rx_cnt * 4 - ob, ileft);
+ 				todo = min_t(size_t, todo, mi.length - oi);
+-				memcpy(buf + ob, mi.addr + oi, todo);
++				memcpy(ss->buf + ob, mi.addr + oi, todo);
+ 				ileft -= todo;
+ 				oi += todo;
+ 				ob += todo;
+ 				if (!(ob % 4)) {
+-					writesl(ss->base + SS_RXFIFO, buf,
++					writesl(ss->base + SS_RXFIFO, ss->buf,
+ 						ob / 4);
+ 					ob = 0;
+ 				}
+@@ -297,13 +295,11 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				oo = 0;
+ 			}
+ 		} else {
+-			char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
+-
+ 			/*
+ 			 * read obl bytes in bufo, we read at maximum for
+ 			 * emptying the device
+ 			 */
+-			readsl(ss->base + SS_TXFIFO, bufo, tx_cnt);
++			readsl(ss->base + SS_TXFIFO, ss->bufo, tx_cnt);
+ 			obl = tx_cnt * 4;
+ 			obo = 0;
+ 			do {
+@@ -315,7 +311,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				 */
+ 				todo = min_t(size_t,
+ 					     mo.length - oo, obl - obo);
+-				memcpy(mo.addr + oo, bufo + obo, todo);
++				memcpy(mo.addr + oo, ss->bufo + obo, todo);
+ 				oleft -= todo;
+ 				obo += todo;
+ 				oo += todo;
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss.h b/drivers/crypto/sunxi-ss/sun4i-ss.h
+index 35a27a7145f84..9a2adc130d9aa 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss.h
++++ b/drivers/crypto/sunxi-ss/sun4i-ss.h
+@@ -138,6 +138,8 @@ struct sun4i_ss_ctx {
+ 	struct reset_control *reset;
+ 	struct device *dev;
+ 	struct resource *res;
++	char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
++	char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
+ 	spinlock_t slock; /* control the use of the device */
+ #ifdef CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG
+ 	u32 seed[SS_SEED_LEN / BITS_PER_LONG];
+-- 
+2.27.0
+
diff --git a/queue-5.4/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch b/queue-5.4/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch
new file mode 100644
index 00000000000..be0bd2bb626
--- /dev/null
+++ b/queue-5.4/crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch
@@ -0,0 +1,160 @@
+From fe6e1a2705eecffb5b92c66dea2977af31db691e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 18:57:24 +0000
+Subject: crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size
+ error)
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 416b846757bcea20006a9197e67ba3a8b5b2a680 ]
+
+Talitos Security Engine AESU considers any input
+data size that is not a multiple of 16 bytes to be an error.
+This is not a problem in general, except for Counter mode
+that is a stream cipher and can have an input of any size.
+
+Test Manager for ctr(aes) fails on 4th test vector which has
+a length of 499 while all previous vectors which have a 16 bytes
+multiple length succeed.
+
+As suggested by Freescale, round up the input data length to the
+nearest 16 bytes.
+
+Fixes: 5e75ae1b3cef ("crypto: talitos - add new crypto modes")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 28 ++++++++++++++++------------
+ drivers/crypto/talitos.h |  1 +
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index b7c66fc0ae0c2..8ef6e93e43f3c 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1097,11 +1097,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+  */
+ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ 				 unsigned int offset, int datalen, int elen,
+-				 struct talitos_ptr *link_tbl_ptr)
++				 struct talitos_ptr *link_tbl_ptr, int align)
+ {
+ 	int n_sg = elen ? sg_count + 1 : sg_count;
+ 	int count = 0;
+ 	int cryptlen = datalen + elen;
++	int padding = ALIGN(cryptlen, align) - cryptlen;
+ 
+ 	while (cryptlen && sg && n_sg--) {
+ 		unsigned int len = sg_dma_len(sg);
+@@ -1125,7 +1126,7 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ 			offset += datalen;
+ 		}
+ 		to_talitos_ptr(link_tbl_ptr + count,
+-			       sg_dma_address(sg) + offset, len, 0);
++			       sg_dma_address(sg) + offset, sg_next(sg) ? len : len + padding, 0);
+ 		to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+ 		count++;
+ 		cryptlen -= len;
+@@ -1148,10 +1149,11 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ 			      unsigned int len, struct talitos_edesc *edesc,
+ 			      struct talitos_ptr *ptr, int sg_count,
+ 			      unsigned int offset, int tbl_off, int elen,
+-			      bool force)
++			      bool force, int align)
+ {
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
++	int aligned_len = ALIGN(len, align);
+ 
+ 	if (!src) {
+ 		to_talitos_ptr(ptr, 0, 0, is_sec1);
+@@ -1159,22 +1161,22 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ 	}
+ 	to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+ 	if (sg_count == 1 && !force) {
+-		to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
++		to_talitos_ptr(ptr, sg_dma_address(src) + offset, aligned_len, is_sec1);
+ 		return sg_count;
+ 	}
+ 	if (is_sec1) {
+-		to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
++		to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, aligned_len, is_sec1);
+ 		return sg_count;
+ 	}
+ 	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
+-					 &edesc->link_tbl[tbl_off]);
++					 &edesc->link_tbl[tbl_off], align);
+ 	if (sg_count == 1 && !force) {
+ 		/* Only one segment now, so no link tbl needed*/
+ 		copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
+ 		return sg_count;
+ 	}
+ 	to_talitos_ptr(ptr, edesc->dma_link_tbl +
+-			    tbl_off * sizeof(struct talitos_ptr), len, is_sec1);
++			    tbl_off * sizeof(struct talitos_ptr), aligned_len, is_sec1);
+ 	to_talitos_ptr_ext_or(ptr, DESC_PTR_LNKTBL_JUMP, is_sec1);
+ 
+ 	return sg_count;
+@@ -1186,7 +1188,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ 			  unsigned int offset, int tbl_off)
+ {
+ 	return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
+-				  tbl_off, 0, false);
++				  tbl_off, 0, false, 1);
+ }
+ 
+ /*
+@@ -1255,7 +1257,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 
+ 	ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
+ 				 sg_count, areq->assoclen, tbl_off, elen,
+-				 false);
++				 false, 1);
+ 
+ 	if (ret > 1) {
+ 		tbl_off += ret;
+@@ -1275,7 +1277,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 		elen = 0;
+ 	ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+ 				 sg_count, areq->assoclen, tbl_off, elen,
+-				 is_ipsec_esp && !encrypt);
++				 is_ipsec_esp && !encrypt, 1);
+ 	tbl_off += ret;
+ 
+ 	if (!encrypt && is_ipsec_esp) {
+@@ -1583,6 +1585,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ 	bool sync_needed = false;
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
++	bool is_ctr = (desc->hdr & DESC_HDR_SEL0_MASK) == DESC_HDR_SEL0_AESU &&
++		      (desc->hdr & DESC_HDR_MODE0_AESU_MASK) == DESC_HDR_MODE0_AESU_CTR;
+ 
+ 	/* first DWORD empty */
+ 
+@@ -1603,8 +1607,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ 	/*
+ 	 * cipher in
+ 	 */
+-	sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc,
+-				  &desc->ptr[3], sg_count, 0, 0);
++	sg_count = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[3],
++				      sg_count, 0, 0, 0, false, is_ctr ? 16 : 1);
+ 	if (sg_count > 1)
+ 		sync_needed = true;
+ 
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index 1469b956948ab..32825119e8805 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -344,6 +344,7 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
+ 
+ /* primary execution unit mode (MODE0) and derivatives */
+ #define	DESC_HDR_MODE0_ENCRYPT		cpu_to_be32(0x00100000)
++#define	DESC_HDR_MODE0_AESU_MASK	cpu_to_be32(0x00600000)
+ #define	DESC_HDR_MODE0_AESU_CBC		cpu_to_be32(0x00200000)
+ #define	DESC_HDR_MODE0_AESU_CTR		cpu_to_be32(0x00600000)
+ #define	DESC_HDR_MODE0_DEU_CBC		cpu_to_be32(0x00400000)
+-- 
+2.27.0
+
diff --git a/queue-5.4/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch b/queue-5.4/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch
new file mode 100644
index 00000000000..a066b7707aa
--- /dev/null
+++ b/queue-5.4/cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch
@@ -0,0 +1,105 @@
+From dbf78a962f03258935bdbb02ba75e49edf815cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 17:12:26 +0530
+Subject: cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in
+ cxgb4 and ulds
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 2355a6773a2cb0d2dce13432dde78497f1d6617b ]
+
+The Max imm data size in cxgb4 is not similar to the max imm data size
+in the chtls. This caused an mismatch in output of is_ofld_imm() of
+cxgb4 and chtls. So fixed this by keeping the max wreq size of imm data
+same in both chtls and cxgb4 as MAX_IMM_OFLD_TX_DATA_WR_LEN.
+
+As cxgb4's max imm. data value for ofld packets is changed to
+MAX_IMM_OFLD_TX_DATA_WR_LEN. Using the same in cxgbit also.
+
+Fixes: 36bedb3f2e5b8 ("crypto: chtls - Inline TLS record Tx")
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.h        |  3 ---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h |  3 +++
+ drivers/net/ethernet/chelsio/cxgb4/sge.c       | 11 ++++++++---
+ drivers/target/iscsi/cxgbit/cxgbit_target.c    |  3 +--
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 3fac0c74a41fa..df4451b306495 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -50,9 +50,6 @@
+ #define MIN_RCV_WND (24 * 1024U)
+ #define LOOPBACK(x)     (((x) & htonl(0xff000000)) == htonl(0x7f000000))
+ 
+-/* ulp_mem_io + ulptx_idata + payload + padding */
+-#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
+-
+ /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
+ #define TX_HEADER_LEN \
+ 	(sizeof(struct fw_ofld_tx_data_wr) + sizeof(struct sge_opaque_hdr))
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+index cee582e361341..6b71ec33bf14d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+@@ -44,6 +44,9 @@
+ 
+ #define MAX_ULD_QSETS 16
+ 
++/* ulp_mem_io + ulptx_idata + payload + padding */
++#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
++
+ /* CPL message priority levels */
+ enum {
+ 	CPL_PRIORITY_DATA     = 0,  /* data messages */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 049f1bbe27ab3..57bf10b4d80c8 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2158,17 +2158,22 @@ int t4_mgmt_tx(struct adapter *adap, struct sk_buff *skb)
+  *	@skb: the packet
+  *
+  *	Returns true if a packet can be sent as an offload WR with immediate
+- *	data.  We currently use the same limit as for Ethernet packets.
++ *	data.
++ *	FW_OFLD_TX_DATA_WR limits the payload to 255 bytes due to 8-bit field.
++ *      However, FW_ULPTX_WR commands have a 256 byte immediate only
++ *      payload limit.
+  */
+ static inline int is_ofld_imm(const struct sk_buff *skb)
+ {
+ 	struct work_request_hdr *req = (struct work_request_hdr *)skb->data;
+ 	unsigned long opcode = FW_WR_OP_G(ntohl(req->wr_hi));
+ 
+-	if (opcode == FW_CRYPTO_LOOKASIDE_WR)
++	if (unlikely(opcode == FW_ULPTX_WR))
++		return skb->len <= MAX_IMM_ULPTX_WR_LEN;
++	else if (opcode == FW_CRYPTO_LOOKASIDE_WR)
+ 		return skb->len <= SGE_MAX_WR_LEN;
+ 	else
+-		return skb->len <= MAX_IMM_TX_PKT_LEN;
++		return skb->len <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+ 
+ /**
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+index fcdc4211e3c27..45a1bfa2f7351 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+@@ -86,8 +86,7 @@ static int cxgbit_is_ofld_imm(const struct sk_buff *skb)
+ 	if (likely(cxgbit_skcb_flags(skb) & SKCBF_TX_ISO))
+ 		length += sizeof(struct cpl_tx_data_iso);
+ 
+-#define MAX_IMM_TX_PKT_LEN	256
+-	return length <= MAX_IMM_TX_PKT_LEN;
++	return length <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+ 
+ /*
+-- 
+2.27.0
+
diff --git a/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch b/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch
new file mode 100644
index 00000000000..e5e32dd02bb
--- /dev/null
+++ b/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch
@@ -0,0 +1,51 @@
+From 61d37ae5d5ebc03fc8a00823a5d9d2d8ef218a6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:06:14 +0100
+Subject: dmaengine: fsldma: Fix a resource leak in an error handling path of
+ the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b202d4e82531a62a33a6b14d321dd2aad491578e ]
+
+In case of error, the previous 'fsl_dma_chan_probe()' calls must be undone
+by some 'fsl_dma_chan_remove()', as already done in the remove function.
+
+It was added in the remove function in commit 77cd62e8082b ("fsldma: allow
+Freescale Elo DMA driver to be compiled as a module")
+
+Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212160614.92576-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsldma.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
+index 996f1d7623d69..eae385a312b88 100644
+--- a/drivers/dma/fsldma.c
++++ b/drivers/dma/fsldma.c
+@@ -1214,6 +1214,7 @@ static int fsldma_of_probe(struct platform_device *op)
+ {
+ 	struct fsldma_device *fdev;
+ 	struct device_node *child;
++	unsigned int i;
+ 	int err;
+ 
+ 	fdev = kzalloc(sizeof(*fdev), GFP_KERNEL);
+@@ -1292,6 +1293,10 @@ static int fsldma_of_probe(struct platform_device *op)
+ 	return 0;
+ 
+ out_free_fdev:
++	for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) {
++		if (fdev->chan[i])
++			fsl_dma_chan_remove(fdev->chan[i]);
++	}
+ 	irq_dispose_mapping(fdev->irq);
+ 	iounmap(fdev->regs);
+ out_free:
+-- 
+2.27.0
+
diff --git a/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch b/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch
new file mode 100644
index 00000000000..33cdf6cd5fd
--- /dev/null
+++ b/queue-5.4/dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch
@@ -0,0 +1,42 @@
+From b7d9fbb7a4df4adc382c800073df4d5c1f0dc5f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:05:16 +0100
+Subject: dmaengine: fsldma: Fix a resource leak in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit cbc0ad004c03ad7971726a5db3ec84dba3dcb857 ]
+
+A 'irq_dispose_mapping()' call is missing in the remove function.
+Add it.
+
+This is needed to undo the 'irq_of_parse_and_map() call from the probe
+function and already part of the error handling path of the probe function.
+
+It was added in the probe function only in commit d3f620b2c4fe ("fsldma:
+simplify IRQ probing and handling")
+
+Fixes: 77cd62e8082b ("fsldma: allow Freescale Elo DMA driver to be compiled as a module")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212160516.92515-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsldma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
+index ad72b3f42ffa0..996f1d7623d69 100644
+--- a/drivers/dma/fsldma.c
++++ b/drivers/dma/fsldma.c
+@@ -1314,6 +1314,7 @@ static int fsldma_of_remove(struct platform_device *op)
+ 		if (fdev->chan[i])
+ 			fsl_dma_chan_remove(fdev->chan[i]);
+ 	}
++	irq_dispose_mapping(fdev->irq);
+ 
+ 	iounmap(fdev->regs);
+ 	kfree(fdev);
+-- 
+2.27.0
+
diff --git a/queue-5.4/dmaengine-hsu-disable-spurious-interrupt.patch b/queue-5.4/dmaengine-hsu-disable-spurious-interrupt.patch
new file mode 100644
index 00000000000..d9e4529ba32
--- /dev/null
+++ b/queue-5.4/dmaengine-hsu-disable-spurious-interrupt.patch
@@ -0,0 +1,76 @@
+From b715ba04e5e4ca4e77b5f7a939b57063cc1f4d69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 23:37:49 +0100
+Subject: dmaengine: hsu: disable spurious interrupt
+
+From: Ferry Toth <ftoth@exalondelft.nl>
+
+[ Upstream commit 035b73b2b3b2e074a56489a7bf84b6a8012c0e0d ]
+
+On Intel Tangier B0 and Anniedale the interrupt line, disregarding
+to have different numbers, is shared between HSU DMA and UART IPs.
+Thus on such SoCs we are expecting that IRQ handler is called in
+UART driver only. hsu_pci_irq was handling the spurious interrupt
+from HSU DMA by returning immediately. This wastes CPU time and
+since HSU DMA and HSU UART interrupt occur simultaneously they race
+to be handled causing delay to the HSU UART interrupt handling.
+Fix this by disabling the interrupt entirely.
+
+Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case")
+Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20210112223749.97036-1-ftoth@exalondelft.nl
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hsu/pci.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/dma/hsu/pci.c b/drivers/dma/hsu/pci.c
+index 07cc7320a614f..9045a6f7f5893 100644
+--- a/drivers/dma/hsu/pci.c
++++ b/drivers/dma/hsu/pci.c
+@@ -26,22 +26,12 @@
+ static irqreturn_t hsu_pci_irq(int irq, void *dev)
+ {
+ 	struct hsu_dma_chip *chip = dev;
+-	struct pci_dev *pdev = to_pci_dev(chip->dev);
+ 	u32 dmaisr;
+ 	u32 status;
+ 	unsigned short i;
+ 	int ret = 0;
+ 	int err;
+ 
+-	/*
+-	 * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
+-	 * to have different numbers, is shared between HSU DMA and UART IPs.
+-	 * Thus on such SoCs we are expecting that IRQ handler is called in
+-	 * UART driver only.
+-	 */
+-	if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
+-		return IRQ_HANDLED;
+-
+ 	dmaisr = readl(chip->regs + HSU_PCI_DMAISR);
+ 	for (i = 0; i < chip->hsu->nr_channels; i++) {
+ 		if (dmaisr & 0x1) {
+@@ -105,6 +95,17 @@ static int hsu_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	if (ret)
+ 		goto err_register_irq;
+ 
++	/*
++	 * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
++	 * to have different numbers, is shared between HSU DMA and UART IPs.
++	 * Thus on such SoCs we are expecting that IRQ handler is called in
++	 * UART driver only. Instead of handling the spurious interrupt
++	 * from HSU DMA here and waste CPU time and delay HSU UART interrupt
++	 * handling, disable the interrupt entirely.
++	 */
++	if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
++		disable_irq_nosync(chip->irq);
++
+ 	pci_set_drvdata(pdev, chip);
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.4/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch b/queue-5.4/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch
new file mode 100644
index 00000000000..f6e22a3ed8f
--- /dev/null
+++ b/queue-5.4/dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch
@@ -0,0 +1,38 @@
+From 36e00402d09f29272af680ad7902203615067f9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:25:35 +0100
+Subject: dmaengine: owl-dma: Fix a resource leak in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 1f0a16f04113f9f0ab0c8e6d3abe661edab549e6 ]
+
+A 'dma_pool_destroy()' call is missing in the remove function.
+Add it.
+
+This call is already made in the error handling path of the probe function.
+
+Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212162535.95727-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/owl-dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c
+index af20e9a790a2a..bb9c361e224bc 100644
+--- a/drivers/dma/owl-dma.c
++++ b/drivers/dma/owl-dma.c
+@@ -1201,6 +1201,7 @@ static int owl_dma_remove(struct platform_device *pdev)
+ 	owl_dma_free(od);
+ 
+ 	clk_disable_unprepare(od->clk);
++	dma_pool_destroy(od->lli_pool);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch b/queue-5.4/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch
new file mode 100644
index 00000000000..3c44ccca291
--- /dev/null
+++ b/queue-5.4/drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch
@@ -0,0 +1,45 @@
+From 74bded9dbab7ef6fd0f02a49678a96326ff7b0ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 08:08:25 +0100
+Subject: Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()
+
+From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+
+[ Upstream commit e3fa4b747f085d2cda09bba0533b86fa76038635 ]
+
+When channel->device_obj is non-NULL, vmbus_onoffer_rescind() could
+invoke put_device(), that will eventually release the device and free
+the channel object (cf. vmbus_device_release()).  However, a pointer
+to the object is dereferenced again later to load the primary_channel.
+The use-after-free can be avoided by noticing that this load/check is
+redundant if device_obj is non-NULL: primary_channel must be NULL if
+device_obj is non-NULL, cf. vmbus_add_channel_work().
+
+Fixes: 54a66265d6754b ("Drivers: hv: vmbus: Fix rescind handling")
+Reported-by: Juan Vazquez <juvazq@microsoft.com>
+Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20201209070827.29335-5-parri.andrea@gmail.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel_mgmt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 452307c79e4b9..0b55bc146b292 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -1101,8 +1101,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 			vmbus_device_unregister(channel->device_obj);
+ 			put_device(dev);
+ 		}
+-	}
+-	if (channel->primary_channel != NULL) {
++	} else if (channel->primary_channel != NULL) {
+ 		/*
+ 		 * Sub-channel is being rescinded. Following is the channel
+ 		 * close sequence when initiated from the driveri (refer to
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch b/queue-5.4/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch
new file mode 100644
index 00000000000..4db9532613b
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch
@@ -0,0 +1,59 @@
+From 698d1df12af9acf41fa5600d129d8c31899224a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 07:17:02 +0100
+Subject: drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth
+ reduction.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+[ Upstream commit 1916866dfa4aaceba1a70db83fde569387649d93 ]
+
+In set_clamp(), the comments and definitions for the COLOR_DEPTH_101010
+and COLOR_DEPTH_121212 cases directly contradict the code comment which
+explains how this should work, whereas the COLOR_DEPTH_888 case
+is consistent with the code comments. Comment says the bitmask should
+be chosen to align to the top-most 10 or 12 MSB's on a 14 bit bus, but
+the implementation contradicts that: 10 bit case sets a mask for 12 bpc
+clamping, whereas 12 bit case sets a mask for 14 bpc clamping.
+
+Note that during my limited testing on DCE-8.3 (HDMI deep color)
+and DCE-11.2 (DP deep color), this didn't have any obvious ill
+effects, neither did fixing it change anything obvious for the
+better, so this fix may be inconsequential on DCE, and just
+reduce the confusion of innocent bystanders when reading the code
+and trying to investigate problems with 10 bpc+ output.
+
+Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index ab63d0d0304cb..6fd57cfb112f5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -429,12 +429,12 @@ static void set_clamp(
+ 		clamp_max = 0x3FC0;
+ 		break;
+ 	case COLOR_DEPTH_101010:
+-		/* 10bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
+-		clamp_max = 0x3FFC;
++		/* 10bit MSB aligned on 14 bit bus '11 1111 1111 0000' */
++		clamp_max = 0x3FF0;
+ 		break;
+ 	case COLOR_DEPTH_121212:
+-		/* 12bit MSB aligned on 14 bit bus '11 1111 1111 1111' */
+-		clamp_max = 0x3FFF;
++		/* 12bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
++		clamp_max = 0x3FFC;
+ 		break;
+ 	default:
+ 		clamp_max = 0x3FC0;
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch b/queue-5.4/drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch
new file mode 100644
index 00000000000..f4236252d36
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch
@@ -0,0 +1,194 @@
+From 62da3b4059eccf3c4d474578910a13db8c7f315e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 07:17:03 +0100
+Subject: drm/amd/display: Fix HDMI deep color output for DCE 6-11.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+[ Upstream commit efa18405baa55a864c61d2f3cc6fe4d363818eb3 ]
+
+This fixes corrupted display output in HDMI deep color
+10/12 bpc mode at least as observed on AMD Mullins, DCE-8.3.
+
+It will hopefully also provide fixes for other DCE's up to
+DCE-11, assuming those will need similar fixes, but i could
+not test that for HDMI due to lack of suitable hw, so viewer
+discretion is advised.
+
+dce110_stream_encoder_hdmi_set_stream_attribute() is used for
+HDMI setup on all DCE's and is missing color_depth assignment.
+
+dce110_program_pix_clk() is used for pixel clock setup on HDMI
+for DCE 6-11, and is missing color_depth assignment.
+
+Additionally some of the underlying Atombios specific encoder
+and pixelclock setup functions are missing code which is in
+the classic amdgpu kms modesetting path and the in the radeon
+kms driver for DCE6/DCE8.
+
+encoder_control_digx_v3() - Was missing setup code wrt. amdgpu
+and radeon kms classic drivers. Added here, but untested due to
+lack of suitable test hw.
+
+encoder_control_digx_v4() - Added missing setup code.
+Successfully tested on AMD mullins / DCE-8.3 with HDMI deep color
+output at 10 bpc and 12 bpc.
+
+Note that encoder_control_digx_v5() has proper setup code in place
+and is used, e.g., by DCE-11.2, but this code wasn't used for deep
+color setup due to the missing cntl.color_depth setup in the calling
+function for HDMI.
+
+set_pixel_clock_v5() - Missing setup code wrt. classic amdgpu/radeon
+kms. Added here, but untested due to lack of hw.
+
+set_pixel_clock_v6() - Missing setup code added. Successfully tested
+on AMD mullins DCE-8.3. This fixes corrupted display output at HDMI
+deep color output with 10 bpc or 12 bpc.
+
+Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/bios/command_table.c   | 61 +++++++++++++++++++
+ .../drm/amd/display/dc/dce/dce_clock_source.c | 14 +++++
+ .../amd/display/dc/dce/dce_stream_encoder.c   |  1 +
+ 3 files changed, 76 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table.c b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+index 5815983caaf80..0d2e13627c647 100644
+--- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c
++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+@@ -245,6 +245,23 @@ static enum bp_result encoder_control_digx_v3(
+ 					cntl->enable_dp_audio);
+ 	params.ucLaneNum = (uint8_t)(cntl->lanes_number);
+ 
++	switch (cntl->color_depth) {
++	case COLOR_DEPTH_888:
++		params.ucBitPerColor = PANEL_8BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_101010:
++		params.ucBitPerColor = PANEL_10BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_121212:
++		params.ucBitPerColor = PANEL_12BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_161616:
++		params.ucBitPerColor = PANEL_16BIT_PER_COLOR;
++		break;
++	default:
++		break;
++	}
++
+ 	if (EXEC_BIOS_CMD_TABLE(DIGxEncoderControl, params))
+ 		result = BP_RESULT_OK;
+ 
+@@ -274,6 +291,23 @@ static enum bp_result encoder_control_digx_v4(
+ 					cntl->enable_dp_audio));
+ 	params.ucLaneNum = (uint8_t)(cntl->lanes_number);
+ 
++	switch (cntl->color_depth) {
++	case COLOR_DEPTH_888:
++		params.ucBitPerColor = PANEL_8BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_101010:
++		params.ucBitPerColor = PANEL_10BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_121212:
++		params.ucBitPerColor = PANEL_12BIT_PER_COLOR;
++		break;
++	case COLOR_DEPTH_161616:
++		params.ucBitPerColor = PANEL_16BIT_PER_COLOR;
++		break;
++	default:
++		break;
++	}
++
+ 	if (EXEC_BIOS_CMD_TABLE(DIGxEncoderControl, params))
+ 		result = BP_RESULT_OK;
+ 
+@@ -1057,6 +1091,19 @@ static enum bp_result set_pixel_clock_v5(
+ 		 * driver choose program it itself, i.e. here we program it
+ 		 * to 888 by default.
+ 		 */
++		if (bp_params->signal_type == SIGNAL_TYPE_HDMI_TYPE_A)
++			switch (bp_params->color_depth) {
++			case TRANSMITTER_COLOR_DEPTH_30:
++				/* yes this is correct, the atom define is wrong */
++				clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_32BPP;
++				break;
++			case TRANSMITTER_COLOR_DEPTH_36:
++				/* yes this is correct, the atom define is wrong */
++				clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
++				break;
++			default:
++				break;
++			}
+ 
+ 		if (EXEC_BIOS_CMD_TABLE(SetPixelClock, clk))
+ 			result = BP_RESULT_OK;
+@@ -1135,6 +1182,20 @@ static enum bp_result set_pixel_clock_v6(
+ 		 * driver choose program it itself, i.e. here we pass required
+ 		 * target rate that includes deep color.
+ 		 */
++		if (bp_params->signal_type == SIGNAL_TYPE_HDMI_TYPE_A)
++			switch (bp_params->color_depth) {
++			case TRANSMITTER_COLOR_DEPTH_30:
++				clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP_V6;
++				break;
++			case TRANSMITTER_COLOR_DEPTH_36:
++				clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP_V6;
++				break;
++			case TRANSMITTER_COLOR_DEPTH_48:
++				clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
++				break;
++			default:
++				break;
++			}
+ 
+ 		if (EXEC_BIOS_CMD_TABLE(SetPixelClock, clk))
+ 			result = BP_RESULT_OK;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+index f787a6b947812..eca67d5d5b10d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+@@ -871,6 +871,20 @@ static bool dce110_program_pix_clk(
+ 	bp_pc_params.flags.SET_EXTERNAL_REF_DIV_SRC =
+ 					pll_settings->use_external_clk;
+ 
++	switch (pix_clk_params->color_depth) {
++	case COLOR_DEPTH_101010:
++		bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_30;
++		break;
++	case COLOR_DEPTH_121212:
++		bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_36;
++		break;
++	case COLOR_DEPTH_161616:
++		bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_48;
++		break;
++	default:
++		break;
++	}
++
+ 	if (clk_src->bios->funcs->set_pixel_clock(
+ 			clk_src->bios, &bp_pc_params) != BP_RESULT_OK)
+ 		return false;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
+index 6ed922a3c1cd5..c25840a774f94 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
+@@ -563,6 +563,7 @@ static void dce110_stream_encoder_hdmi_set_stream_attribute(
+ 	cntl.enable_dp_audio = enable_audio;
+ 	cntl.pixel_clock = actual_pix_clk_khz;
+ 	cntl.lanes_number = LANE_COUNT_FOUR;
++	cntl.color_depth = crtc_timing->display_color_depth;
+ 
+ 	if (enc110->base.bp->funcs->encoder_control(
+ 			enc110->base.bp, &cntl) != BP_RESULT_OK)
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch b/queue-5.4/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch
new file mode 100644
index 00000000000..458c6cd1180
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch
@@ -0,0 +1,38 @@
+From 0f8e061e78905b60be7a92eeb79996ca31a753bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 16:56:07 +0800
+Subject: drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if
+ condition
+
+From: Chenyang Li <lichenyang@loongson.cn>
+
+[ Upstream commit 956e20eb0fbb206e5e795539db5469db099715c8 ]
+
+Add an underscore in amdgpu_trace.h line 24 "_AMDGPU_TRACE_H".
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Chenyang Li <lichenyang@loongson.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+index 91899d28fa722..e8132210c244c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+@@ -21,7 +21,7 @@
+  *
+  */
+ 
+-#if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
++#if !defined(_AMDGPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+ #define _AMDGPU_TRACE_H_
+ 
+ #include <linux/stringify.h>
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch b/queue-5.4/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch
new file mode 100644
index 00000000000..a0e13caca3f
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch
@@ -0,0 +1,48 @@
+From 92f524a6ac006b01fb7cec832348578139ad0a90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 08:56:36 +0300
+Subject: drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c915ef890d5dc79f483e1ca3b3a5b5f1a170690c ]
+
+If the user passes a "level" value which is higher than 31 then that
+leads to shift wrapping.  The undefined behavior will lead to a
+syzkaller stack dump.
+
+Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 3f744e72912f1..bcb7ab5c602d1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -870,7 +870,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
+ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ {
+ 	int ret;
+-	long level;
++	unsigned long level;
+ 	char *sub_str = NULL;
+ 	char *tmp;
+ 	char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
+@@ -886,8 +886,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ 	while (tmp[0]) {
+ 		sub_str = strsep(&tmp, delimiter);
+ 		if (strlen(sub_str)) {
+-			ret = kstrtol(sub_str, 0, &level);
+-			if (ret)
++			ret = kstrtoul(sub_str, 0, &level);
++			if (ret || level > 31)
+ 				return -EINVAL;
+ 			*mask |= 1 << level;
+ 		} else
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch b/queue-5.4/drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch
new file mode 100644
index 00000000000..c553e0588e2
--- /dev/null
+++ b/queue-5.4/drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch
@@ -0,0 +1,59 @@
+From 04bc9b06f963609161ce6bf5c21200289425ea24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 22:42:48 +0800
+Subject: drm/fb-helper: Add missed unlocks in setcmap_legacy()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 0a260e731d6c4c17547ac275a2cde888a9eb4a3d ]
+
+setcmap_legacy() does not call drm_modeset_unlock_all() in some exits,
+add the missed unlocks with goto to fix it.
+
+Fixes: 964c60063bff ("drm/fb-helper: separate the fb_setcmap helper into atomic and legacy paths")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201203144248.418281-1-hslester96@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 6b8502bcf0fd3..02ffde5fd7226 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -965,11 +965,15 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
+ 	drm_modeset_lock_all(fb_helper->dev);
+ 	drm_client_for_each_modeset(modeset, &fb_helper->client) {
+ 		crtc = modeset->crtc;
+-		if (!crtc->funcs->gamma_set || !crtc->gamma_size)
+-			return -EINVAL;
++		if (!crtc->funcs->gamma_set || !crtc->gamma_size) {
++			ret = -EINVAL;
++			goto out;
++		}
+ 
+-		if (cmap->start + cmap->len > crtc->gamma_size)
+-			return -EINVAL;
++		if (cmap->start + cmap->len > crtc->gamma_size) {
++			ret = -EINVAL;
++			goto out;
++		}
+ 
+ 		r = crtc->gamma_store;
+ 		g = r + crtc->gamma_size;
+@@ -982,8 +986,9 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
+ 		ret = crtc->funcs->gamma_set(crtc, r, g, b,
+ 					     crtc->gamma_size, NULL);
+ 		if (ret)
+-			return ret;
++			goto out;
+ 	}
++out:
+ 	drm_modeset_unlock_all(fb_helper->dev);
+ 
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-gma500-fix-error-return-code-in-psb_driver_load.patch b/queue-5.4/drm-gma500-fix-error-return-code-in-psb_driver_load.patch
new file mode 100644
index 00000000000..69cba33e4c3
--- /dev/null
+++ b/queue-5.4/drm-gma500-fix-error-return-code-in-psb_driver_load.patch
@@ -0,0 +1,38 @@
+From 468b06fbdcd0a61efcc6e6913f006a340e2ae2eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 10:02:16 +0800
+Subject: drm/gma500: Fix error return code in psb_driver_load()
+
+From: Jialin Zhang <zhangjialin11@huawei.com>
+
+[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/psb_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index 7005f8f69c683..d414525eccf6d 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -313,6 +313,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
+ 	if (ret)
+ 		goto out_err;
+ 
++	ret = -ENOMEM;
++
+ 	dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
+ 	if (!dev_priv->mmu)
+ 		goto out_err;
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch b/queue-5.4/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch
new file mode 100644
index 00000000000..8b8b2653629
--- /dev/null
+++ b/queue-5.4/drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch
@@ -0,0 +1,37 @@
+From 50cbe8775343aaac551006d767228fda7be955c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 17:15:58 +0100
+Subject: drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+[ Upstream commit 33a7808ce1aea6e2edc1af25db25928137940c02 ]
+
+The previous registers were *almost* correct, but instead of
+PHYs, they were pointing at DSI PLLs, resulting in the PHY id
+autodetection failing miserably.
+
+Fixes: dcefc117cc19 ("drm/msm/dsi: Add support for msm8x94")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+index 1afb7c579dbbb..eca86bf448f74 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+@@ -139,7 +139,7 @@ const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs = {
+ 		.disable = dsi_20nm_phy_disable,
+ 		.init = msm_dsi_phy_init_common,
+ 	},
+-	.io_start = { 0xfd998300, 0xfd9a0300 },
++	.io_start = { 0xfd998500, 0xfd9a0500 },
+ 	.num_dsi_phy = 2,
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch b/queue-5.4/drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch
new file mode 100644
index 00000000000..03a483dff4e
--- /dev/null
+++ b/queue-5.4/drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch
@@ -0,0 +1,43 @@
+From 0bf60cd49163b179fc9b4423759f366463d96676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:24:40 +0200
+Subject: drm/msm/mdp5: Fix wait-for-commit for cmd panels
+
+From: Iskren Chernev <iskren.chernev@gmail.com>
+
+[ Upstream commit 68e4f01fddb4ead80e8c7084db489307f22c9cbb ]
+
+Before the offending commit in msm_atomic_commit_tail wait_flush was
+called once per frame, after the commit was submitted. After it
+wait_flush is also called at the beginning to ensure previous
+potentially async commits are done.
+
+For cmd panels the source of wait_flush is a ping-pong irq notifying
+a completion. The completion needs to be notified with complete_all so
+multiple waiting parties (new async committers) can proceed.
+
+Signed-off-by: Iskren Chernev <iskren.chernev@gmail.com>
+Suggested-by: Rob Clark <robdclark@gmail.com>
+Fixes: 2d99ced787e3d ("drm/msm: async commit support")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+index 03c6d6157e4d0..395146884a222 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -1099,7 +1099,7 @@ static void mdp5_crtc_pp_done_irq(struct mdp_irq *irq, uint32_t irqstatus)
+ 	struct mdp5_crtc *mdp5_crtc = container_of(irq, struct mdp5_crtc,
+ 								pp_done);
+ 
+-	complete(&mdp5_crtc->pp_completion);
++	complete_all(&mdp5_crtc->pp_completion);
+ }
+ 
+ static void mdp5_crtc_wait_for_pp_done(struct drm_crtc *crtc)
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch b/queue-5.4/drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch
new file mode 100644
index 00000000000..e5da6f70486
--- /dev/null
+++ b/queue-5.4/drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch
@@ -0,0 +1,127 @@
+From 0f965a72196688b46b3b3863fd90c8f752c2e525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 11:28:46 +0200
+Subject: drm/nouveau: bail out of nouveau_channel_new if channel init fails
+
+From: Frantisek Hrbata <frantisek@hrbata.com>
+
+[ Upstream commit eaba3b28401f50e22d64351caa8afe8d29509f27 ]
+
+Unprivileged user can crash kernel by using DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC
+ioctl. This was reported by trinity[1] fuzzer.
+
+[   71.073906] nouveau 0000:01:00.0: crashme[1329]: channel failed to initialise, -17
+[   71.081730] BUG: kernel NULL pointer dereference, address: 00000000000000a0
+[   71.088928] #PF: supervisor read access in kernel mode
+[   71.094059] #PF: error_code(0x0000) - not-present page
+[   71.099189] PGD 119590067 P4D 119590067 PUD 1054f5067 PMD 0
+[   71.104842] Oops: 0000 [#1] SMP NOPTI
+[   71.108498] CPU: 2 PID: 1329 Comm: crashme Not tainted 5.8.0-rc6+ #2
+[   71.114993] Hardware name: AMD Pike/Pike, BIOS RPK1506A 09/03/2014
+[   71.121213] RIP: 0010:nouveau_abi16_ioctl_channel_alloc+0x108/0x380 [nouveau]
+[   71.128339] Code: 48 89 9d f0 00 00 00 41 8b 4c 24 04 41 8b 14 24 45 31 c0 4c 8d 4b 10 48 89 ee 4c 89 f7 e8 10 11 00 00 85 c0 75 78 48 8b 43 10 <8b> 90 a0 00 00 00 41 89 54 24 08 80 7d 3d 05 0f 86 bb 01 00 00 41
+[   71.147074] RSP: 0018:ffffb4a1809cfd38 EFLAGS: 00010246
+[   71.152526] RAX: 0000000000000000 RBX: ffff98cedbaa1d20 RCX: 00000000000003bf
+[   71.159651] RDX: 00000000000003be RSI: 0000000000000000 RDI: 0000000000030160
+[   71.166774] RBP: ffff98cee776de00 R08: ffffdc0144198a08 R09: ffff98ceeefd4000
+[   71.173901] R10: ffff98cee7e81780 R11: 0000000000000001 R12: ffffb4a1809cfe08
+[   71.181214] R13: ffff98cee776d000 R14: ffff98cec519e000 R15: ffff98cee776def0
+[   71.188339] FS:  00007fd926250500(0000) GS:ffff98ceeac80000(0000) knlGS:0000000000000000
+[   71.196418] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   71.202155] CR2: 00000000000000a0 CR3: 0000000106622000 CR4: 00000000000406e0
+[   71.209297] Call Trace:
+[   71.211777]  ? nouveau_abi16_ioctl_getparam+0x1f0/0x1f0 [nouveau]
+[   71.218053]  drm_ioctl_kernel+0xac/0xf0 [drm]
+[   71.222421]  drm_ioctl+0x211/0x3c0 [drm]
+[   71.226379]  ? nouveau_abi16_ioctl_getparam+0x1f0/0x1f0 [nouveau]
+[   71.232500]  nouveau_drm_ioctl+0x57/0xb0 [nouveau]
+[   71.237285]  ksys_ioctl+0x86/0xc0
+[   71.240595]  __x64_sys_ioctl+0x16/0x20
+[   71.244340]  do_syscall_64+0x4c/0x90
+[   71.248110]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[   71.253162] RIP: 0033:0x7fd925d4b88b
+[   71.256731] Code: Bad RIP value.
+[   71.259955] RSP: 002b:00007ffc743592d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
+[   71.267514] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd925d4b88b
+[   71.274637] RDX: 0000000000601080 RSI: 00000000c0586442 RDI: 0000000000000003
+[   71.281986] RBP: 00007ffc74359340 R08: 00007fd926016ce0 R09: 00007fd926016ce0
+[   71.289111] R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000400620
+[   71.296235] R13: 00007ffc74359420 R14: 0000000000000000 R15: 0000000000000000
+[   71.303361] Modules linked in: rfkill sunrpc snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core edac_mce_amd snd_hwdep kvm_amd snd_seq ccp snd_seq_device snd_pcm kvm snd_timer snd irqbypass soundcore sp5100_tco pcspkr crct10dif_pclmul crc32_pclmul ghash_clmulni_intel wmi_bmof joydev i2c_piix4 fam15h_power k10temp acpi_cpufreq ip_tables xfs libcrc32c sd_mod t10_pi sg nouveau video mxm_wmi i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm broadcom bcm_phy_lib ata_generic ahci drm e1000 crc32c_intel libahci serio_raw tg3 libata firewire_ohci firewire_core wmi crc_itu_t dm_mirror dm_region_hash dm_log dm_mod
+[   71.365269] CR2: 00000000000000a0
+
+simplified reproducer
+---------------------------------8<----------------------------------------
+/*
+ * gcc -o crashme crashme.c
+ * ./crashme /dev/dri/renderD128
+ */
+
+struct drm_nouveau_channel_alloc {
+	uint32_t     fb_ctxdma_handle;
+	uint32_t     tt_ctxdma_handle;
+
+	int          channel;
+	uint32_t     pushbuf_domains;
+
+	/* Notifier memory */
+	uint32_t     notifier_handle;
+
+	/* DRM-enforced subchannel assignments */
+	struct {
+		uint32_t handle;
+		uint32_t grclass;
+	} subchan[8];
+	uint32_t nr_subchan;
+};
+
+static struct drm_nouveau_channel_alloc channel;
+
+int main(int argc, char *argv[]) {
+	int fd;
+	int rv;
+
+	if (argc != 2)
+		die("usage: %s <dev>", 0, argv[0]);
+
+	if ((fd = open(argv[1], O_RDONLY)) == -1)
+		die("open %s", errno, argv[1]);
+
+	if (ioctl(fd, DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC, &channel) == -1 &&
+			errno == EACCES)
+		die("ioctl %s", errno, argv[1]);
+
+	close(fd);
+
+	printf("PASS\n");
+
+	return 0;
+}
+---------------------------------8<----------------------------------------
+
+[1] https://github.com/kernelslacker/trinity
+
+Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared virtual memory")
+Signed-off-by: Frantisek Hrbata <frantisek@hrbata.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_chan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c
+index 282fd90b65e13..9ce7b0d4b8764 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_chan.c
++++ b/drivers/gpu/drm/nouveau/nouveau_chan.c
+@@ -497,6 +497,7 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device,
+ 	if (ret) {
+ 		NV_PRINTK(err, cli, "channel failed to initialise, %d\n", ret);
+ 		nouveau_channel_del(pchan);
++		goto done;
+ 	}
+ 
+ 	ret = nouveau_svmm_join((*pchan)->vmm->svmm, (*pchan)->inst);
+-- 
+2.27.0
+
diff --git a/queue-5.4/drm-sun4i-tcon-fix-inverted-dclk-polarity.patch b/queue-5.4/drm-sun4i-tcon-fix-inverted-dclk-polarity.patch
new file mode 100644
index 00000000000..a529f6da012
--- /dev/null
+++ b/queue-5.4/drm-sun4i-tcon-fix-inverted-dclk-polarity.patch
@@ -0,0 +1,85 @@
+From be997d3540c5d3c815e6d6a069202628314940e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 09:17:32 +0100
+Subject: drm/sun4i: tcon: fix inverted DCLK polarity
+
+From: Giulio Benetti <giulio.benetti@micronovasrl.com>
+
+[ Upstream commit 67f4aeb2b41a0629abde3794d463547f60b0cbdd ]
+
+During commit 88bc4178568b ("drm: Use new
+DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags") DRM_BUS_FLAG_*
+macros have been changed to avoid ambiguity but just because of this
+ambiguity previous DRM_BUS_FLAG_PIXDATA_(POS/NEG)EDGE were used meaning
+_SAMPLE_ not _DRIVE_. This leads to DLCK inversion and need to fix but
+instead of swapping phase values, let's adopt an easier approach Maxime
+suggested:
+It turned out that bit 26 of SUN4I_TCON0_IO_POL_REG is dedicated to
+invert DCLK polarity and this makes things really easier than before. So
+let's handle DCLK polarity by adding SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE
+as bit 26 and activating according to bus_flags the same way it is done
+for all the other signals polarity.
+
+Fixes: 88bc4178568b ("drm: Use new DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags")
+Suggested-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210114081732.9386-1-giulio.benetti@benettiengineering.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 21 ++-------------------
+ drivers/gpu/drm/sun4i/sun4i_tcon.h |  1 +
+ 2 files changed, 3 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 6bf1425e8b0ca..eb3b2350687fb 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -545,30 +545,13 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
+ 	if (info->bus_flags & DRM_BUS_FLAG_DE_LOW)
+ 		val |= SUN4I_TCON0_IO_POL_DE_NEGATIVE;
+ 
+-	/*
+-	 * On A20 and similar SoCs, the only way to achieve Positive Edge
+-	 * (Rising Edge), is setting dclk clock phase to 2/3(240°).
+-	 * By default TCON works in Negative Edge(Falling Edge),
+-	 * this is why phase is set to 0 in that case.
+-	 * Unfortunately there's no way to logically invert dclk through
+-	 * IO_POL register.
+-	 * The only acceptable way to work, triple checked with scope,
+-	 * is using clock phase set to 0° for Negative Edge and set to 240°
+-	 * for Positive Edge.
+-	 * On A33 and similar SoCs there would be a 90° phase option,
+-	 * but it divides also dclk by 2.
+-	 * Following code is a way to avoid quirks all around TCON
+-	 * and DOTCLOCK drivers.
+-	 */
+-	if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE)
+-		clk_set_phase(tcon->dclk, 240);
+-
+ 	if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+-		clk_set_phase(tcon->dclk, 0);
++		val |= SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE;
+ 
+ 	regmap_update_bits(tcon->regs, SUN4I_TCON0_IO_POL_REG,
+ 			   SUN4I_TCON0_IO_POL_HSYNC_POSITIVE |
+ 			   SUN4I_TCON0_IO_POL_VSYNC_POSITIVE |
++			   SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE |
+ 			   SUN4I_TCON0_IO_POL_DE_NEGATIVE,
+ 			   val);
+ 
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+index 5bdbaf0847824..ce500c8dd4c72 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+@@ -113,6 +113,7 @@
+ #define SUN4I_TCON0_IO_POL_REG			0x88
+ #define SUN4I_TCON0_IO_POL_DCLK_PHASE(phase)		((phase & 3) << 28)
+ #define SUN4I_TCON0_IO_POL_DE_NEGATIVE			BIT(27)
++#define SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE		BIT(26)
+ #define SUN4I_TCON0_IO_POL_HSYNC_POSITIVE		BIT(25)
+ #define SUN4I_TCON0_IO_POL_VSYNC_POSITIVE		BIT(24)
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/evm-fix-memleak-in-init_desc.patch b/queue-5.4/evm-fix-memleak-in-init_desc.patch
new file mode 100644
index 00000000000..c0242318b9a
--- /dev/null
+++ b/queue-5.4/evm-fix-memleak-in-init_desc.patch
@@ -0,0 +1,55 @@
+From 97c654ef762ccc252ef6c7260cb8c8fab7aaa23c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 16:02:53 +0800
+Subject: evm: Fix memleak in init_desc
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit ccf11dbaa07b328fa469415c362d33459c140a37 ]
+
+tmp_tfm is allocated, but not freed on subsequent kmalloc failure, which
+leads to a memory leak.  Free tmp_tfm.
+
+Fixes: d46eb3699502b ("evm: crypto hash replaced by shash")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+[zohar@linux.ibm.com: formatted/reworded patch description]
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_crypto.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index ee6bd945f3d6a..25dac691491b1 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ {
+ 	long rc;
+ 	const char *algo;
+-	struct crypto_shash **tfm, *tmp_tfm;
++	struct crypto_shash **tfm, *tmp_tfm = NULL;
+ 	struct shash_desc *desc;
+ 
+ 	if (type == EVM_XATTR_HMAC) {
+@@ -120,13 +120,16 @@ unlock:
+ alloc:
+ 	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
+ 			GFP_KERNEL);
+-	if (!desc)
++	if (!desc) {
++		crypto_free_shash(tmp_tfm);
+ 		return ERR_PTR(-ENOMEM);
++	}
+ 
+ 	desc->tfm = *tfm;
+ 
+ 	rc = crypto_shash_init(desc);
+ 	if (rc) {
++		crypto_free_shash(tmp_tfm);
+ 		kfree(desc);
+ 		return ERR_PTR(rc);
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/ext4-fix-potential-htree-index-checksum-corruption.patch b/queue-5.4/ext4-fix-potential-htree-index-checksum-corruption.patch
new file mode 100644
index 00000000000..69178c45fc6
--- /dev/null
+++ b/queue-5.4/ext4-fix-potential-htree-index-checksum-corruption.patch
@@ -0,0 +1,55 @@
+From 9ce493f642ed2f7280b3d1f4159d98ecc7efb0fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 00:05:20 -0500
+Subject: ext4: fix potential htree index checksum corruption
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit b5776e7524afbd4569978ff790864755c438bba7 ]
+
+In the case where we need to do an interior node split, and
+immediately afterwards, we are unable to allocate a new directory leaf
+block due to ENOSPC, the directory index checksum's will not be filled
+in correctly (and indeed, will not be correctly journalled).
+
+This looks like a bug that was introduced when we added largedir
+support.  The original code doesn't make any sense (and should have
+been caught in code review), but it was hidden because most of the
+time, the index node checksum will be set by do_split().  But if
+do_split bails out due to ENOSPC, then ext4_handle_dirty_dx_node()
+won't get called, and so the directory index checksum field will not
+get set, leading to:
+
+EXT4-fs error (device sdb): dx_probe:858: inode #6635543: block 4022: comm nfsd: Directory index failed checksum
+
+Google-Bug-Id: 176345532
+Fixes: e08ac99fa2a2 ("ext4: add largedir feature")
+Cc: Artem Blagodarenko <artem.blagodarenko@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/namei.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index f05ec9bfbf4fd..7f22487d502b5 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2405,11 +2405,10 @@ again:
+ 						   (frame - 1)->bh);
+ 			if (err)
+ 				goto journal_error;
+-			if (restart) {
+-				err = ext4_handle_dirty_dx_node(handle, dir,
+-							   frame->bh);
++			err = ext4_handle_dirty_dx_node(handle, dir,
++							frame->bh);
++			if (err)
+ 				goto journal_error;
+-			}
+ 		} else {
+ 			struct dx_root *dxroot;
+ 			memcpy((char *) entries2, (char *) entries,
+-- 
+2.27.0
+
diff --git a/queue-5.4/f2fs-fix-a-wrong-condition-in-__submit_bio.patch b/queue-5.4/f2fs-fix-a-wrong-condition-in-__submit_bio.patch
new file mode 100644
index 00000000000..a7626728f6c
--- /dev/null
+++ b/queue-5.4/f2fs-fix-a-wrong-condition-in-__submit_bio.patch
@@ -0,0 +1,37 @@
+From 316f49b6d866045dae9f8cca061eee9d62dae932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:39:22 +0800
+Subject: f2fs: fix a wrong condition in __submit_bio
+
+From: Dehe Gu <gudehe@huawei.com>
+
+[ Upstream commit 39f71b7e40e21805d6b15fc7750bdd9cab6a5010 ]
+
+We should use !F2FS_IO_ALIGNED() to check and submit_io directly.
+
+Fixes: 8223ecc456d0 ("f2fs: fix to add missing F2FS_IO_ALIGNED() condition")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Dehe Gu <gudehe@huawei.com>
+Signed-off-by: Ge Qiu <qiuge@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 68be334afc286..64ee2a064e339 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -318,7 +318,7 @@ static inline void __submit_bio(struct f2fs_sb_info *sbi,
+ 		if (test_opt(sbi, LFS) && current->plug)
+ 			blk_finish_plug(current->plug);
+ 
+-		if (F2FS_IO_ALIGNED(sbi))
++		if (!F2FS_IO_ALIGNED(sbi))
+ 			goto submit_io;
+ 
+ 		start = bio->bi_iter.bi_size >> F2FS_BLKSIZE_BITS;
+-- 
+2.27.0
+
diff --git a/queue-5.4/f2fs-fix-to-avoid-inconsistent-quota-data.patch b/queue-5.4/f2fs-fix-to-avoid-inconsistent-quota-data.patch
new file mode 100644
index 00000000000..869e1e18b47
--- /dev/null
+++ b/queue-5.4/f2fs-fix-to-avoid-inconsistent-quota-data.patch
@@ -0,0 +1,100 @@
+From 4db8ce27a8364169952b1be45f73b3eb35737118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 17:02:56 +0800
+Subject: f2fs: fix to avoid inconsistent quota data
+
+From: Yi Chen <chenyi77@huawei.com>
+
+[ Upstream commit 25fb04dbce6a0e165d28fd1fa8a1d7018c637fe8 ]
+
+Occasionally, quota data may be corrupted detected by fsck:
+
+Info: checkpoint state = 45 :  crc compacted_summary unmount
+[QUOTA WARNING] Usage inconsistent for ID 0:actual (1543036928, 762) != expected (1543032832, 762)
+[ASSERT] (fsck_chk_quota_files:1986)  --> Quota file is missing or invalid quota file content found.
+[QUOTA WARNING] Usage inconsistent for ID 0:actual (1352478720, 344) != expected (1352474624, 344)
+[ASSERT] (fsck_chk_quota_files:1986)  --> Quota file is missing or invalid quota file content found.
+
+[FSCK] Unreachable nat entries                        [Ok..] [0x0]
+[FSCK] SIT valid block bitmap checking                [Ok..]
+[FSCK] Hard link checking for regular file            [Ok..] [0x0]
+[FSCK] valid_block_count matching with CP             [Ok..] [0xdf299]
+[FSCK] valid_node_count matcing with CP (de lookup)   [Ok..] [0x2b01]
+[FSCK] valid_node_count matcing with CP (nat lookup)  [Ok..] [0x2b01]
+[FSCK] valid_inode_count matched with CP              [Ok..] [0x2665]
+[FSCK] free segment_count matched with CP             [Ok..] [0xcb04]
+[FSCK] next block offset is free                      [Ok..]
+[FSCK] fixing SIT types
+[FSCK] other corrupted bugs                           [Fail]
+
+The root cause is:
+If we open file w/ readonly flag, disk quota info won't be initialized
+for this file, however, following mmap() will force to convert inline
+inode via f2fs_convert_inline_inode(), which may increase block usage
+for this inode w/o updating quota data, it causes inconsistent disk quota
+info.
+
+The issue will happen in following stack:
+open(file, O_RDONLY)
+mmap(file)
+- f2fs_convert_inline_inode
+ - f2fs_convert_inline_page
+  - f2fs_reserve_block
+   - f2fs_reserve_new_block
+    - f2fs_reserve_new_blocks
+     - f2fs_i_blocks_write
+      - dquot_claim_block
+inode->i_blocks increase, but the dqb_curspace keep the size for the dquots
+is NULL.
+
+To fix this issue, let's call dquot_initialize() anyway in both
+f2fs_truncate() and f2fs_convert_inline_inode() functions to avoid potential
+inconsistent quota data issue.
+
+Fixes: 0abd675e97e6 ("f2fs: support plain user/group quota")
+Signed-off-by: Daiyue Zhang <zhangdaiyue1@huawei.com>
+Signed-off-by: Dehe Gu <gudehe@huawei.com>
+Signed-off-by: Junchao Jiang <jiangjunchao1@huawei.com>
+Signed-off-by: Ge Qiu <qiuge@huawei.com>
+Signed-off-by: Yi Chen <chenyi77@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c   | 4 ++++
+ fs/f2fs/inline.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 5d94abe467a4f..6273a8768081e 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -686,6 +686,10 @@ int f2fs_truncate(struct inode *inode)
+ 		return -EIO;
+ 	}
+ 
++	err = dquot_initialize(inode);
++	if (err)
++		return err;
++
+ 	/* we should check inline_data size */
+ 	if (!f2fs_may_inline_data(inode)) {
+ 		err = f2fs_convert_inline_inode(inode);
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 183388393c6a8..cbd17e4ff920c 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -189,6 +189,10 @@ int f2fs_convert_inline_inode(struct inode *inode)
+ 	if (!f2fs_has_inline_data(inode))
+ 		return 0;
+ 
++	err = dquot_initialize(inode);
++	if (err)
++		return err;
++
+ 	page = f2fs_grab_cache_page(inode->i_mapping, 0, false);
+ 	if (!page)
+ 		return -ENOMEM;
+-- 
+2.27.0
+
diff --git a/queue-5.4/fbdev-aty-sparc64-requires-fb_aty_ct.patch b/queue-5.4/fbdev-aty-sparc64-requires-fb_aty_ct.patch
new file mode 100644
index 00000000000..51b56aba8cd
--- /dev/null
+++ b/queue-5.4/fbdev-aty-sparc64-requires-fb_aty_ct.patch
@@ -0,0 +1,62 @@
+From e92ee2f594217124dd5a657d7383d355dd5a454e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 19:17:52 -0800
+Subject: fbdev: aty: SPARC64 requires FB_ATY_CT
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]
+
+It looks like SPARC64 requires FB_ATY_CT to build without errors,
+so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
+instead of using "default y if SPARC64 && PCI", which is not strong
+enough to prevent build errors.
+
+As it currently is, FB_ATY_CT can be disabled, resulting in build
+errors:
+
+ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
+ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!
+
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: sparclinux@vger.kernel.org
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 1e70e838530ee..a7e5f12687b70 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1269,6 +1269,7 @@ config FB_ATY
+ 	select FB_CFB_IMAGEBLIT
+ 	select FB_BACKLIGHT if FB_ATY_BACKLIGHT
+ 	select FB_MACMODES if PPC
++	select FB_ATY_CT if SPARC64 && PCI
+ 	help
+ 	  This driver supports graphics boards with the ATI Mach64 chips.
+ 	  Say Y if you have such a graphics board.
+@@ -1279,7 +1280,6 @@ config FB_ATY
+ config FB_ATY_CT
+ 	bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
+ 	depends on PCI && FB_ATY
+-	default y if SPARC64 && PCI
+ 	help
+ 	  Say Y here to support use of ATI's 64-bit Rage boards (or other
+ 	  boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
+-- 
+2.27.0
+
diff --git a/queue-5.4/fdt-properly-handle-no-map-field-in-the-memory-regio.patch b/queue-5.4/fdt-properly-handle-no-map-field-in-the-memory-regio.patch
new file mode 100644
index 00000000000..6a41d2594aa
--- /dev/null
+++ b/queue-5.4/fdt-properly-handle-no-map-field-in-the-memory-regio.patch
@@ -0,0 +1,42 @@
+From 217da9e7d6b599a3655dd51b7ee0b62747448387 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:45:43 +0000
+Subject: fdt: Properly handle "no-map" field in the memory region
+
+From: KarimAllah Ahmed <karahmed@amazon.de>
+
+[ Upstream commit 86588296acbfb1591e92ba60221e95677ecadb43 ]
+
+Mark the memory region with NOMAP flag instead of completely removing it
+from the memory blocks. That makes the FDT handling consistent with the EFI
+memory map handling.
+
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Cc: devicetree@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Link: https://lore.kernel.org/r/20210115114544.1830068-2-qperret@google.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 223d617ecfe17..036af904e0cfa 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1154,7 +1154,7 @@ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ 					phys_addr_t size, bool nomap)
+ {
+ 	if (nomap)
+-		return memblock_remove(base, size);
++		return memblock_mark_nomap(base, size);
+ 	return memblock_reserve(base, size);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch b/queue-5.4/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch
new file mode 100644
index 00000000000..d2e557a5201
--- /dev/null
+++ b/queue-5.4/fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch
@@ -0,0 +1,39 @@
+From 2f4a140806e6fa24c470ef9cbd04cac494c88dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 13:01:08 +0000
+Subject: fs/jfs: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit integer. In the case where
+l2nb is 32 or more this can lead to an overflow.  Avoid this by shifting
+the value 1LL instead.
+
+Addresses-Coverity: ("Uninitentional integer overflow")
+Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index caade185e568d..6fe82ce8663ef 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -1656,7 +1656,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
+ 		} else if (rc == -ENOSPC) {
+ 			/* search for next smaller log2 block */
+ 			l2nb = BLKSTOL2(nblocks) - 1;
+-			nblocks = 1 << l2nb;
++			nblocks = 1LL << l2nb;
+ 		} else {
+ 			/* Trim any already allocated blocks */
+ 			jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n");
+-- 
+2.27.0
+
diff --git a/queue-5.4/gma500-clean-up-error-handling-in-init.patch b/queue-5.4/gma500-clean-up-error-handling-in-init.patch
new file mode 100644
index 00000000000..8016cecbea1
--- /dev/null
+++ b/queue-5.4/gma500-clean-up-error-handling-in-init.patch
@@ -0,0 +1,73 @@
+From 0c6a7424d32172b4f69aebc0d09d95643a2133c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 11:40:48 +0300
+Subject: gma500: clean up error handling in init
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ]
+
+The main problem with this error handling was that it didn't clean up if
+i2c_add_numbered_adapter() failed.  This code is pretty old, and doesn't
+match with today's checkpatch.pl standards so I took the opportunity to
+tidy it up a bit.  I changed the NULL comparison, and removed the
+WARNING message if kzalloc() fails and updated the label names.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+index e281070611480..fc9a34ed58bd1 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ 	hdmi_dev = pci_get_drvdata(dev);
+ 
+ 	i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
+-	if (i2c_dev == NULL) {
+-		DRM_ERROR("Can't allocate interface\n");
+-		ret = -ENOMEM;
+-		goto exit;
+-	}
++	if (!i2c_dev)
++		return -ENOMEM;
+ 
+ 	i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
+ 	i2c_dev->status = I2C_STAT_INIT;
+@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ 			  oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
+ 	if (ret) {
+ 		DRM_ERROR("Failed to request IRQ for I2C controller\n");
+-		goto err;
++		goto free_dev;
+ 	}
+ 
+ 	/* Adapter registration */
+ 	ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
+-	return ret;
++	if (ret) {
++		DRM_ERROR("Failed to add I2C adapter\n");
++		goto free_irq;
++	}
+ 
+-err:
++	return 0;
++
++free_irq:
++	free_irq(dev->irq, hdmi_dev);
++free_dev:
+ 	kfree(i2c_dev);
+-exit:
++
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch b/queue-5.4/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch
new file mode 100644
index 00000000000..60f1e91446e
--- /dev/null
+++ b/queue-5.4/hid-core-detect-and-skip-invalid-inputs-to-snto32.patch
@@ -0,0 +1,51 @@
+From e6861c099f2b55e70f8714b26ed03225f7067581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 17:12:21 -0800
+Subject: HID: core: detect and skip invalid inputs to snto32()
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a0312af1f94d13800e63a7d0a66e563582e39aec ]
+
+Prevent invalid (0, 0) inputs to hid-core's snto32() function.
+
+Maybe it is just the dummy device here that is causing this, but
+there are hundreds of calls to snto32(0, 0). Having n (bits count)
+of 0 is causing the current UBSAN trap with a shift value of
+0xffffffff (-1, or n - 1 in this function).
+
+Either of the value to shift being 0 or the bits count being 0 can be
+handled by just returning 0 to the caller, avoiding the following
+complex shift + OR operations:
+
+	return value & (1 << (n - 1)) ? value | (~0U << n) : value;
+
+Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: linux-input@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 263eca119ff0f..8d202011b2db5 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1300,6 +1300,9 @@ EXPORT_SYMBOL_GPL(hid_open_report);
+ 
+ static s32 snto32(__u32 value, unsigned n)
+ {
++	if (!value || !n)
++		return 0;
++
+ 	switch (n) {
+ 	case 8:  return ((__s8)value);
+ 	case 16: return ((__s16)value);
+-- 
+2.27.0
+
diff --git a/queue-5.4/hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch b/queue-5.4/hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch
new file mode 100644
index 00000000000..65d24658549
--- /dev/null
+++ b/queue-5.4/hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch
@@ -0,0 +1,39 @@
+From b35db57fec1fc4bd5b34a2b4653f6ee752f031e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:18:27 +0800
+Subject: HSI: Fix PM usage counter unbalance in ssi_hw_init
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit aa57e77b3d28f0df07149d88c47bc0f3aa77330b ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: b209e047bc743 ("HSI: Introduce OMAP SSI driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/controllers/omap_ssi_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 2be9c01e175ca..f36036be7f032 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -424,7 +424,7 @@ static int ssi_hw_init(struct hsi_controller *ssi)
+ 	struct omap_ssi_controller *omap_ssi = hsi_controller_drvdata(ssi);
+ 	int err;
+ 
+-	err = pm_runtime_get_sync(ssi->device.parent);
++	err = pm_runtime_resume_and_get(ssi->device.parent);
+ 	if (err < 0) {
+ 		dev_err(&ssi->device, "runtime PM failed %d\n", err);
+ 		return err;
+-- 
+2.27.0
+
diff --git a/queue-5.4/hwrng-timeriomem-fix-cooldown-period-calculation.patch b/queue-5.4/hwrng-timeriomem-fix-cooldown-period-calculation.patch
new file mode 100644
index 00000000000..06d2ebdd5c5
--- /dev/null
+++ b/queue-5.4/hwrng-timeriomem-fix-cooldown-period-calculation.patch
@@ -0,0 +1,35 @@
+From f520156fb866a1efd075377fcfee059c502b106f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 16:14:59 +0100
+Subject: hwrng: timeriomem - Fix cooldown period calculation
+
+From: Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
+
+[ Upstream commit e145f5565dc48ccaf4cb50b7cfc48777bed8c100 ]
+
+Ensure cooldown period tolerance of 1% is actually accounted for.
+
+Fixes: ca3bff70ab32 ("hwrng: timeriomem - Improve performance...")
+Signed-off-by: Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/timeriomem-rng.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c
+index e262445fed5f5..f35f0f31f52ad 100644
+--- a/drivers/char/hw_random/timeriomem-rng.c
++++ b/drivers/char/hw_random/timeriomem-rng.c
+@@ -69,7 +69,7 @@ static int timeriomem_rng_read(struct hwrng *hwrng, void *data,
+ 		 */
+ 		if (retval > 0)
+ 			usleep_range(period_us,
+-					period_us + min(1, period_us / 100));
++					period_us + max(1, period_us / 100));
+ 
+ 		*(u32 *)data = readl(priv->io_base);
+ 		retval += sizeof(u32);
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch b/queue-5.4/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch
new file mode 100644
index 00000000000..9bec50459e9
--- /dev/null
+++ b/queue-5.4/i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch
@@ -0,0 +1,40 @@
+From 2dfb2195c00e7c91606a0f1f6fcbf9d49ac7d051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:11:01 +0100
+Subject: i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit a1858ce0cfe31368b23ba55794e409fb57ced4a4 ]
+
+The brcmstb_send_i2c_cmd currently has a condition that is (CMD_RD ||
+CMD_WR) which always evaluates to true, while the obvious fix is to test
+whether the cmd variable passed as parameter holds one of these two
+values.
+
+Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver")
+Reported-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-brcmstb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
+index 506991596b68d..5e89cd6b690ce 100644
+--- a/drivers/i2c/busses/i2c-brcmstb.c
++++ b/drivers/i2c/busses/i2c-brcmstb.c
+@@ -316,7 +316,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev,
+ 		goto cmd_out;
+ 	}
+ 
+-	if ((CMD_RD || CMD_WR) &&
++	if ((cmd == CMD_RD || cmd == CMD_WR) &&
+ 	    bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) {
+ 		rc = -EREMOTEIO;
+ 		dev_dbg(dev->device, "controller received NOACK intr for %s\n",
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch b/queue-5.4/i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch
new file mode 100644
index 00000000000..b036e6fdba6
--- /dev/null
+++ b/queue-5.4/i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch
@@ -0,0 +1,89 @@
+From 3a6c3838d6d778c6d7f7e044611859e0e6c747c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 20:35:45 +0530
+Subject: i2c: i2c-qcom-geni: Add shutdown callback for i2c
+
+From: Roja Rani Yarubandi <rojay@codeaurora.org>
+
+[ Upstream commit e0371298ddc51761be257698554ea507ac8bf831 ]
+
+If the hardware is still accessing memory after SMMU translation
+is disabled (as part of smmu shutdown callback), then the
+IOVAs (I/O virtual address) which it was using will go on the bus
+as the physical addresses which will result in unknown crashes
+like NoC/interconnect errors.
+
+So, implement shutdown callback to i2c driver to stop on-going transfer
+and unmap DMA mappings during system "reboot" or "shutdown".
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 34 ++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index b56a427fb928f..2262bf295286c 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -377,6 +377,32 @@ static void geni_i2c_tx_msg_cleanup(struct geni_i2c_dev *gi2c,
+ 	}
+ }
+ 
++static void geni_i2c_stop_xfer(struct geni_i2c_dev *gi2c)
++{
++	int ret;
++	u32 geni_status;
++	struct i2c_msg *cur;
++
++	/* Resume device, as runtime suspend can happen anytime during transfer */
++	ret = pm_runtime_get_sync(gi2c->se.dev);
++	if (ret < 0) {
++		dev_err(gi2c->se.dev, "Failed to resume device: %d\n", ret);
++		return;
++	}
++
++	geni_status = readl_relaxed(gi2c->se.base + SE_GENI_STATUS);
++	if (geni_status & M_GENI_CMD_ACTIVE) {
++		cur = gi2c->cur;
++		geni_i2c_abort_xfer(gi2c);
++		if (cur->flags & I2C_M_RD)
++			geni_i2c_rx_msg_cleanup(gi2c, cur);
++		else
++			geni_i2c_tx_msg_cleanup(gi2c, cur);
++	}
++
++	pm_runtime_put_sync_suspend(gi2c->se.dev);
++}
++
+ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 				u32 m_param)
+ {
+@@ -641,6 +667,13 @@ static int geni_i2c_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static void  geni_i2c_shutdown(struct platform_device *pdev)
++{
++	struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
++
++	geni_i2c_stop_xfer(gi2c);
++}
++
+ static int __maybe_unused geni_i2c_runtime_suspend(struct device *dev)
+ {
+ 	int ret;
+@@ -701,6 +734,7 @@ MODULE_DEVICE_TABLE(of, geni_i2c_dt_match);
+ static struct platform_driver geni_i2c_driver = {
+ 	.probe  = geni_i2c_probe,
+ 	.remove = geni_i2c_remove,
++	.shutdown = geni_i2c_shutdown,
+ 	.driver = {
+ 		.name = "geni_i2c",
+ 		.pm = &geni_i2c_pm_ops,
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-iproc-handle-master-read-request.patch b/queue-5.4/i2c-iproc-handle-master-read-request.patch
new file mode 100644
index 00000000000..9e5e36427b3
--- /dev/null
+++ b/queue-5.4/i2c-iproc-handle-master-read-request.patch
@@ -0,0 +1,321 @@
+From 058cf527695363b84e610905633208198d69be06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:32 +0530
+Subject: i2c: iproc: handle master read request
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit e21d79778768e4e187b2892d662c6aaa01e1d399 ]
+
+Handle single or multi byte master read request with or without
+repeated start.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 215 +++++++++++++++++++++++------
+ 1 file changed, 170 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 38a28bf6cfee4..70cd9fc7fb869 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -157,6 +157,11 @@
+ 
+ #define IE_S_ALL_INTERRUPT_SHIFT     21
+ #define IE_S_ALL_INTERRUPT_MASK      0x3f
++/*
++ * It takes ~18us to reading 10bytes of data, hence to keep tasklet
++ * running for less time, max slave read per tasklet is set to 10 bytes.
++ */
++#define MAX_SLAVE_RX_PER_INT         10
+ 
+ enum i2c_slave_read_status {
+ 	I2C_SLAVE_RX_FIFO_EMPTY = 0,
+@@ -203,8 +208,18 @@ struct bcm_iproc_i2c_dev {
+ 	/* bytes that have been read */
+ 	unsigned int rx_bytes;
+ 	unsigned int thld_bytes;
++
++	bool slave_rx_only;
++	bool rx_start_rcvd;
++	bool slave_read_complete;
++	u32 tx_underrun;
++	u32 slave_int_mask;
++	struct tasklet_struct slave_rx_tasklet;
+ };
+ 
++/* tasklet to process slave rx data */
++static void slave_rx_tasklet_fn(unsigned long);
++
+ /*
+  * Can be expanded in the future if more interrupt status bits are utilized
+  */
+@@ -258,6 +273,7 @@ static void bcm_iproc_i2c_slave_init(
+ {
+ 	u32 val;
+ 
++	iproc_i2c->tx_underrun = 0;
+ 	if (need_reset) {
+ 		/* put controller in reset */
+ 		val = iproc_i2c_rd_reg(iproc_i2c, CFG_OFFSET);
+@@ -294,8 +310,11 @@ static void bcm_iproc_i2c_slave_init(
+ 
+ 	/* Enable interrupt register to indicate a valid byte in receive fifo */
+ 	val = BIT(IE_S_RX_EVENT_SHIFT);
++	/* Enable interrupt register to indicate a Master read transaction */
++	val |= BIT(IE_S_RD_EVENT_SHIFT);
+ 	/* Enable interrupt register for the Slave BUSY command */
+ 	val |= BIT(IE_S_START_BUSY_SHIFT);
++	iproc_i2c->slave_int_mask = val;
+ 	iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
+ }
+ 
+@@ -320,76 +339,176 @@ static void bcm_iproc_i2c_check_slave_status(
+ 	}
+ }
+ 
+-static bool bcm_iproc_i2c_slave_isr(struct bcm_iproc_i2c_dev *iproc_i2c,
+-				    u32 status)
++static void bcm_iproc_i2c_slave_read(struct bcm_iproc_i2c_dev *iproc_i2c)
+ {
++	u8 rx_data, rx_status;
++	u32 rx_bytes = 0;
+ 	u32 val;
+-	u8 value, rx_status;
+ 
+-	/* Slave RX byte receive */
+-	if (status & BIT(IS_S_RX_EVENT_SHIFT)) {
++	while (rx_bytes < MAX_SLAVE_RX_PER_INT) {
+ 		val = iproc_i2c_rd_reg(iproc_i2c, S_RX_OFFSET);
+ 		rx_status = (val >> S_RX_STATUS_SHIFT) & S_RX_STATUS_MASK;
+-		if (rx_status == I2C_SLAVE_RX_START) {
+-			/* Start of SMBUS for Master write */
+-			i2c_slave_event(iproc_i2c->slave,
+-					I2C_SLAVE_WRITE_REQUESTED, &value);
++		rx_data = ((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
+ 
+-			val = iproc_i2c_rd_reg(iproc_i2c, S_RX_OFFSET);
+-			value = (u8)((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
++		if (rx_status == I2C_SLAVE_RX_START) {
++			/* Start of SMBUS Master write */
+ 			i2c_slave_event(iproc_i2c->slave,
+-					I2C_SLAVE_WRITE_RECEIVED, &value);
+-		} else if (status & BIT(IS_S_RD_EVENT_SHIFT)) {
+-			/* Start of SMBUS for Master Read */
++					I2C_SLAVE_WRITE_REQUESTED, &rx_data);
++			iproc_i2c->rx_start_rcvd = true;
++			iproc_i2c->slave_read_complete = false;
++		} else if (rx_status == I2C_SLAVE_RX_DATA &&
++			   iproc_i2c->rx_start_rcvd) {
++			/* Middle of SMBUS Master write */
+ 			i2c_slave_event(iproc_i2c->slave,
+-					I2C_SLAVE_READ_REQUESTED, &value);
+-			iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, value);
++					I2C_SLAVE_WRITE_RECEIVED, &rx_data);
++		} else if (rx_status == I2C_SLAVE_RX_END &&
++			   iproc_i2c->rx_start_rcvd) {
++			/* End of SMBUS Master write */
++			if (iproc_i2c->slave_rx_only)
++				i2c_slave_event(iproc_i2c->slave,
++						I2C_SLAVE_WRITE_RECEIVED,
++						&rx_data);
++
++			i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP,
++					&rx_data);
++		} else if (rx_status == I2C_SLAVE_RX_FIFO_EMPTY) {
++			iproc_i2c->rx_start_rcvd = false;
++			iproc_i2c->slave_read_complete = true;
++			break;
++		}
+ 
+-			val = BIT(S_CMD_START_BUSY_SHIFT);
+-			iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++		rx_bytes++;
++	}
++}
+ 
+-			/*
+-			 * Enable interrupt for TX FIFO becomes empty and
+-			 * less than PKT_LENGTH bytes were output on the SMBUS
+-			 */
+-			val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+-			val |= BIT(IE_S_TX_UNDERRUN_SHIFT);
+-			iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
+-		} else {
+-			/* Master write other than start */
+-			value = (u8)((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
++static void slave_rx_tasklet_fn(unsigned long data)
++{
++	struct bcm_iproc_i2c_dev *iproc_i2c = (struct bcm_iproc_i2c_dev *)data;
++	u32 int_clr;
++
++	bcm_iproc_i2c_slave_read(iproc_i2c);
++
++	/* clear pending IS_S_RX_EVENT_SHIFT interrupt */
++	int_clr = BIT(IS_S_RX_EVENT_SHIFT);
++
++	if (!iproc_i2c->slave_rx_only && iproc_i2c->slave_read_complete) {
++		/*
++		 * In case of single byte master-read request,
++		 * IS_S_TX_UNDERRUN_SHIFT event is generated before
++		 * IS_S_START_BUSY_SHIFT event. Hence start slave data send
++		 * from first IS_S_TX_UNDERRUN_SHIFT event.
++		 *
++		 * This means don't send any data from slave when
++		 * IS_S_RD_EVENT_SHIFT event is generated else it will increment
++		 * eeprom or other backend slave driver read pointer twice.
++		 */
++		iproc_i2c->tx_underrun = 0;
++		iproc_i2c->slave_int_mask |= BIT(IE_S_TX_UNDERRUN_SHIFT);
++
++		/* clear IS_S_RD_EVENT_SHIFT interrupt */
++		int_clr |= BIT(IS_S_RD_EVENT_SHIFT);
++	}
++
++	/* clear slave interrupt */
++	iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, int_clr);
++	/* enable slave interrupts */
++	iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, iproc_i2c->slave_int_mask);
++}
++
++static bool bcm_iproc_i2c_slave_isr(struct bcm_iproc_i2c_dev *iproc_i2c,
++				    u32 status)
++{
++	u32 val;
++	u8 value;
++
++	/*
++	 * Slave events in case of master-write, master-write-read and,
++	 * master-read
++	 *
++	 * Master-write     : only IS_S_RX_EVENT_SHIFT event
++	 * Master-write-read: both IS_S_RX_EVENT_SHIFT and IS_S_RD_EVENT_SHIFT
++	 *                    events
++	 * Master-read      : both IS_S_RX_EVENT_SHIFT and IS_S_RD_EVENT_SHIFT
++	 *                    events or only IS_S_RD_EVENT_SHIFT
++	 */
++	if (status & BIT(IS_S_RX_EVENT_SHIFT) ||
++	    status & BIT(IS_S_RD_EVENT_SHIFT)) {
++		/* disable slave interrupts */
++		val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
++		val &= ~iproc_i2c->slave_int_mask;
++		iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
++
++		if (status & BIT(IS_S_RD_EVENT_SHIFT))
++			/* Master-write-read request */
++			iproc_i2c->slave_rx_only = false;
++		else
++			/* Master-write request only */
++			iproc_i2c->slave_rx_only = true;
++
++		/* schedule tasklet to read data later */
++		tasklet_schedule(&iproc_i2c->slave_rx_tasklet);
++
++		/* clear only IS_S_RX_EVENT_SHIFT interrupt */
++		iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++				 BIT(IS_S_RX_EVENT_SHIFT));
++	}
++
++	if (status & BIT(IS_S_TX_UNDERRUN_SHIFT)) {
++		iproc_i2c->tx_underrun++;
++		if (iproc_i2c->tx_underrun == 1)
++			/* Start of SMBUS for Master Read */
+ 			i2c_slave_event(iproc_i2c->slave,
+-					I2C_SLAVE_WRITE_RECEIVED, &value);
+-			if (rx_status == I2C_SLAVE_RX_END)
+-				i2c_slave_event(iproc_i2c->slave,
+-						I2C_SLAVE_STOP, &value);
+-		}
+-	} else if (status & BIT(IS_S_TX_UNDERRUN_SHIFT)) {
+-		/* Master read other than start */
+-		i2c_slave_event(iproc_i2c->slave,
+-				I2C_SLAVE_READ_PROCESSED, &value);
++					I2C_SLAVE_READ_REQUESTED,
++					&value);
++		else
++			/* Master read other than start */
++			i2c_slave_event(iproc_i2c->slave,
++					I2C_SLAVE_READ_PROCESSED,
++					&value);
+ 
+ 		iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, value);
++		/* start transfer */
+ 		val = BIT(S_CMD_START_BUSY_SHIFT);
+ 		iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++
++		/* clear interrupt */
++		iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++				 BIT(IS_S_TX_UNDERRUN_SHIFT));
+ 	}
+ 
+-	/* Stop */
++	/* Stop received from master in case of master read transaction */
+ 	if (status & BIT(IS_S_START_BUSY_SHIFT)) {
+-		i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP, &value);
+ 		/*
+ 		 * Enable interrupt for TX FIFO becomes empty and
+ 		 * less than PKT_LENGTH bytes were output on the SMBUS
+ 		 */
+-		val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+-		val &= ~BIT(IE_S_TX_UNDERRUN_SHIFT);
+-		iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
++		iproc_i2c->slave_int_mask &= ~BIT(IE_S_TX_UNDERRUN_SHIFT);
++		iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET,
++				 iproc_i2c->slave_int_mask);
++
++		/* End of SMBUS for Master Read */
++		val = BIT(S_TX_WR_STATUS_SHIFT);
++		iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, val);
++
++		val = BIT(S_CMD_START_BUSY_SHIFT);
++		iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++
++		/* flush TX FIFOs */
++		val = iproc_i2c_rd_reg(iproc_i2c, S_FIFO_CTRL_OFFSET);
++		val |= (BIT(S_FIFO_TX_FLUSH_SHIFT));
++		iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, val);
++
++		i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP, &value);
++
++		/* clear interrupt */
++		iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++				 BIT(IS_S_START_BUSY_SHIFT));
+ 	}
+ 
+-	/* clear interrupt status */
+-	iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, status);
++	/* check slave transmit status only if slave is transmitting */
++	if (!iproc_i2c->slave_rx_only)
++		bcm_iproc_i2c_check_slave_status(iproc_i2c);
+ 
+-	bcm_iproc_i2c_check_slave_status(iproc_i2c);
+ 	return true;
+ }
+ 
+@@ -1031,6 +1150,10 @@ static int bcm_iproc_i2c_reg_slave(struct i2c_client *slave)
+ 		return -EAFNOSUPPORT;
+ 
+ 	iproc_i2c->slave = slave;
++
++	tasklet_init(&iproc_i2c->slave_rx_tasklet, slave_rx_tasklet_fn,
++		     (unsigned long)iproc_i2c);
++
+ 	bcm_iproc_i2c_slave_init(iproc_i2c, false);
+ 	return 0;
+ }
+@@ -1051,6 +1174,8 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ 			IE_S_ALL_INTERRUPT_SHIFT);
+ 	iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, tmp);
+ 
++	tasklet_kill(&iproc_i2c->slave_rx_tasklet);
++
+ 	/* Erase the slave address programmed */
+ 	tmp = iproc_i2c_rd_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET);
+ 	tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT);
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch b/queue-5.4/i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch
new file mode 100644
index 00000000000..5d15af55b1e
--- /dev/null
+++ b/queue-5.4/i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch
@@ -0,0 +1,54 @@
+From b74a79f51a212c66c7eb73048b7a4106c6ce9cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:29 +0530
+Subject: i2c: iproc: handle only slave interrupts which are enabled
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 545f4011e156554d704d6278245d54543f6680d1 ]
+
+Handle only slave interrupts which are enabled.
+
+The IS_OFFSET register contains the interrupt status bits which will be
+set regardless of the enabling of the corresponding interrupt condition.
+One must therefore look at both IS_OFFSET and IE_OFFSET to determine
+whether an interrupt condition is set and enabled.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index dd9661c11782a..2983cd9f855b4 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -503,12 +503,17 @@ static void bcm_iproc_i2c_process_m_event(struct bcm_iproc_i2c_dev *iproc_i2c,
+ static irqreturn_t bcm_iproc_i2c_isr(int irq, void *data)
+ {
+ 	struct bcm_iproc_i2c_dev *iproc_i2c = data;
+-	u32 status = iproc_i2c_rd_reg(iproc_i2c, IS_OFFSET);
++	u32 slave_status;
++	u32 status;
+ 	bool ret;
+-	u32 sl_status = status & ISR_MASK_SLAVE;
+ 
+-	if (sl_status) {
+-		ret = bcm_iproc_i2c_slave_isr(iproc_i2c, sl_status);
++	status = iproc_i2c_rd_reg(iproc_i2c, IS_OFFSET);
++	/* process only slave interrupt which are enabled */
++	slave_status = status & iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET) &
++		       ISR_MASK_SLAVE;
++
++	if (slave_status) {
++		ret = bcm_iproc_i2c_slave_isr(iproc_i2c, slave_status);
+ 		if (ret)
+ 			return IRQ_HANDLED;
+ 		else
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch b/queue-5.4/i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch
new file mode 100644
index 00000000000..04f7a3d3c86
--- /dev/null
+++ b/queue-5.4/i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch
@@ -0,0 +1,38 @@
+From e634d0545dd74413aab78b7be4370739795619ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:30 +0530
+Subject: i2c: iproc: update slave isr mask (ISR_MASK_SLAVE)
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 603e77af7b0704bdb057de0368f1f2b04fc9552c ]
+
+Update slave isr mask (ISR_MASK_SLAVE) to include remaining
+two slave interrupts.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 2983cd9f855b4..38a28bf6cfee4 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -213,7 +213,8 @@ struct bcm_iproc_i2c_dev {
+ 
+ #define ISR_MASK_SLAVE (BIT(IS_S_START_BUSY_SHIFT)\
+ 		| BIT(IS_S_RX_EVENT_SHIFT) | BIT(IS_S_RD_EVENT_SHIFT)\
+-		| BIT(IS_S_TX_UNDERRUN_SHIFT))
++		| BIT(IS_S_TX_UNDERRUN_SHIFT) | BIT(IS_S_RX_FIFO_FULL_SHIFT)\
++		| BIT(IS_S_RX_THLD_SHIFT))
+ 
+ static int bcm_iproc_i2c_reg_slave(struct i2c_client *slave);
+ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave);
+-- 
+2.27.0
+
diff --git a/queue-5.4/i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch b/queue-5.4/i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch
new file mode 100644
index 00000000000..69f614edccd
--- /dev/null
+++ b/queue-5.4/i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch
@@ -0,0 +1,154 @@
+From 85dc52fa1bf2487ac35642982db8e77d3212e800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 18:08:00 +0530
+Subject: i2c: qcom-geni: Store DMA mapping data in geni_i2c_dev struct
+
+From: Roja Rani Yarubandi <rojay@codeaurora.org>
+
+[ Upstream commit 357ee8841d0b7bd822f25fc768afbc0c2ab7e47b ]
+
+Store DMA mapping data in geni_i2c_dev struct to enhance DMA mapping
+data scope. For example during shutdown callback to unmap DMA mapping,
+this stored DMA mapping data can be used to call geni_se_tx_dma_unprep
+and geni_se_rx_dma_unprep functions.
+
+Add two helper functions geni_i2c_rx_msg_cleanup and
+geni_i2c_tx_msg_cleanup to unwrap the things after rx/tx FIFO/DMA
+transfers, so that the same can be used in geni_i2c_stop_xfer()
+function during shutdown callback.
+
+Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 59 ++++++++++++++++++++++--------
+ 1 file changed, 43 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 17abf60c94aeb..b56a427fb928f 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -87,6 +87,9 @@ struct geni_i2c_dev {
+ 	u32 clk_freq_out;
+ 	const struct geni_i2c_clk_fld *clk_fld;
+ 	int suspended;
++	void *dma_buf;
++	size_t xfer_len;
++	dma_addr_t dma_addr;
+ };
+ 
+ struct geni_i2c_err_log {
+@@ -350,14 +353,39 @@ static void geni_i2c_tx_fsm_rst(struct geni_i2c_dev *gi2c)
+ 		dev_err(gi2c->se.dev, "Timeout resetting TX_FSM\n");
+ }
+ 
++static void geni_i2c_rx_msg_cleanup(struct geni_i2c_dev *gi2c,
++				     struct i2c_msg *cur)
++{
++	gi2c->cur_rd = 0;
++	if (gi2c->dma_buf) {
++		if (gi2c->err)
++			geni_i2c_rx_fsm_rst(gi2c);
++		geni_se_rx_dma_unprep(&gi2c->se, gi2c->dma_addr, gi2c->xfer_len);
++		i2c_put_dma_safe_msg_buf(gi2c->dma_buf, cur, !gi2c->err);
++	}
++}
++
++static void geni_i2c_tx_msg_cleanup(struct geni_i2c_dev *gi2c,
++				     struct i2c_msg *cur)
++{
++	gi2c->cur_wr = 0;
++	if (gi2c->dma_buf) {
++		if (gi2c->err)
++			geni_i2c_tx_fsm_rst(gi2c);
++		geni_se_tx_dma_unprep(&gi2c->se, gi2c->dma_addr, gi2c->xfer_len);
++		i2c_put_dma_safe_msg_buf(gi2c->dma_buf, cur, !gi2c->err);
++	}
++}
++
+ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 				u32 m_param)
+ {
+-	dma_addr_t rx_dma;
++	dma_addr_t rx_dma = 0;
+ 	unsigned long time_left;
+ 	void *dma_buf = NULL;
+ 	struct geni_se *se = &gi2c->se;
+ 	size_t len = msg->len;
++	struct i2c_msg *cur;
+ 
+ 	if (!of_machine_is_compatible("lenovo,yoga-c630"))
+ 		dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+@@ -374,19 +402,18 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 		i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
+ 		dma_buf = NULL;
++	} else {
++		gi2c->xfer_len = len;
++		gi2c->dma_addr = rx_dma;
++		gi2c->dma_buf = dma_buf;
+ 	}
+ 
++	cur = gi2c->cur;
+ 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ 	if (!time_left)
+ 		geni_i2c_abort_xfer(gi2c);
+ 
+-	gi2c->cur_rd = 0;
+-	if (dma_buf) {
+-		if (gi2c->err)
+-			geni_i2c_rx_fsm_rst(gi2c);
+-		geni_se_rx_dma_unprep(se, rx_dma, len);
+-		i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
+-	}
++	geni_i2c_rx_msg_cleanup(gi2c, cur);
+ 
+ 	return gi2c->err;
+ }
+@@ -394,11 +421,12 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 				u32 m_param)
+ {
+-	dma_addr_t tx_dma;
++	dma_addr_t tx_dma = 0;
+ 	unsigned long time_left;
+ 	void *dma_buf = NULL;
+ 	struct geni_se *se = &gi2c->se;
+ 	size_t len = msg->len;
++	struct i2c_msg *cur;
+ 
+ 	if (!of_machine_is_compatible("lenovo,yoga-c630"))
+ 		dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+@@ -415,22 +443,21 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 		i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
+ 		dma_buf = NULL;
++	} else {
++		gi2c->xfer_len = len;
++		gi2c->dma_addr = tx_dma;
++		gi2c->dma_buf = dma_buf;
+ 	}
+ 
+ 	if (!dma_buf) /* Get FIFO IRQ */
+ 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
+ 
++	cur = gi2c->cur;
+ 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ 	if (!time_left)
+ 		geni_i2c_abort_xfer(gi2c);
+ 
+-	gi2c->cur_wr = 0;
+-	if (dma_buf) {
+-		if (gi2c->err)
+-			geni_i2c_tx_fsm_rst(gi2c);
+-		geni_se_tx_dma_unprep(se, tx_dma, len);
+-		i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
+-	}
++	geni_i2c_tx_msg_cleanup(gi2c, cur);
+ 
+ 	return gi2c->err;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-add-zero-initialization-of-aq-command-structure.patch b/queue-5.4/i40e-add-zero-initialization-of-aq-command-structure.patch
new file mode 100644
index 00000000000..e30e37e1d67
--- /dev/null
+++ b/queue-5.4/i40e-add-zero-initialization-of-aq-command-structure.patch
@@ -0,0 +1,62 @@
+From c1fd2a814c5dd0a6dbcabe17d3a44ed69631649c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 10:35:37 +0000
+Subject: i40e: Add zero-initialization of AQ command structures
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit d2c788f739b6f68090e968a2ee31b543701e795f ]
+
+Zero-initialize AQ command data structures to comply with
+API specifications.
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Fixes: f4492db16df8 ("i40e: Add NPAR BW get and set functions")
+Signed-off-by: Andrzej Sawuła <andrzej.sawula@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index c19b45a90fcd2..e41f7acc0e1fa 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7612,6 +7612,8 @@ int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
+ 	if (filter->flags >= ARRAY_SIZE(flag_table))
+ 		return I40E_ERR_CONFIG;
+ 
++	memset(&cld_filter, 0, sizeof(cld_filter));
++
+ 	/* copy element needed to add cloud filter from filter */
+ 	i40e_set_cld_element(filter, &cld_filter);
+ 
+@@ -7679,6 +7681,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ 	    !ipv6_addr_any(&filter->ip.v6.src_ip6))
+ 		return -EOPNOTSUPP;
+ 
++	memset(&cld_filter, 0, sizeof(cld_filter));
++
+ 	/* copy element needed to add cloud filter from filter */
+ 	i40e_set_cld_element(filter, &cld_filter.element);
+ 
+@@ -11770,6 +11774,8 @@ i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf)
+ 	struct i40e_aqc_configure_partition_bw_data bw_data;
+ 	i40e_status status;
+ 
++	memset(&bw_data, 0, sizeof(bw_data));
++
+ 	/* Set the valid bit for this PF */
+ 	bw_data.pf_valid_bits = cpu_to_le16(BIT(pf->hw.pf_id));
+ 	bw_data.max_bw[pf->hw.pf_id] = pf->max_bw & I40E_ALT_BW_VALUE_MASK;
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-fix-add-tc-filter-for-ipv6.patch b/queue-5.4/i40e-fix-add-tc-filter-for-ipv6.patch
new file mode 100644
index 00000000000..4a4596045a0
--- /dev/null
+++ b/queue-5.4/i40e-fix-add-tc-filter-for-ipv6.patch
@@ -0,0 +1,51 @@
+From b880feb113ada6a33b8b0a8140bc0bc26778bab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 11:38:00 +0100
+Subject: i40e: Fix add TC filter for IPv6
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 61c1e0eb8375def7c891bfe857bb795a57090526 ]
+
+Fix insufficient distinction between IPv4 and IPv6 addresses
+when creating a filter.
+IPv4 and IPv6 are kept in the same memory area. If IPv6 is added,
+then it's caught by IPv4 check, which leads to err -95.
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 96d818cb2b5b7..0604b5aaad86f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7676,7 +7676,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ 		return -EOPNOTSUPP;
+ 
+ 	/* adding filter using src_port/src_ip is not supported at this stage */
+-	if (filter->src_port || filter->src_ipv4 ||
++	if (filter->src_port ||
++	    (filter->src_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ 	    !ipv6_addr_any(&filter->ip.v6.src_ip6))
+ 		return -EOPNOTSUPP;
+ 
+@@ -7705,7 +7706,7 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ 			cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_MAC_VLAN_PORT);
+ 		}
+ 
+-	} else if (filter->dst_ipv4 ||
++	} else if ((filter->dst_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ 		   !ipv6_addr_any(&filter->ip.v6.dst_ip6)) {
+ 		cld_filter.element.flags =
+ 				cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_IP_PORT);
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch b/queue-5.4/i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch
new file mode 100644
index 00000000000..d14eb2dae60
--- /dev/null
+++ b/queue-5.4/i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch
@@ -0,0 +1,108 @@
+From e8ecae5bf0c7bf4fa0b74442e17a4f42ebaceba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:39:03 +0000
+Subject: i40e: Fix addition of RX filters after enabling FW LLDP agent
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 28b1208e7a7fa3ddc9345b022bb93e53d9dcc28a ]
+
+Fix addition of VLAN filter for PF after enabling FW LLDP agent.
+Changing LLDP Agent causes FW to re-initialize per NVM settings.
+Remove default PF filter and move "Enable/Disable" to currently used
+reset flag.
+Without this patch PF would try to add MAC VLAN filter with default
+switch filter present. This causes AQ error and sets promiscuous mode
+on.
+
+Fixes: c65e78f87f81 ("i40e: Further implementation of LLDP")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 16 +++++++++-------
+ drivers/net/ethernet/intel/i40e/i40e_main.c    |  9 ++++-----
+ 2 files changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index b577e6adf3bff..82c62e4678705 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -4874,7 +4874,7 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
+ 	enum i40e_admin_queue_err adq_err;
+ 	struct i40e_vsi *vsi = np->vsi;
+ 	struct i40e_pf *pf = vsi->back;
+-	bool is_reset_needed;
++	u32 reset_needed = 0;
+ 	i40e_status status;
+ 	u32 i, j;
+ 
+@@ -4919,9 +4919,11 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
+ flags_complete:
+ 	changed_flags = orig_flags ^ new_flags;
+ 
+-	is_reset_needed = !!(changed_flags & (I40E_FLAG_VEB_STATS_ENABLED |
+-		I40E_FLAG_LEGACY_RX | I40E_FLAG_SOURCE_PRUNING_DISABLED |
+-		I40E_FLAG_DISABLE_FW_LLDP));
++	if (changed_flags & I40E_FLAG_DISABLE_FW_LLDP)
++		reset_needed = I40E_PF_RESET_AND_REBUILD_FLAG;
++	if (changed_flags & (I40E_FLAG_VEB_STATS_ENABLED |
++	    I40E_FLAG_LEGACY_RX | I40E_FLAG_SOURCE_PRUNING_DISABLED))
++		reset_needed = BIT(__I40E_PF_RESET_REQUESTED);
+ 
+ 	/* Before we finalize any flag changes, we need to perform some
+ 	 * checks to ensure that the changes are supported and safe.
+@@ -5038,7 +5040,7 @@ flags_complete:
+ 				case I40E_AQ_RC_EEXIST:
+ 					dev_warn(&pf->pdev->dev,
+ 						 "FW LLDP agent is already running\n");
+-					is_reset_needed = false;
++					reset_needed = 0;
+ 					break;
+ 				case I40E_AQ_RC_EPERM:
+ 					dev_warn(&pf->pdev->dev,
+@@ -5067,8 +5069,8 @@ flags_complete:
+ 	/* Issue reset to cause things to take effect, as additional bits
+ 	 * are added we will need to create a mask of bits requiring reset
+ 	 */
+-	if (is_reset_needed)
+-		i40e_do_reset(pf, BIT(__I40E_PF_RESET_REQUESTED), true);
++	if (reset_needed)
++		i40e_do_reset(pf, reset_needed, true);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index c63de06c98df2..4f584a9dcf44e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -8485,11 +8485,6 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired)
+ 		dev_dbg(&pf->pdev->dev, "PFR requested\n");
+ 		i40e_handle_reset_warning(pf, lock_acquired);
+ 
+-		dev_info(&pf->pdev->dev,
+-			 pf->flags & I40E_FLAG_DISABLE_FW_LLDP ?
+-			 "FW LLDP is disabled\n" :
+-			 "FW LLDP is enabled\n");
+-
+ 	} else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) {
+ 		/* Request a PF Reset
+ 		 *
+@@ -8497,6 +8492,10 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired)
+ 		 */
+ 		i40e_prep_for_reset(pf, lock_acquired);
+ 		i40e_reset_and_rebuild(pf, true, lock_acquired);
++		dev_info(&pf->pdev->dev,
++			 pf->flags & I40E_FLAG_DISABLE_FW_LLDP ?
++			 "FW LLDP is disabled\n" :
++			 "FW LLDP is enabled\n");
+ 
+ 	} else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) {
+ 		int v;
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-fix-flow-for-ipv6-next-header-extension-header.patch b/queue-5.4/i40e-fix-flow-for-ipv6-next-header-extension-header.patch
new file mode 100644
index 00000000000..1f30b3e0473
--- /dev/null
+++ b/queue-5.4/i40e-fix-flow-for-ipv6-next-header-extension-header.patch
@@ -0,0 +1,63 @@
+From 447c93aa1905390fbac6c612876c918b70e013a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Sep 2020 07:57:04 +0000
+Subject: i40e: Fix flow for IPv6 next header (extension header)
+
+From: Slawomir Laba <slawomirx.laba@intel.com>
+
+[ Upstream commit 92c6058024e87087cf1b99b0389d67c0a886360e ]
+
+When a packet contains an IPv6 header with next header which is
+an extension header and not a protocol one, the kernel function
+skb_transport_header called with such sk_buff will return a
+pointer to the extension header and not to the TCP one.
+
+The above explained call caused a problem with packet processing
+for skb with encapsulation for tunnel with I40E_TX_CTX_EXT_IP_IPV6.
+The extension header was not skipped at all.
+
+The ipv6_skip_exthdr function does check if next header of the IPV6
+header is an extension header and doesn't modify the l4_proto pointer
+if it points to a protocol header value so its safe to omit the
+comparison of exthdr and l4.hdr pointers. The ipv6_skip_exthdr can
+return value -1. This means that the skipping process failed
+and there is something wrong with the packet so it will be dropped.
+
+Fixes: a3fd9d8876a5 ("i40e/i40evf: Handle IPv6 extension headers in checksum offload")
+Signed-off-by: Slawomir Laba <slawomirx.laba@intel.com>
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index f47841f3a69d5..218aada8949d9 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3093,13 +3093,16 @@ static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags,
+ 
+ 			l4_proto = ip.v4->protocol;
+ 		} else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
++			int ret;
++
+ 			tunnel |= I40E_TX_CTX_EXT_IP_IPV6;
+ 
+ 			exthdr = ip.hdr + sizeof(*ip.v6);
+ 			l4_proto = ip.v6->nexthdr;
+-			if (l4.hdr != exthdr)
+-				ipv6_skip_exthdr(skb, exthdr - skb->data,
+-						 &l4_proto, &frag_off);
++			ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
++					       &l4_proto, &frag_off);
++			if (ret < 0)
++				return -1;
+ 		}
+ 
+ 		/* define outer transport */
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-fix-overwriting-flow-control-settings-during-dr.patch b/queue-5.4/i40e-fix-overwriting-flow-control-settings-during-dr.patch
new file mode 100644
index 00000000000..2dd387f63ee
--- /dev/null
+++ b/queue-5.4/i40e-fix-overwriting-flow-control-settings-during-dr.patch
@@ -0,0 +1,87 @@
+From 2791a3cd3fa8bf04aa87e20beea915138e7eb29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 15:08:27 +0000
+Subject: i40e: Fix overwriting flow control settings during driver loading
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 4cdb9f80dcd46aab3c0020b4a6920c22735c5d6e ]
+
+During driver loading flow control settings were written to FW
+using a variable which was always zero, since it was being set
+only by ethtool. This behavior has been corrected and driver
+no longer overwrites the default FW/NVM settings.
+
+Fixes: 373149fc99a0 ("i40e: Decrease the scope of rtnl lock")
+Signed-off-by: Dawid Lukwinski <dawid.lukwinski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ---------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index e41f7acc0e1fa..c63de06c98df2 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -9959,7 +9959,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ 	int old_recovery_mode_bit = test_bit(__I40E_RECOVERY_MODE, pf->state);
+ 	struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi];
+ 	struct i40e_hw *hw = &pf->hw;
+-	u8 set_fc_aq_fail = 0;
+ 	i40e_status ret;
+ 	u32 val;
+ 	int v;
+@@ -10085,13 +10084,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ 			 i40e_stat_str(&pf->hw, ret),
+ 			 i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+ 
+-	/* make sure our flow control settings are restored */
+-	ret = i40e_set_fc(&pf->hw, &set_fc_aq_fail, true);
+-	if (ret)
+-		dev_dbg(&pf->pdev->dev, "setting flow control: ret = %s last_status = %s\n",
+-			i40e_stat_str(&pf->hw, ret),
+-			i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+-
+ 	/* Rebuild the VSIs and VEBs that existed before reset.
+ 	 * They are still in our local switch element arrays, so only
+ 	 * need to rebuild the switch model in the HW.
+@@ -14774,7 +14766,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	int err;
+ 	u32 val;
+ 	u32 i;
+-	u8 set_fc_aq_fail;
+ 
+ 	err = pci_enable_device_mem(pdev);
+ 	if (err)
+@@ -15096,24 +15087,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	}
+ 	INIT_LIST_HEAD(&pf->vsi[pf->lan_vsi]->ch_list);
+ 
+-	/* Make sure flow control is set according to current settings */
+-	err = i40e_set_fc(hw, &set_fc_aq_fail, true);
+-	if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_GET)
+-		dev_dbg(&pf->pdev->dev,
+-			"Set fc with err %s aq_err %s on get_phy_cap\n",
+-			i40e_stat_str(hw, err),
+-			i40e_aq_str(hw, hw->aq.asq_last_status));
+-	if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_SET)
+-		dev_dbg(&pf->pdev->dev,
+-			"Set fc with err %s aq_err %s on set_phy_config\n",
+-			i40e_stat_str(hw, err),
+-			i40e_aq_str(hw, hw->aq.asq_last_status));
+-	if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_UPDATE)
+-		dev_dbg(&pf->pdev->dev,
+-			"Set fc with err %s aq_err %s on get_link_info\n",
+-			i40e_stat_str(hw, err),
+-			i40e_aq_str(hw, hw->aq.asq_last_status));
+-
+ 	/* if FDIR VSI was set up, start it now */
+ 	for (i = 0; i < pf->num_alloc_vsi; i++) {
+ 		if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
+-- 
+2.27.0
+
diff --git a/queue-5.4/i40e-fix-vfs-not-created.patch b/queue-5.4/i40e-fix-vfs-not-created.patch
new file mode 100644
index 00000000000..4d4d2116270
--- /dev/null
+++ b/queue-5.4/i40e-fix-vfs-not-created.patch
@@ -0,0 +1,52 @@
+From adeddcd407c591b0ac96767c19c706cff93c9d68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 11:23:01 +0000
+Subject: i40e: Fix VFs not created
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit dc8812626440fa6a27f1f3f654f6dc435e042e42 ]
+
+When creating VFs they were sometimes not getting resources.
+It was caused by not executing i40e_reset_all_vfs due to
+flag __I40E_VF_DISABLE being set on PF. Because of this
+IAVF was never able to finish setup sequence never
+getting reset indication from PF.
+Changed test_and_set_bit __I40E_VF_DISABLE in
+i40e_sync_filters_subtask to test_bit and removed clear_bit.
+This function should not set this bit it should only check
+if it hasn't been already set.
+
+Fixes: a7542b876075 ("i40e: check __I40E_VF_DISABLE bit in i40e_sync_filters_subtask")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 4f584a9dcf44e..96d818cb2b5b7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2603,7 +2603,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ 		return;
+ 	if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
+ 		return;
+-	if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
++	if (test_bit(__I40E_VF_DISABLE, pf->state)) {
+ 		set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
+ 		return;
+ 	}
+@@ -2621,7 +2621,6 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ 			}
+ 		}
+ 	}
+-	clear_bit(__I40E_VF_DISABLE, pf->state);
+ }
+ 
+ /**
+-- 
+2.27.0
+
diff --git a/queue-5.4/ib-cm-avoid-a-loop-when-device-has-255-ports.patch b/queue-5.4/ib-cm-avoid-a-loop-when-device-has-255-ports.patch
new file mode 100644
index 00000000000..5f52d827bb3
--- /dev/null
+++ b/queue-5.4/ib-cm-avoid-a-loop-when-device-has-255-ports.patch
@@ -0,0 +1,67 @@
+From a4eec4433c4343022b2cd80e685f461667a895ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:00:08 +0200
+Subject: IB/cm: Avoid a loop when device has 255 ports
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 131be26750379592f0dd6244b2a90bbb504a10bb ]
+
+When RDMA device has 255 ports, loop iterator i overflows.  Due to which
+cm_add_one() port iterator loops infinitely.  Use core provided port
+iterator to avoid the infinite loop.
+
+Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
+Link: https://lore.kernel.org/r/20210127150010.1876121-9-leon@kernel.org
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index fd7c84721b0de..c933c1c7ddd8e 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -4336,7 +4336,7 @@ static void cm_add_one(struct ib_device *ib_device)
+ 	unsigned long flags;
+ 	int ret;
+ 	int count = 0;
+-	u8 i;
++	unsigned int i;
+ 
+ 	cm_dev = kzalloc(struct_size(cm_dev, port, ib_device->phys_port_cnt),
+ 			 GFP_KERNEL);
+@@ -4348,7 +4348,7 @@ static void cm_add_one(struct ib_device *ib_device)
+ 	cm_dev->going_down = 0;
+ 
+ 	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
+-	for (i = 1; i <= ib_device->phys_port_cnt; i++) {
++	rdma_for_each_port (ib_device, i) {
+ 		if (!rdma_cap_ib_cm(ib_device, i))
+ 			continue;
+ 
+@@ -4427,7 +4427,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
+ 		.clr_port_cap_mask = IB_PORT_CM_SUP
+ 	};
+ 	unsigned long flags;
+-	int i;
++	unsigned int i;
+ 
+ 	if (!cm_dev)
+ 		return;
+@@ -4440,7 +4440,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
+ 	cm_dev->going_down = 1;
+ 	spin_unlock_irq(&cm.lock);
+ 
+-	for (i = 1; i <= ib_device->phys_port_cnt; i++) {
++	rdma_for_each_port (ib_device, i) {
+ 		if (!rdma_cap_ib_cm(ib_device, i))
+ 			continue;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/ib-mlx5-return-appropriate-error-code-instead-of-eno.patch b/queue-5.4/ib-mlx5-return-appropriate-error-code-instead-of-eno.patch
new file mode 100644
index 00000000000..0048f2bb042
--- /dev/null
+++ b/queue-5.4/ib-mlx5-return-appropriate-error-code-instead-of-eno.patch
@@ -0,0 +1,39 @@
+From e7dccbd9cd0ceda5e67b28d3afe4c5b27c60a4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:00:07 +0200
+Subject: IB/mlx5: Return appropriate error code instead of ENOMEM
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit d286ac1d05210695c312b9018b3aa7c2048e9aca ]
+
+When mlx5_ib_stage_init_init() fails, return the error code related to
+failure instead of -ENOMEM.
+
+Fixes: 16c1975f1032 ("IB/mlx5: Create profile infrastructure to add and remove stages")
+Link: https://lore.kernel.org/r/20210127150010.1876121-8-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index c9e583c05ef27..e2656b68ec222 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -6213,8 +6213,7 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
+ 
+ err_mp:
+ 	mlx5_ib_cleanup_multiport_master(dev);
+-
+-	return -ENOMEM;
++	return err;
+ }
+ 
+ static int mlx5_ib_stage_flow_db_init(struct mlx5_ib_dev *dev)
+-- 
+2.27.0
+
diff --git a/queue-5.4/ib-umad-return-eio-in-case-of-when-device-disassocia.patch b/queue-5.4/ib-umad-return-eio-in-case-of-when-device-disassocia.patch
new file mode 100644
index 00000000000..2249e68d1f9
--- /dev/null
+++ b/queue-5.4/ib-umad-return-eio-in-case-of-when-device-disassocia.patch
@@ -0,0 +1,54 @@
+From 94feec9c8ec4e8753a4521dee6e1348ebb34ed80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:13:38 +0200
+Subject: IB/umad: Return EIO in case of when device disassociated
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 4fc5461823c9cad547a9bdfbf17d13f0da0d6bb5 ]
+
+MAD message received by the user has EINVAL error in all flows
+including when the device is disassociated. That makes it impossible
+for the applications to treat such flow differently.
+
+Change it to return EIO, so the applications will be able to perform
+disassociation recovery.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/20210125121339.837518-2-leon@kernel.org
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/user_mad.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index da229eab59032..dec5175803fe2 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -379,6 +379,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+ 
+ 	mutex_lock(&file->mutex);
+ 
++	if (file->agents_dead) {
++		mutex_unlock(&file->mutex);
++		return -EIO;
++	}
++
+ 	while (list_empty(&file->recv_list)) {
+ 		mutex_unlock(&file->mutex);
+ 
+@@ -524,7 +529,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
+ 
+ 	agent = __get_agent(file, packet->mad.hdr.id);
+ 	if (!agent) {
+-		ret = -EINVAL;
++		ret = -EIO;
+ 		goto err_up;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/ib-umad-return-epollerr-in-case-of-when-device-disas.patch b/queue-5.4/ib-umad-return-epollerr-in-case-of-when-device-disas.patch
new file mode 100644
index 00000000000..da694e65760
--- /dev/null
+++ b/queue-5.4/ib-umad-return-epollerr-in-case-of-when-device-disas.patch
@@ -0,0 +1,66 @@
+From af1d0d0d0e1647950a1b5a40363994161a35585c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:13:39 +0200
+Subject: IB/umad: Return EPOLLERR in case of when device disassociated
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit def4cd43f522253645b72c97181399c241b54536 ]
+
+Currently, polling a umad device will always works, even if the device was
+disassociated. A disassociated device should immediately return EPOLLERR
+from poll(). Otherwise userspace is endlessly hung on poll() with no idea
+that the device has been removed from the system.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/20210125121339.837518-3-leon@kernel.org
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/user_mad.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index dec5175803fe2..ad3a092b8b5c3 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -397,6 +397,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+ 		mutex_lock(&file->mutex);
+ 	}
+ 
++	if (file->agents_dead) {
++		mutex_unlock(&file->mutex);
++		return -EIO;
++	}
++
+ 	packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
+ 	list_del(&packet->list);
+ 
+@@ -658,10 +663,14 @@ static __poll_t ib_umad_poll(struct file *filp, struct poll_table_struct *wait)
+ 	/* we will always be able to post a MAD send */
+ 	__poll_t mask = EPOLLOUT | EPOLLWRNORM;
+ 
++	mutex_lock(&file->mutex);
+ 	poll_wait(filp, &file->recv_wait, wait);
+ 
+ 	if (!list_empty(&file->recv_list))
+ 		mask |= EPOLLIN | EPOLLRDNORM;
++	if (file->agents_dead)
++		mask = EPOLLERR;
++	mutex_unlock(&file->mutex);
+ 
+ 	return mask;
+ }
+@@ -1341,6 +1350,7 @@ static void ib_umad_kill_port(struct ib_umad_port *port)
+ 	list_for_each_entry(file, &port->file_list, port_list) {
+ 		mutex_lock(&file->mutex);
+ 		file->agents_dead = 1;
++		wake_up_interruptible(&file->recv_wait);
+ 		mutex_unlock(&file->mutex);
+ 
+ 		for (id = 0; id < IB_UMAD_MAX_AGENTS; ++id)
+-- 
+2.27.0
+
diff --git a/queue-5.4/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch b/queue-5.4/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch
new file mode 100644
index 00000000000..b3e7b02aeb4
--- /dev/null
+++ b/queue-5.4/ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch
@@ -0,0 +1,48 @@
+From a04450263bf9b18d9fa61622ae535b9084b9a285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:48:40 -0600
+Subject: ibmvnic: add memory barrier to protect long term buffer
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 42557dab78edc8235aba5b441f2eb35f725a0ede ]
+
+dma_rmb() barrier is added to load the long term buffer before copying
+it to socket buffer; and dma_wmb() barrier is added to update the
+long term buffer before it being accessed by VIOS (virtual i/o server).
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Acked-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5b5d488c2f374..901883a44a320 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1518,6 +1518,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ 		skb_copy_from_linear_data(skb, dst, skb->len);
+ 	}
+ 
++	/* post changes to long_term_buff *dst before VIOS accessing it */
++	dma_wmb();
++
+ 	tx_pool->consumer_index =
+ 	    (tx_pool->consumer_index + 1) % tx_pool->num_buffers;
+ 
+@@ -2340,6 +2343,8 @@ restart_poll:
+ 		offset = be16_to_cpu(next->rx_comp.off_frame_data);
+ 		flags = next->rx_comp.flags;
+ 		skb = rx_buff->skb;
++		/* load long_term_buff before copying to skb */
++		dma_rmb();
+ 		skb_copy_to_linear_data(skb, rx_buff->data + offset,
+ 					length);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/ibmvnic-set-to-closed-state-even-on-error.patch b/queue-5.4/ibmvnic-set-to-closed-state-even-on-error.patch
new file mode 100644
index 00000000000..adee5cb725f
--- /dev/null
+++ b/queue-5.4/ibmvnic-set-to-closed-state-even-on-error.patch
@@ -0,0 +1,42 @@
+From 770c587deca9426c519230e2abdbb8804cb4b44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 17:41:43 -0800
+Subject: ibmvnic: Set to CLOSED state even on error
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit d4083d3c00f60a09ad82e3bf17ff57fec69c8aa6 ]
+
+If set_link_state() fails for any reason, we still cleanup the adapter
+state and cannot recover from a partial close anyway. So set the adapter
+to CLOSED state. That way if a new soft/hard reset is processed, the
+adapter will remain in the CLOSED state until the next ibmvnic_open().
+
+Fixes: 01d9bd792d16 ("ibmvnic: Reorganize device close")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Reported-by: Abdul Haleem <abdhalee@in.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 0f35eec967ae8..5b5d488c2f374 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1254,10 +1254,8 @@ static int __ibmvnic_close(struct net_device *netdev)
+ 
+ 	adapter->state = VNIC_CLOSING;
+ 	rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_DN);
+-	if (rc)
+-		return rc;
+ 	adapter->state = VNIC_CLOSED;
+-	return 0;
++	return rc;
+ }
+ 
+ static int ibmvnic_close(struct net_device *netdev)
+-- 
+2.27.0
+
diff --git a/queue-5.4/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch b/queue-5.4/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch
new file mode 100644
index 00000000000..c364ce22552
--- /dev/null
+++ b/queue-5.4/ibmvnic-skip-send_request_unmap-for-timeout-reset.patch
@@ -0,0 +1,45 @@
+From 199a2185f304edacc8a32ea19107b087c9e152cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:49:00 -0600
+Subject: ibmvnic: skip send_request_unmap for timeout reset
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 7d3a7b9ea59ddb223aec59b45fa1713c633aaed4 ]
+
+Timeout reset will trigger the VIOS to unmap it automatically,
+similarly as FAILVOER and MOBILITY events. If we unmap it
+in the linux side, we will see errors like
+"30000003: Error 4 in REQUEST_UNMAP_RSP".
+So, don't call send_request_unmap for timeout reset.
+
+Fixes: ed651a10875f ("ibmvnic: Updated reset handling")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 901883a44a320..309cdc5ebc1ff 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -202,8 +202,13 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter,
+ 	if (!ltb->buff)
+ 		return;
+ 
++	/* VIOS automatically unmaps the long term buffer at remote
++	 * end for the following resets:
++	 * FAILOVER, MOBILITY, TIMEOUT.
++	 */
+ 	if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+-	    adapter->reset_reason != VNIC_RESET_MOBILITY)
++	    adapter->reset_reason != VNIC_RESET_MOBILITY &&
++	    adapter->reset_reason != VNIC_RESET_TIMEOUT)
+ 		send_request_unmap(adapter, ltb->map_id);
+ 	dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/ima-free-ima-measurement-buffer-after-kexec-syscall.patch b/queue-5.4/ima-free-ima-measurement-buffer-after-kexec-syscall.patch
new file mode 100644
index 00000000000..7b817254799
--- /dev/null
+++ b/queue-5.4/ima-free-ima-measurement-buffer-after-kexec-syscall.patch
@@ -0,0 +1,80 @@
+From e80a4b01ec2334c5fa823f129fcc9f23b65b5fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 09:49:51 -0800
+Subject: ima: Free IMA measurement buffer after kexec syscall
+
+From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+
+[ Upstream commit f31e3386a4e92ba6eda7328cb508462956c94c64 ]
+
+IMA allocates kernel virtual memory to carry forward the measurement
+list, from the current kernel to the next kernel on kexec system call,
+in ima_add_kexec_buffer() function.  This buffer is not freed before
+completing the kexec system call resulting in memory leak.
+
+Add ima_buffer field in "struct kimage" to store the virtual address
+of the buffer allocated for the IMA measurement list.
+Free the memory allocated for the IMA measurement list in
+kimage_file_post_load_cleanup() function.
+
+Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Suggested-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list")
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kexec.h              | 5 +++++
+ kernel/kexec_file.c                | 5 +++++
+ security/integrity/ima/ima_kexec.c | 2 ++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/include/linux/kexec.h b/include/linux/kexec.h
+index 1776eb2e43a44..a1cffce3de8cd 100644
+--- a/include/linux/kexec.h
++++ b/include/linux/kexec.h
+@@ -293,6 +293,11 @@ struct kimage {
+ 	/* Information for loading purgatory */
+ 	struct purgatory_info purgatory_info;
+ #endif
++
++#ifdef CONFIG_IMA_KEXEC
++	/* Virtual address of IMA measurement buffer for kexec syscall */
++	void *ima_buffer;
++#endif
+ };
+ 
+ /* kexec interface functions */
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index 79f252af7dee3..4e74db89bd23f 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -165,6 +165,11 @@ void kimage_file_post_load_cleanup(struct kimage *image)
+ 	vfree(pi->sechdrs);
+ 	pi->sechdrs = NULL;
+ 
++#ifdef CONFIG_IMA_KEXEC
++	vfree(image->ima_buffer);
++	image->ima_buffer = NULL;
++#endif /* CONFIG_IMA_KEXEC */
++
+ 	/* See if architecture has anything to cleanup post load */
+ 	arch_kimage_file_post_load_cleanup(image);
+ 
+diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
+index 37b1244e3a166..955e4b4d09e21 100644
+--- a/security/integrity/ima/ima_kexec.c
++++ b/security/integrity/ima/ima_kexec.c
+@@ -130,6 +130,8 @@ void ima_add_kexec_buffer(struct kimage *image)
+ 		return;
+ 	}
+ 
++	image->ima_buffer = kexec_buffer;
++
+ 	pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
+ 		 kbuf.mem);
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/ima-free-ima-measurement-buffer-on-error.patch b/queue-5.4/ima-free-ima-measurement-buffer-on-error.patch
new file mode 100644
index 00000000000..d849dd0f5eb
--- /dev/null
+++ b/queue-5.4/ima-free-ima-measurement-buffer-on-error.patch
@@ -0,0 +1,41 @@
+From 47ddd688da91116ea590d459edbbede9dcf2a28d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 09:49:50 -0800
+Subject: ima: Free IMA measurement buffer on error
+
+From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+
+[ Upstream commit 6d14c6517885fa68524238787420511b87d671df ]
+
+IMA allocates kernel virtual memory to carry forward the measurement
+list, from the current kernel to the next kernel on kexec system call,
+in ima_add_kexec_buffer() function.  In error code paths this memory
+is not freed resulting in memory leak.
+
+Free the memory allocated for the IMA measurement list in
+the error code paths in ima_add_kexec_buffer() function.
+
+Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Suggested-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list")
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_kexec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
+index 9e94eca48b898..37b1244e3a166 100644
+--- a/security/integrity/ima/ima_kexec.c
++++ b/security/integrity/ima/ima_kexec.c
+@@ -120,6 +120,7 @@ void ima_add_kexec_buffer(struct kimage *image)
+ 	ret = kexec_add_buffer(&kbuf);
+ 	if (ret) {
+ 		pr_err("Error passing over kexec measurement buffer.\n");
++		vfree(kexec_buffer);
+ 		return;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/input-elo-fix-an-error-code-in-elo_connect.patch b/queue-5.4/input-elo-fix-an-error-code-in-elo_connect.patch
new file mode 100644
index 00000000000..c56a37f4102
--- /dev/null
+++ b/queue-5.4/input-elo-fix-an-error-code-in-elo_connect.patch
@@ -0,0 +1,40 @@
+From ae86605cba6a6c700f21060de896340fcdeb3c81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 20:29:05 -0800
+Subject: Input: elo - fix an error code in elo_connect()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0958351e93fa0ac142f6dd8bd844441594f30a57 ]
+
+If elo_setup_10() fails then this should return an error code instead
+of success.
+
+Fixes: fae3006e4b42 ("Input: elo - add support for non-pressure-sensitive touchscreens")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/elo.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
+index d6772a2c2d096..e396857cb4c1b 100644
+--- a/drivers/input/touchscreen/elo.c
++++ b/drivers/input/touchscreen/elo.c
+@@ -341,8 +341,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
+ 	switch (elo->id) {
+ 
+ 	case 0: /* 10-byte protocol */
+-		if (elo_setup_10(elo))
++		if (elo_setup_10(elo)) {
++			err = -EIO;
+ 			goto fail3;
++		}
+ 
+ 		break;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/input-sur40-fix-an-error-code-in-sur40_probe.patch b/queue-5.4/input-sur40-fix-an-error-code-in-sur40_probe.patch
new file mode 100644
index 00000000000..adc0081c2ea
--- /dev/null
+++ b/queue-5.4/input-sur40-fix-an-error-code-in-sur40_probe.patch
@@ -0,0 +1,36 @@
+From d711ebf54c812facd6690ebf80581f506c844b43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 20:30:45 -0800
+Subject: Input: sur40 - fix an error code in sur40_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b0b7d2815839024e5181bd2572f5d8d4f65363b3 ]
+
+If v4l2_ctrl_handler_setup() fails then probe() should return an error
+code instead of returning success.
+
+Fixes: cee1e3e2ef39 ("media: add video control handlers using V4L2 control framework")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YBKFkbATXa5fA3xj@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/sur40.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
+index 2e2ea5719c90e..902522df03592 100644
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -774,6 +774,7 @@ static int sur40_probe(struct usb_interface *interface,
+ 		dev_err(&interface->dev,
+ 			"Unable to register video controls.");
+ 		v4l2_ctrl_handler_free(&sur40->hdl);
++		error = sur40->hdl.error;
+ 		goto err_unreg_v4l2;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/isofs-release-buffer-head-before-return.patch b/queue-5.4/isofs-release-buffer-head-before-return.patch
new file mode 100644
index 00000000000..679efecb4e1
--- /dev/null
+++ b/queue-5.4/isofs-release-buffer-head-before-return.patch
@@ -0,0 +1,49 @@
+From 516bbc0c76c6fd1064d37ad11eabfe0635e95903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 04:04:55 -0800
+Subject: isofs: release buffer head before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 0a6dc67a6aa45f19bd4ff89b4f468fc50c4b8daa ]
+
+Release the buffer_head before returning error code in
+do_isofs_readdir() and isofs_find_entry().
+
+Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem")
+Link: https://lore.kernel.org/r/20210118120455.118955-1-bianpan2016@163.com
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/isofs/dir.c   | 1 +
+ fs/isofs/namei.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
+index f0fe641893a5e..b9e6a7ec78be4 100644
+--- a/fs/isofs/dir.c
++++ b/fs/isofs/dir.c
+@@ -152,6 +152,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
+ 			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ 			       " in block %lu of inode %lu\n", block,
+ 			       inode->i_ino);
++			brelse(bh);
+ 			return -EIO;
+ 		}
+ 
+diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
+index cac468f04820e..558e7c51ce0d4 100644
+--- a/fs/isofs/namei.c
++++ b/fs/isofs/namei.c
+@@ -102,6 +102,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
+ 			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ 			       " in block %lu of inode %lu\n", block,
+ 			       dir->i_ino);
++			brelse(bh);
+ 			return 0;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch b/queue-5.4/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch
new file mode 100644
index 00000000000..131bae28c1c
--- /dev/null
+++ b/queue-5.4/jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch
@@ -0,0 +1,58 @@
+From cf9ce47084e44214fcb4bbbb3802344ca700f416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 06:56:04 -0800
+Subject: jffs2: fix use after free in jffs2_sum_write_data()
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 19646447ad3a680d2ab08c097585b7d96a66126b ]
+
+clang static analysis reports this problem
+
+fs/jffs2/summary.c:794:31: warning: Use of memory after it is freed
+                c->summary->sum_list_head = temp->u.next;
+                                            ^~~~~~~~~~~~
+
+In jffs2_sum_write_data(), in a loop summary data is handles a node at
+a time.  When it has written out the node it is removed the summary list,
+and the node is deleted.  In the corner case when a
+JFFS2_FEATURE_RWCOMPAT_COPY is seen, a call is made to
+jffs2_sum_disable_collecting().  jffs2_sum_disable_collecting() deletes
+the whole list which conflicts with the loop's deleting the list by parts.
+
+To preserve the old behavior of stopping the write midway, bail out of
+the loop after disabling summary collection.
+
+Fixes: 6171586a7ae5 ("[JFFS2] Correct handling of JFFS2_FEATURE_RWCOMPAT_COPY nodes.")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jffs2/summary.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
+index be7c8a6a57480..4fe64519870f1 100644
+--- a/fs/jffs2/summary.c
++++ b/fs/jffs2/summary.c
+@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+ 					dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
+ 						    je16_to_cpu(temp->u.nodetype));
+ 					jffs2_sum_disable_collecting(c->summary);
++					/* The above call removes the list, nothing more to do */
++					goto bail_rwcompat;
+ 				} else {
+ 					BUG();	/* unknown node in summary information */
+ 				}
+@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+ 
+ 		c->summary->sum_num--;
+ 	}
++ bail_rwcompat:
+ 
+ 	jffs2_sum_reset_collected(c->summary);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch b/queue-5.4/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch
new file mode 100644
index 00000000000..e55a6675a6a
--- /dev/null
+++ b/queue-5.4/kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch
@@ -0,0 +1,79 @@
+From d136f40b1156533c961f72ea3757800544cea91b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:32:01 +0100
+Subject: KVM: PPC: Make the VMX instruction emulation routines static
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit 9236f57a9e51c72ce426ccd2e53e123de7196a0f ]
+
+These are only used locally. It fixes these W=1 compile errors :
+
+../arch/powerpc/kvm/powerpc.c:1521:5: error: no previous prototype for ‘kvmppc_get_vmx_dword’ [-Werror=missing-prototypes]
+ 1521 | int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+      |     ^~~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1539:5: error: no previous prototype for ‘kvmppc_get_vmx_word’ [-Werror=missing-prototypes]
+ 1539 | int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+      |     ^~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1557:5: error: no previous prototype for ‘kvmppc_get_vmx_hword’ [-Werror=missing-prototypes]
+ 1557 | int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+      |     ^~~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1575:5: error: no previous prototype for ‘kvmppc_get_vmx_byte’ [-Werror=missing-prototypes]
+ 1575 | int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
+      |     ^~~~~~~~~~~~~~~~~~~
+
+Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction mmio emulation with analyse_instr() input")
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210104143206.695198-19-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/powerpc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 3a77bb6434521..e03c064716789 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1513,7 +1513,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ 	return emulated;
+ }
+ 
+-int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ 	union kvmppc_one_reg reg;
+ 	int vmx_offset = 0;
+@@ -1531,7 +1531,7 @@ int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ 	return result;
+ }
+ 
+-int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ 	union kvmppc_one_reg reg;
+ 	int vmx_offset = 0;
+@@ -1549,7 +1549,7 @@ int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ 	return result;
+ }
+ 
+-int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ 	union kvmppc_one_reg reg;
+ 	int vmx_offset = 0;
+@@ -1567,7 +1567,7 @@ int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ 	return result;
+ }
+ 
+-int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ 	union kvmppc_one_reg reg;
+ 	int vmx_offset = 0;
+-- 
+2.27.0
+
diff --git a/queue-5.4/mac80211-fix-potential-overflow-when-multiplying-to-.patch b/queue-5.4/mac80211-fix-potential-overflow-when-multiplying-to-.patch
new file mode 100644
index 00000000000..8eae2b3cae3
--- /dev/null
+++ b/queue-5.4/mac80211-fix-potential-overflow-when-multiplying-to-.patch
@@ -0,0 +1,40 @@
+From da4c0942b1cb55fd4a2baa494b3ff9a934b8bc02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:53:52 +0000
+Subject: mac80211: fix potential overflow when multiplying to u32 integers
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 6194f7e6473be78acdc5d03edd116944bdbb2c4e ]
+
+The multiplication of the u32 variables tx_time and estimated_retx is
+performed using a 32 bit multiplication and the result is stored in
+a u64 result. This has a potential u32 overflow issue, so avoid this
+by casting tx_time to a u64 to force a 64 bit multiply.
+
+Addresses-Coverity: ("Unintentional integer overflow")
+Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210205175352.208841-1-colin.king@canonical.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index aa5150929996d..b5b728a71ab53 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -356,7 +356,7 @@ u32 airtime_link_metric_get(struct ieee80211_local *local,
+ 	 */
+ 	tx_time = (device_constant + 10 * test_frame_len / rate);
+ 	estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
+-	result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
++	result = ((u64)tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
+ 	return (u32)result;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-aspeed-fix-error-return-code-in-aspeed_video_s.patch b/queue-5.4/media-aspeed-fix-error-return-code-in-aspeed_video_s.patch
new file mode 100644
index 00000000000..054e17cfcbc
--- /dev/null
+++ b/queue-5.4/media-aspeed-fix-error-return-code-in-aspeed_video_s.patch
@@ -0,0 +1,45 @@
+From 736e00ffb98369d3a63c93f7dd89bac1dcc876fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 09:27:58 +0100
+Subject: media: aspeed: fix error return code in aspeed_video_setup_video()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit d497fcdab02996a4510d5dd0d743447c737c317a ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index 4eaaf39b9223c..e0299a7899231 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -1529,12 +1529,12 @@ static int aspeed_video_setup_video(struct aspeed_video *video)
+ 			       V4L2_JPEG_CHROMA_SUBSAMPLING_420, mask,
+ 			       V4L2_JPEG_CHROMA_SUBSAMPLING_444);
+ 
+-	if (video->ctrl_handler.error) {
++	rc = video->ctrl_handler.error;
++	if (rc) {
+ 		v4l2_ctrl_handler_free(&video->ctrl_handler);
+ 		v4l2_device_unregister(v4l2_dev);
+ 
+-		dev_err(video->dev, "Failed to init controls: %d\n",
+-			video->ctrl_handler.error);
++		dev_err(video->dev, "Failed to init controls: %d\n", rc);
+ 		return rc;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-camss-missing-error-code-in-msm_video_register.patch b/queue-5.4/media-camss-missing-error-code-in-msm_video_register.patch
new file mode 100644
index 00000000000..89720cc386b
--- /dev/null
+++ b/queue-5.4/media-camss-missing-error-code-in-msm_video_register.patch
@@ -0,0 +1,36 @@
+From 71842e6cde5f3f9d97331ed081c330ed8b1a2fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 07:51:30 +0100
+Subject: media: camss: missing error code in msm_video_register()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9c67ed2ab299123872be14a3dc2ea44ce7e4538b ]
+
+This error path returns success but it should return -EINVAL.
+
+Fixes: cba3819d1e93 ("media: camss: Format configuration per hardware version")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
+index 1d50dfbbb762e..4c2675b437181 100644
+--- a/drivers/media/platform/qcom/camss/camss-video.c
++++ b/drivers/media/platform/qcom/camss/camss-video.c
+@@ -901,6 +901,7 @@ int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
+ 			video->nformats = ARRAY_SIZE(formats_rdi_8x96);
+ 		}
+ 	} else {
++		ret = -EINVAL;
+ 		goto error_video_register;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch b/queue-5.4/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch
new file mode 100644
index 00000000000..2714ebd2a46
--- /dev/null
+++ b/queue-5.4/media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch
@@ -0,0 +1,46 @@
+From 03920d4c464eb8be6deb66c40f85ebb530237716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Jan 2021 22:21:46 +0100
+Subject: media: cx25821: Fix a bug when reallocating some dma memory
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b2de3643c5024fc4fd128ba7767c7fb8b714bea7 ]
+
+This function looks like a realloc.
+
+However, if 'risc->cpu != NULL', the memory will be freed, but never
+reallocated with the bigger 'size'.
+Explicitly set 'risc->cpu' to NULL, so that the reallocation is
+correctly performed a few lines below.
+
+[hverkuil: NULL != risc->cpu -> risc->cpu]
+
+Fixes: 5ede94c70553 ("[media] cx25821: remove bogus btcx_risc dependency)
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 41be22ce66f3e..44839a6461e88 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -976,8 +976,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci,
+ 	__le32 *cpu;
+ 	dma_addr_t dma = 0;
+ 
+-	if (NULL != risc->cpu && risc->size < size)
++	if (risc->cpu && risc->size < size) {
+ 		pci_free_consistent(pci, risc->size, risc->cpu, risc->dma);
++		risc->cpu = NULL;
++	}
+ 	if (NULL == risc->cpu) {
+ 		cpu = pci_zalloc_consistent(pci, size, &dma);
+ 		if (NULL == cpu)
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch b/queue-5.4/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch
new file mode 100644
index 00000000000..02b4920e5a7
--- /dev/null
+++ b/queue-5.4/media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch
@@ -0,0 +1,46 @@
+From 10680b12e37b77253812a0e94ae07bba114a3248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 14:02:05 +0100
+Subject: media: em28xx: Fix use-after-free in em28xx_alloc_urbs
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]
+
+When kzalloc() fails, em28xx_uninit_usb_xfer() will free
+usb_bufs->buf and set it to NULL. Thus the later access
+to usb_bufs->buf[i] will lead to null pointer dereference.
+Also the kfree(usb_bufs->buf) after that is redundant.
+
+Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index e6088b5d1b805..3daa64bb1e1d9 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
+ 
+ 		usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
+ 		if (!usb_bufs->buf[i]) {
+-			em28xx_uninit_usb_xfer(dev, mode);
+-
+ 			for (i--; i >= 0; i--)
+ 				kfree(usb_bufs->buf[i]);
+ 
+-			kfree(usb_bufs->buf);
+-			usb_bufs->buf = NULL;
+-
++			em28xx_uninit_usb_xfer(dev, mode);
+ 			return -ENOMEM;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch b/queue-5.4/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch
new file mode 100644
index 00000000000..7058d6fa6e1
--- /dev/null
+++ b/queue-5.4/media-i2c-ov5670-fix-pixel_rate-minimum-value.patch
@@ -0,0 +1,43 @@
+From 044b63cf0a459825f3131c9861e2c7721f3f3f9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 18:52:20 +0100
+Subject: media: i2c: ov5670: Fix PIXEL_RATE minimum value
+
+From: Jacopo Mondi <jacopo@jmondi.org>
+
+[ Upstream commit dc1eb7c9c290cba52937c9a224b22a400bb0ffd7 ]
+
+The driver currently reports a single supported value for
+V4L2_CID_PIXEL_RATE and initializes the control's minimum value to 0,
+which is very risky, as userspace might accidentally use it as divider
+when calculating the time duration of a line.
+
+Fix this by using as minimum the only supported value when registering
+the control.
+
+Fixes: 5de35c9b8dcd1 ("media: i2c: Add Omnivision OV5670 5M sensor support")
+Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5670.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index 041fcbb4eebdf..79e608dba4b6d 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2081,7 +2081,8 @@ static int ov5670_init_controls(struct ov5670 *ov5670)
+ 
+ 	/* By default, V4L2_CID_PIXEL_RATE is read only */
+ 	ov5670->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov5670_ctrl_ops,
+-					       V4L2_CID_PIXEL_RATE, 0,
++					       V4L2_CID_PIXEL_RATE,
++					       link_freq_configs[0].pixel_rate,
+ 					       link_freq_configs[0].pixel_rate,
+ 					       1,
+ 					       link_freq_configs[0].pixel_rate);
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-imx-fix-csc-scaler-unregister.patch b/queue-5.4/media-imx-fix-csc-scaler-unregister.patch
new file mode 100644
index 00000000000..807f8dff7c0
--- /dev/null
+++ b/queue-5.4/media-imx-fix-csc-scaler-unregister.patch
@@ -0,0 +1,52 @@
+From 4778292a6488fe10f8f5ab975d487241d34e15f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 21:34:40 +0100
+Subject: media: imx: Fix csc/scaler unregister
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 89b14485caa4b7b2eaf70be0064f0978e68ebeee ]
+
+The csc/scaler device private struct is released by
+ipu_csc_scaler_video_device_release(), which can be called
+by video_unregister_device() if there are no users
+of the underlying struct video device.
+
+Therefore, the mutex can't be held when calling
+video_unregister_device() as its memory may be freed
+by it, leading to a kernel oops.
+
+Fortunately, the fix is quite simple as no locking
+is needed when calling video_unregister_device(): v4l2-core
+already has its own internal locking, and the structures
+are also properly refcounted.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-csc-scaler.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
+index 2b635ebf62d6a..a15d970adb983 100644
+--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
++++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
+@@ -866,11 +866,7 @@ void imx_media_csc_scaler_device_unregister(struct imx_media_video_dev *vdev)
+ 	struct ipu_csc_scaler_priv *priv = vdev_to_priv(vdev);
+ 	struct video_device *vfd = priv->vdev.vfd;
+ 
+-	mutex_lock(&priv->mutex);
+-
+ 	video_unregister_device(vfd);
+-
+-	mutex_unlock(&priv->mutex);
+ }
+ 
+ struct imx_media_video_dev *
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-imx-unregister-csc-scaler-only-if-registered.patch b/queue-5.4/media-imx-unregister-csc-scaler-only-if-registered.patch
new file mode 100644
index 00000000000..2bb0704c3f6
--- /dev/null
+++ b/queue-5.4/media-imx-unregister-csc-scaler-only-if-registered.patch
@@ -0,0 +1,58 @@
+From 96b9592fc75efbbe7b4d6f2344a5f5d305260dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 21:34:39 +0100
+Subject: media: imx: Unregister csc/scaler only if registered
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit bb2216548a2b13cf2942a058b475438a7a6bb028 ]
+
+The csc/scaler device pointer (imxmd->m2m_vdev) is assigned
+after the imx media device v4l2-async probe completes,
+therefore we need to check if the device is non-NULL
+before trying to unregister it.
+
+This can be the case if the non-completed imx media device
+is unbinded (or the driver is removed), leading to a kernel oops.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-dev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
+index 2c3c2adca6832..e16408af92d9c 100644
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -53,6 +53,7 @@ static int imx6_media_probe_complete(struct v4l2_async_notifier *notifier)
+ 	imxmd->m2m_vdev = imx_media_csc_scaler_device_init(imxmd);
+ 	if (IS_ERR(imxmd->m2m_vdev)) {
+ 		ret = PTR_ERR(imxmd->m2m_vdev);
++		imxmd->m2m_vdev = NULL;
+ 		goto unlock;
+ 	}
+ 
+@@ -107,10 +108,14 @@ static int imx_media_remove(struct platform_device *pdev)
+ 
+ 	v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
+ 
++	if (imxmd->m2m_vdev) {
++		imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
++		imxmd->m2m_vdev = NULL;
++	}
++
+ 	v4l2_async_notifier_unregister(&imxmd->notifier);
+ 	imx_media_unregister_ipu_internal_subdevs(imxmd);
+ 	v4l2_async_notifier_cleanup(&imxmd->notifier);
+-	imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
+ 	media_device_unregister(&imxmd->md);
+ 	v4l2_device_unregister(&imxmd->v4l2_dev);
+ 	media_device_cleanup(&imxmd->md);
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-lmedm04-fix-misuse-of-comma.patch b/queue-5.4/media-lmedm04-fix-misuse-of-comma.patch
new file mode 100644
index 00000000000..19eb7a6d7fb
--- /dev/null
+++ b/queue-5.4/media-lmedm04-fix-misuse-of-comma.patch
@@ -0,0 +1,40 @@
+From 6d2b50d31e7d31bcb162148b455107b0c43a2957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 20:13:31 +0200
+Subject: media: lmedm04: Fix misuse of comma
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit 59a3e78f8cc33901fe39035c1ab681374bba95ad ]
+
+There's a comma used instead of a semicolon that causes multiple
+statements to be executed after an if instead of just the intended
+single statement.
+
+Replace the comma with a semicolon.
+
+Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 62d3566bf7eeb..5ac1a6af87826 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -391,7 +391,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ 	ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
+ 
+ 	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+-		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+ 
+ 	usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
+ 	info("INT Interrupt Service Started");
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-media-pci-fix-memleak-in-empress_init.patch b/queue-5.4/media-media-pci-fix-memleak-in-empress_init.patch
new file mode 100644
index 00000000000..5c3f61b2a1b
--- /dev/null
+++ b/queue-5.4/media-media-pci-fix-memleak-in-empress_init.patch
@@ -0,0 +1,42 @@
+From e65db341894df44434b409a4867997976d014003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 07:27:22 +0100
+Subject: media: media/pci: Fix memleak in empress_init
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ]
+
+When vb2_queue_init() fails, dev->empress_dev
+should be released just like other error handling
+paths.
+
+Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
+index cb65d345fd3e9..e2666d1c68964 100644
+--- a/drivers/media/pci/saa7134/saa7134-empress.c
++++ b/drivers/media/pci/saa7134/saa7134-empress.c
+@@ -282,8 +282,11 @@ static int empress_init(struct saa7134_dev *dev)
+ 	q->lock = &dev->lock;
+ 	q->dev = &dev->pci->dev;
+ 	err = vb2_queue_init(q);
+-	if (err)
++	if (err) {
++		video_device_release(dev->empress_dev);
++		dev->empress_dev = NULL;
+ 		return err;
++	}
+ 	dev->empress_dev->queue = q;
+ 	dev->empress_dev->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING |
+ 					V4L2_CAP_VIDEO_CAPTURE;
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-pxa_camera-declare-variable-when-debug-is-defi.patch b/queue-5.4/media-pxa_camera-declare-variable-when-debug-is-defi.patch
new file mode 100644
index 00000000000..9473e8e7161
--- /dev/null
+++ b/queue-5.4/media-pxa_camera-declare-variable-when-debug-is-defi.patch
@@ -0,0 +1,46 @@
+From 85a26b54eb709aec78f3349e7ff9d20ff02c4dff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 14:45:13 +0100
+Subject: media: pxa_camera: declare variable when DEBUG is defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 031b9212eeee365443aaef013360ea6cded7b2c4 ]
+
+When DEBUG is defined this error occurs
+
+drivers/media/platform/pxa_camera.c:1410:7: error:
+  ‘i’ undeclared (first use in this function)
+  for (i = 0; i < vb->num_planes; i++)
+       ^
+The variable 'i' is missing, so declare it.
+
+Fixes: 6f28435d1c15 ("[media] media: platform: pxa_camera: trivial move of functions")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/pxa_camera.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
+index 8d47ea0c33f84..6e04e3ec61bac 100644
+--- a/drivers/media/platform/pxa_camera.c
++++ b/drivers/media/platform/pxa_camera.c
+@@ -1447,6 +1447,9 @@ static int pxac_vb2_prepare(struct vb2_buffer *vb)
+ 	struct pxa_camera_dev *pcdev = vb2_get_drv_priv(vb->vb2_queue);
+ 	struct pxa_buffer *buf = vb2_to_pxa_buffer(vb);
+ 	int ret = 0;
++#ifdef DEBUG
++	int i;
++#endif
+ 
+ 	switch (pcdev->channels) {
+ 	case 1:
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch b/queue-5.4/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch
new file mode 100644
index 00000000000..d6cd909ee82
--- /dev/null
+++ b/queue-5.4/media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch
@@ -0,0 +1,43 @@
+From 4bae5e570566100bab49e40c4c56528f8c29ddb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 02:34:37 +0100
+Subject: media: qm1d1c0042: fix error return code in qm1d1c0042_init()
+
+From: Luo Meng <luomeng12@huawei.com>
+
+[ Upstream commit fcf8d018bdca0453b8d6359062e6bc1512d04c38 ]
+
+Fix to return a negative error code from the error handling case
+instead of 0 in function qm1d1c0042_init(), as done elsewhere
+in this function.
+
+Fixes: ab4d14528fdf ("[media] em28xx: add support for PLEX PX-BCUD (ISDB-S)")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Luo Meng <luomeng12@huawei.com>
+Acked-by: Akihiro Tsukada <tskd08@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/tuners/qm1d1c0042.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/tuners/qm1d1c0042.c b/drivers/media/tuners/qm1d1c0042.c
+index 83ca5dc047ea2..baa9950783b66 100644
+--- a/drivers/media/tuners/qm1d1c0042.c
++++ b/drivers/media/tuners/qm1d1c0042.c
+@@ -343,8 +343,10 @@ static int qm1d1c0042_init(struct dvb_frontend *fe)
+ 		if (val == reg_initval[reg_index][0x00])
+ 			break;
+ 	}
+-	if (reg_index >= QM1D1C0042_NUM_REG_ROWS)
++	if (reg_index >= QM1D1C0042_NUM_REG_ROWS) {
++		ret = -EINVAL;
+ 		goto failed;
++	}
+ 	memcpy(state->regs, reg_initval[reg_index], QM1D1C0042_NUM_REGS);
+ 	usleep_range(2000, 3000);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-software_node-fix-refcounts-in-software_node_g.patch b/queue-5.4/media-software_node-fix-refcounts-in-software_node_g.patch
new file mode 100644
index 00000000000..b59f14e765c
--- /dev/null
+++ b/queue-5.4/media-software_node-fix-refcounts-in-software_node_g.patch
@@ -0,0 +1,55 @@
+From 065d7c8c40c9a81cbb14aec07ccce1c285321774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 14:28:24 +0100
+Subject: media: software_node: Fix refcounts in software_node_get_next_child()
+
+From: Daniel Scally <djrscally@gmail.com>
+
+[ Upstream commit fb5ec981adf08b94e6ce27ca16b7765c94f4513c ]
+
+The software_node_get_next_child() function currently does not hold
+references to the child software_node that it finds or put the ref that
+is held against the old child - fix that.
+
+Fixes: 59abd83672f7 ("drivers: base: Introducing software nodes to the firmware node framework")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Daniel Scally <djrscally@gmail.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index 77cc138d138cd..7d5236eafe845 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -534,14 +534,18 @@ software_node_get_next_child(const struct fwnode_handle *fwnode,
+ 	struct swnode *c = to_swnode(child);
+ 
+ 	if (!p || list_empty(&p->children) ||
+-	    (c && list_is_last(&c->entry, &p->children)))
++	    (c && list_is_last(&c->entry, &p->children))) {
++		fwnode_handle_put(child);
+ 		return NULL;
++	}
+ 
+ 	if (c)
+ 		c = list_next_entry(c, entry);
+ 	else
+ 		c = list_first_entry(&p->children, struct swnode, entry);
+-	return &c->fwnode;
++
++	fwnode_handle_put(child);
++	return fwnode_handle_get(&c->fwnode);
+ }
+ 
+ static struct fwnode_handle *
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-tm6000-fix-memleak-in-tm6000_start_stream.patch b/queue-5.4/media-tm6000-fix-memleak-in-tm6000_start_stream.patch
new file mode 100644
index 00000000000..e1599ed069c
--- /dev/null
+++ b/queue-5.4/media-tm6000-fix-memleak-in-tm6000_start_stream.patch
@@ -0,0 +1,40 @@
+From 103483eeea57d34c6b0b4f38e2a43447f6f8a621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 09:26:37 +0100
+Subject: media: tm6000: Fix memleak in tm6000_start_stream
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ]
+
+When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer
+and dvb->bulk_urb should be freed just like when
+usb_submit_urb() fails.
+
+Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
+index 19c90fa9e443d..293a460f4616c 100644
+--- a/drivers/media/usb/tm6000/tm6000-dvb.c
++++ b/drivers/media/usb/tm6000/tm6000-dvb.c
+@@ -141,6 +141,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
+ 	if (ret < 0) {
+ 		printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
+ 							ret, __func__);
++
++		kfree(dvb->bulk_urb->transfer_buffer);
++		usb_free_urb(dvb->bulk_urb);
++		dvb->bulk_urb = NULL;
+ 		return ret;
+ 	} else
+ 		printk(KERN_ERR "tm6000: pipe reset\n");
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch b/queue-5.4/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch
new file mode 100644
index 00000000000..d9c846b39f2
--- /dev/null
+++ b/queue-5.4/media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch
@@ -0,0 +1,82 @@
+From b18bc1e88e18b027ec62d69d3f1fab5d7e32d371 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Dec 2020 15:11:13 +0100
+Subject: media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit dc9455ffae02d7b7fb51ba1e007fffcb9dc5d890 ]
+
+The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and
+bFrameIndex values when negotiating the video probe and commit controls.
+The UVC descriptors report a single supported format and frame size,
+with bFormatIndex and bFrameIndex both equal to 2, but the video probe
+and commit controls report bFormatIndex and bFrameIndex set to 1.
+
+The device otherwise operates correctly, but the driver rejects the
+values and fails the format try operation. Fix it by ignoring the
+invalid indices, and assuming that the format and frame requested by the
+driver are accepted by the device.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767
+
+Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2")
+Reported-by: Till Dörges <doerges@pre-sense.de>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_v4l2.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 5e6f3153b5ff8..7d60dd3b0bd85 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -248,7 +248,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ 		goto done;
+ 
+ 	/* After the probe, update fmt with the values returned from
+-	 * negotiation with the device.
++	 * negotiation with the device. Some devices return invalid bFormatIndex
++	 * and bFrameIndex values, in which case we can only assume they have
++	 * accepted the requested format as-is.
+ 	 */
+ 	for (i = 0; i < stream->nformats; ++i) {
+ 		if (probe->bFormatIndex == stream->format[i].index) {
+@@ -257,11 +259,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ 		}
+ 	}
+ 
+-	if (i == stream->nformats) {
+-		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
++	if (i == stream->nformats)
++		uvc_trace(UVC_TRACE_FORMAT,
++			  "Unknown bFormatIndex %u, using default\n",
+ 			  probe->bFormatIndex);
+-		return -EINVAL;
+-	}
+ 
+ 	for (i = 0; i < format->nframes; ++i) {
+ 		if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
+@@ -270,11 +271,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ 		}
+ 	}
+ 
+-	if (i == format->nframes) {
+-		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
++	if (i == format->nframes)
++		uvc_trace(UVC_TRACE_FORMAT,
++			  "Unknown bFrameIndex %u, using default\n",
+ 			  probe->bFrameIndex);
+-		return -EINVAL;
+-	}
+ 
+ 	fmt->fmt.pix.width = frame->wWidth;
+ 	fmt->fmt.pix.height = frame->wHeight;
+-- 
+2.27.0
+
diff --git a/queue-5.4/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch b/queue-5.4/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch
new file mode 100644
index 00000000000..2c793c99e57
--- /dev/null
+++ b/queue-5.4/media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch
@@ -0,0 +1,43 @@
+From 293bc62d2c126047438d8c0778ca030e0fd9cf0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 18:41:19 +0100
+Subject: media: vsp1: Fix an error handling path in the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 7113469dafc2d545fa4fa9bc649c31dc27db492e ]
+
+A previous 'rcar_fcp_get()' call must be undone in the error handling path,
+as already done in the remove function.
+
+Fixes: 94fcdf829793 ("[media] v4l: vsp1: Add FCP support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vsp1/vsp1_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
+index dc62533cf32ce..aa66e4f5f3f34 100644
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -882,8 +882,10 @@ static int vsp1_probe(struct platform_device *pdev)
+ 	}
+ 
+ done:
+-	if (ret)
++	if (ret) {
+ 		pm_runtime_disable(&pdev->dev);
++		rcar_fcp_put(vsp1->fcp);
++	}
+ 
+ 	return ret;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch b/queue-5.4/mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch
new file mode 100644
index 00000000000..440e00fd0d4
--- /dev/null
+++ b/queue-5.4/mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch
@@ -0,0 +1,38 @@
+From c5caaba504b79ac268d31f2962f5ccd01c2c1211 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 14:07:48 +0200
+Subject: mei: hbm: call mei_set_devstate() on hbm stop response
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+[ Upstream commit 3a77df62deb2e62de0dc26c1cb763cc152329287 ]
+
+Use mei_set_devstate() wrapper upon hbm stop command response,
+to trigger sysfs event.
+
+Fixes: 43b8a7ed4739 ("mei: expose device state in sysfs")
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20210129120752.850325-3-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/hbm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index a44094cdbc36c..d20b2b99c6f24 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1300,7 +1300,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ 			return -EPROTO;
+ 		}
+ 
+-		dev->dev_state = MEI_DEV_POWER_DOWN;
++		mei_set_devstate(dev, MEI_DEV_POWER_DOWN);
+ 		dev_info(dev->dev, "hbm: stop response: resetting.\n");
+ 		/* force the reset */
+ 		return -EPROTO;
+-- 
+2.27.0
+
diff --git a/queue-5.4/memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch b/queue-5.4/memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch
new file mode 100644
index 00000000000..4a6cf3ade40
--- /dev/null
+++ b/queue-5.4/memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch
@@ -0,0 +1,49 @@
+From 91f78d7d8edbd3b256ddd917de698e66d28241e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:21:18 +0800
+Subject: memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit a2d522ff0f5cc26915c4ccee9457fd4b4e1edc48 ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: 4f0a1a1ae3519 ("memory: mtk-smi: Invoke pm runtime_callback to enable clocks")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123102118.3866195-1-zhangqilong3@huawei.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/mtk-smi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
+index a113e811faabe..da1ce7fd4cf5c 100644
+--- a/drivers/memory/mtk-smi.c
++++ b/drivers/memory/mtk-smi.c
+@@ -127,7 +127,7 @@ static void mtk_smi_clk_disable(const struct mtk_smi *smi)
+ 
+ int mtk_smi_larb_get(struct device *larbdev)
+ {
+-	int ret = pm_runtime_get_sync(larbdev);
++	int ret = pm_runtime_resume_and_get(larbdev);
+ 
+ 	return (ret < 0) ? ret : 0;
+ }
+@@ -336,7 +336,7 @@ static int __maybe_unused mtk_smi_larb_resume(struct device *dev)
+ 	int ret;
+ 
+ 	/* Power on smi-common. */
+-	ret = pm_runtime_get_sync(larb->smi_common_dev);
++	ret = pm_runtime_resume_and_get(larb->smi_common_dev);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Failed to pm get for smi-common(%d).\n", ret);
+ 		return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch b/queue-5.4/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch
new file mode 100644
index 00000000000..1aabd4ff4b7
--- /dev/null
+++ b/queue-5.4/memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch
@@ -0,0 +1,55 @@
+From 9f570c8c2da2b8502a5c05f0c6c068266414bd59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 01:03:59 -0800
+Subject: memory: ti-aemif: Drop child node when jumping out loop
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 94e9dd43cf327366388c8f146bccdc6322c0d999 ]
+
+Call of_node_put() to decrement the reference count of the child node
+child_np when jumping out of the loop body of
+for_each_available_child_of_node(), which is a macro that increments and
+decrements the reference count of child node. If the loop is broken, the
+reference of the child node should be dropped manually.
+
+Fixes: 5a7c81547c1d ("memory: ti-aemif: introduce AEMIF driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210121090359.61763-1-bianpan2016@163.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/ti-aemif.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
+index db526dbf71eed..94219d2a2773d 100644
+--- a/drivers/memory/ti-aemif.c
++++ b/drivers/memory/ti-aemif.c
+@@ -378,8 +378,10 @@ static int aemif_probe(struct platform_device *pdev)
+ 		 */
+ 		for_each_available_child_of_node(np, child_np) {
+ 			ret = of_aemif_parse_abus_config(pdev, child_np);
+-			if (ret < 0)
++			if (ret < 0) {
++				of_node_put(child_np);
+ 				goto error;
++			}
+ 		}
+ 	} else if (pdata && pdata->num_abus_data > 0) {
+ 		for (i = 0; i < pdata->num_abus_data; i++, aemif->num_cs++) {
+@@ -405,8 +407,10 @@ static int aemif_probe(struct platform_device *pdev)
+ 		for_each_available_child_of_node(np, child_np) {
+ 			ret = of_platform_populate(child_np, NULL,
+ 						   dev_lookup, dev);
+-			if (ret < 0)
++			if (ret < 0) {
++				of_node_put(child_np);
+ 				goto error;
++			}
+ 		}
+ 	} else if (pdata) {
+ 		for (i = 0; i < pdata->num_sub_devices; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.4/mfd-bd9571mwv-use-devm_mfd_add_devices.patch b/queue-5.4/mfd-bd9571mwv-use-devm_mfd_add_devices.patch
new file mode 100644
index 00000000000..e946c401711
--- /dev/null
+++ b/queue-5.4/mfd-bd9571mwv-use-devm_mfd_add_devices.patch
@@ -0,0 +1,43 @@
+From 944ad7d6f15ae9a171b07707690f3fdf48215939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 18:00:56 +0900
+Subject: mfd: bd9571mwv: Use devm_mfd_add_devices()
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit c58ad0f2b052b5675d6394e03713ee41e721b44c ]
+
+To remove mfd devices when unload this driver, should use
+devm_mfd_add_devices() instead.
+
+Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Acked-for-MFD-by: Lee Jones <lee.jones@linaro.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/bd9571mwv.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index fab3cdc27ed64..19d57a45134c6 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -185,9 +185,9 @@ static int bd9571mwv_probe(struct i2c_client *client,
+ 		return ret;
+ 	}
+ 
+-	ret = mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO, bd9571mwv_cells,
+-			      ARRAY_SIZE(bd9571mwv_cells), NULL, 0,
+-			      regmap_irq_get_domain(bd->irq_data));
++	ret = devm_mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO,
++				   bd9571mwv_cells, ARRAY_SIZE(bd9571mwv_cells),
++				   NULL, 0, regmap_irq_get_domain(bd->irq_data));
+ 	if (ret) {
+ 		regmap_del_irq_chip(bd->irq, bd->irq_data);
+ 		return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch b/queue-5.4/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch
new file mode 100644
index 00000000000..f5c87b16799
--- /dev/null
+++ b/queue-5.4/mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch
@@ -0,0 +1,44 @@
+From fb3bd8fa3219367140e10ffae583e4171dfc6fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:37:24 +0300
+Subject: mfd: wm831x-auxadc: Prevent use after free in
+ wm831x_auxadc_read_irq()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]
+
+The "req" struct is always added to the "wm831x->auxadc_pending" list,
+but it's only removed from the list on the success path.  If a failure
+occurs then the "req" struct is freed but it's still on the list,
+leading to a use after free.
+
+Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wm831x-auxadc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
+index 8a7cc0f86958b..65b98f3fbd929 100644
+--- a/drivers/mfd/wm831x-auxadc.c
++++ b/drivers/mfd/wm831x-auxadc.c
+@@ -93,11 +93,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
+ 	wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
+ 
+ 	mutex_lock(&wm831x->auxadc_lock);
+-
+-	list_del(&req->list);
+ 	ret = req->val;
+ 
+ out:
++	list_del(&req->list);
+ 	mutex_unlock(&wm831x->auxadc_lock);
+ 
+ 	kfree(req);
+-- 
+2.27.0
+
diff --git a/queue-5.4/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch b/queue-5.4/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch
new file mode 100644
index 00000000000..c495cc1119c
--- /dev/null
+++ b/queue-5.4/mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch
@@ -0,0 +1,45 @@
+From 6711a7123cce3193a5751dbb3318e19023fd8d8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 13:34:56 -0700
+Subject: MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ]
+
+When building with clang, the following section mismatch warning occurs:
+
+WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in
+reference from the function r4k_cache_init() to the function
+.init.text:loongson2_sc_init()
+
+This should have been fixed with commit ad4fddef5f23 ("mips: fix Section
+mismatch in reference") but it was missed. Remove the improper __init
+annotation like that commit did.
+
+Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code")
+Link: https://github.com/ClangBuiltLinux/linux/issues/787
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/c-r4k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 504fd61592405..3375bbe63284e 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1560,7 +1560,7 @@ static int probe_scache(void)
+ 	return 1;
+ }
+ 
+-static void __init loongson2_sc_init(void)
++static void loongson2_sc_init(void)
+ {
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch b/queue-5.4/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch
new file mode 100644
index 00000000000..a625a1fbe99
--- /dev/null
+++ b/queue-5.4/mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch
@@ -0,0 +1,55 @@
+From 1be9e97fdc5748cc0fed2e8cca94a28e7e81f3f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 13:15:48 -0700
+Subject: MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ]
+
+When building xway_defconfig with clang:
+
+arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant
+operand [-Werror,-Wconstant-logical-operand]
+        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+                                                      ^ ~~~~~~~~~~~~~~~~~
+arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation
+        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+                                                      ^~
+                                                      &
+arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this
+warning
+        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+                                                     ~^~~~~~~~~~~~~~~~~~~~
+1 error generated.
+
+Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the
+warning. Additionally, remove the unnecessary parentheses as this is a
+simple conditional statement and shorthand '== 0' to '!'.
+
+Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support")
+Link: https://github.com/ClangBuiltLinux/linux/issues/807
+Reported-by: Dmitry Golovin <dima@golovin.in>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index 115b417dfb8e3..9fcc118312cb9 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -302,7 +302,7 @@ static void ltq_hw_irq_handler(struct irq_desc *desc)
+ 	generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
+ 
+ 	/* if this is a EBU irq, we need to ack it or get a deadlock */
+-	if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
++	if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
+ 		ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
+ 			LTQ_EBU_PCC_ISTAT);
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/mips-properly-stop-.eh_frame-generation.patch b/queue-5.4/mips-properly-stop-.eh_frame-generation.patch
new file mode 100644
index 00000000000..c6b464964b2
--- /dev/null
+++ b/queue-5.4/mips-properly-stop-.eh_frame-generation.patch
@@ -0,0 +1,84 @@
+From db5c643e44246c4d0161b1537000476eded29353 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 11:56:28 +0000
+Subject: MIPS: properly stop .eh_frame generation
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 894ef530012fb5078466efdfb2c15d8b2f1565cd ]
+
+Commit 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly") added
+-fno-asynchronous-unwind-tables to KBUILD_CFLAGS to prevent compiler
+from emitting .eh_frame symbols.
+However, as MIPS heavily uses CFI, that's not enough. Use the
+approach taken for x86 (as it also uses CFI) and explicitly put CFI
+symbols into the .debug_frame section (except for VDSO).
+This allows us to drop .eh_frame from DISCARDS as it's no longer
+being generated.
+
+Fixes: 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly")
+Suggested-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/asm.h    | 18 ++++++++++++++++++
+ arch/mips/kernel/vmlinux.lds.S |  1 -
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/asm.h b/arch/mips/include/asm/asm.h
+index c23527ba65d09..64bffc1f75e0c 100644
+--- a/arch/mips/include/asm/asm.h
++++ b/arch/mips/include/asm/asm.h
+@@ -20,10 +20,27 @@
+ #include <asm/sgidefs.h>
+ #include <asm/asm-eva.h>
+ 
++#ifndef __VDSO__
++/*
++ * Emit CFI data in .debug_frame sections, not .eh_frame sections.
++ * We don't do DWARF unwinding at runtime, so only the offline DWARF
++ * information is useful to anyone. Note we should change this if we
++ * ever decide to enable DWARF unwinding at runtime.
++ */
++#define CFI_SECTIONS	.cfi_sections .debug_frame
++#else
++ /*
++  * For the vDSO, emit both runtime unwind information and debug
++  * symbols for the .dbg file.
++  */
++#define CFI_SECTIONS
++#endif
++
+ /*
+  * LEAF - declare leaf routine
+  */
+ #define LEAF(symbol)					\
++		CFI_SECTIONS;				\
+ 		.globl	symbol;				\
+ 		.align	2;				\
+ 		.type	symbol, @function;		\
+@@ -36,6 +53,7 @@ symbol:		.frame	sp, 0, ra;			\
+  * NESTED - declare nested routine entry point
+  */
+ #define NESTED(symbol, framesize, rpc)			\
++		CFI_SECTIONS;				\
+ 		.globl	symbol;				\
+ 		.align	2;				\
+ 		.type	symbol, @function;		\
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 09770a4d97846..faf98f209b3f4 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -226,6 +226,5 @@ SECTIONS
+ 		*(.options)
+ 		*(.pdr)
+ 		*(.reginfo)
+-		*(.eh_frame)
+ 	}
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch b/queue-5.4/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch
new file mode 100644
index 00000000000..5c980a01f63
--- /dev/null
+++ b/queue-5.4/misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch
@@ -0,0 +1,38 @@
+From 38e717599edfa2212f97868c0b2997b91f796a83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 10:42:52 +0530
+Subject: misc: eeprom_93xx46: Add module alias to avoid breaking support for
+ non device tree users
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 4540b9fbd8ebb21bb3735796d300a1589ee5fbf2 ]
+
+Module alias "spi:93xx46" is used by non device tree users like
+drivers/misc/eeprom/digsy_mtc_eeprom.c  and removing it will
+break support for them.
+
+Fix this by adding back the module alias "spi:93xx46".
+
+Fixes: 13613a2246bf ("misc: eeprom_93xx46: Fix module alias to enable module autoprobe")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Link: https://lore.kernel.org/r/20210113051253.15061-1-a-govindraju@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 6adf979299667..414dcbd3c3c25 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -510,4 +510,5 @@ module_spi_driver(eeprom_93xx46_driver);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
++MODULE_ALIAS("spi:93xx46");
+ MODULE_ALIAS("spi:eeprom-93xx46");
+-- 
+2.27.0
+
diff --git a/queue-5.4/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch b/queue-5.4/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch
new file mode 100644
index 00000000000..b3cf3125a70
--- /dev/null
+++ b/queue-5.4/misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch
@@ -0,0 +1,34 @@
+From dc64da5212cd9efc480db50eb3af2f19f3370529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 22:09:53 +0530
+Subject: misc: eeprom_93xx46: Fix module alias to enable module autoprobe
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 13613a2246bf531f5fc04e8e62e8f21a3d39bf1c ]
+
+Fix module autoprobe by correcting module alias to match the string from
+/sys/class/.../spi1.0/modalias content.
+
+Fixes: 06b4501e88ad ("misc/eeprom: add driver for microwire 93xx46 EEPROMs")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Link: https://lore.kernel.org/r/20210107163957.28664-2-a-govindraju@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 94cfb675fe4ed..6adf979299667 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -510,4 +510,4 @@ module_spi_driver(eeprom_93xx46_driver);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+-MODULE_ALIAS("spi:93xx46");
++MODULE_ALIAS("spi:eeprom-93xx46");
+-- 
+2.27.0
+
diff --git a/queue-5.4/mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch b/queue-5.4/mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch
new file mode 100644
index 00000000000..aef1a202ebc
--- /dev/null
+++ b/queue-5.4/mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch
@@ -0,0 +1,113 @@
+From cedcb6aa89079444ddfe314505aa4e1d1fdc2713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:09:36 -0800
+Subject: mm/compaction: fix misbehaviors of fast_find_migrateblock()
+
+From: Wonhyuk Yang <vvghjk1234@gmail.com>
+
+[ Upstream commit 15d28d0d11609c7a4f217b3d85e26456d9beb134 ]
+
+In the fast_find_migrateblock(), it iterates ocer the freelist to find the
+proper pageblock.  But there are some misbehaviors.
+
+First, if the page we found is equal to cc->migrate_pfn, it is considered
+that we didn't find a suitable pageblock.  Secondly, if the loop was
+terminated because order is less than PAGE_ALLOC_COSTLY_ORDER, it could be
+considered that we found a suitable one.  Thirdly, if the skip bit is set
+on the page block and we goto continue, it doesn't check nr_scanned.
+Fourthly, if the page block's skip bit is set, it checks that page block
+is the last of list, which is unnecessary.
+
+Link: https://lkml.kernel.org/r/20210128130411.6125-1-vvghjk1234@gmail.com
+Fixes: 70b44595eafe9 ("mm, compaction: use free lists to quickly locate a migration source")
+Signed-off-by: Wonhyuk Yang <vvghjk1234@gmail.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/compaction.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 88c3f6bad1aba..d686887856fee 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -1630,6 +1630,7 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 	unsigned long pfn = cc->migrate_pfn;
+ 	unsigned long high_pfn;
+ 	int order;
++	bool found_block = false;
+ 
+ 	/* Skip hints are relied on to avoid repeats on the fast search */
+ 	if (cc->ignore_skip_hint)
+@@ -1672,7 +1673,7 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 	high_pfn = pageblock_start_pfn(cc->migrate_pfn + distance);
+ 
+ 	for (order = cc->order - 1;
+-	     order >= PAGE_ALLOC_COSTLY_ORDER && pfn == cc->migrate_pfn && nr_scanned < limit;
++	     order >= PAGE_ALLOC_COSTLY_ORDER && !found_block && nr_scanned < limit;
+ 	     order--) {
+ 		struct free_area *area = &cc->zone->free_area[order];
+ 		struct list_head *freelist;
+@@ -1687,7 +1688,11 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 		list_for_each_entry(freepage, freelist, lru) {
+ 			unsigned long free_pfn;
+ 
+-			nr_scanned++;
++			if (nr_scanned++ >= limit) {
++				move_freelist_tail(freelist, freepage);
++				break;
++			}
++
+ 			free_pfn = page_to_pfn(freepage);
+ 			if (free_pfn < high_pfn) {
+ 				/*
+@@ -1696,12 +1701,8 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 				 * the list assumes an entry is deleted, not
+ 				 * reordered.
+ 				 */
+-				if (get_pageblock_skip(freepage)) {
+-					if (list_is_last(freelist, &freepage->lru))
+-						break;
+-
++				if (get_pageblock_skip(freepage))
+ 					continue;
+-				}
+ 
+ 				/* Reorder to so a future search skips recent pages */
+ 				move_freelist_tail(freelist, freepage);
+@@ -1709,15 +1710,10 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 				update_fast_start_pfn(cc, free_pfn);
+ 				pfn = pageblock_start_pfn(free_pfn);
+ 				cc->fast_search_fail = 0;
++				found_block = true;
+ 				set_pageblock_skip(freepage);
+ 				break;
+ 			}
+-
+-			if (nr_scanned >= limit) {
+-				cc->fast_search_fail++;
+-				move_freelist_tail(freelist, freepage);
+-				break;
+-			}
+ 		}
+ 		spin_unlock_irqrestore(&cc->zone->lock, flags);
+ 	}
+@@ -1728,9 +1724,10 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ 	 * If fast scanning failed then use a cached entry for a page block
+ 	 * that had free pages as the basis for starting a linear scan.
+ 	 */
+-	if (pfn == cc->migrate_pfn)
++	if (!found_block) {
++		cc->fast_search_fail++;
+ 		pfn = reinit_migrate_pfn(cc);
+-
++	}
+ 	return pfn;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch b/queue-5.4/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch
new file mode 100644
index 00000000000..691db3155dc
--- /dev/null
+++ b/queue-5.4/mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch
@@ -0,0 +1,46 @@
+From adf6799a4fc2926f908ba8bc5c665a9e247524aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:06:50 -0800
+Subject: mm/hugetlb: fix potential double free in hugetlb_register_node()
+ error path
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit cc2205a67dec5a700227a693fc113441e73e4641 ]
+
+In hugetlb_sysfs_add_hstate(), we would do kobject_put() on hstate_kobjs
+when failed to create sysfs group but forget to set hstate_kobjs to NULL.
+Then in hugetlb_register_node() error path, we may free it again via
+hugetlb_unregister_node().
+
+Link: https://lkml.kernel.org/r/20210107123249.36964-1-linmiaohe@huawei.com
+Fixes: a3437870160c ("hugetlb: new sysfs interface")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Reviewed-by: Muchun Song <smuchun@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/hugetlb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d5b03b9262d4f..2e2527c9f9a21 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2812,8 +2812,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
+ 		return -ENOMEM;
+ 
+ 	retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group);
+-	if (retval)
++	if (retval) {
+ 		kobject_put(hstate_kobjs[hi]);
++		hstate_kobjs[hi] = NULL;
++	}
+ 
+ 	return retval;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch b/queue-5.4/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch
new file mode 100644
index 00000000000..a8289dba965
--- /dev/null
+++ b/queue-5.4/mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch
@@ -0,0 +1,66 @@
+From 0cd702b302e33c237f768b1ff987f5a9378adb98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:04:33 -0800
+Subject: mm/memory.c: fix potential pte_unmap_unlock pte error
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit 90a3e375d324b2255b83e3dd29e99e2b05d82aaf ]
+
+Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
+high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
+we would break the loop with pte unchanged.  Then the wrong pte - 1 would
+be passed to pte_unmap_unlock.
+
+Andi said:
+
+ "While the fix is correct, I'm not sure if it actually is a real bug.
+  Is there any architecture that would do something else than unlocking
+  the underlying page? If it's just the underlying page then it should
+  be always the same page, so no bug"
+
+Link: https://lkml.kernel.org/r/20210109080118.20885-1-linmiaohe@huawei.com
+Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
+Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mm/memory.c b/mm/memory.c
+index b23831132933a..9710e94ff4f21 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1804,11 +1804,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ 			unsigned long addr, unsigned long end,
+ 			unsigned long pfn, pgprot_t prot)
+ {
+-	pte_t *pte;
++	pte_t *pte, *mapped_pte;
+ 	spinlock_t *ptl;
+ 	int err = 0;
+ 
+-	pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
++	mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ 	if (!pte)
+ 		return -ENOMEM;
+ 	arch_enter_lazy_mmu_mode();
+@@ -1822,7 +1822,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ 		pfn++;
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+ 	arch_leave_lazy_mmu_mode();
+-	pte_unmap_unlock(pte - 1, ptl);
++	pte_unmap_unlock(mapped_pte, ptl);
+ 	return err;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch b/queue-5.4/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
new file mode 100644
index 00000000000..a42bc359958
--- /dev/null
+++ b/queue-5.4/mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
@@ -0,0 +1,56 @@
+From bfa4711d1c8baa62f4693b77ceed3e77e70fadaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:18:09 -0800
+Subject: mm/rmap: fix potential pte_unmap on an not mapped pte
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit 5d5d19eda6b0ee790af89c45e3f678345be6f50f ]
+
+For PMD-mapped page (usually THP), pvmw->pte is NULL.  For PTE-mapped THP,
+pvmw->pte is mapped.  But for HugeTLB pages, pvmw->pte is not mapped and
+set to the relevant page table entry.  So in page_vma_mapped_walk_done(),
+we may do pte_unmap() for HugeTLB pte which is not mapped.  Fix this by
+checking pvmw->page against PageHuge before trying to do pte_unmap().
+
+Link: https://lkml.kernel.org/r/20210127093349.39081-1-linmiaohe@huawei.com
+Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
+Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Shakeel Butt <shakeelb@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
+Cc: Dmitry Safonov <0x7f454c46@gmail.com>
+Cc: Brian Geffon <bgeffon@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rmap.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index 988d176472df7..d7d6d4eb17949 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -214,7 +214,8 @@ struct page_vma_mapped_walk {
+ 
+ static inline void page_vma_mapped_walk_done(struct page_vma_mapped_walk *pvmw)
+ {
+-	if (pvmw->pte)
++	/* HugeTLB pte is set to the relevant page table entry without pte_mapped. */
++	if (pvmw->pte && !PageHuge(pvmw->page))
+ 		pte_unmap(pvmw->pte);
+ 	if (pvmw->ptl)
+ 		spin_unlock(pvmw->ptl);
+-- 
+2.27.0
+
diff --git a/queue-5.4/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch b/queue-5.4/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch
new file mode 100644
index 00000000000..8dc4c510b8c
--- /dev/null
+++ b/queue-5.4/mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch
@@ -0,0 +1,44 @@
+From 53ca9a01582a3b853956f1d499dc8d0413703e6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 19:29:31 +0900
+Subject: mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to
+ 128-bytes
+
+From: Takeshi Saito <takeshi.saito.xv@renesas.com>
+
+[ Upstream commit d7aefb2887601cf1fc3f86f55d43b2c9aece5e8f ]
+
+According to the latest datasheet, the internal DMAC buffer alignment
+R-Car Gen3 SDHI HW should be 128-bytes. So, fix it.
+
+Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com>
+[shimoda: revise commit description, rebase]
+Fixes: 2a68ea7896e3 ("mmc: renesas-sdhi: add support for R-Car Gen3 SDHI DMAC")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/1608114572-1892-2-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_internal_dmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index cb89f0578d425..f54d0427e9c00 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -186,8 +186,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
+ 			mmc_get_dma_dir(data)))
+ 		goto force_pio;
+ 
+-	/* This DMAC cannot handle if buffer is not 8-bytes alignment */
+-	if (!IS_ALIGNED(sg_dma_address(sg), 8))
++	/* This DMAC cannot handle if buffer is not 128-bytes alignment */
++	if (!IS_ALIGNED(sg_dma_address(sg), 128))
+ 		goto force_pio_with_unmap;
+ 
+ 	if (data->flags & MMC_DATA_READ) {
+-- 
+2.27.0
+
diff --git a/queue-5.4/mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch b/queue-5.4/mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch
new file mode 100644
index 00000000000..b1826881581
--- /dev/null
+++ b/queue-5.4/mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch
@@ -0,0 +1,51 @@
+From ce068cc1bdba185b3337a94a026bc3ac8c7a0bae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 21:42:36 +0100
+Subject: mmc: sdhci-sprd: Fix some resource leaks in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit c9c256a8b0dc09c305c409d6264cc016af2ba38d ]
+
+'sdhci_remove_host()' and 'sdhci_pltfm_free()' should be used in place of
+'mmc_remove_host()' and 'mmc_free_host()'.
+
+This avoids some resource leaks, is more in line with the error handling
+path of the probe function, and is more consistent with other drivers.
+
+Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Orson Zhai <orson.zhai@gmail.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20201217204236.163446-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-sprd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
+index d07b9793380f0..10705e5fa90ee 100644
+--- a/drivers/mmc/host/sdhci-sprd.c
++++ b/drivers/mmc/host/sdhci-sprd.c
+@@ -665,14 +665,14 @@ static int sdhci_sprd_remove(struct platform_device *pdev)
+ {
+ 	struct sdhci_host *host = platform_get_drvdata(pdev);
+ 	struct sdhci_sprd_host *sprd_host = TO_SPRD_HOST(host);
+-	struct mmc_host *mmc = host->mmc;
+ 
+-	mmc_remove_host(mmc);
++	sdhci_remove_host(host, 0);
++
+ 	clk_disable_unprepare(sprd_host->clk_sdio);
+ 	clk_disable_unprepare(sprd_host->clk_enable);
+ 	clk_disable_unprepare(sprd_host->clk_2x_enable);
+ 
+-	mmc_free_host(mmc);
++	sdhci_pltfm_free(pdev);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch b/queue-5.4/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch
new file mode 100644
index 00000000000..88252ecacfb
--- /dev/null
+++ b/queue-5.4/mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch
@@ -0,0 +1,46 @@
+From c71f7f5b397cd0f7797eb99962823ded922ad803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 22:09:22 +0100
+Subject: mmc: usdhi6rol0: Fix a resource leak in the error handling path of
+ the probe
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6052b3c370fb82dec28bcfff6d7ec0da84ac087a ]
+
+A call to 'ausdhi6_dma_release()' to undo a previous call to
+'usdhi6_dma_request()' is missing in the error handling path of the probe
+function.
+
+It is already present in the remove function.
+
+Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201217210922.165340-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/usdhi6rol0.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
+index b11ac2314328d..6eba2441c7efd 100644
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1860,10 +1860,12 @@ static int usdhi6_probe(struct platform_device *pdev)
+ 
+ 	ret = mmc_add_host(mmc);
+ 	if (ret < 0)
+-		goto e_clk_off;
++		goto e_release_dma;
+ 
+ 	return 0;
+ 
++e_release_dma:
++	usdhi6_dma_release(host);
+ e_clk_off:
+ 	clk_disable_unprepare(host->clk);
+ e_free_mmc:
+-- 
+2.27.0
+
diff --git a/queue-5.4/mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch b/queue-5.4/mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch
new file mode 100644
index 00000000000..0342fa59a30
--- /dev/null
+++ b/queue-5.4/mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch
@@ -0,0 +1,61 @@
+From 434aff98db22f6049145eb5505347a5accb490cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 12:36:52 +0300
+Subject: mtd: parser: imagetag: fix error codes in
+ bcm963xx_parse_imagetag_partitions()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 12ba8f8ce29fdd277f3100052eddc1afd2f5ea3f ]
+
+If the kstrtouint() calls fail, then this should return a negative
+error code but it currently returns success.
+
+Fixes: dd84cb022b31 ("mtd: bcm63xxpart: move imagetag parsing to its own parser")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/YBKFtNaFHGYBj+u4@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/parser_imagetag.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mtd/parsers/parser_imagetag.c b/drivers/mtd/parsers/parser_imagetag.c
+index d69607b482272..fab0949aabba1 100644
+--- a/drivers/mtd/parsers/parser_imagetag.c
++++ b/drivers/mtd/parsers/parser_imagetag.c
+@@ -83,6 +83,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ 			pr_err("invalid rootfs address: %*ph\n",
+ 				(int)sizeof(buf->flash_image_start),
+ 				buf->flash_image_start);
++			ret = -EINVAL;
+ 			goto out;
+ 		}
+ 
+@@ -92,6 +93,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ 			pr_err("invalid kernel address: %*ph\n",
+ 				(int)sizeof(buf->kernel_address),
+ 				buf->kernel_address);
++			ret = -EINVAL;
+ 			goto out;
+ 		}
+ 
+@@ -100,6 +102,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ 			pr_err("invalid kernel length: %*ph\n",
+ 				(int)sizeof(buf->kernel_length),
+ 				buf->kernel_length);
++			ret = -EINVAL;
+ 			goto out;
+ 		}
+ 
+@@ -108,6 +111,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ 			pr_err("invalid total length: %*ph\n",
+ 				(int)sizeof(buf->total_length),
+ 				buf->total_length);
++			ret = -EINVAL;
+ 			goto out;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch b/queue-5.4/mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch
new file mode 100644
index 00000000000..e6e1f7a5244
--- /dev/null
+++ b/queue-5.4/mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch
@@ -0,0 +1,44 @@
+From f9d1483b2e80aa4f648d2bfdf1f7e88041f4d34d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 09:41:37 +0530
+Subject: mtd: parsers: afs: Fix freeing the part name memory in failure
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 7b844cf445f0a7daa68be0ce71eb2c88d68b0c5d ]
+
+In the case of failure while parsing the partitions, the iterator should
+be pre decremented by one before starting to free the memory allocated
+by kstrdup(). Because in the failure case, kstrdup() will not succeed
+and thus no memory will be allocated for the current iteration.
+
+Fixes: 1fca1f6abb38 ("mtd: afs: simplify partition parsing")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210104041137.113075-5-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/afs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c
+index 752b6cf005f71..8fd61767af831 100644
+--- a/drivers/mtd/parsers/afs.c
++++ b/drivers/mtd/parsers/afs.c
+@@ -370,10 +370,8 @@ static int parse_afs_partitions(struct mtd_info *mtd,
+ 	return i;
+ 
+ out_free_parts:
+-	while (i >= 0) {
++	while (--i >= 0)
+ 		kfree(parts[i].name);
+-		i--;
+-	}
+ 	kfree(parts);
+ 	*pparts = NULL;
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch b/queue-5.4/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch
new file mode 100644
index 00000000000..3da85405bc2
--- /dev/null
+++ b/queue-5.4/net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch
@@ -0,0 +1,78 @@
+From 8a66d354fe3f746380d0743c5d6cbea1e641d881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:08 +0530
+Subject: net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 186edbb510bd60e748f93975989ccba25ee99c50 ]
+
+The current driver calls netif_carrier_off() late in the link tear down
+which can result in a netdev watchdog timeout.
+
+Calling netif_carrier_off() immediately after netif_tx_stop_all_queues()
+avoids the warning.
+
+ ------------[ cut here ]------------
+ NETDEV WATCHDOG: enp3s0f2 (amd-xgbe): transmit queue 0 timed out
+ WARNING: CPU: 3 PID: 0 at net/sched/sch_generic.c:461 dev_watchdog+0x20d/0x220
+ Modules linked in: amd_xgbe(E)  amd-xgbe 0000:03:00.2 enp3s0f2: Link is Down
+ CPU: 3 PID: 0 Comm: swapper/3 Tainted: G            E
+ Hardware name: AMD Bilby-RV2/Bilby-RV2, BIOS RBB1202A 10/18/2019
+ RIP: 0010:dev_watchdog+0x20d/0x220
+ Code: 00 49 63 4e e0 eb 92 4c 89 e7 c6 05 c6 e2 c1 00 01 e8 e7 ce fc ff 89 d9 48
+ RSP: 0018:ffff90cfc28c3e88 EFLAGS: 00010286
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006
+ RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff90cfc28d63c0
+ RBP: ffff90cfb977845c R08: 0000000000000050 R09: 0000000000196018
+ R10: ffff90cfc28c3ef8 R11: 0000000000000000 R12: ffff90cfb9778000
+ R13: 0000000000000003 R14: ffff90cfb9778480 R15: 0000000000000010
+ FS:  0000000000000000(0000) GS:ffff90cfc28c0000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f240ff2d9d0 CR3: 00000001e3e0a000 CR4: 00000000003406e0
+ Call Trace:
+  <IRQ>
+  ? pfifo_fast_reset+0x100/0x100
+  call_timer_fn+0x2b/0x130
+  run_timer_softirq+0x3e8/0x440
+  ? enqueue_hrtimer+0x39/0x90
+
+Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c  | 1 +
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 3bd20f7651207..da8c2c4aca7ef 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1443,6 +1443,7 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
+ 		return;
+ 
+ 	netif_tx_stop_all_queues(netdev);
++	netif_carrier_off(pdata->netdev);
+ 
+ 	xgbe_stop_timers(pdata);
+ 	flush_workqueue(pdata->dev_workqueue);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 8a3a60bb26888..4d5506d928973 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1396,7 +1396,6 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ 	pdata->phy_if.phy_impl.stop(pdata);
+ 
+ 	pdata->phy.link = 0;
+-	netif_carrier_off(pdata->netdev);
+ 
+ 	xgbe_phy_adjust_link(pdata);
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch b/queue-5.4/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch
new file mode 100644
index 00000000000..01c7926b0e2
--- /dev/null
+++ b/queue-5.4/net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch
@@ -0,0 +1,41 @@
+From 85a69d1b696038cdde23660e0eeb49965238e6e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:10 +0530
+Subject: net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 9eab3fdb419916f66a72d1572f68d82cd9b3f963 ]
+
+Frequent link up/down events can happen when a Bel Fuse SFP part is
+connected to the amd-xgbe device. Try to avoid the frequent link
+issues by resetting the PHY as documented in Bel Fuse SFP datasheets.
+
+Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 387d3aeebf237..d6f6afb67bcc6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -921,6 +921,9 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
+ 	if ((phy_id & 0xfffffff0) != 0x03625d10)
+ 		return false;
+ 
++	/* Reset PHY - wait for self-clearing reset bit to clear */
++	genphy_soft_reset(phy_data->phydev);
++
+ 	/* Disable RGMII mode */
+ 	phy_write(phy_data->phydev, 0x18, 0x7007);
+ 	reg = phy_read(phy_data->phydev, 0x18);
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch b/queue-5.4/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch
new file mode 100644
index 00000000000..9d1b3367c40
--- /dev/null
+++ b/queue-5.4/net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch
@@ -0,0 +1,66 @@
+From e3437afa558b4dc939b447df0848fe1e64948d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:09 +0530
+Subject: net: amd-xgbe: Reset link when the link never comes back
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 84fe68eb67f9499309cffd97c1ba269de125ff14 ]
+
+Normally, auto negotiation and reconnect should be automatically done by
+the hardware. But there seems to be an issue where auto negotiation has
+to be restarted manually. This happens because of link training and so
+even though still connected to the partner the link never "comes back".
+This needs an auto-negotiation restart.
+
+Also, a change in xgbe-mdio is needed to get ethtool to recognize the
+link down and get the link change message. This change is only
+required in a backplane connection mode.
+
+Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c   | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 4d5506d928973..156a0bc8ab01d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1345,7 +1345,7 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
+ 							     &an_restart);
+ 	if (an_restart) {
+ 		xgbe_phy_config_aneg(pdata);
+-		return;
++		goto adjust_link;
+ 	}
+ 
+ 	if (pdata->phy.link) {
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index f024db6d90158..387d3aeebf237 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -2601,6 +2601,14 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ 	if (reg & MDIO_STAT1_LSTATUS)
+ 		return 1;
+ 
++	if (pdata->phy.autoneg == AUTONEG_ENABLE &&
++	    phy_data->port_mode == XGBE_PORT_MODE_BACKPLANE) {
++		if (!test_bit(XGBE_LINK_INIT, &pdata->dev_state)) {
++			netif_carrier_off(pdata->netdev);
++			*an_restart = 1;
++		}
++	}
++
+ 	/* No link, attempt a receiver reset cycle */
+ 	if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ 		phy_data->rrc_count = 0;
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch b/queue-5.4/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch
new file mode 100644
index 00000000000..fd2d6907980
--- /dev/null
+++ b/queue-5.4/net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch
@@ -0,0 +1,128 @@
+From b13dbeb8acc0cd7cf954b9875b061ba11615c840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:07 +0530
+Subject: net: amd-xgbe: Reset the PHY rx data path when mailbox command
+ timeout
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 30b7edc82ec82578f4f5e6706766f0a9535617d3 ]
+
+Sometimes mailbox commands timeout when the RX data path becomes
+unresponsive. This prevents the submission of new mailbox commands to DXIO.
+This patch identifies the timeout and resets the RX data path so that the
+next message can be submitted properly.
+
+Fixes: 549b32af9f7c ("amd-xgbe: Simplify mailbox interface rate change code")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 +++++++++++
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 28 ++++++++++++++++++++-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index b40d4377cc71d..b2cd3bdba9f89 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1279,10 +1279,18 @@
+ #define MDIO_PMA_10GBR_FECCTRL		0x00ab
+ #endif
+ 
++#ifndef MDIO_PMA_RX_CTRL1
++#define MDIO_PMA_RX_CTRL1		0x8051
++#endif
++
+ #ifndef MDIO_PCS_DIG_CTRL
+ #define MDIO_PCS_DIG_CTRL		0x8000
+ #endif
+ 
++#ifndef MDIO_PCS_DIGITAL_STAT
++#define MDIO_PCS_DIGITAL_STAT		0x8010
++#endif
++
+ #ifndef MDIO_AN_XNP
+ #define MDIO_AN_XNP			0x0016
+ #endif
+@@ -1358,6 +1366,8 @@
+ #define XGBE_KR_TRAINING_ENABLE		BIT(1)
+ 
+ #define XGBE_PCS_CL37_BP		BIT(12)
++#define XGBE_PCS_PSEQ_STATE_MASK	0x1c
++#define XGBE_PCS_PSEQ_STATE_POWER_GOOD	0x10
+ 
+ #define XGBE_AN_CL37_INT_CMPLT		BIT(0)
+ #define XGBE_AN_CL37_INT_MASK		0x01
+@@ -1375,6 +1385,10 @@
+ #define XGBE_PMA_CDR_TRACK_EN_OFF	0x00
+ #define XGBE_PMA_CDR_TRACK_EN_ON	0x01
+ 
++#define XGBE_PMA_RX_RST_0_MASK		BIT(4)
++#define XGBE_PMA_RX_RST_0_RESET_ON	0x10
++#define XGBE_PMA_RX_RST_0_RESET_OFF	0x00
++
+ /* Bit setting and getting macros
+  *  The get macro will extract the current bit field value from within
+  *  the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 128cd648ba99c..f024db6d90158 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -1948,6 +1948,27 @@ static void xgbe_phy_set_redrv_mode(struct xgbe_prv_data *pdata)
+ 	xgbe_phy_put_comm_ownership(pdata);
+ }
+ 
++static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
++{
++	int reg;
++
++	reg = XMDIO_READ_BITS(pdata, MDIO_MMD_PCS, MDIO_PCS_DIGITAL_STAT,
++			      XGBE_PCS_PSEQ_STATE_MASK);
++	if (reg == XGBE_PCS_PSEQ_STATE_POWER_GOOD) {
++		/* Mailbox command timed out, reset of RX block is required.
++		 * This can be done by asseting the reset bit and wait for
++		 * its compeletion.
++		 */
++		XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++				 XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_ON);
++		ndelay(20);
++		XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++				 XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_OFF);
++		usleep_range(40, 50);
++		netif_err(pdata, link, pdata->netdev, "firmware mailbox reset performed\n");
++	}
++}
++
+ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ 					unsigned int cmd, unsigned int sub_cmd)
+ {
+@@ -1955,9 +1976,11 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ 	unsigned int wait;
+ 
+ 	/* Log if a previous command did not complete */
+-	if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
++	if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
+ 		netif_dbg(pdata, link, pdata->netdev,
+ 			  "firmware mailbox not ready for command\n");
++		xgbe_phy_rx_reset(pdata);
++	}
+ 
+ 	/* Construct the command */
+ 	XP_SET_BITS(s0, XP_DRIVER_SCRATCH_0, COMMAND, cmd);
+@@ -1979,6 +2002,9 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ 
+ 	netif_dbg(pdata, link, pdata->netdev,
+ 		  "firmware mailbox command did not complete\n");
++
++	/* Reset on error */
++	xgbe_phy_rx_reset(pdata);
+ }
+ 
+ static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-axienet-handle-deferred-probe-on-clock-properly.patch b/queue-5.4/net-axienet-handle-deferred-probe-on-clock-properly.patch
new file mode 100644
index 00000000000..c6bb3eff070
--- /dev/null
+++ b/queue-5.4/net-axienet-handle-deferred-probe-on-clock-properly.patch
@@ -0,0 +1,76 @@
+From a417e77651b716dcd7c4f17b453ca2374fe103bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 18:17:48 -0600
+Subject: net: axienet: Handle deferred probe on clock properly
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 57baf8cc70ea4cf5503c9d42f31f6a86d7f5ff1a ]
+
+This driver is set up to use a clock mapping in the device tree if it is
+present, but still work without one for backward compatibility. However,
+if getting the clock returns -EPROBE_DEFER, then we need to abort and
+return that error from our driver initialization so that the probe can
+be retried later after the clock is set up.
+
+Move clock initialization to earlier in the process so we do not waste as
+much effort if the clock is not yet available. Switch to use
+devm_clk_get_optional and abort initialization on any error reported.
+Also enable the clock regardless of whether the controller is using an MDIO
+bus, as the clock is required in any case.
+
+Fixes: 09a0354cadec267be7f ("net: axienet: Use clock framework to get device clock rate")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/xilinx/xilinx_axienet_main.c | 26 +++++++++----------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index bb6e52f3bdf9b..f98318d93ce72 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1689,6 +1689,18 @@ static int axienet_probe(struct platform_device *pdev)
+ 	lp->options = XAE_OPTION_DEFAULTS;
+ 	lp->rx_bd_num = RX_BD_NUM_DEFAULT;
+ 	lp->tx_bd_num = TX_BD_NUM_DEFAULT;
++
++	lp->clk = devm_clk_get_optional(&pdev->dev, NULL);
++	if (IS_ERR(lp->clk)) {
++		ret = PTR_ERR(lp->clk);
++		goto free_netdev;
++	}
++	ret = clk_prepare_enable(lp->clk);
++	if (ret) {
++		dev_err(&pdev->dev, "Unable to enable clock: %d\n", ret);
++		goto free_netdev;
++	}
++
+ 	/* Map device registers */
+ 	ethres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	lp->regs = devm_ioremap_resource(&pdev->dev, ethres);
+@@ -1836,20 +1848,6 @@ static int axienet_probe(struct platform_device *pdev)
+ 
+ 	lp->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+ 	if (lp->phy_node) {
+-		lp->clk = devm_clk_get(&pdev->dev, NULL);
+-		if (IS_ERR(lp->clk)) {
+-			dev_warn(&pdev->dev, "Failed to get clock: %ld\n",
+-				 PTR_ERR(lp->clk));
+-			lp->clk = NULL;
+-		} else {
+-			ret = clk_prepare_enable(lp->clk);
+-			if (ret) {
+-				dev_err(&pdev->dev, "Unable to enable clock: %d\n",
+-					ret);
+-				goto free_netdev;
+-			}
+-		}
+-
+ 		ret = axienet_mdio_setup(lp);
+ 		if (ret)
+ 			dev_warn(&pdev->dev,
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch b/queue-5.4/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch
new file mode 100644
index 00000000000..0b0610ba6a5
--- /dev/null
+++ b/queue-5.4/net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch
@@ -0,0 +1,39 @@
+From f7ba3a8e3f6b8bf5a17d97ef2089d1d7f15fe2ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Feb 2021 22:35:59 +0800
+Subject: net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 8eb65fda4a6dbd59cd5de24b106a10b6ee0d2176 ]
+
+mlx4_do_mirror_rule() forgets to call mlx4_free_cmd_mailbox() to
+free the memory region allocated by mlx4_alloc_cmd_mailbox() before
+an exit.
+Add the missed call to fix it.
+
+Fixes: 78efed275117 ("net/mlx4_core: Support mirroring VF DMFS rules on both ports")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20210221143559.390277-1-hslester96@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index 1187ef1375e29..cb341372d5a35 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -4986,6 +4986,7 @@ static int mlx4_do_mirror_rule(struct mlx4_dev *dev, struct res_fs_rule *fs_rule
+ 
+ 	if (!fs_rule->mirr_mbox) {
+ 		mlx4_err(dev, "rule mirroring mailbox is null\n");
++		mlx4_free_cmd_mailbox(dev, mailbox);
+ 		return -EINVAL;
+ 	}
+ 	memcpy(mailbox->buf, fs_rule->mirr_mbox, fs_rule->mirr_mbox_size);
+-- 
+2.27.0
+
diff --git a/queue-5.4/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch b/queue-5.4/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch
new file mode 100644
index 00000000000..62e831e763c
--- /dev/null
+++ b/queue-5.4/net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch
@@ -0,0 +1,55 @@
+From 47dd5e805e4206dfa986788195d117f43f5e3b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 10:25:35 +0100
+Subject: net: mvneta: Remove per-cpu queue mapping for Armada 3700
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit cf9bf871280d9e0a8869d98c2602d29caf69dfa3 ]
+
+According to Errata #23 "The per-CPU GbE interrupt is limited to Core
+0", we can't use the per-cpu interrupt mechanism on the Armada 3700
+familly.
+
+This is correctly checked for RSS configuration, but the initial queue
+mapping is still done by having the queues spread across all the CPUs in
+the system, both in the init path and in the cpu_hotplug path.
+
+Fixes: 2636ac3cc2b4 ("net: mvneta: Add network support for Armada 3700 SoC")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 94e3f8b869be4..7b0543056b101 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3027,7 +3027,9 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+ 	}
+ 
+ 	/* Setup XPS mapping */
+-	if (txq_number > 1)
++	if (pp->neta_armada3700)
++		cpu = 0;
++	else if (txq_number > 1)
+ 		cpu = txq->id % num_present_cpus();
+ 	else
+ 		cpu = pp->rxq_def % num_present_cpus();
+@@ -3764,6 +3766,11 @@ static int mvneta_cpu_online(unsigned int cpu, struct hlist_node *node)
+ 						  node_online);
+ 	struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
+ 
++	/* Armada 3700's per-cpu interrupt for mvneta is broken, all interrupts
++	 * are routed to CPU 0, so we don't need all the cpu-hotplug support
++	 */
++	if (pp->neta_armada3700)
++		return 0;
+ 
+ 	spin_lock(&pp->lock);
+ 	/*
+-- 
+2.27.0
+
diff --git a/queue-5.4/nfsd-register-pernet-ops-last-unregister-first.patch b/queue-5.4/nfsd-register-pernet-ops-last-unregister-first.patch
new file mode 100644
index 00000000000..e12de325d5a
--- /dev/null
+++ b/queue-5.4/nfsd-register-pernet-ops-last-unregister-first.patch
@@ -0,0 +1,87 @@
+From da3b7c33130db145816d6404c837aaeafca3baab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 11:42:13 -0500
+Subject: nfsd: register pernet ops last, unregister first
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit bd5ae9288d6451bd346a1b4a59d4fe7e62ba29b7 ]
+
+These pernet operations may depend on stuff set up or torn down in the
+module init/exit functions.  And they may be called at any time in
+between.  So it makes more sense for them to be the last to be
+registered in the init function, and the first to be unregistered in the
+exit function.
+
+In particular, without this, the drc slab is being destroyed before all
+the per-net drcs are shut down, resulting in an "Objects remaining in
+nfsd_drc on __kmem_cache_shutdown()" warning in exit_nfsd.
+
+Reported-by: Zhi Li <yieli@redhat.com>
+Fixes: 3ba75830ce17 "nfsd4: drc containerization"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfsctl.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index be418fccc9d86..7f39d6091dfa0 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1523,12 +1523,9 @@ static int __init init_nfsd(void)
+ 	int retval;
+ 	printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");
+ 
+-	retval = register_pernet_subsys(&nfsd_net_ops);
+-	if (retval < 0)
+-		return retval;
+ 	retval = register_cld_notifier();
+ 	if (retval)
+-		goto out_unregister_pernet;
++		return retval;
+ 	retval = nfsd4_init_slabs();
+ 	if (retval)
+ 		goto out_unregister_notifier;
+@@ -1546,9 +1543,14 @@ static int __init init_nfsd(void)
+ 		goto out_free_lockd;
+ 	retval = register_filesystem(&nfsd_fs_type);
+ 	if (retval)
++		goto out_free_exports;
++	retval = register_pernet_subsys(&nfsd_net_ops);
++	if (retval < 0)
+ 		goto out_free_all;
+ 	return 0;
+ out_free_all:
++	unregister_pernet_subsys(&nfsd_net_ops);
++out_free_exports:
+ 	remove_proc_entry("fs/nfs/exports", NULL);
+ 	remove_proc_entry("fs/nfs", NULL);
+ out_free_lockd:
+@@ -1562,13 +1564,12 @@ out_free_slabs:
+ 	nfsd4_free_slabs();
+ out_unregister_notifier:
+ 	unregister_cld_notifier();
+-out_unregister_pernet:
+-	unregister_pernet_subsys(&nfsd_net_ops);
+ 	return retval;
+ }
+ 
+ static void __exit exit_nfsd(void)
+ {
++	unregister_pernet_subsys(&nfsd_net_ops);
+ 	nfsd_drc_slab_free();
+ 	remove_proc_entry("fs/nfs/exports", NULL);
+ 	remove_proc_entry("fs/nfs", NULL);
+@@ -1579,7 +1580,6 @@ static void __exit exit_nfsd(void)
+ 	nfsd_fault_inject_cleanup();
+ 	unregister_filesystem(&nfsd_fs_type);
+ 	unregister_cld_notifier();
+-	unregister_pernet_subsys(&nfsd_net_ops);
+ }
+ 
+ MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
+-- 
+2.27.0
+
diff --git a/queue-5.4/nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch b/queue-5.4/nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch
new file mode 100644
index 00000000000..7649a457239
--- /dev/null
+++ b/queue-5.4/nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch
@@ -0,0 +1,38 @@
+From a0b0b4e7b25421ce6133bf2983173e7dc98a67aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:14:26 +0000
+Subject: nvmem: core: Fix a resource leak on error in
+ nvmem_add_cells_from_of()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 72e008ce307fa2f35f6783997378b32e83122839 ]
+
+This doesn't call of_node_put() on the error path so it leads to a
+memory leak.
+
+Fixes: 0749aa25af82 ("nvmem: core: fix regression in of_nvmem_cell_get()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210129171430.11328-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 84f4078216a36..acd82ff41951f 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -345,6 +345,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ 				cell->name, nvmem->stride);
+ 			/* Cells already added will be freed later. */
+ 			kfree_const(cell->name);
++			of_node_put(cell->np);
+ 			kfree(cell);
+ 			return -EINVAL;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.4/nvmem-core-skip-child-nodes-not-matching-binding.patch b/queue-5.4/nvmem-core-skip-child-nodes-not-matching-binding.patch
new file mode 100644
index 00000000000..d8bd27e4f52
--- /dev/null
+++ b/queue-5.4/nvmem-core-skip-child-nodes-not-matching-binding.patch
@@ -0,0 +1,67 @@
+From 7e5fc5f8101d8d451e7a0436b23c3641074157f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:14:30 +0000
+Subject: nvmem: core: skip child nodes not matching binding
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit 0445efacec75b85c2a3c176957ee050ba9be53f0 ]
+
+The nvmem cell binding applies to all eeprom child nodes matching
+"^.*@[0-9a-f]+$" without taking a compatible into account.
+
+Linux drivers, like at24, are even more extensive and assume
+_all_ at24 eeprom child nodes to be nvmem cells since e888d445ac33
+("nvmem: resolve cells from DT at registration time").
+
+Since df5f3b6f5357 ("dt-bindings: nvmem: stm32: new property for
+data access"), the additionalProperties: True means it's Ok to have
+other properties as long as they don't match "^.*@[0-9a-f]+$".
+
+The barebox bootloader extends the MTD partitions binding to
+EEPROM and can fix up following device tree node:
+
+  &eeprom {
+    partitions {
+      compatible = "fixed-partitions";
+    };
+  };
+
+This is allowed binding-wise, but drivers using nvmem_register()
+like at24 will fail to parse because the function expects all child
+nodes to have a reg property present. This results in the whole
+EEPROM driver probe failing despite the device tree being correct.
+
+Fix this by skipping nodes lacking a reg property instead of
+returning an error. This effectively makes the drivers adhere
+to the binding because all nodes with a unit address must have
+a reg property and vice versa.
+
+Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time").
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210129171430.11328-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index acd82ff41951f..3ba68baeed1db 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -314,7 +314,9 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ 
+ 	for_each_child_of_node(parent, child) {
+ 		addr = of_get_property(child, "reg", &len);
+-		if (!addr || (len < 2 * sizeof(u32))) {
++		if (!addr)
++			continue;
++		if (len < 2 * sizeof(u32)) {
+ 			dev_err(dev, "nvmem: invalid reg on %pOF\n", child);
+ 			return -EINVAL;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.4/objtool-fix-.cold-section-suffix-check-for-newer-ver.patch b/queue-5.4/objtool-fix-.cold-section-suffix-check-for-newer-ver.patch
new file mode 100644
index 00000000000..372e7e5fc55
--- /dev/null
+++ b/queue-5.4/objtool-fix-.cold-section-suffix-check-for-newer-ver.patch
@@ -0,0 +1,42 @@
+From 10103c3649d59a72c007cf8a8cc63b11a280b6cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 15:29:19 -0600
+Subject: objtool: Fix ".cold" section suffix check for newer versions of GCC
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 34ca59e109bdf69704c33b8eeffaa4c9f71076e5 ]
+
+With my version of GCC 9.3.1 the ".cold" subfunctions no longer have a
+numbered suffix, so the trailing period is no longer there.
+
+Presumably this doesn't yet trigger a user-visible bug since most of the
+subfunction detection logic is duplicated.   I only found it when
+testing vmlinux.o validation.
+
+Fixes: 54262aa28301 ("objtool: Fix sibling call detection")
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/ca0b5a57f08a2fbb48538dd915cc253b5edabb40.1611263461.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 1cff21aef0730..06aaf04e629c2 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -626,8 +626,8 @@ static int add_jump_destinations(struct objtool_file *file)
+ 			 * case where the parent function's only reference to a
+ 			 * subfunction is through a jump table.
+ 			 */
+-			if (!strstr(insn->func->name, ".cold.") &&
+-			    strstr(insn->jump_dest->func->name, ".cold.")) {
++			if (!strstr(insn->func->name, ".cold") &&
++			    strstr(insn->jump_dest->func->name, ".cold")) {
+ 				insn->func->cfunc = insn->jump_dest->func;
+ 				insn->jump_dest->func->pfunc = insn->func;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/objtool-fix-error-handling-for-std-cld-warnings.patch b/queue-5.4/objtool-fix-error-handling-for-std-cld-warnings.patch
new file mode 100644
index 00000000000..01f6f7afdea
--- /dev/null
+++ b/queue-5.4/objtool-fix-error-handling-for-std-cld-warnings.patch
@@ -0,0 +1,49 @@
+From 7f5cf9f406b7ba26699f246f3344b9e5d0263b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 15:29:17 -0600
+Subject: objtool: Fix error handling for STD/CLD warnings
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 6f567c9300a5ebd7b18c26dda1c8d6ffbdd0debd ]
+
+Actually return an error (and display a backtrace, if requested) for
+directional bit warnings.
+
+Fixes: 2f0f9e9ad7b3 ("objtool: Add Direction Flag validation")
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/dc70f2adbc72f09526f7cab5b6feb8bf7f6c5ad4.1611263461.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 1b7e748170e54..1cff21aef0730 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2192,15 +2192,19 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
+ 			break;
+ 
+ 		case INSN_STD:
+-			if (state.df)
++			if (state.df) {
+ 				WARN_FUNC("recursive STD", sec, insn->offset);
++				return 1;
++			}
+ 
+ 			state.df = true;
+ 			break;
+ 
+ 		case INSN_CLD:
+-			if (!state.df && func)
++			if (!state.df && func) {
+ 				WARN_FUNC("redundant CLD", sec, insn->offset);
++				return 1;
++			}
+ 
+ 			state.df = false;
+ 			break;
+-- 
+2.27.0
+
diff --git a/queue-5.4/ocfs2-fix-a-use-after-free-on-error.patch b/queue-5.4/ocfs2-fix-a-use-after-free-on-error.patch
new file mode 100644
index 00000000000..35bd9df16f9
--- /dev/null
+++ b/queue-5.4/ocfs2-fix-a-use-after-free-on-error.patch
@@ -0,0 +1,60 @@
+From 4174feae150493befa4dc8f63f58ed390b2536c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:00:41 -0800
+Subject: ocfs2: fix a use after free on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c57d117f2b2f2a19b570c36f2819ef8d8210af20 ]
+
+The error handling in this function frees "reg" but it is still on the
+"o2hb_all_regions" list so it will lead to a use after freew.  Joseph Qi
+points out that we need to clear the bit in the "o2hb_region_bitmap" as
+well
+
+Link: https://lkml.kernel.org/r/YBk4M6HUG8jB/jc7@mwanda
+Fixes: 1cf257f51191 ("ocfs2: fix memory leak")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/cluster/heartbeat.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
+index a368350d4c279..c843bc318382b 100644
+--- a/fs/ocfs2/cluster/heartbeat.c
++++ b/fs/ocfs2/cluster/heartbeat.c
+@@ -2052,7 +2052,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+ 			o2hb_nego_timeout_handler,
+ 			reg, NULL, &reg->hr_handler_list);
+ 	if (ret)
+-		goto free;
++		goto remove_item;
+ 
+ 	ret = o2net_register_handler(O2HB_NEGO_APPROVE_MSG, reg->hr_key,
+ 			sizeof(struct o2hb_nego_msg),
+@@ -2067,6 +2067,12 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+ 
+ unregister_handler:
+ 	o2net_unregister_handler_list(&reg->hr_handler_list);
++remove_item:
++	spin_lock(&o2hb_live_lock);
++	list_del(&reg->hr_all_item);
++	if (o2hb_global_heartbeat_active())
++		clear_bit(reg->hr_region_num, o2hb_region_bitmap);
++	spin_unlock(&o2hb_live_lock);
+ free:
+ 	kfree(reg);
+ 	return ERR_PTR(ret);
+-- 
+2.27.0
+
diff --git a/queue-5.4/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch b/queue-5.4/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch
new file mode 100644
index 00000000000..9c35a6f6e82
--- /dev/null
+++ b/queue-5.4/of-fdt-make-sure-no-map-does-not-remove-already-rese.patch
@@ -0,0 +1,80 @@
+From 0f184af1a2c6c85cb479f7e96d114a98615b33d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:45:44 +0000
+Subject: of/fdt: Make sure no-map does not remove already reserved regions
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 8a5a75e5e9e55de1cef5d83ca3589cb4899193ef ]
+
+If the device tree is incorrectly configured, and attempts to
+define a "no-map" reserved memory that overlaps with the kernel
+data/code, the kernel would crash quickly after boot, with no
+obvious clue about the nature of the issue.
+
+For example, this would happen if we have the kernel mapped at
+these addresses (from /proc/iomem):
+40000000-41ffffff : System RAM
+  40080000-40dfffff : Kernel code
+  40e00000-411fffff : reserved
+  41200000-413e0fff : Kernel data
+
+And we declare a no-map shared-dma-pool region at a fixed address
+within that range:
+mem_reserved: mem_region {
+	compatible = "shared-dma-pool";
+	reg = <0 0x40000000 0 0x01A00000>;
+	no-map;
+};
+
+To fix this, when removing memory regions at early boot (which is
+what "no-map" regions do), we need to make sure that the memory
+is not already reserved. If we do, __reserved_mem_reserve_reg
+will throw an error:
+[    0.000000] OF: fdt: Reserved memory: failed to reserve memory
+   for node 'mem_region': base 0x0000000040000000, size 26 MiB
+and the code that will try to use the region should also fail,
+later on.
+
+We do not do anything for non-"no-map" regions, as memblock
+explicitly allows reserved regions to overlap, and the commit
+that this fixes removed the check for that precise reason.
+
+[ qperret: fixed conflicts caused by the usage of memblock_mark_nomap ]
+
+Fixes: 094cb98179f19b7 ("of/fdt: memblock_reserve /memreserve/ regions in the case of partial overlap")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Link: https://lore.kernel.org/r/20210115114544.1830068-3-qperret@google.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 036af904e0cfa..fc24102e25ce7 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1153,8 +1153,16 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size)
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ 					phys_addr_t size, bool nomap)
+ {
+-	if (nomap)
++	if (nomap) {
++		/*
++		 * If the memory is already reserved (by another region), we
++		 * should not allow it to be marked nomap.
++		 */
++		if (memblock_is_region_reserved(base, size))
++			return -EBUSY;
++
+ 		return memblock_mark_nomap(base, size);
++	}
+ 	return memblock_reserve(base, size);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/pci-align-checking-of-syscall-user-config-accessors.patch b/queue-5.4/pci-align-checking-of-syscall-user-config-accessors.patch
new file mode 100644
index 00000000000..6b89beb3de3
--- /dev/null
+++ b/queue-5.4/pci-align-checking-of-syscall-user-config-accessors.patch
@@ -0,0 +1,80 @@
+From 10834dfe1c2d883f248315e23ca4306af6aa8c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 16:39:32 +0100
+Subject: PCI: Align checking of syscall user config accessors
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit ef9e4005cbaf022c6251263aa27836acccaef65d ]
+
+After 34e3207205ef ("PCI: handle positive error codes"),
+pci_user_read_config_*() and pci_user_write_config_*() return 0 or negative
+errno values, not PCIBIOS_* values like PCIBIOS_SUCCESSFUL or
+PCIBIOS_BAD_REGISTER_NUMBER.
+
+Remove comparisons with PCIBIOS_SUCCESSFUL and check only for non-zero.  It
+happens that PCIBIOS_SUCCESSFUL is zero, so this is not a functional
+change, but it aligns this code with the user accessors.
+
+[bhelgaas: commit log]
+Fixes: 34e3207205ef ("PCI: handle positive error codes")
+Link: https://lore.kernel.org/r/f1220314-e518-1e18-bf94-8e6f8c703758@gmail.com
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/syscall.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
+index 31e39558d49d8..8b003c890b87b 100644
+--- a/drivers/pci/syscall.c
++++ b/drivers/pci/syscall.c
+@@ -20,7 +20,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ 	u16 word;
+ 	u32 dword;
+ 	long err;
+-	long cfg_ret;
++	int cfg_ret;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+@@ -46,7 +46,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ 	}
+ 
+ 	err = -EIO;
+-	if (cfg_ret != PCIBIOS_SUCCESSFUL)
++	if (cfg_ret)
+ 		goto error;
+ 
+ 	switch (len) {
+@@ -105,7 +105,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ 		if (err)
+ 			break;
+ 		err = pci_user_write_config_byte(dev, off, byte);
+-		if (err != PCIBIOS_SUCCESSFUL)
++		if (err)
+ 			err = -EIO;
+ 		break;
+ 
+@@ -114,7 +114,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ 		if (err)
+ 			break;
+ 		err = pci_user_write_config_word(dev, off, word);
+-		if (err != PCIBIOS_SUCCESSFUL)
++		if (err)
+ 			err = -EIO;
+ 		break;
+ 
+@@ -123,7 +123,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ 		if (err)
+ 			break;
+ 		err = pci_user_write_config_dword(dev, off, dword);
+-		if (err != PCIBIOS_SUCCESSFUL)
++		if (err)
+ 			err = -EIO;
+ 		break;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch b/queue-5.4/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch
new file mode 100644
index 00000000000..5e4d6cbe727
--- /dev/null
+++ b/queue-5.4/perf-intel-pt-fix-missing-cyc-processing-in-psb.patch
@@ -0,0 +1,41 @@
+From 14e15e5d7c56b1dc71107fbc63b7a160423cd6b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:53:47 +0200
+Subject: perf intel-pt: Fix missing CYC processing in PSB
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 03fb0f859b45d1eb05c984ab4bd3bef67e45ede2 ]
+
+Add missing CYC packet processing when walking through PSB+. This
+improves the accuracy of timestamps that follow PSB+, until the next
+MTC.
+
+Fixes: 3d49807870f08 ("perf tools: Add new Intel PT packet definitions")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20210205175350.23817-2-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 7ffcbd6fcd1ae..a3fdea49ad663 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1745,6 +1745,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
+ 			break;
+ 
+ 		case INTEL_PT_CYC:
++			intel_pt_calc_cyc_timestamp(decoder);
++			break;
++
+ 		case INTEL_PT_VMCS:
+ 		case INTEL_PT_MNT:
+ 		case INTEL_PT_PAD:
+-- 
+2.27.0
+
diff --git a/queue-5.4/perf-intel-pt-fix-premature-ipc.patch b/queue-5.4/perf-intel-pt-fix-premature-ipc.patch
new file mode 100644
index 00000000000..ae36912006a
--- /dev/null
+++ b/queue-5.4/perf-intel-pt-fix-premature-ipc.patch
@@ -0,0 +1,108 @@
+From 37806409d6823917e0c54a2b7035cfefe4a14887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:53:48 +0200
+Subject: perf intel-pt: Fix premature IPC
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 20aa39708a5999b7921b27482a756766272286ac ]
+
+The code assumed a change in cycle count means accurate IPC. That is not
+correct, for example when sampling both branches and instructions, or at
+a FUP packet (which is not CYC-eligible) address. Fix by using an explicit
+flag to indicate when IPC can be sampled.
+
+Fixes: 5b1dc0fd1da06 ("perf intel-pt: Add support for samples to contain IPC ratio")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20210205175350.23817-3-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/intel-pt-decoder/intel-pt-decoder.c     | 11 ++++++++++-
+ .../util/intel-pt-decoder/intel-pt-decoder.h     |  1 +
+ tools/perf/util/intel-pt.c                       | 16 ++++++----------
+ 3 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index a3fdea49ad663..7f53b63088b2c 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -2637,9 +2637,18 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ 		}
+ 		if (intel_pt_sample_time(decoder->pkt_state)) {
+ 			intel_pt_update_sample_time(decoder);
+-			if (decoder->sample_cyc)
++			if (decoder->sample_cyc) {
+ 				decoder->sample_tot_cyc_cnt = decoder->tot_cyc_cnt;
++				decoder->state.flags |= INTEL_PT_SAMPLE_IPC;
++				decoder->sample_cyc = false;
++			}
+ 		}
++		/*
++		 * When using only TSC/MTC to compute cycles, IPC can be
++		 * sampled as soon as the cycle count changes.
++		 */
++		if (!decoder->have_cyc)
++			decoder->state.flags |= INTEL_PT_SAMPLE_IPC;
+ 	}
+ 
+ 	decoder->state.timestamp = decoder->sample_timestamp;
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+index e289e463d635e..7396da0fa3a7c 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+@@ -17,6 +17,7 @@
+ #define INTEL_PT_ABORT_TX	(1 << 1)
+ #define INTEL_PT_ASYNC		(1 << 2)
+ #define INTEL_PT_FUP_IP		(1 << 3)
++#define INTEL_PT_SAMPLE_IPC	(1 << 4)
+ 
+ enum intel_pt_sample_type {
+ 	INTEL_PT_BRANCH		= 1 << 0,
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 8aeaeba48a41f..d0e0ce11faf58 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -1304,7 +1304,8 @@ static int intel_pt_synth_branch_sample(struct intel_pt_queue *ptq)
+ 		sample.branch_stack = (struct branch_stack *)&dummy_bs;
+ 	}
+ 
+-	sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_br_cyc_cnt;
++	if (ptq->state->flags & INTEL_PT_SAMPLE_IPC)
++		sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_br_cyc_cnt;
+ 	if (sample.cyc_cnt) {
+ 		sample.insn_cnt = ptq->ipc_insn_cnt - ptq->last_br_insn_cnt;
+ 		ptq->last_br_insn_cnt = ptq->ipc_insn_cnt;
+@@ -1366,7 +1367,8 @@ static int intel_pt_synth_instruction_sample(struct intel_pt_queue *ptq)
+ 	sample.stream_id = ptq->pt->instructions_id;
+ 	sample.period = ptq->state->tot_insn_cnt - ptq->last_insn_cnt;
+ 
+-	sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_in_cyc_cnt;
++	if (ptq->state->flags & INTEL_PT_SAMPLE_IPC)
++		sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_in_cyc_cnt;
+ 	if (sample.cyc_cnt) {
+ 		sample.insn_cnt = ptq->ipc_insn_cnt - ptq->last_in_insn_cnt;
+ 		ptq->last_in_insn_cnt = ptq->ipc_insn_cnt;
+@@ -1901,14 +1903,8 @@ static int intel_pt_sample(struct intel_pt_queue *ptq)
+ 
+ 	ptq->have_sample = false;
+ 
+-	if (ptq->state->tot_cyc_cnt > ptq->ipc_cyc_cnt) {
+-		/*
+-		 * Cycle count and instruction count only go together to create
+-		 * a valid IPC ratio when the cycle count changes.
+-		 */
+-		ptq->ipc_insn_cnt = ptq->state->tot_insn_cnt;
+-		ptq->ipc_cyc_cnt = ptq->state->tot_cyc_cnt;
+-	}
++	ptq->ipc_insn_cnt = ptq->state->tot_insn_cnt;
++	ptq->ipc_cyc_cnt = ptq->state->tot_cyc_cnt;
+ 
+ 	/*
+ 	 * Do PEBS first to allow for the possibility that the PEBS timestamp
+-- 
+2.27.0
+
diff --git a/queue-5.4/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch b/queue-5.4/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch
new file mode 100644
index 00000000000..e069cb01f12
--- /dev/null
+++ b/queue-5.4/perf-test-fix-unaligned-access-in-sample-parsing-tes.patch
@@ -0,0 +1,73 @@
+From 5c08b1c3f00fa3b86f2f71f61534f4e5087b07aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Feb 2021 18:16:38 +0900
+Subject: perf test: Fix unaligned access in sample parsing test
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit c5c97cadd7ed13381cb6b4bef5c841a66938d350 ]
+
+The ubsan reported the following error.  It was because sample's raw
+data missed u32 padding at the end.  So it broke the alignment of the
+array after it.
+
+The raw data contains an u32 size prefix so the data size should have
+an u32 padding after 8-byte aligned data.
+
+27: Sample parsing  :util/synthetic-events.c:1539:4:
+  runtime error: store to misaligned address 0x62100006b9bc for type
+  '__u64' (aka 'unsigned long long'), which requires 8 byte alignment
+0x62100006b9bc: note: pointer points here
+  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
+              ^
+    #0 0x561532a9fc96 in perf_event__synthesize_sample util/synthetic-events.c:1539:13
+    #1 0x5615327f4a4f in do_test tests/sample-parsing.c:284:8
+    #2 0x5615327f3f50 in test__sample_parsing tests/sample-parsing.c:381:9
+    #3 0x56153279d3a1 in run_test tests/builtin-test.c:424:9
+    #4 0x56153279c836 in test_and_print tests/builtin-test.c:454:9
+    #5 0x56153279b7eb in __cmd_test tests/builtin-test.c:675:4
+    #6 0x56153279abf0 in cmd_test tests/builtin-test.c:821:9
+    #7 0x56153264e796 in run_builtin perf.c:312:11
+    #8 0x56153264cf03 in handle_internal_command perf.c:364:8
+    #9 0x56153264e47d in run_argv perf.c:408:2
+    #10 0x56153264c9a9 in main perf.c:538:3
+    #11 0x7f137ab6fbbc in __libc_start_main (/lib64/libc.so.6+0x38bbc)
+    #12 0x561532596828 in _start ...
+
+SUMMARY: UndefinedBehaviorSanitizer: misaligned-pointer-use
+ util/synthetic-events.c:1539:4 in
+
+Fixes: 045f8cd8542d ("perf tests: Add a sample parsing test")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/r/20210214091638.519643-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/sample-parsing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
+index 3a02426db9a63..2f76d4a9de860 100644
+--- a/tools/perf/tests/sample-parsing.c
++++ b/tools/perf/tests/sample-parsing.c
+@@ -180,7 +180,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format)
+ 		.data = {1, 211, 212, 213},
+ 	};
+ 	u64 regs[64];
+-	const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL};
++	const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 };
+ 	const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL};
+ 	struct perf_sample sample = {
+ 		.ip		= 101,
+-- 
+2.27.0
+
diff --git a/queue-5.4/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch b/queue-5.4/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch
new file mode 100644
index 00000000000..722fbef41d5
--- /dev/null
+++ b/queue-5.4/perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch
@@ -0,0 +1,101 @@
+From 4d48b6eec1eea04ea8da71ac0946766a25a7efad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 09:52:47 -0300
+Subject: perf tools: Fix DSO filtering when not finding a map for a sampled
+ address
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit c69bf11ad3d30b6bf01cfa538ddff1a59467c734 ]
+
+When we lookup an address and don't find a map we should filter that
+sample if the user specified a list of --dso entries to filter on, fix
+it.
+
+Before:
+
+  $ perf script
+             sleep 274800  2843.556162:          1 cycles:u:  ffffffffbb26bff4 [unknown] ([unknown])
+             sleep 274800  2843.556168:          1 cycles:u:  ffffffffbb2b047d [unknown] ([unknown])
+             sleep 274800  2843.556171:          1 cycles:u:  ffffffffbb2706b2 [unknown] ([unknown])
+             sleep 274800  2843.556174:          6 cycles:u:  ffffffffbb2b0267 [unknown] ([unknown])
+             sleep 274800  2843.556176:         59 cycles:u:  ffffffffbb2b03b1 [unknown] ([unknown])
+             sleep 274800  2843.556180:        691 cycles:u:  ffffffffbb26bff4 [unknown] ([unknown])
+             sleep 274800  2843.556189:       9160 cycles:u:      7fa9550eeaa3 __GI___tunables_init+0xf3 (/usr/lib64/ld-2.32.so)
+             sleep 274800  2843.556312:      86937 cycles:u:      7fa9550e157b _dl_lookup_symbol_x+0x4b (/usr/lib64/ld-2.32.so)
+  $
+
+So we have some samples we somehow didn't find in a map for, if we now
+do:
+
+  $ perf report --stdio --dso /usr/lib64/ld-2.32.so
+  # dso: /usr/lib64/ld-2.32.so
+  #
+  # Total Lost Samples: 0
+  #
+  # Samples: 8  of event 'cycles:u'
+  # Event count (approx.): 96856
+  #
+  # Overhead  Command  Symbol
+  # ........  .......  ........................
+  #
+      89.76%  sleep    [.] _dl_lookup_symbol_x
+       9.46%  sleep    [.] __GI___tunables_init
+       0.71%  sleep    [k] 0xffffffffbb26bff4
+       0.06%  sleep    [k] 0xffffffffbb2b03b1
+       0.01%  sleep    [k] 0xffffffffbb2b0267
+       0.00%  sleep    [k] 0xffffffffbb2706b2
+       0.00%  sleep    [k] 0xffffffffbb2b047d
+  $
+
+After this patch we get the right output with just entries for the DSOs
+specified in --dso:
+
+  $ perf report --stdio --dso /usr/lib64/ld-2.32.so
+  # dso: /usr/lib64/ld-2.32.so
+  #
+  # Total Lost Samples: 0
+  #
+  # Samples: 8  of event 'cycles:u'
+  # Event count (approx.): 96856
+  #
+  # Overhead  Command  Symbol
+  # ........  .......  ........................
+  #
+      89.76%  sleep    [.] _dl_lookup_symbol_x
+       9.46%  sleep    [.] __GI___tunables_init
+  $
+  #
+
+Fixes: 96415e4d3f5fdf9c ("perf symbols: Avoid unnecessary symbol loading when dso list is specified")
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210128131209.GD775562@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/event.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index fc1e5a991008d..bfaa9afdb8b4c 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -597,6 +597,8 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
+ 		}
+ 
+ 		al->sym = map__find_symbol(al->map, al->addr);
++	} else if (symbol_conf.dso_list) {
++		al->filtered |= (1 << HIST_FILTER__DSO);
+ 	}
+ 
+ 	if (symbol_conf.sym_list &&
+-- 
+2.27.0
+
diff --git a/queue-5.4/perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch b/queue-5.4/perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch
new file mode 100644
index 00000000000..2135e43d9c5
--- /dev/null
+++ b/queue-5.4/perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch
@@ -0,0 +1,48 @@
+From 9b57bb677e69f39c7bc5b34f90ccce94bc2e6bf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 20:00:33 +0800
+Subject: perf vendor events arm64: Fix Ampere eMag event typo
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2bf797be81fa808f05f1a7a65916619132256a27 ]
+
+The "briefdescription" for event 0x35 has a typo - fix it.
+
+Fixes: d35c595bf005 ("perf vendor events arm64: Revise core JSON events for eMAG")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Acked-by: Will Deacon <will@kernel.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Nakamura, Shunsuke/中村 俊介 <nakamura.shun@fujitsu.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxarm@openeuler.org
+Link: https://lore.kernel.org/r/1611835236-34696-2-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json b/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
+index df9201434cb6a..b0a10a219b50d 100644
+--- a/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
++++ b/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
+@@ -114,7 +114,7 @@
+         "PublicDescription": "Level 2 access to instruciton TLB that caused a page table walk. This event counts on any instruciton access which causes L2I_TLB_REFILL to count",
+         "EventCode": "0x35",
+         "EventName": "L2I_TLB_ACCESS",
+-        "BriefDescription": "L2D TLB access"
++        "BriefDescription": "L2I TLB access"
+     },
+     {
+         "PublicDescription": "Branch target buffer misprediction",
+-- 
+2.27.0
+
diff --git a/queue-5.4/phy-rockchip-emmc-emmc_phy_init-always-return-0.patch b/queue-5.4/phy-rockchip-emmc-emmc_phy_init-always-return-0.patch
new file mode 100644
index 00000000000..07f7abd2a3f
--- /dev/null
+++ b/queue-5.4/phy-rockchip-emmc-emmc_phy_init-always-return-0.patch
@@ -0,0 +1,52 @@
+From 1e3d7e487a5d96bccebf87048aac2f248a0a425b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 16:04:54 +0800
+Subject: phy: rockchip-emmc: emmc_phy_init() always return 0
+
+From: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit 39961bd6b70e5a5d7c4b5483ad8e1db6b5765c60 ]
+
+rockchip_emmc_phy_init() return variable is not set with the error value
+if clk_get() failed. 'emmcclk' is optional, thus use clk_get_optional()
+and if the return value != NULL make error processing and set the
+return code accordingly.
+
+Fixes: 52c0624a10cce phy: rockchip-emmc: Set phyctrl_frqsel based on card clock
+Signed-off-by: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20201210080454.17379-1-chris.ruehl@gtsys.com.hk
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-emmc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-emmc.c b/drivers/phy/rockchip/phy-rockchip-emmc.c
+index 2dc19ddd120f5..a005fc58bbf02 100644
+--- a/drivers/phy/rockchip/phy-rockchip-emmc.c
++++ b/drivers/phy/rockchip/phy-rockchip-emmc.c
+@@ -240,15 +240,17 @@ static int rockchip_emmc_phy_init(struct phy *phy)
+ 	 * - SDHCI driver to get the PHY
+ 	 * - SDHCI driver to init the PHY
+ 	 *
+-	 * The clock is optional, so upon any error we just set to NULL.
++	 * The clock is optional, using clk_get_optional() to get the clock
++	 * and do error processing if the return value != NULL
+ 	 *
+ 	 * NOTE: we don't do anything special for EPROBE_DEFER here.  Given the
+ 	 * above expected use case, EPROBE_DEFER isn't sensible to expect, so
+ 	 * it's just like any other error.
+ 	 */
+-	rk_phy->emmcclk = clk_get(&phy->dev, "emmcclk");
++	rk_phy->emmcclk = clk_get_optional(&phy->dev, "emmcclk");
+ 	if (IS_ERR(rk_phy->emmcclk)) {
+-		dev_dbg(&phy->dev, "Error getting emmcclk: %d\n", ret);
++		ret = PTR_ERR(rk_phy->emmcclk);
++		dev_err(&phy->dev, "Error getting emmcclk: %d\n", ret);
+ 		rk_phy->emmcclk = NULL;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch b/queue-5.4/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch
new file mode 100644
index 00000000000..dd66b014b7a
--- /dev/null
+++ b/queue-5.4/power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch
@@ -0,0 +1,36 @@
+From 1f402b8d3b1215dc6d31046b5aa5ee4a45759dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 14:57:31 +0200
+Subject: power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 95aa21a3f1183260db1b0395e03df5bebc5ed641 ]
+
+According to datasheet WKUPDBC mask is b/w bits 26..24.
+
+Fixes: f80cb48843987 ("power: reset: at91-shdwc: add new shutdown controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/at91-sama5d2_shdwc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index e341cc5c0ea6f..c84df27cd5482 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -37,7 +37,7 @@
+ 
+ #define AT91_SHDW_MR	0x04		/* Shut Down Mode Register */
+ #define AT91_SHDW_WKUPDBC_SHIFT	24
+-#define AT91_SHDW_WKUPDBC_MASK	GENMASK(31, 16)
++#define AT91_SHDW_WKUPDBC_MASK	GENMASK(26, 24)
+ #define AT91_SHDW_WKUPDBC(x)	(((x) << AT91_SHDW_WKUPDBC_SHIFT) \
+ 						& AT91_SHDW_WKUPDBC_MASK)
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/powerpc-47x-disable-256k-page-size.patch b/queue-5.4/powerpc-47x-disable-256k-page-size.patch
new file mode 100644
index 00000000000..ed09ab7b531
--- /dev/null
+++ b/queue-5.4/powerpc-47x-disable-256k-page-size.patch
@@ -0,0 +1,41 @@
+From 9004339dbfffdada83a1d73732f3684eccd1df38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 07:49:13 +0000
+Subject: powerpc/47x: Disable 256k page size
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 910a0cb6d259736a0c86e795d4c2f42af8d0d775 ]
+
+PPC47x_TLBE_SIZE isn't defined for 256k pages, leading to a build
+break if 256k pages is selected.
+
+So change the kconfig so that 256k pages can't be selected for 47x.
+
+Fixes: e7f75ad01d59 ("powerpc/47x: Base ppc476 support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+[mpe: Expand change log to mention build break]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/2fed79b1154c872194f98bac4422c23918325e61.1611128938.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index cb285e474c880..c4cbb65e742f4 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -723,7 +723,7 @@ config PPC_64K_PAGES
+ 
+ config PPC_256K_PAGES
+ 	bool "256k page size"
+-	depends on 44x && !STDBINUTILS
++	depends on 44x && !STDBINUTILS && !PPC_47x
+ 	help
+ 	  Make the page size 256k.
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/powerpc-8xx-fix-software-emulation-interrupt.patch b/queue-5.4/powerpc-8xx-fix-software-emulation-interrupt.patch
new file mode 100644
index 00000000000..cfbe7091c2d
--- /dev/null
+++ b/queue-5.4/powerpc-8xx-fix-software-emulation-interrupt.patch
@@ -0,0 +1,40 @@
+From ebd95987f756c8f33c413c3a5a7129418db2f055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 08:56:13 +0000
+Subject: powerpc/8xx: Fix software emulation interrupt
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 903178d0ce6bb30ef80a3604ab9ee2b57869fbc9 ]
+
+For unimplemented instructions or unimplemented SPRs, the 8xx triggers
+a "Software Emulation Exception" (0x1000). That interrupt doesn't set
+reason bits in SRR1 as the "Program Check Exception" does.
+
+Go through emulation_assist_interrupt() to set REASON_ILLEGAL.
+
+Fixes: fbbcc3bb139e ("powerpc/8xx: Remove SoftwareEmulation()")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ad782af87a222efc79cfb06079b0fd23d4224eaf.1612515180.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index f6428b90a6c77..6f3e417f55a35 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -191,7 +191,7 @@ SystemCall:
+ /* On the MPC8xx, this is a software emulation interrupt.  It occurs
+  * for all unimplemented and illegal instructions.
+  */
+-	EXCEPTION(0x1000, SoftEmu, program_check_exception, EXC_XFER_STD)
++	EXCEPTION(0x1000, SoftEmu, emulation_assist_interrupt, EXC_XFER_STD)
+ 
+ /* Called from DataStoreTLBMiss when perf TLB misses events are activated */
+ #ifdef CONFIG_PERF_EVENTS
+-- 
+2.27.0
+
diff --git a/queue-5.4/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch b/queue-5.4/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch
new file mode 100644
index 00000000000..a7612f391a4
--- /dev/null
+++ b/queue-5.4/powerpc-pseries-dlpar-handle-ibm-configure-connector.patch
@@ -0,0 +1,65 @@
+From f3478775acc8266f0913c3a41e9b2ca9366ae86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 20:59:00 -0600
+Subject: powerpc/pseries/dlpar: handle ibm, configure-connector delay status
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 768d70e19ba525debd571b36e6d0ab19956c63d7 ]
+
+dlpar_configure_connector() has two problems in its handling of
+ibm,configure-connector's return status:
+
+1. When the status is -2 (busy, call again), we call
+   ibm,configure-connector again immediately without checking whether
+   to schedule, which can result in monopolizing the CPU.
+2. Extended delay status (9900..9905) goes completely unhandled,
+   causing the configuration to unnecessarily terminate.
+
+Fix both of these issues by using rtas_busy_delay().
+
+Fixes: ab519a011caa ("powerpc/pseries: Kernel DLPAR Infrastructure")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210107025900.410369-1-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 16e86ba8aa209..f6b7749d6ada7 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -127,7 +127,6 @@ void dlpar_free_cc_nodes(struct device_node *dn)
+ #define NEXT_PROPERTY   3
+ #define PREV_PARENT     4
+ #define MORE_MEMORY     5
+-#define CALL_AGAIN	-2
+ #define ERR_CFG_USE     -9003
+ 
+ struct device_node *dlpar_configure_connector(__be32 drc_index,
+@@ -168,6 +167,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ 
+ 		spin_unlock(&rtas_data_buf_lock);
+ 
++		if (rtas_busy_delay(rc))
++			continue;
++
+ 		switch (rc) {
+ 		case COMPLETE:
+ 			break;
+@@ -216,9 +218,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ 			last_dn = last_dn->parent;
+ 			break;
+ 
+-		case CALL_AGAIN:
+-			break;
+-
+ 		case MORE_MEMORY:
+ 		case ERR_CFG_USE:
+ 		default:
+-- 
+2.27.0
+
diff --git a/queue-5.4/powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch b/queue-5.4/powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch
new file mode 100644
index 00000000000..b05cf4d5d0b
--- /dev/null
+++ b/queue-5.4/powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch
@@ -0,0 +1,57 @@
+From 1dcc60e976b6f4c9ccf0f3939c43b3ec0057f8f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 18:36:43 +0530
+Subject: powerpc/sstep: Fix incorrect return from analyze_instr()
+
+From: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+
+[ Upstream commit 718aae916fa6619c57c348beaedd675835cf1aa1 ]
+
+We currently just percolate the return value from analyze_instr()
+to the caller of emulate_step(), especially if it is a -1.
+
+For one particular case (opcode = 4) for instructions that aren't
+currently emulated, we are returning 'should not be single-stepped'
+while we should have returned 0 which says 'did not emulate, may
+have to single-step'.
+
+Fixes: 930d6288a26787 ("powerpc: sstep: Add support for maddhd, maddhdu, maddld instructions")
+Signed-off-by: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Tested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Reviewed-by: Sandipan Das <sandipan@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/161157999039.64773.14950289716779364766.stgit@thinktux.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index c077acb983a19..bf3432b10d0af 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1304,6 +1304,11 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 
+ #ifdef __powerpc64__
+ 	case 4:
++		/*
++		 * There are very many instructions with this primary opcode
++		 * introduced in the ISA as early as v2.03. However, the ones
++		 * we currently emulate were all introduced with ISA 3.0
++		 */
+ 		if (!cpu_has_feature(CPU_FTR_ARCH_300))
+ 			return -1;
+ 
+@@ -1331,7 +1336,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 		 * There are other instructions from ISA 3.0 with the same
+ 		 * primary opcode which do not have emulation support yet.
+ 		 */
+-		return -1;
++		goto unknown_opcode;
+ #endif
+ 
+ 	case 7:		/* mulli */
+-- 
+2.27.0
+
diff --git a/queue-5.4/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch b/queue-5.4/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch
new file mode 100644
index 00000000000..71d7fcb7531
--- /dev/null
+++ b/queue-5.4/pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch
@@ -0,0 +1,43 @@
+From 622fef94d4c581151f63448f45130f2be2cb9224 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 11:12:06 -0500
+Subject: pwm: rockchip: rockchip_pwm_probe(): Remove superfluous
+ clk_unprepare()
+
+From: Simon South <simon@simonsouth.net>
+
+[ Upstream commit d5d8d675865ccddfe4da26c85f22c55cec663bf2 ]
+
+If rockchip_pwm_probe() fails to register a PWM device it calls
+clk_unprepare() for the device's PWM clock, without having first disabled
+the clock and before jumping to an error handler that also unprepares
+it. This is likely to produce warnings from the kernel about the clock
+being unprepared when it is still enabled, and then being unprepared when
+it has already been unprepared.
+
+Prevent these warnings by removing this unnecessary call to
+clk_unprepare().
+
+Fixes: 48cf973cae33 ("pwm: rockchip: Avoid glitches on already running PWMs")
+Signed-off-by: Simon South <simon@simonsouth.net>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-rockchip.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index 73352e6fbccbf..6ad6aad215cf1 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -361,7 +361,6 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ 
+ 	ret = pwmchip_add(&pc->chip);
+ 	if (ret < 0) {
+-		clk_unprepare(pc->clk);
+ 		dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+ 		goto err_pclk;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/quota-fix-memory-leak-when-handling-corrupted-quota-.patch b/queue-5.4/quota-fix-memory-leak-when-handling-corrupted-quota-.patch
new file mode 100644
index 00000000000..c2da6d305b8
--- /dev/null
+++ b/queue-5.4/quota-fix-memory-leak-when-handling-corrupted-quota-.patch
@@ -0,0 +1,55 @@
+From 263b017403c8e67e03009d4edebf792b6d2f1b9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Dec 2020 12:09:53 +0100
+Subject: quota: Fix memory leak when handling corrupted quota file
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit a4db1072e1a3bd7a8d9c356e1902b13ac5deb8ef ]
+
+When checking corrupted quota file we can bail out and leak allocated
+info structure. Properly free info structure on error return.
+
+Reported-by: syzbot+77779c9b52ab78154b08@syzkaller.appspotmail.com
+Fixes: 11c514a99bb9 ("quota: Sanity-check quota file headers on load")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/quota_v2.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index 36dce17b01016..56aedf4ba8864 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -166,19 +166,24 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ 		quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+ 		    (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+ 		    i_size_read(sb_dqopt(sb)->files[type]));
+-		goto out;
++		goto out_free;
+ 	}
+ 	if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+ 		quota_error(sb, "Free block number too big (%u >= %u).",
+ 			    qinfo->dqi_free_blk, qinfo->dqi_blocks);
+-		goto out;
++		goto out_free;
+ 	}
+ 	if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+ 		quota_error(sb, "Block with free entry too big (%u >= %u).",
+ 			    qinfo->dqi_free_entry, qinfo->dqi_blocks);
+-		goto out;
++		goto out_free;
+ 	}
+ 	ret = 0;
++out_free:
++	if (ret) {
++		kfree(info->dqi_priv);
++		info->dqi_priv = NULL;
++	}
+ out:
+ 	up_read(&dqopt->dqio_sem);
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.4/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch b/queue-5.4/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch
new file mode 100644
index 00000000000..f9990360bed
--- /dev/null
+++ b/queue-5.4/r8169-fix-jumbo-packet-handling-on-rtl8168e.patch
@@ -0,0 +1,54 @@
+From 22121d55c9d0f963c75f7323c8c5cbc8309a94c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 16:05:19 +0100
+Subject: r8169: fix jumbo packet handling on RTL8168e
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 6cf739131a15e4177e58a1b4f2bede9d5da78552 ]
+
+Josef reported [0] that using jumbo packets fails on RTL8168e.
+Aligning the values for register MaxTxPacketSize with the
+vendor driver fixes the problem.
+
+[0] https://bugzilla.kernel.org/show_bug.cgi?id=211827
+
+Fixes: d58d46b5d851 ("r8169: jumbo fixes.")
+Reported-by: Josef OÅ¡kera <joskera@redhat.com>
+Tested-by: Josef OÅ¡kera <joskera@redhat.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/b15ddef7-0d50-4320-18f4-6a3f86fbfd3e@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 1e8244ec5b332..131be1fa770cb 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4077,7 +4077,7 @@ static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp)
+ 
+ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+ {
+-	RTL_W8(tp, MaxTxPacketSize, 0x3f);
++	RTL_W8(tp, MaxTxPacketSize, 0x24);
+ 	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+ 	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01);
+ 	rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_512B);
+@@ -4085,7 +4085,7 @@ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+ 
+ static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp)
+ {
+-	RTL_W8(tp, MaxTxPacketSize, 0x0c);
++	RTL_W8(tp, MaxTxPacketSize, 0x3f);
+ 	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+ 	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01);
+ 	rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B);
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-hns-fix-type-of-sq_signal_bits.patch b/queue-5.4/rdma-hns-fix-type-of-sq_signal_bits.patch
new file mode 100644
index 00000000000..d16d05bbe60
--- /dev/null
+++ b/queue-5.4/rdma-hns-fix-type-of-sq_signal_bits.patch
@@ -0,0 +1,38 @@
+From 295cfcc1d2434d11cdf1f9527cdc60a29e16084f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:39:24 +0800
+Subject: RDMA/hns: Fix type of sq_signal_bits
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit ea4092f3b56b236d08890ea589506ebd76248c53 ]
+
+This bit should be in type of enum ib_sig_type, or there will be a sparse
+warning.
+
+Fixes: bfe860351e31 ("RDMA/hns: Fix cast from or to restricted __le32 for driver")
+Link: https://lore.kernel.org/r/1612517974-31867-3-git-send-email-liweihang@huawei.com
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index e36d315690819..3e68ba9dab45d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -657,7 +657,7 @@ struct hns_roce_qp {
+ 	u8			rdb_en;
+ 	u8			sdb_en;
+ 	u32			doorbell_qpn;
+-	u32			sq_signal_bits;
++	enum ib_sig_type	sq_signal_bits;
+ 	struct hns_roce_wq	sq;
+ 
+ 	struct ib_umem		*umem;
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch b/queue-5.4/rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch
new file mode 100644
index 00000000000..4fada248f12
--- /dev/null
+++ b/queue-5.4/rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch
@@ -0,0 +1,39 @@
+From 3c9f034d9f1585488286c505076fbc05c4bcfff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:58:02 +0800
+Subject: RDMA/hns: Fixed wrong judgments in the goto branch
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit bb74fe7e81c8b2b65c6a351a247fdb9a969cbaec ]
+
+When an error occurs, the qp_table must be cleared, regardless of whether
+the SRQ feature is enabled.
+
+Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08")
+Link: https://lore.kernel.org/r/1611997090-48820-5-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index b5d196c119eec..f23a341400c06 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -848,8 +848,7 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
+ 	return 0;
+ 
+ err_qp_table_free:
+-	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
+-		hns_roce_cleanup_qp_table(hr_dev);
++	hns_roce_cleanup_qp_table(hr_dev);
+ 
+ err_cq_table_free:
+ 	hns_roce_cleanup_cq_table(hr_dev);
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-hns-fixes-missing-error-code-of-cmdq.patch b/queue-5.4/rdma-hns-fixes-missing-error-code-of-cmdq.patch
new file mode 100644
index 00000000000..73653f0a02f
--- /dev/null
+++ b/queue-5.4/rdma-hns-fixes-missing-error-code-of-cmdq.patch
@@ -0,0 +1,56 @@
+From 4a1d9b61cbb93302c9a7328d38f74377b782fa7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Feb 2021 16:55:40 +0800
+Subject: RDMA/hns: Fixes missing error code of CMDQ
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit 8f86e2eadac968200a6ab1d7074fc0f5cbc1e075 ]
+
+When posting a multi-descriptors command, the error code of previous
+failed descriptors may be rewrote to 0 by a later successful descriptor.
+
+Fixes: a04ff739f2a9 ("RDMA/hns: Add command queue support for hip08 RoCE driver")
+Link: https://lore.kernel.org/r/1612688143-28226-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index e8933daab4995..d01e3222c00cf 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1009,7 +1009,7 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev,
+ 	u32 timeout = 0;
+ 	int handle = 0;
+ 	u16 desc_ret;
+-	int ret = 0;
++	int ret;
+ 	int ntc;
+ 
+ 	spin_lock_bh(&csq->lock);
+@@ -1054,15 +1054,14 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev,
+ 	if (hns_roce_cmq_csq_done(hr_dev)) {
+ 		complete = true;
+ 		handle = 0;
++		ret = 0;
+ 		while (handle < num) {
+ 			/* get the result of hardware write back */
+ 			desc_to_use = &csq->desc[ntc];
+ 			desc[handle] = *desc_to_use;
+ 			dev_dbg(hr_dev->dev, "Get cmq desc:\n");
+ 			desc_ret = le16_to_cpu(desc[handle].retval);
+-			if (desc_ret == CMD_EXEC_SUCCESS)
+-				ret = 0;
+-			else
++			if (unlikely(desc_ret != CMD_EXEC_SUCCESS))
+ 				ret = -EIO;
+ 			priv->cmq.last_status = desc_ret;
+ 			ntc++;
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch b/queue-5.4/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch
new file mode 100644
index 00000000000..53ed4655d4a
--- /dev/null
+++ b/queue-5.4/rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch
@@ -0,0 +1,40 @@
+From ffbf6a03d6ba17e26ac78d03e09502af572235f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 15:01:19 +0200
+Subject: RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation
+
+From: Yishai Hadas <yishaih@nvidia.com>
+
+[ Upstream commit 8798e4ad0abe0ba1221928a46561981c510be0c6 ]
+
+Use the correct obj_id upon DEVX TIR creation by strictly taking the tirn
+24 bits and not the general obj_id which is 32 bits.
+
+Fixes: 7efce3691d33 ("IB/mlx5: Add obj create and destroy functionality")
+Link: https://lore.kernel.org/r/20201230130121.180350-2-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index fd75a9043bf15..4d6f25fdcc0ef 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -1118,7 +1118,9 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din,
+ 		MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_RQT);
+ 		break;
+ 	case MLX5_CMD_OP_CREATE_TIR:
+-		MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++		*obj_id = MLX5_GET(create_tir_out, out, tirn);
++		MLX5_SET(destroy_tir_in, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++		MLX5_SET(destroy_tir_in, din, tirn, *obj_id);
+ 		break;
+ 	case MLX5_CMD_OP_CREATE_TIS:
+ 		MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIS);
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-rxe-correct-skb-on-loopback-path.patch b/queue-5.4/rdma-rxe-correct-skb-on-loopback-path.patch
new file mode 100644
index 00000000000..1e9e8e5acdb
--- /dev/null
+++ b/queue-5.4/rdma-rxe-correct-skb-on-loopback-path.patch
@@ -0,0 +1,43 @@
+From 3024fc645b53f63d114989d877033e7cbc298f6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 12:23:02 -0600
+Subject: RDMA/rxe: Correct skb on loopback path
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 5120bf0a5fc15dec210a0fe0f39e4a256bb6e349 ]
+
+rxe_net.c sends packets at the IP layer with skb->data pointing at the IP
+header but receives packets from a UDP tunnel with skb->data pointing at
+the UDP header.  On the loopback path this was not correctly accounted
+for.  This patch corrects for this by using sbk_pull() to strip the IP
+header from the skb on received packets.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20210128182301.16859-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_net.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 312c2fc961c00..d411356828911 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -453,6 +453,11 @@ int rxe_send(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+ 
+ void rxe_loopback(struct sk_buff *skb)
+ {
++	if (skb->protocol == htons(ETH_P_IP))
++		skb_pull(skb, sizeof(struct iphdr));
++	else
++		skb_pull(skb, sizeof(struct ipv6hdr));
++
+ 	rxe_rcv(skb);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch b/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch
new file mode 100644
index 00000000000..cf2b2bd91ae
--- /dev/null
+++ b/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch
@@ -0,0 +1,75 @@
+From 10283284067658287c0e6e44962ff3415a5778c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 11:47:53 -0600
+Subject: RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 8fc1b7027fc162738d5a85c82410e501a371a404 ]
+
+rxe_rcv_mcast_pkt() in rxe_recv.c can leak SKBs in error path code. The
+loop over the QPs attached to a multicast group creates new cloned SKBs
+for all but the last QP in the list and passes the SKB and its clones to
+rxe_rcv_pkt() for further processing. Any QPs that do not pass some checks
+are skipped.  If the last QP in the list fails the tests the SKB is
+leaked.  This patch checks if the SKB for the last QP was used and if not
+frees it. Also removes a redundant loop invariant assignment.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Fixes: 71abf20b28ff ("RDMA/rxe: Handle skb_clone() failure in rxe_recv.c")
+Link: https://lore.kernel.org/r/20210128174752.16128-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index 2dc808988d949..369ba76f1605e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -305,7 +305,6 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+ 
+ 	list_for_each_entry(mce, &mcg->qp_list, qp_list) {
+ 		qp = mce->qp;
+-		pkt = SKB_TO_PKT(skb);
+ 
+ 		/* validate qp for incoming packet */
+ 		err = check_type_state(rxe, pkt, qp);
+@@ -317,12 +316,18 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+ 			continue;
+ 
+ 		/* for all but the last qp create a new clone of the
+-		 * skb and pass to the qp.
++		 * skb and pass to the qp. If an error occurs in the
++		 * checks for the last qp in the list we need to
++		 * free the skb since it hasn't been passed on to
++		 * rxe_rcv_pkt() which would free it later.
+ 		 */
+-		if (mce->qp_list.next != &mcg->qp_list)
++		if (mce->qp_list.next != &mcg->qp_list) {
+ 			per_qp_skb = skb_clone(skb, GFP_ATOMIC);
+-		else
++		} else {
+ 			per_qp_skb = skb;
++			/* show we have consumed the skb */
++			skb = NULL;
++		}
+ 
+ 		if (unlikely(!per_qp_skb))
+ 			continue;
+@@ -337,9 +342,8 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+ 
+ 	rxe_drop_ref(mcg);	/* drop ref from rxe_pool_get_key. */
+ 
+-	return;
+-
+ err1:
++	/* free skb if not consumed */
+ 	kfree_skb(skb);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch b/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch
new file mode 100644
index 00000000000..c672eec4bf2
--- /dev/null
+++ b/queue-5.4/rdma-rxe-fix-coding-error-in-rxe_recv.c.patch
@@ -0,0 +1,67 @@
+From 9180be6c11fa0c03abe11c80bb3ef8bfe8637d05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 15:45:01 -0600
+Subject: RDMA/rxe: Fix coding error in rxe_recv.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 7d9ae80e31df57dd3253e1ec514f0000aa588a81 ]
+
+check_type_state() in rxe_recv.c is written as if the type bits in the
+packet opcode were a bit mask which is not correct. This patch corrects
+this code to compare all 3 type bits to the required type.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20210127214500.3707-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index 9bfb98056fc2a..2dc808988d949 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -36,21 +36,26 @@
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ 
++/* check that QP matches packet opcode type and is in a valid state */
+ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ 			    struct rxe_qp *qp)
+ {
++	unsigned int pkt_type;
++
+ 	if (unlikely(!qp->valid))
+ 		goto err1;
+ 
++	pkt_type = pkt->opcode & 0xe0;
++
+ 	switch (qp_type(qp)) {
+ 	case IB_QPT_RC:
+-		if (unlikely((pkt->opcode & IB_OPCODE_RC) != 0)) {
++		if (unlikely(pkt_type != IB_OPCODE_RC)) {
+ 			pr_warn_ratelimited("bad qp type\n");
+ 			goto err1;
+ 		}
+ 		break;
+ 	case IB_QPT_UC:
+-		if (unlikely(!(pkt->opcode & IB_OPCODE_UC))) {
++		if (unlikely(pkt_type != IB_OPCODE_UC)) {
+ 			pr_warn_ratelimited("bad qp type\n");
+ 			goto err1;
+ 		}
+@@ -58,7 +63,7 @@ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ 	case IB_QPT_UD:
+ 	case IB_QPT_SMI:
+ 	case IB_QPT_GSI:
+-		if (unlikely(!(pkt->opcode & IB_OPCODE_UD))) {
++		if (unlikely(pkt_type != IB_OPCODE_UD)) {
+ 			pr_warn_ratelimited("bad qp type\n");
+ 			goto err1;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch b/queue-5.4/rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch
new file mode 100644
index 00000000000..377526300fc
--- /dev/null
+++ b/queue-5.4/rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch
@@ -0,0 +1,75 @@
+From 6d593b8971974c25b7f397ee5654d210da31ebc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 13:29:22 +0200
+Subject: RDMA/siw: Fix calculation of tx_valid_cpus size
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 429fa9698957d1a910535ce5e33aedf5adfdabc1 ]
+
+The size of tx_valid_cpus was calculated under the assumption that the
+numa nodes identifiers are continuous, which is not the case in all archs
+as this could lead to the following panic when trying to access an invalid
+tx_valid_cpus index, avoid the following panic by using nr_node_ids
+instead of num_online_nodes() to allocate the tx_valid_cpus size.
+
+   Kernel attempted to read user page (8) - exploit attempt? (uid: 0)
+   BUG: Kernel NULL pointer dereference on read at 0x00000008
+   Faulting instruction address: 0xc0080000081b4a90
+   Oops: Kernel access of bad area, sig: 11 [#1]
+   LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
+   Modules linked in: siw(+) rfkill rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm sunrpc ib_umad rdma_cm ib_cm iw_cm i40iw ib_uverbs ib_core i40e ses enclosure scsi_transport_sas ipmi_powernv ibmpowernv at24 ofpart ipmi_devintf regmap_i2c ipmi_msghandler powernv_flash uio_pdrv_genirq uio mtd opal_prd zram ip_tables xfs libcrc32c sd_mod t10_pi ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm_ttm_helper ttm drm vmx_crypto aacraid drm_panel_orientation_quirks dm_mod
+   CPU: 40 PID: 3279 Comm: modprobe Tainted: G        W      X --------- ---  5.11.0-0.rc4.129.eln108.ppc64le #2
+   NIP:  c0080000081b4a90 LR: c0080000081b4a2c CTR: c0000000007ce1c0
+   REGS: c000000027fa77b0 TRAP: 0300   Tainted: G        W      X --------- ---   (5.11.0-0.rc4.129.eln108.ppc64le)
+   MSR:  9000000002009033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE>  CR: 44224882  XER: 00000000
+   CFAR: c0000000007ce200 DAR: 0000000000000008 DSISR: 40000000 IRQMASK: 0
+   GPR00: c0080000081b4a2c c000000027fa7a50 c0080000081c3900 0000000000000040
+   GPR04: c000000002023080 c000000012e1c300 000020072ad70000 0000000000000001
+   GPR08: c000000001726068 0000000000000008 0000000000000008 c0080000081b5758
+   GPR12: c0000000007ce1c0 c0000007fffc3000 00000001590b1e40 0000000000000000
+   GPR16: 0000000000000000 0000000000000001 000000011ad68fc8 00007fffcc09c5c8
+   GPR20: 0000000000000008 0000000000000000 00000001590b2850 00000001590b1d30
+   GPR24: 0000000000043d68 000000011ad67a80 000000011ad67a80 0000000000100000
+   GPR28: c000000012e1c300 c0000000020271c8 0000000000000001 c0080000081bf608
+   NIP [c0080000081b4a90] siw_init_cpulist+0x194/0x214 [siw]
+   LR [c0080000081b4a2c] siw_init_cpulist+0x130/0x214 [siw]
+   Call Trace:
+   [c000000027fa7a50] [c0080000081b4a2c] siw_init_cpulist+0x130/0x214 [siw] (unreliable)
+   [c000000027fa7a90] [c0080000081b4e68] siw_init_module+0x40/0x2a0 [siw]
+   [c000000027fa7b30] [c0000000000124f4] do_one_initcall+0x84/0x2e0
+   [c000000027fa7c00] [c000000000267ffc] do_init_module+0x7c/0x350
+   [c000000027fa7c90] [c00000000026a180] __do_sys_init_module+0x210/0x250
+   [c000000027fa7db0] [c0000000000387e4] system_call_exception+0x134/0x230
+   [c000000027fa7e10] [c00000000000d660] system_call_common+0xf0/0x27c
+   Instruction dump:
+   40810044 3d420000 e8bf0000 e88a82d0 3d420000 e90a82c8 792a1f24 7cc4302a
+   7d2642aa 79291f24 7d25482a 7d295214 <7d4048a8> 7d4a3b78 7d4049ad 40c2fff4
+
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Link: https://lore.kernel.org/r/20210201112922.141085-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index fb66d67572787..dbbf8c6c16d38 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -134,7 +134,7 @@ static struct {
+ 
+ static int siw_init_cpulist(void)
+ {
+-	int i, num_nodes = num_possible_nodes();
++	int i, num_nodes = nr_node_ids;
+ 
+ 	memset(siw_tx_thread, 0, sizeof(siw_tx_thread));
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch b/queue-5.4/rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch
new file mode 100644
index 00000000000..18443af0b2c
--- /dev/null
+++ b/queue-5.4/rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch
@@ -0,0 +1,574 @@
+From c3dcc095dad25f6c2c38cfc2ba19f6a2e50d4121 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 13:58:45 +0100
+Subject: RDMA/siw: Fix handling of zero-sized Read and Receive Queues.
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+[ Upstream commit 661f385961f06f36da24cf408d461f988d0c39ad ]
+
+During connection setup, the application may choose to zero-size inbound
+and outbound READ queues, as well as the Receive queue.  This patch fixes
+handling of zero-sized queues, but not prevents it.
+
+Kamal Heib says in an initial error report:
+
+ When running the blktests over siw the following shift-out-of-bounds is
+ reported, this is happening because the passed IRD or ORD from the ulp
+ could be zero which will lead to unexpected behavior when calling
+ roundup_pow_of_two(), fix that by blocking zero values of ORD or IRD.
+
+   UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13
+   shift exponent 64 is too large for 64-bit type 'long unsigned int'
+   CPU: 20 PID: 3957 Comm: kworker/u64:13 Tainted: G S     5.10.0-rc6 #2
+   Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016
+   Workqueue: iw_cm_wq cm_work_handler [iw_cm]
+   Call Trace:
+    dump_stack+0x99/0xcb
+    ubsan_epilogue+0x5/0x40
+    __ubsan_handle_shift_out_of_bounds.cold.11+0xb4/0xf3
+    ? down_write+0x183/0x3d0
+    siw_qp_modify.cold.8+0x2d/0x32 [siw]
+    ? __local_bh_enable_ip+0xa5/0xf0
+    siw_accept+0x906/0x1b60 [siw]
+    ? xa_load+0x147/0x1f0
+    ? siw_connect+0x17a0/0x17a0 [siw]
+    ? lock_downgrade+0x700/0x700
+    ? siw_get_base_qp+0x1c2/0x340 [siw]
+    ? _raw_spin_unlock_irqrestore+0x39/0x40
+    iw_cm_accept+0x1f4/0x430 [iw_cm]
+    rdma_accept+0x3fa/0xb10 [rdma_cm]
+    ? check_flush_dependency+0x410/0x410
+    ? cma_rep_recv+0x570/0x570 [rdma_cm]
+    nvmet_rdma_queue_connect+0x1a62/0x2680 [nvmet_rdma]
+    ? nvmet_rdma_alloc_cmds+0xce0/0xce0 [nvmet_rdma]
+    ? lock_release+0x56e/0xcc0
+    ? lock_downgrade+0x700/0x700
+    ? lock_downgrade+0x700/0x700
+    ? __xa_alloc_cyclic+0xef/0x350
+    ? __xa_alloc+0x2d0/0x2d0
+    ? rdma_restrack_add+0xbe/0x2c0 [ib_core]
+    ? __ww_mutex_die+0x190/0x190
+    cma_cm_event_handler+0xf2/0x500 [rdma_cm]
+    iw_conn_req_handler+0x910/0xcb0 [rdma_cm]
+    ? _raw_spin_unlock_irqrestore+0x39/0x40
+    ? trace_hardirqs_on+0x1c/0x150
+    ? cma_ib_handler+0x8a0/0x8a0 [rdma_cm]
+    ? __kasan_kmalloc.constprop.7+0xc1/0xd0
+    cm_work_handler+0x121c/0x17a0 [iw_cm]
+    ? iw_cm_reject+0x190/0x190 [iw_cm]
+    ? trace_hardirqs_on+0x1c/0x150
+    process_one_work+0x8fb/0x16c0
+    ? pwq_dec_nr_in_flight+0x320/0x320
+    worker_thread+0x87/0xb40
+    ? __kthread_parkme+0xd1/0x1a0
+    ? process_one_work+0x16c0/0x16c0
+    kthread+0x35f/0x430
+    ? kthread_mod_delayed_work+0x180/0x180
+    ret_from_fork+0x22/0x30
+
+Fixes: a531975279f3 ("rdma/siw: main include file")
+Fixes: f29dd55b0236 ("rdma/siw: queue pair methods")
+Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
+Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://lore.kernel.org/r/20210108125845.1803-1-bmt@zurich.ibm.com
+Reported-by: Kamal Heib <kamalheib1@gmail.com>
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw.h       |   2 +-
+ drivers/infiniband/sw/siw/siw_qp.c    | 271 ++++++++++++++------------
+ drivers/infiniband/sw/siw/siw_qp_rx.c |  26 ++-
+ drivers/infiniband/sw/siw/siw_qp_tx.c |   4 +-
+ drivers/infiniband/sw/siw/siw_verbs.c |  20 +-
+ 5 files changed, 177 insertions(+), 146 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
+index dba4535494abd..4d8bc995b4503 100644
+--- a/drivers/infiniband/sw/siw/siw.h
++++ b/drivers/infiniband/sw/siw/siw.h
+@@ -667,7 +667,7 @@ static inline struct siw_sqe *orq_get_free(struct siw_qp *qp)
+ {
+ 	struct siw_sqe *orq_e = orq_get_tail(qp);
+ 
+-	if (orq_e && READ_ONCE(orq_e->flags) == 0)
++	if (READ_ONCE(orq_e->flags) == 0)
+ 		return orq_e;
+ 
+ 	return NULL;
+diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
+index b4317480cee74..5927ac5923dd8 100644
+--- a/drivers/infiniband/sw/siw/siw_qp.c
++++ b/drivers/infiniband/sw/siw/siw_qp.c
+@@ -199,26 +199,26 @@ void siw_qp_llp_write_space(struct sock *sk)
+ 
+ static int siw_qp_readq_init(struct siw_qp *qp, int irq_size, int orq_size)
+ {
+-	irq_size = roundup_pow_of_two(irq_size);
+-	orq_size = roundup_pow_of_two(orq_size);
+-
+-	qp->attrs.irq_size = irq_size;
+-	qp->attrs.orq_size = orq_size;
+-
+-	qp->irq = vzalloc(irq_size * sizeof(struct siw_sqe));
+-	if (!qp->irq) {
+-		siw_dbg_qp(qp, "irq malloc for %d failed\n", irq_size);
+-		qp->attrs.irq_size = 0;
+-		return -ENOMEM;
++	if (irq_size) {
++		irq_size = roundup_pow_of_two(irq_size);
++		qp->irq = vzalloc(irq_size * sizeof(struct siw_sqe));
++		if (!qp->irq) {
++			qp->attrs.irq_size = 0;
++			return -ENOMEM;
++		}
+ 	}
+-	qp->orq = vzalloc(orq_size * sizeof(struct siw_sqe));
+-	if (!qp->orq) {
+-		siw_dbg_qp(qp, "orq malloc for %d failed\n", orq_size);
+-		qp->attrs.orq_size = 0;
+-		qp->attrs.irq_size = 0;
+-		vfree(qp->irq);
+-		return -ENOMEM;
++	if (orq_size) {
++		orq_size = roundup_pow_of_two(orq_size);
++		qp->orq = vzalloc(orq_size * sizeof(struct siw_sqe));
++		if (!qp->orq) {
++			qp->attrs.orq_size = 0;
++			qp->attrs.irq_size = 0;
++			vfree(qp->irq);
++			return -ENOMEM;
++		}
+ 	}
++	qp->attrs.irq_size = irq_size;
++	qp->attrs.orq_size = orq_size;
+ 	siw_dbg_qp(qp, "ORD %d, IRD %d\n", orq_size, irq_size);
+ 	return 0;
+ }
+@@ -288,13 +288,14 @@ int siw_qp_mpa_rts(struct siw_qp *qp, enum mpa_v2_ctrl ctrl)
+ 	if (ctrl & MPA_V2_RDMA_WRITE_RTR)
+ 		wqe->sqe.opcode = SIW_OP_WRITE;
+ 	else if (ctrl & MPA_V2_RDMA_READ_RTR) {
+-		struct siw_sqe *rreq;
++		struct siw_sqe *rreq = NULL;
+ 
+ 		wqe->sqe.opcode = SIW_OP_READ;
+ 
+ 		spin_lock(&qp->orq_lock);
+ 
+-		rreq = orq_get_free(qp);
++		if (qp->attrs.orq_size)
++			rreq = orq_get_free(qp);
+ 		if (rreq) {
+ 			siw_read_to_orq(rreq, &wqe->sqe);
+ 			qp->orq_put++;
+@@ -877,135 +878,88 @@ void siw_read_to_orq(struct siw_sqe *rreq, struct siw_sqe *sqe)
+ 	rreq->num_sge = 1;
+ }
+ 
+-/*
+- * Must be called with SQ locked.
+- * To avoid complete SQ starvation by constant inbound READ requests,
+- * the active IRQ will not be served after qp->irq_burst, if the
+- * SQ has pending work.
+- */
+-int siw_activate_tx(struct siw_qp *qp)
++static int siw_activate_tx_from_sq(struct siw_qp *qp)
+ {
+-	struct siw_sqe *irqe, *sqe;
++	struct siw_sqe *sqe;
+ 	struct siw_wqe *wqe = tx_wqe(qp);
+ 	int rv = 1;
+ 
+-	irqe = &qp->irq[qp->irq_get % qp->attrs.irq_size];
+-
+-	if (irqe->flags & SIW_WQE_VALID) {
+-		sqe = sq_get_next(qp);
+-
+-		/*
+-		 * Avoid local WQE processing starvation in case
+-		 * of constant inbound READ request stream
+-		 */
+-		if (sqe && ++qp->irq_burst >= SIW_IRQ_MAXBURST_SQ_ACTIVE) {
+-			qp->irq_burst = 0;
+-			goto skip_irq;
+-		}
+-		memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
+-		wqe->wr_status = SIW_WR_QUEUED;
+-
+-		/* start READ RESPONSE */
+-		wqe->sqe.opcode = SIW_OP_READ_RESPONSE;
+-		wqe->sqe.flags = 0;
+-		if (irqe->num_sge) {
+-			wqe->sqe.num_sge = 1;
+-			wqe->sqe.sge[0].length = irqe->sge[0].length;
+-			wqe->sqe.sge[0].laddr = irqe->sge[0].laddr;
+-			wqe->sqe.sge[0].lkey = irqe->sge[0].lkey;
+-		} else {
+-			wqe->sqe.num_sge = 0;
+-		}
+-
+-		/* Retain original RREQ's message sequence number for
+-		 * potential error reporting cases.
+-		 */
+-		wqe->sqe.sge[1].length = irqe->sge[1].length;
+-
+-		wqe->sqe.rkey = irqe->rkey;
+-		wqe->sqe.raddr = irqe->raddr;
++	sqe = sq_get_next(qp);
++	if (!sqe)
++		return 0;
+ 
+-		wqe->processed = 0;
+-		qp->irq_get++;
++	memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
++	wqe->wr_status = SIW_WR_QUEUED;
+ 
+-		/* mark current IRQ entry free */
+-		smp_store_mb(irqe->flags, 0);
++	/* First copy SQE to kernel private memory */
++	memcpy(&wqe->sqe, sqe, sizeof(*sqe));
+ 
++	if (wqe->sqe.opcode >= SIW_NUM_OPCODES) {
++		rv = -EINVAL;
+ 		goto out;
+ 	}
+-	sqe = sq_get_next(qp);
+-	if (sqe) {
+-skip_irq:
+-		memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
+-		wqe->wr_status = SIW_WR_QUEUED;
+-
+-		/* First copy SQE to kernel private memory */
+-		memcpy(&wqe->sqe, sqe, sizeof(*sqe));
+-
+-		if (wqe->sqe.opcode >= SIW_NUM_OPCODES) {
++	if (wqe->sqe.flags & SIW_WQE_INLINE) {
++		if (wqe->sqe.opcode != SIW_OP_SEND &&
++		    wqe->sqe.opcode != SIW_OP_WRITE) {
+ 			rv = -EINVAL;
+ 			goto out;
+ 		}
+-		if (wqe->sqe.flags & SIW_WQE_INLINE) {
+-			if (wqe->sqe.opcode != SIW_OP_SEND &&
+-			    wqe->sqe.opcode != SIW_OP_WRITE) {
+-				rv = -EINVAL;
+-				goto out;
+-			}
+-			if (wqe->sqe.sge[0].length > SIW_MAX_INLINE) {
+-				rv = -EINVAL;
+-				goto out;
+-			}
+-			wqe->sqe.sge[0].laddr = (uintptr_t)&wqe->sqe.sge[1];
+-			wqe->sqe.sge[0].lkey = 0;
+-			wqe->sqe.num_sge = 1;
++		if (wqe->sqe.sge[0].length > SIW_MAX_INLINE) {
++			rv = -EINVAL;
++			goto out;
+ 		}
+-		if (wqe->sqe.flags & SIW_WQE_READ_FENCE) {
+-			/* A READ cannot be fenced */
+-			if (unlikely(wqe->sqe.opcode == SIW_OP_READ ||
+-				     wqe->sqe.opcode ==
+-					     SIW_OP_READ_LOCAL_INV)) {
+-				siw_dbg_qp(qp, "cannot fence read\n");
+-				rv = -EINVAL;
+-				goto out;
+-			}
+-			spin_lock(&qp->orq_lock);
++		wqe->sqe.sge[0].laddr = (uintptr_t)&wqe->sqe.sge[1];
++		wqe->sqe.sge[0].lkey = 0;
++		wqe->sqe.num_sge = 1;
++	}
++	if (wqe->sqe.flags & SIW_WQE_READ_FENCE) {
++		/* A READ cannot be fenced */
++		if (unlikely(wqe->sqe.opcode == SIW_OP_READ ||
++			     wqe->sqe.opcode ==
++				     SIW_OP_READ_LOCAL_INV)) {
++			siw_dbg_qp(qp, "cannot fence read\n");
++			rv = -EINVAL;
++			goto out;
++		}
++		spin_lock(&qp->orq_lock);
+ 
+-			if (!siw_orq_empty(qp)) {
+-				qp->tx_ctx.orq_fence = 1;
+-				rv = 0;
+-			}
+-			spin_unlock(&qp->orq_lock);
++		if (qp->attrs.orq_size && !siw_orq_empty(qp)) {
++			qp->tx_ctx.orq_fence = 1;
++			rv = 0;
++		}
++		spin_unlock(&qp->orq_lock);
+ 
+-		} else if (wqe->sqe.opcode == SIW_OP_READ ||
+-			   wqe->sqe.opcode == SIW_OP_READ_LOCAL_INV) {
+-			struct siw_sqe *rreq;
++	} else if (wqe->sqe.opcode == SIW_OP_READ ||
++		   wqe->sqe.opcode == SIW_OP_READ_LOCAL_INV) {
++		struct siw_sqe *rreq;
+ 
+-			wqe->sqe.num_sge = 1;
++		if (unlikely(!qp->attrs.orq_size)) {
++			/* We negotiated not to send READ req's */
++			rv = -EINVAL;
++			goto out;
++		}
++		wqe->sqe.num_sge = 1;
+ 
+-			spin_lock(&qp->orq_lock);
++		spin_lock(&qp->orq_lock);
+ 
+-			rreq = orq_get_free(qp);
+-			if (rreq) {
+-				/*
+-				 * Make an immediate copy in ORQ to be ready
+-				 * to process loopback READ reply
+-				 */
+-				siw_read_to_orq(rreq, &wqe->sqe);
+-				qp->orq_put++;
+-			} else {
+-				qp->tx_ctx.orq_fence = 1;
+-				rv = 0;
+-			}
+-			spin_unlock(&qp->orq_lock);
++		rreq = orq_get_free(qp);
++		if (rreq) {
++			/*
++			 * Make an immediate copy in ORQ to be ready
++			 * to process loopback READ reply
++			 */
++			siw_read_to_orq(rreq, &wqe->sqe);
++			qp->orq_put++;
++		} else {
++			qp->tx_ctx.orq_fence = 1;
++			rv = 0;
+ 		}
+-
+-		/* Clear SQE, can be re-used by application */
+-		smp_store_mb(sqe->flags, 0);
+-		qp->sq_get++;
+-	} else {
+-		rv = 0;
++		spin_unlock(&qp->orq_lock);
+ 	}
++
++	/* Clear SQE, can be re-used by application */
++	smp_store_mb(sqe->flags, 0);
++	qp->sq_get++;
+ out:
+ 	if (unlikely(rv < 0)) {
+ 		siw_dbg_qp(qp, "error %d\n", rv);
+@@ -1014,6 +968,65 @@ out:
+ 	return rv;
+ }
+ 
++/*
++ * Must be called with SQ locked.
++ * To avoid complete SQ starvation by constant inbound READ requests,
++ * the active IRQ will not be served after qp->irq_burst, if the
++ * SQ has pending work.
++ */
++int siw_activate_tx(struct siw_qp *qp)
++{
++	struct siw_sqe *irqe;
++	struct siw_wqe *wqe = tx_wqe(qp);
++
++	if (!qp->attrs.irq_size)
++		return siw_activate_tx_from_sq(qp);
++
++	irqe = &qp->irq[qp->irq_get % qp->attrs.irq_size];
++
++	if (!(irqe->flags & SIW_WQE_VALID))
++		return siw_activate_tx_from_sq(qp);
++
++	/*
++	 * Avoid local WQE processing starvation in case
++	 * of constant inbound READ request stream
++	 */
++	if (sq_get_next(qp) && ++qp->irq_burst >= SIW_IRQ_MAXBURST_SQ_ACTIVE) {
++		qp->irq_burst = 0;
++		return siw_activate_tx_from_sq(qp);
++	}
++	memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
++	wqe->wr_status = SIW_WR_QUEUED;
++
++	/* start READ RESPONSE */
++	wqe->sqe.opcode = SIW_OP_READ_RESPONSE;
++	wqe->sqe.flags = 0;
++	if (irqe->num_sge) {
++		wqe->sqe.num_sge = 1;
++		wqe->sqe.sge[0].length = irqe->sge[0].length;
++		wqe->sqe.sge[0].laddr = irqe->sge[0].laddr;
++		wqe->sqe.sge[0].lkey = irqe->sge[0].lkey;
++	} else {
++		wqe->sqe.num_sge = 0;
++	}
++
++	/* Retain original RREQ's message sequence number for
++	 * potential error reporting cases.
++	 */
++	wqe->sqe.sge[1].length = irqe->sge[1].length;
++
++	wqe->sqe.rkey = irqe->rkey;
++	wqe->sqe.raddr = irqe->raddr;
++
++	wqe->processed = 0;
++	qp->irq_get++;
++
++	/* mark current IRQ entry free */
++	smp_store_mb(irqe->flags, 0);
++
++	return 1;
++}
++
+ /*
+  * Check if current CQ state qualifies for calling CQ completion
+  * handler. Must be called with CQ lock held.
+diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
+index 0520e70084f97..c7c38f7fd29d6 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
+@@ -680,6 +680,10 @@ static int siw_init_rresp(struct siw_qp *qp, struct siw_rx_stream *srx)
+ 	}
+ 	spin_lock_irqsave(&qp->sq_lock, flags);
+ 
++	if (unlikely(!qp->attrs.irq_size)) {
++		run_sq = 0;
++		goto error_irq;
++	}
+ 	if (tx_work->wr_status == SIW_WR_IDLE) {
+ 		/*
+ 		 * immediately schedule READ response w/o
+@@ -712,8 +716,9 @@ static int siw_init_rresp(struct siw_qp *qp, struct siw_rx_stream *srx)
+ 		/* RRESP now valid as current TX wqe or placed into IRQ */
+ 		smp_store_mb(resp->flags, SIW_WQE_VALID);
+ 	} else {
+-		pr_warn("siw: [QP %u]: irq %d exceeded %d\n", qp_id(qp),
+-			qp->irq_put % qp->attrs.irq_size, qp->attrs.irq_size);
++error_irq:
++		pr_warn("siw: [QP %u]: IRQ exceeded or null, size %d\n",
++			qp_id(qp), qp->attrs.irq_size);
+ 
+ 		siw_init_terminate(qp, TERM_ERROR_LAYER_RDMAP,
+ 				   RDMAP_ETYPE_REMOTE_OPERATION,
+@@ -740,6 +745,9 @@ static int siw_orqe_start_rx(struct siw_qp *qp)
+ 	struct siw_sqe *orqe;
+ 	struct siw_wqe *wqe = NULL;
+ 
++	if (unlikely(!qp->attrs.orq_size))
++		return -EPROTO;
++
+ 	/* make sure ORQ indices are current */
+ 	smp_mb();
+ 
+@@ -796,8 +804,8 @@ int siw_proc_rresp(struct siw_qp *qp)
+ 		 */
+ 		rv = siw_orqe_start_rx(qp);
+ 		if (rv) {
+-			pr_warn("siw: [QP %u]: ORQ empty at idx %d\n",
+-				qp_id(qp), qp->orq_get % qp->attrs.orq_size);
++			pr_warn("siw: [QP %u]: ORQ empty, size %d\n",
++				qp_id(qp), qp->attrs.orq_size);
+ 			goto error_term;
+ 		}
+ 		rv = siw_rresp_check_ntoh(srx, frx);
+@@ -1290,11 +1298,13 @@ static int siw_rdmap_complete(struct siw_qp *qp, int error)
+ 					      wc_status);
+ 		siw_wqe_put_mem(wqe, SIW_OP_READ);
+ 
+-		if (!error)
++		if (!error) {
+ 			rv = siw_check_tx_fence(qp);
+-		else
+-			/* Disable current ORQ eleement */
+-			WRITE_ONCE(orq_get_current(qp)->flags, 0);
++		} else {
++			/* Disable current ORQ element */
++			if (qp->attrs.orq_size)
++				WRITE_ONCE(orq_get_current(qp)->flags, 0);
++		}
+ 		break;
+ 
+ 	case RDMAP_RDMA_READ_REQ:
+diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
+index e7cd04eda04ac..424918eb1cd4a 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
+@@ -1107,8 +1107,8 @@ next_wqe:
+ 		/*
+ 		 * RREQ may have already been completed by inbound RRESP!
+ 		 */
+-		if (tx_type == SIW_OP_READ ||
+-		    tx_type == SIW_OP_READ_LOCAL_INV) {
++		if ((tx_type == SIW_OP_READ ||
++		     tx_type == SIW_OP_READ_LOCAL_INV) && qp->attrs.orq_size) {
+ 			/* Cleanup pending entry in ORQ */
+ 			qp->orq_put--;
+ 			qp->orq[qp->orq_put % qp->attrs.orq_size].flags = 0;
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 1b1a40db529c6..2c3704f0f10fa 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -387,13 +387,23 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ 	if (rv)
+ 		goto err_out;
+ 
++	num_sqe = attrs->cap.max_send_wr;
++	num_rqe = attrs->cap.max_recv_wr;
++
+ 	/* All queue indices are derived from modulo operations
+ 	 * on a free running 'get' (consumer) and 'put' (producer)
+ 	 * unsigned counter. Having queue sizes at power of two
+ 	 * avoids handling counter wrap around.
+ 	 */
+-	num_sqe = roundup_pow_of_two(attrs->cap.max_send_wr);
+-	num_rqe = roundup_pow_of_two(attrs->cap.max_recv_wr);
++	if (num_sqe)
++		num_sqe = roundup_pow_of_two(num_sqe);
++	else {
++		/* Zero sized SQ is not supported */
++		rv = -EINVAL;
++		goto err_out;
++	}
++	if (num_rqe)
++		num_rqe = roundup_pow_of_two(num_rqe);
+ 
+ 	if (qp->kernel_verbs)
+ 		qp->sendq = vzalloc(num_sqe * sizeof(struct siw_sqe));
+@@ -401,7 +411,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ 		qp->sendq = vmalloc_user(num_sqe * sizeof(struct siw_sqe));
+ 
+ 	if (qp->sendq == NULL) {
+-		siw_dbg(base_dev, "SQ size %d alloc failed\n", num_sqe);
+ 		rv = -ENOMEM;
+ 		goto err_out_xa;
+ 	}
+@@ -434,7 +443,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ 				vmalloc_user(num_rqe * sizeof(struct siw_rqe));
+ 
+ 		if (qp->recvq == NULL) {
+-			siw_dbg(base_dev, "RQ size %d alloc failed\n", num_rqe);
+ 			rv = -ENOMEM;
+ 			goto err_out_xa;
+ 		}
+@@ -982,9 +990,9 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr,
+ 	unsigned long flags;
+ 	int rv = 0;
+ 
+-	if (qp->srq) {
++	if (qp->srq || qp->attrs.rq_size == 0) {
+ 		*bad_wr = wr;
+-		return -EOPNOTSUPP; /* what else from errno.h? */
++		return -EINVAL;
+ 	}
+ 	if (!qp->kernel_verbs) {
+ 		siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n");
+-- 
+2.27.0
+
diff --git a/queue-5.4/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch b/queue-5.4/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch
new file mode 100644
index 00000000000..9b5e6fba369
--- /dev/null
+++ b/queue-5.4/regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch
@@ -0,0 +1,60 @@
+From d51dfad5590bdcd0d8f4aa5355185d240d62505b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:30 +0800
+Subject: regmap: sdw: use _no_pm functions in regmap_read/write
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit d288a5712ef961e16d588bbdb2d846e00b5ef154 ]
+
+sdw_update_slave_status will be invoked when a codec is attached,
+and the codec driver will initialize the codec with regmap functions
+while the codec device is pm_runtime suspended.
+
+regmap routines currently rely on regular SoundWire IO functions,
+which will call pm_runtime_get_sync()/put_autosuspend.
+
+This causes a deadlock where the resume routine waits for an
+initialization complete signal that while the initialization complete
+can only be reached when the resume completes.
+
+The only solution if we allow regmap functions to be used in resume
+operations as well as during codec initialization is to use _no_pm
+routines. The duty of making sure the bus is operational needs to be
+handled above the regmap level.
+
+Fixes: 7c22ce6e21840 ('regmap: Add SoundWire bus support')
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210122070634.12825-6-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-sdw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/regmap/regmap-sdw.c b/drivers/base/regmap/regmap-sdw.c
+index 50a66382d87d0..e75168b941d0c 100644
+--- a/drivers/base/regmap/regmap-sdw.c
++++ b/drivers/base/regmap/regmap-sdw.c
+@@ -12,7 +12,7 @@ static int regmap_sdw_write(void *context, unsigned int reg, unsigned int val)
+ 	struct device *dev = context;
+ 	struct sdw_slave *slave = dev_to_sdw_dev(dev);
+ 
+-	return sdw_write(slave, reg, val);
++	return sdw_write_no_pm(slave, reg, val);
+ }
+ 
+ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+@@ -21,7 +21,7 @@ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+ 	struct sdw_slave *slave = dev_to_sdw_dev(dev);
+ 	int read;
+ 
+-	read = sdw_read(slave, reg);
++	read = sdw_read_no_pm(slave, reg);
+ 	if (read < 0)
+ 		return read;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/regulator-axp20x-fix-reference-cout-leak.patch b/queue-5.4/regulator-axp20x-fix-reference-cout-leak.patch
new file mode 100644
index 00000000000..d043816abe2
--- /dev/null
+++ b/queue-5.4/regulator-axp20x-fix-reference-cout-leak.patch
@@ -0,0 +1,52 @@
+From 5215abf93fe69439b914769ed4b2fb8a5b7e70b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 04:33:13 -0800
+Subject: regulator: axp20x: Fix reference cout leak
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e78bf6be7edaacb39778f3a89416caddfc6c6d70 ]
+
+Decrements the reference count of device node and its child node.
+
+Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210120123313.107640-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/axp20x-regulator.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index aefc351bfed59..86a3c2dd05848 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -1072,7 +1072,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
+ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ {
+ 	struct device_node *np, *regulators;
+-	int ret;
++	int ret = 0;
+ 	u32 dcdcfreq = 0;
+ 
+ 	np = of_node_get(pdev->dev.parent->of_node);
+@@ -1087,13 +1087,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ 		ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
+ 		if (ret < 0) {
+ 			dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret);
+-			return ret;
+ 		}
+-
+ 		of_node_put(regulators);
+ 	}
+ 
+-	return 0;
++	of_node_put(np);
++	return ret;
+ }
+ 
+ static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode)
+-- 
+2.27.0
+
diff --git a/queue-5.4/regulator-core-avoid-debugfs-directory-.-already-pre.patch b/queue-5.4/regulator-core-avoid-debugfs-directory-.-already-pre.patch
new file mode 100644
index 00000000000..26e411deb63
--- /dev/null
+++ b/queue-5.4/regulator-core-avoid-debugfs-directory-.-already-pre.patch
@@ -0,0 +1,70 @@
+From 0fc651793a5641cfc9f9a5b622b2db1fe2f79cad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 19:32:50 +0100
+Subject: regulator: core: Avoid debugfs: Directory ... already present! error
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit dbe954d8f1635f949a1d9a5d6e6fb749ae022b47 ]
+
+Sometimes regulator_get() gets called twice for the same supply on the
+same device. This may happen e.g. when a framework / library is used
+which uses the regulator; and the driver itself also needs to enable
+the regulator in some cases where the framework will not enable it.
+
+Commit ff268b56ce8c ("regulator: core: Don't spew backtraces on
+duplicate sysfs") already takes care of the backtrace which would
+trigger when creating a duplicate consumer symlink under
+/sys/class/regulator/regulator.%d in this scenario.
+
+Commit c33d442328f5 ("debugfs: make error message a bit more verbose")
+causes a new error to get logged in this scenario:
+
+[   26.938425] debugfs: Directory 'wm5102-codec-MICVDD' with parent 'spi-WM510204:00-MICVDD' already present!
+
+There is no _nowarn variant of debugfs_create_dir(), but we can detect
+and avoid this problem by checking the return value of the earlier
+sysfs_create_link_nowarn() call.
+
+Add a check for the earlier sysfs_create_link_nowarn() failing with
+-EEXIST and skip the debugfs_create_dir() call in that case, avoiding
+this error getting logged.
+
+Fixes: c33d442328f5 ("debugfs: make error message a bit more verbose")
+Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20210122183250.370571-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 5b9d570df85cc..a31b6ae92a84e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1576,7 +1576,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ 					  const char *supply_name)
+ {
+ 	struct regulator *regulator;
+-	int err;
++	int err = 0;
+ 
+ 	if (dev) {
+ 		char buf[REG_STR_SIZE];
+@@ -1622,8 +1622,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ 		}
+ 	}
+ 
+-	regulator->debugfs = debugfs_create_dir(supply_name,
+-						rdev->debugfs);
++	if (err != -EEXIST)
++		regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
+ 	if (!regulator->debugfs) {
+ 		rdev_dbg(rdev, "Failed to create debugfs directory\n");
+ 	} else {
+-- 
+2.27.0
+
diff --git a/queue-5.4/regulator-qcom-rpmh-fix-pm8009-ldo7.patch b/queue-5.4/regulator-qcom-rpmh-fix-pm8009-ldo7.patch
new file mode 100644
index 00000000000..3b06be64000
--- /dev/null
+++ b/queue-5.4/regulator-qcom-rpmh-fix-pm8009-ldo7.patch
@@ -0,0 +1,37 @@
+From 99da608e8142cd8739ece72be458908068acfe11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 22:49:35 -0500
+Subject: regulator: qcom-rpmh: fix pm8009 ldo7
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 20ccc362c3d20da734af896e075b74222589f2c0 ]
+
+Use the correct name to avoid ldo7 commands being sent to ldo6's address.
+
+Fixes: 06369bcc15a1 ("regulator: qcom-rpmh: Add support for SM8150")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210211034935.5622-1-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index a47f87b8373df..68d22acdb037a 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -874,7 +874,7 @@ static const struct rpmh_vreg_init_data pm8009_vreg_data[] = {
+ 	RPMH_VREG("ldo4",   "ldo%s4",  &pmic5_nldo,      "vdd-l4"),
+ 	RPMH_VREG("ldo5",   "ldo%s5",  &pmic5_pldo,      "vdd-l5-l6"),
+ 	RPMH_VREG("ldo6",   "ldo%s6",  &pmic5_pldo,      "vdd-l5-l6"),
+-	RPMH_VREG("ldo7",   "ldo%s6",  &pmic5_pldo_lv,   "vdd-l7"),
++	RPMH_VREG("ldo7",   "ldo%s7",  &pmic5_pldo_lv,   "vdd-l7"),
+ 	{},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/regulator-s5m8767-drop-regulators-of-node-reference.patch b/queue-5.4/regulator-s5m8767-drop-regulators-of-node-reference.patch
new file mode 100644
index 00000000000..3e72326150d
--- /dev/null
+++ b/queue-5.4/regulator-s5m8767-drop-regulators-of-node-reference.patch
@@ -0,0 +1,49 @@
+From 6f7c3ec8f610c610f23c6919864d0dd76af06d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:59:14 +0100
+Subject: regulator: s5m8767: Drop regulators OF node reference
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit a5872bd3398d0ff2ce4c77794bc7837899c69024 ]
+
+The device node reference obtained with of_get_child_by_name() should be
+dropped on error paths.
+
+Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20210121155914.48034-1-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/s5m8767.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index ee0ed538e244f..5276f8442f3c6 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -544,14 +544,18 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+ 	rdata = devm_kcalloc(&pdev->dev,
+ 			     pdata->num_regulators, sizeof(*rdata),
+ 			     GFP_KERNEL);
+-	if (!rdata)
++	if (!rdata) {
++		of_node_put(regulators_np);
+ 		return -ENOMEM;
++	}
+ 
+ 	rmode = devm_kcalloc(&pdev->dev,
+ 			     pdata->num_regulators, sizeof(*rmode),
+ 			     GFP_KERNEL);
+-	if (!rmode)
++	if (!rmode) {
++		of_node_put(regulators_np);
+ 		return -ENOMEM;
++	}
+ 
+ 	pdata->regulators = rdata;
+ 	pdata->opmode = rmode;
+-- 
+2.27.0
+
diff --git a/queue-5.4/regulator-s5m8767-fix-reference-count-leak.patch b/queue-5.4/regulator-s5m8767-fix-reference-count-leak.patch
new file mode 100644
index 00000000000..a08acad27e9
--- /dev/null
+++ b/queue-5.4/regulator-s5m8767-fix-reference-count-leak.patch
@@ -0,0 +1,45 @@
+From 33fad1d8e04eea135ca9ac3f24b2f572547fed53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 19:27:56 -0800
+Subject: regulator: s5m8767: Fix reference count leak
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit dea6dd2ba63f8c8532addb8f32daf7b89a368a42 ]
+
+Call of_node_put() to drop references of regulators_np and reg_np before
+returning error code.
+
+Fixes: 9ae5cc75ceaa ("regulator: s5m8767: Pass descriptor instead of GPIO number")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20210121032756.49501-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/s5m8767.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 6ca27e9d5ef7d..ee0ed538e244f 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -574,10 +574,13 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+ 			0,
+ 			GPIOD_OUT_HIGH | GPIOD_FLAGS_BIT_NONEXCLUSIVE,
+ 			"s5m8767");
+-		if (PTR_ERR(rdata->ext_control_gpiod) == -ENOENT)
++		if (PTR_ERR(rdata->ext_control_gpiod) == -ENOENT) {
+ 			rdata->ext_control_gpiod = NULL;
+-		else if (IS_ERR(rdata->ext_control_gpiod))
++		} else if (IS_ERR(rdata->ext_control_gpiod)) {
++			of_node_put(reg_np);
++			of_node_put(regulators_np);
+ 			return PTR_ERR(rdata->ext_control_gpiod);
++		}
+ 
+ 		rdata->id = i;
+ 		rdata->initdata = of_get_regulator_init_data(
+-- 
+2.27.0
+
diff --git a/queue-5.4/rtc-s5m-select-regmap_i2c.patch b/queue-5.4/rtc-s5m-select-regmap_i2c.patch
new file mode 100644
index 00000000000..29a29315329
--- /dev/null
+++ b/queue-5.4/rtc-s5m-select-regmap_i2c.patch
@@ -0,0 +1,37 @@
+From eefce2d12ca013ed323e8b675d27a30921b04469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 11:22:17 +0100
+Subject: rtc: s5m: select REGMAP_I2C
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit 1f0cbda3b452b520c5f3794f8f0e410e8bc7386a ]
+
+The rtc-s5m uses the I2C regmap but doesn't select it in Kconfig so
+depending on the configuration the build may fail. Fix it.
+
+Fixes: 959df7778bbd ("rtc: Enable compile testing for Maxim and Samsung drivers")
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210114102219.23682-2-brgl@bgdev.pl
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index c5b9804140860..9ae7ce3f50696 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -683,6 +683,7 @@ config RTC_DRV_S5M
+ 	tristate "Samsung S2M/S5M series"
+ 	depends on MFD_SEC_CORE || COMPILE_TEST
+ 	select REGMAP_IRQ
++	select REGMAP_I2C
+ 	help
+ 	  If you say yes here you will get support for the
+ 	  RTC of Samsung S2MPS14 and S5M PMIC series.
+-- 
+2.27.0
+
diff --git a/queue-5.4/sched-eas-don-t-update-misfit-status-if-the-task-is-.patch b/queue-5.4/sched-eas-don-t-update-misfit-status-if-the-task-is-.patch
new file mode 100644
index 00000000000..4cc9789a394
--- /dev/null
+++ b/queue-5.4/sched-eas-don-t-update-misfit-status-if-the-task-is-.patch
@@ -0,0 +1,53 @@
+From 1a8030b4dd44ed4ba5d48457fda6d1a04d5bad4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 12:07:55 +0000
+Subject: sched/eas: Don't update misfit status if the task is pinned
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit 0ae78eec8aa64e645866e75005162603a77a0f49 ]
+
+If the task is pinned to a cpu, setting the misfit status means that
+we'll unnecessarily continuously attempt to migrate the task but fail.
+
+This continuous failure will cause the balance_interval to increase to
+a high value, and eventually cause unnecessary significant delays in
+balancing the system when real imbalance happens.
+
+Caught while testing uclamp where rt-app calibration loop was pinned to
+cpu 0, shortly after which we spawn another task with high util_clamp
+value. The task was failing to migrate after over 40ms of runtime due to
+balance_interval unnecessary expanded to a very high value from the
+calibration loop.
+
+Not done here, but it could be useful to extend the check for pinning to
+verify that the affinity of the task has a cpu that fits. We could end
+up in a similar situation otherwise.
+
+Fixes: 3b1baa6496e6 ("sched/fair: Add 'group_misfit_task' load-balance type")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Quentin Perret <qperret@google.com>
+Acked-by: Valentin Schneider <valentin.schneider@arm.com>
+Link: https://lkml.kernel.org/r/20210119120755.2425264-1-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 3dd7c10d6a582..611adca1e6d0c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3814,7 +3814,7 @@ static inline void update_misfit_status(struct task_struct *p, struct rq *rq)
+ 	if (!static_branch_unlikely(&sched_asym_cpucapacity))
+ 		return;
+ 
+-	if (!p) {
++	if (!p || p->nr_cpus_allowed == 1) {
+ 		rq->misfit_task_load = 0;
+ 		return;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch b/queue-5.4/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch
new file mode 100644
index 00000000000..aff71979387
--- /dev/null
+++ b/queue-5.4/scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch
@@ -0,0 +1,57 @@
+From a3ca607df36fef4ecb3566ada39c01dc99c858ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Feb 2021 11:24:28 -0800
+Subject: scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit eefb816acb0162e94a85a857f3a55148f671d5a5 ]
+
+CNIC depends on MMU, but since 'select' does not follow any dependency
+chains, SCSI_BNX2X_FCOE also needs to depend on MMU, so that erroneous
+configs are not generated, which cause build errors in cnic.
+
+WARNING: unmet direct dependencies detected for CNIC
+  Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && MMU [=n]
+  Selected by [y]:
+  - SCSI_BNX2X_FCOE [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && LIBFC [=y] && LIBFCOE [=y]
+
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L154':
+cnic.c:(.text+0x1094): undefined reference to `uio_event_notify'
+riscv64-linux-ld: cnic.c:(.text+0x10bc): undefined reference to `uio_event_notify'
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L1442':
+cnic.c:(.text+0x96a8): undefined reference to `__uio_register_device'
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L0 ':
+cnic.c:(.text.unlikely+0x68): undefined reference to `uio_unregister_device'
+
+Link: https://lore.kernel.org/r/20210213192428.22537-1-rdunlap@infradead.org
+Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver")
+Cc: Saurav Kashyap <skashyap@marvell.com>
+Cc: Javed Hasan <jhasan@marvell.com>
+Cc: GR-QLogic-Storage-Upstream@marvell.com
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: linux-scsi@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2fc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig
+index e0ccb48ec9617..40e9c9dc04bd8 100644
+--- a/drivers/scsi/bnx2fc/Kconfig
++++ b/drivers/scsi/bnx2fc/Kconfig
+@@ -5,6 +5,7 @@ config SCSI_BNX2X_FCOE
+ 	depends on (IPV6 || IPV6=n)
+ 	depends on LIBFC
+ 	depends on LIBFCOE
++	depends on MMU
+ 	select NETDEVICES
+ 	select ETHERNET
+ 	select NET_VENDOR_BROADCOM
+-- 
+2.27.0
+
diff --git a/queue-5.4/selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch b/queue-5.4/selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch
new file mode 100644
index 00000000000..5399ada591c
--- /dev/null
+++ b/queue-5.4/selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch
@@ -0,0 +1,42 @@
+From 4007eeb07d5c1e467a304b9415f27a05388e0950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 12:34:59 +0800
+Subject: selftests/powerpc: Make the test check in eeh-basic.sh posix
+ compliant
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 3db380570af7052620ace20c29e244938610ca71 ]
+
+The == operand is a bash extension, thus this will fail on Ubuntu
+with:
+  ./eeh-basic.sh: 89: test: 2: unexpected operator
+
+As the /bin/sh on Ubuntu is pointed to DASH.
+
+Use -eq to fix this posix compatibility issue.
+
+Fixes: 996f9e0f93f162 ("selftests/powerpc: Fix eeh-basic.sh exit codes")
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201228043459.14281-1-po-hsu.lin@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/eeh/eeh-basic.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
+index cf001a2c69420..7c2cb04569dab 100755
+--- a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
++++ b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
+@@ -81,5 +81,5 @@ echo "$failed devices failed to recover ($dev_count tested)"
+ lspci | diff -u $pre_lspci -
+ rm -f $pre_lspci
+ 
+-test "$failed" == 0
++test "$failed" -eq 0
+ exit $?
+-- 
+2.27.0
+
diff --git a/queue-5.4/series b/queue-5.4/series
index 507089936b3..64cc51581fc 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -10,3 +10,225 @@ bfq-avoid-false-bfq-queue-merging.patch
 alsa-usb-audio-fix-pcm-buffer-allocation-in-non-vmalloc-mode.patch
 mips-vmlinux.lds.s-add-missing-page_aligned_data-section.patch
 random-fix-the-rndreseedcrng-ioctl.patch
+ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch
+bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch
+bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
+bluetooth-fix-initializing-response-id-after-clearin.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-17107
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-15427
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-3724
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18208
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-4737
+arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch
+arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-21413
+memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch
+bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch
+bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch
+arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch
+arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch
+arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch
+arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch
+arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch
+cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch
+cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch
+acpica-fix-exception-code-class-checks.patch
+usb-gadget-u_audio-free-requests-only-after-callback.patch
+bluetooth-drop-hci-device-reference-before-return.patch
+bluetooth-put-hci-device-if-inquiry-procedure-interr.patch
+memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch
+arm-dts-configure-missing-thermal-interrupt-for-4430.patch
+usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch
+usb-dwc2-abort-transaction-after-errors-with-unknown.patch
+usb-dwc2-make-trimming-xfer-length-a-debug-message.patch
+staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch
+arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch
+arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch
+arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch
+bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch
+arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch
+arm-s3c-fix-fiq-for-clang-ias.patch
+soc-aspeed-snoop-add-clock-control-logic.patch
+bpf_lru_list-read-double-checked-variable-once-witho.patch
+ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch
+ibmvnic-set-to-closed-state-even-on-error.patch
+bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch
+xen-netback-fix-spurious-event-detection-for-common-.patch
+mac80211-fix-potential-overflow-when-multiplying-to-.patch
+bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch
+tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch
+net-axienet-handle-deferred-probe-on-clock-properly.patch
+cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch
+b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch
+ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch
+ibmvnic-skip-send_request_unmap-for-timeout-reset.patch
+net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch
+net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch
+net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch
+net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch
+net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch
+fbdev-aty-sparc64-requires-fb_aty_ct.patch
+drm-gma500-fix-error-return-code-in-psb_driver_load.patch
+gma500-clean-up-error-handling-in-init.patch
+drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch
+crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch
+crypto-sun4i-ss-fix-kmap-usage.patch
+crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch
+drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch
+mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch
+mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch
+media-i2c-ov5670-fix-pixel_rate-minimum-value.patch
+media-imx-unregister-csc-scaler-only-if-registered.patch
+media-imx-fix-csc-scaler-unregister.patch
+media-camss-missing-error-code-in-msm_video_register.patch
+media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch
+media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch
+media-media-pci-fix-memleak-in-empress_init.patch
+media-tm6000-fix-memleak-in-tm6000_start_stream.patch
+media-aspeed-fix-error-return-code-in-aspeed_video_s.patch
+asoc-cs42l56-fix-up-error-handling-in-probe.patch
+evm-fix-memleak-in-init_desc.patch
+crypto-bcm-rename-struct-device_private-to-bcm_devic.patch
+drm-sun4i-tcon-fix-inverted-dclk-polarity.patch
+mips-properly-stop-.eh_frame-generation.patch
+bsg-free-the-request-before-return-error-code.patch
+drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch
+drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch
+media-software_node-fix-refcounts-in-software_node_g.patch
+media-lmedm04-fix-misuse-of-comma.patch
+media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch
+media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch
+media-pxa_camera-declare-variable-when-debug-is-defi.patch
+media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch
+sched-eas-don-t-update-misfit-status-if-the-task-is-.patch
+mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch
+crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch
+drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch
+ata-ahci_brcm-add-back-regulators-management.patch
+asoc-cpcap-fix-microphone-timeslot-mask.patch
+mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch
+f2fs-fix-to-avoid-inconsistent-quota-data.patch
+drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch
+f2fs-fix-a-wrong-condition-in-__submit_bio.patch
+drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch
+asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch
+btrfs-clarify-error-returns-values-in-__load_free_sp.patch
+hwrng-timeriomem-fix-cooldown-period-calculation.patch
+crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch
+ima-free-ima-measurement-buffer-on-error.patch
+ima-free-ima-measurement-buffer-after-kexec-syscall.patch
+asoc-simple-card-utils-fix-device-module-clock.patch
+fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch
+jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch
+ubifs-fix-memleak-in-ubifs_init_authentication.patch
+ubifs-fix-error-return-code-in-alloc_wbufs.patch
+capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch
+hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch
+clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch
+clk-meson-clk-pll-make-ret-a-signed-integer.patch
+clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch
+selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch
+quota-fix-memory-leak-when-handling-corrupted-quota-.patch
+i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch
+i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch
+i2c-iproc-handle-master-read-request.patch
+spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch
+clk-sunxi-ng-h6-fix-cec-clock.patch
+hid-core-detect-and-skip-invalid-inputs-to-snto32.patch
+rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch
+dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch
+dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch
+dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch
+dmaengine-hsu-disable-spurious-interrupt.patch
+mfd-bd9571mwv-use-devm_mfd_add_devices.patch
+fdt-properly-handle-no-map-field-in-the-memory-regio.patch
+of-fdt-make-sure-no-map-does-not-remove-already-rese.patch
+power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch
+rtc-s5m-select-regmap_i2c.patch
+clocksource-drivers-ixp4xx-select-timer_of-when-need.patch
+clocksource-drivers-mxs_timer-add-missing-semicolon-.patch
+rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch
+clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch
+regulator-axp20x-fix-reference-cout-leak.patch
+certs-fix-blacklist-flag-type-confusion.patch
+regulator-s5m8767-fix-reference-count-leak.patch
+spi-atmel-put-allocated-master-before-return.patch
+regulator-s5m8767-drop-regulators-of-node-reference.patch
+regulator-core-avoid-debugfs-directory-.-already-pre.patch
+isofs-release-buffer-head-before-return.patch
+auxdisplay-ht16k33-fix-refresh-rate-handling.patch
+objtool-fix-error-handling-for-std-cld-warnings.patch
+objtool-fix-.cold-section-suffix-check-for-newer-ver.patch
+ib-umad-return-eio-in-case-of-when-device-disassocia.patch
+ib-umad-return-epollerr-in-case-of-when-device-disas.patch
+kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch
+powerpc-47x-disable-256k-page-size.patch
+powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch
+mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch
+mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch
+mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch
+arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch
+i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch
+i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch
+amba-fix-resource-leak-for-drivers-without-.remove.patch
+ib-mlx5-return-appropriate-error-code-instead-of-eno.patch
+ib-cm-avoid-a-loop-when-device-has-255-ports.patch
+tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch
+perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch
+perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch
+rdma-rxe-fix-coding-error-in-rxe_recv.c.patch
+rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch
+rdma-rxe-correct-skb-on-loopback-path.patch
+spi-stm32-properly-handle-0-byte-transfer.patch
+mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch
+powerpc-pseries-dlpar-handle-ibm-configure-connector.patch
+powerpc-8xx-fix-software-emulation-interrupt.patch
+clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch
+rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch
+rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch
+rdma-hns-fix-type-of-sq_signal_bits.patch
+spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch
+regulator-qcom-rpmh-fix-pm8009-ldo7.patch
+clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch
+nfsd-register-pernet-ops-last-unregister-first.patch
+rdma-hns-fixes-missing-error-code-of-cmdq.patch
+input-sur40-fix-an-error-code-in-sur40_probe.patch
+perf-intel-pt-fix-missing-cyc-processing-in-psb.patch
+perf-intel-pt-fix-premature-ipc.patch
+perf-test-fix-unaligned-access-in-sample-parsing-tes.patch
+input-elo-fix-an-error-code-in-elo_connect.patch
+sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch
+misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch
+phy-rockchip-emmc-emmc_phy_init-always-return-0.patch
+misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch
+soundwire-cadence-fix-ack-nak-handling.patch
+pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch
+vmci-use-set_page_dirty_lock-when-unregistering-gues.patch
+pci-align-checking-of-syscall-user-config-accessors.patch
+mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch
+drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch
+drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch
+vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch
+ext4-fix-potential-htree-index-checksum-corruption.patch
+nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch
+nvmem-core-skip-child-nodes-not-matching-binding.patch
+regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch
+i40e-fix-flow-for-ipv6-next-header-extension-header.patch
+i40e-add-zero-initialization-of-aq-command-structure.patch
+i40e-fix-overwriting-flow-control-settings-during-dr.patch
+i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch
+i40e-fix-vfs-not-created.patch
+take-mmap-lock-in-cacheflush-syscall.patch
+i40e-fix-add-tc-filter-for-ipv6.patch
+vfio-type1-use-follow_pte.patch
+net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch
+vxlan-move-debug-check-after-netdev-unregister.patch
+ocfs2-fix-a-use-after-free-on-error.patch
+mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch
+mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch
+mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch
+r8169-fix-jumbo-packet-handling-on-rtl8168e.patch
+arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch
+i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch
+mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
+scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch
diff --git a/queue-5.4/soc-aspeed-snoop-add-clock-control-logic.patch b/queue-5.4/soc-aspeed-snoop-add-clock-control-logic.patch
new file mode 100644
index 00000000000..785da9d579a
--- /dev/null
+++ b/queue-5.4/soc-aspeed-snoop-add-clock-control-logic.patch
@@ -0,0 +1,110 @@
+From 68650a321e0daf06fb997da2a9757c5667565499 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 17:17:47 +0800
+Subject: soc: aspeed: snoop: Add clock control logic
+
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+
+[ Upstream commit 3f94cf15583be554df7aaa651b8ff8e1b68fbe51 ]
+
+If LPC SNOOP driver is registered ahead of lpc-ctrl module, LPC
+SNOOP block will be enabled without heart beating of LCLK until
+lpc-ctrl enables the LCLK. This issue causes improper handling on
+host interrupts when the host sends interrupt in that time frame.
+Then kernel eventually forcibly disables the interrupt with
+dumping stack and printing a 'nobody cared this irq' message out.
+
+To prevent this issue, all LPC sub-nodes should enable LCLK
+individually so this patch adds clock control logic into the LPC
+SNOOP driver.
+
+Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
+Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201208091748.1920-1-wangzhiqiang.bj@bytedance.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-lpc-snoop.c | 30 ++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+index f3d8d53ab84de..dbe5325a324d5 100644
+--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
++++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include <linux/bitops.h>
++#include <linux/clk.h>
+ #include <linux/interrupt.h>
+ #include <linux/fs.h>
+ #include <linux/kfifo.h>
+@@ -67,6 +68,7 @@ struct aspeed_lpc_snoop_channel {
+ struct aspeed_lpc_snoop {
+ 	struct regmap		*regmap;
+ 	int			irq;
++	struct clk		*clk;
+ 	struct aspeed_lpc_snoop_channel chan[NUM_SNOOP_CHANNELS];
+ };
+ 
+@@ -282,22 +284,42 @@ static int aspeed_lpc_snoop_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
++	lpc_snoop->clk = devm_clk_get(dev, NULL);
++	if (IS_ERR(lpc_snoop->clk)) {
++		rc = PTR_ERR(lpc_snoop->clk);
++		if (rc != -EPROBE_DEFER)
++			dev_err(dev, "couldn't get clock\n");
++		return rc;
++	}
++	rc = clk_prepare_enable(lpc_snoop->clk);
++	if (rc) {
++		dev_err(dev, "couldn't enable clock\n");
++		return rc;
++	}
++
+ 	rc = aspeed_lpc_snoop_config_irq(lpc_snoop, pdev);
+ 	if (rc)
+-		return rc;
++		goto err;
+ 
+ 	rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 0, port);
+ 	if (rc)
+-		return rc;
++		goto err;
+ 
+ 	/* Configuration of 2nd snoop channel port is optional */
+ 	if (of_property_read_u32_index(dev->of_node, "snoop-ports",
+ 				       1, &port) == 0) {
+ 		rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 1, port);
+-		if (rc)
++		if (rc) {
+ 			aspeed_lpc_disable_snoop(lpc_snoop, 0);
++			goto err;
++		}
+ 	}
+ 
++	return 0;
++
++err:
++	clk_disable_unprepare(lpc_snoop->clk);
++
+ 	return rc;
+ }
+ 
+@@ -309,6 +331,8 @@ static int aspeed_lpc_snoop_remove(struct platform_device *pdev)
+ 	aspeed_lpc_disable_snoop(lpc_snoop, 0);
+ 	aspeed_lpc_disable_snoop(lpc_snoop, 1);
+ 
++	clk_disable_unprepare(lpc_snoop->clk);
++
+ 	return 0;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/soundwire-cadence-fix-ack-nak-handling.patch b/queue-5.4/soundwire-cadence-fix-ack-nak-handling.patch
new file mode 100644
index 00000000000..01ef3df1f38
--- /dev/null
+++ b/queue-5.4/soundwire-cadence-fix-ack-nak-handling.patch
@@ -0,0 +1,54 @@
+From 1d91a85c084a096b4ff70eaa1e22704d106c480f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:37:37 +0800
+Subject: soundwire: cadence: fix ACK/NAK handling
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit db9d9f944f95e7f3aa60ac00cbd502415152c421 ]
+
+The existing code reports a NAK only when ACK=0
+This is not aligned with the SoundWire 1.x specifications.
+
+Table 32 in the SoundWire 1.2 specification shows that a Device shall
+not set NAK=1 if ACK=1. But Table 33 shows the Combined Response
+may very well be NAK=1/ACK=1, e.g. if another Device than the one
+addressed reports a parity error.
+
+NAK=1 signals a 'Command_Aborted', regardless of the ACK bit value.
+
+Move the tests for NAK so that the NAK=1/ACK=1 combination is properly
+detected according to the specification.
+
+Fixes: 956baa1992f9a ('soundwire: cdns: Add sdw_master_ops and IO transfer support')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115053738.22630-5-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index e3d06330d1258..f7d0f63921dc2 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -368,10 +368,10 @@ cdns_fill_msg_resp(struct sdw_cdns *cdns,
+ 		if (!(cdns->response_buf[i] & CDNS_MCP_RESP_ACK)) {
+ 			no_ack = 1;
+ 			dev_dbg_ratelimited(cdns->dev, "Msg Ack not received\n");
+-			if (cdns->response_buf[i] & CDNS_MCP_RESP_NACK) {
+-				nack = 1;
+-				dev_err_ratelimited(cdns->dev, "Msg NACK received\n");
+-			}
++		}
++		if (cdns->response_buf[i] & CDNS_MCP_RESP_NACK) {
++			nack = 1;
++			dev_err_ratelimited(cdns->dev, "Msg NACK received\n");
+ 		}
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch b/queue-5.4/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch
new file mode 100644
index 00000000000..b76202f00b2
--- /dev/null
+++ b/queue-5.4/sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch
@@ -0,0 +1,47 @@
+From 7f7de8cfa2b370c1aebb0cfcf5883b2dd57cfb7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 16:40:11 -0800
+Subject: sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 80bddf5c93a99e11fc9faf7e4b575d01cecd45d3 ]
+
+Currently COMPAT on SPARC64 selects COMPAT_BINFMT_ELF unconditionally,
+even when BINFMT_ELF is not enabled. This causes a kconfig warning.
+
+Instead, just select COMPAT_BINFMT_ELF if BINFMT_ELF is enabled.
+This builds cleanly with no kconfig warnings.
+
+WARNING: unmet direct dependencies detected for COMPAT_BINFMT_ELF
+  Depends on [n]: COMPAT [=y] && BINFMT_ELF [=n]
+  Selected by [y]:
+  - COMPAT [=y] && SPARC64 [=y]
+
+Fixes: 26b4c912185a ("sparc,sparc64: unify Kconfig files")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: sparclinux@vger.kernel.org
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 18e9fb6fcf1bf..349e27771ceaf 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -524,7 +524,7 @@ config COMPAT
+ 	bool
+ 	depends on SPARC64
+ 	default y
+-	select COMPAT_BINFMT_ELF
++	select COMPAT_BINFMT_ELF if BINFMT_ELF
+ 	select HAVE_UID16
+ 	select ARCH_WANT_OLD_COMPAT_IPC
+ 	select COMPAT_OLD_SIGACTION
+-- 
+2.27.0
+
diff --git a/queue-5.4/spi-atmel-put-allocated-master-before-return.patch b/queue-5.4/spi-atmel-put-allocated-master-before-return.patch
new file mode 100644
index 00000000000..fdd5c8b290a
--- /dev/null
+++ b/queue-5.4/spi-atmel-put-allocated-master-before-return.patch
@@ -0,0 +1,39 @@
+From 813e3b411701569829e0a83d7e0f05048e09b231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 21:00:25 -0800
+Subject: spi: atmel: Put allocated master before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 21ea2743f015dbacec1831bdc8afc848db9c2b8c ]
+
+The allocated master is not released. Goto error handling label rather
+than directly return.
+
+Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring")
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20210120050025.25426-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-atmel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index abbc1582f457e..d9711ea5b01d3 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1569,7 +1569,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
+ 		if (ret == 0) {
+ 			as->use_dma = true;
+ 		} else if (ret == -EPROBE_DEFER) {
+-			return ret;
++			goto out_unmap_regs;
+ 		}
+ 	} else if (as->caps.has_pdc_support) {
+ 		as->use_pdc = true;
+-- 
+2.27.0
+
diff --git a/queue-5.4/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch b/queue-5.4/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch
new file mode 100644
index 00000000000..7e892ad75c4
--- /dev/null
+++ b/queue-5.4/spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch
@@ -0,0 +1,41 @@
+From 5cf86d335afe6e63edd0b0787df949394e9e27e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 00:14:20 +0530
+Subject: spi: cadence-quadspi: Abort read if dummy cycles required are too
+ many
+
+From: Pratyush Yadav <p.yadav@ti.com>
+
+[ Upstream commit ceeda328edeeeeac7579e9dbf0610785a3b83d39 ]
+
+The controller can only support up to 31 dummy cycles. If the command
+requires more it falls back to using 31. This command is likely to fail
+because the correct number of cycles are not waited upon. Rather than
+silently issuing an incorrect command, fail loudly so the caller can get
+a chance to find out the command can't be supported by the controller.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
+Link: https://lore.kernel.org/r/20201222184425.7028-3-p.yadav@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 7bef63947b29f..97a5e1eaeefdf 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -475,7 +475,7 @@ static int cqspi_read_setup(struct spi_nor *nor)
+ 	/* Setup dummy clock cycles */
+ 	dummy_clk = nor->read_dummy;
+ 	if (dummy_clk > CQSPI_DUMMY_CLKS_MAX)
+-		dummy_clk = CQSPI_DUMMY_CLKS_MAX;
++		return -EOPNOTSUPP;
+ 
+ 	if (dummy_clk / 8) {
+ 		reg |= (1 << CQSPI_REG_RD_INSTR_MODE_EN_LSB);
+-- 
+2.27.0
+
diff --git a/queue-5.4/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch b/queue-5.4/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch
new file mode 100644
index 00000000000..1cf4fe8471b
--- /dev/null
+++ b/queue-5.4/spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch
@@ -0,0 +1,87 @@
+From 7488e7546827239c22b2d15e071bd2f66a275c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 18:38:15 +0200
+Subject: spi: pxa2xx: Fix the controller numbering for Wildcat Point
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 54c5d3bfb0cfb7b31259765524567871dee11615 ]
+
+Wildcat Point has two SPI controllers and added one is actually second one.
+Fix the numbering by adding the description of the first one.
+
+Fixes: caba248db286 ("spi: spi-pxa2xx-pci: Add ID and driver type for WildcatPoint PCH")
+Cc: Leif Liddy <leif.liddy@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210208163816.22147-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx-pci.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index f236e3034cf85..aafac128bb5f1 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -21,7 +21,8 @@ enum {
+ 	PORT_BSW1,
+ 	PORT_BSW2,
+ 	PORT_CE4100,
+-	PORT_LPT,
++	PORT_LPT0,
++	PORT_LPT1,
+ };
+ 
+ struct pxa_spi_info {
+@@ -57,8 +58,10 @@ static struct dw_dma_slave bsw1_rx_param = { .src_id = 7 };
+ static struct dw_dma_slave bsw2_tx_param = { .dst_id = 8 };
+ static struct dw_dma_slave bsw2_rx_param = { .src_id = 9 };
+ 
+-static struct dw_dma_slave lpt_tx_param = { .dst_id = 0 };
+-static struct dw_dma_slave lpt_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt1_tx_param = { .dst_id = 0 };
++static struct dw_dma_slave lpt1_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt0_tx_param = { .dst_id = 2 };
++static struct dw_dma_slave lpt0_rx_param = { .src_id = 3 };
+ 
+ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ {
+@@ -185,12 +188,19 @@ static struct pxa_spi_info spi_info_configs[] = {
+ 		.num_chipselect = 1,
+ 		.max_clk_rate = 50000000,
+ 	},
+-	[PORT_LPT] = {
++	[PORT_LPT0] = {
+ 		.type = LPSS_LPT_SSP,
+ 		.port_id = 0,
+ 		.setup = lpss_spi_setup,
+-		.tx_param = &lpt_tx_param,
+-		.rx_param = &lpt_rx_param,
++		.tx_param = &lpt0_tx_param,
++		.rx_param = &lpt0_rx_param,
++	},
++	[PORT_LPT1] = {
++		.type = LPSS_LPT_SSP,
++		.port_id = 1,
++		.setup = lpss_spi_setup,
++		.tx_param = &lpt1_tx_param,
++		.rx_param = &lpt1_rx_param,
+ 	},
+ };
+ 
+@@ -285,8 +295,9 @@ static const struct pci_device_id pxa2xx_spi_pci_devices[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x2290), PORT_BSW1 },
+ 	{ PCI_VDEVICE(INTEL, 0x22ac), PORT_BSW2 },
+ 	{ PCI_VDEVICE(INTEL, 0x2e6a), PORT_CE4100 },
+-	{ PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT },
+-	{ },
++	{ PCI_VDEVICE(INTEL, 0x9ce5), PORT_LPT0 },
++	{ PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT1 },
++	{ }
+ };
+ MODULE_DEVICE_TABLE(pci, pxa2xx_spi_pci_devices);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/spi-stm32-properly-handle-0-byte-transfer.patch b/queue-5.4/spi-stm32-properly-handle-0-byte-transfer.patch
new file mode 100644
index 00000000000..569ffb08462
--- /dev/null
+++ b/queue-5.4/spi-stm32-properly-handle-0-byte-transfer.patch
@@ -0,0 +1,39 @@
+From 8b0ed6e637756e20385bad6e29733da883bb85a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:59:25 +0100
+Subject: spi: stm32: properly handle 0 byte transfer
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 2269f5a8b1a7b38651d62676b98182828f29d11a ]
+
+On 0 byte transfer request, return straight from the
+xfer function after finalizing the transfer.
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1612551572-495-2-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 77ddf23b65d65..8622cf9d3f640 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1668,6 +1668,10 @@ static int stm32_spi_transfer_one(struct spi_master *master,
+ 	struct stm32_spi *spi = spi_master_get_devdata(master);
+ 	int ret;
+ 
++	/* Don't do anything on 0 bytes transfers */
++	if (transfer->len == 0)
++		return 0;
++
+ 	spi->tx_buf = transfer->tx_buf;
+ 	spi->rx_buf = transfer->rx_buf;
+ 	spi->tx_len = spi->tx_buf ? transfer->len : 0;
+-- 
+2.27.0
+
diff --git a/queue-5.4/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch b/queue-5.4/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch
new file mode 100644
index 00000000000..1a1de2b9552
--- /dev/null
+++ b/queue-5.4/staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch
@@ -0,0 +1,93 @@
+From 2bf04ab84a81e45c937c79461ac00d3b8a2f3058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 22:14:01 +0800
+Subject: staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory
+ rules
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 61834c967a929f6b4b7fcb91f43fa225cc29aa19 ]
+
+The custom regulatory ruleset in the rtl8723bs driver lists an incorrect
+number of rules: one too many. This results in an out-of-bounds access,
+as detected by KASAN. This was possible thanks to the newly added support
+for KASAN on ARMv7.
+
+Fix this by filling in the correct number of rules given.
+
+KASAN report:
+
+==================================================================
+BUG: KASAN: global-out-of-bounds in cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211]
+Read of size 4 at addr bf20c254 by task ip/971
+
+CPU: 2 PID: 971 Comm: ip Tainted: G         C        5.11.0-rc2-00020-gf7fe528a7ebe #1
+Hardware name: Allwinner sun8i Family
+[<c0113338>] (unwind_backtrace) from [<c010e8a4>] (show_stack+0x10/0x14)
+[<c010e8a4>] (show_stack) from [<c0e0f868>] (dump_stack+0x9c/0xb4)
+[<c0e0f868>] (dump_stack) from [<c0388284>] (print_address_description.constprop.2+0x1dc/0x2dc)
+[<c0388284>] (print_address_description.constprop.2) from [<c03885cc>] (kasan_report+0x1a8/0x1c4)
+[<c03885cc>] (kasan_report) from [<bf00a354>] (cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211])
+[<bf00a354>] (cfg80211_does_bw_fit_range [cfg80211]) from [<bf00b41c>] (freq_reg_info_regd.part.6+0x108/0x124 [>
+[<bf00b41c>] (freq_reg_info_regd.part.6 [cfg80211]) from [<bf00df00>] (handle_channel_custom.constprop.12+0x48/>
+[<bf00df00>] (handle_channel_custom.constprop.12 [cfg80211]) from [<bf00e150>] (wiphy_apply_custom_regulatory+0>
+[<bf00e150>] (wiphy_apply_custom_regulatory [cfg80211]) from [<bf1fb9e8>] (rtw_regd_init+0x60/0x70 [r8723bs])
+[<bf1fb9e8>] (rtw_regd_init [r8723bs]) from [<bf1ee5a8>] (rtw_cfg80211_init_wiphy+0x164/0x1e8 [r8723bs])
+[<bf1ee5a8>] (rtw_cfg80211_init_wiphy [r8723bs]) from [<bf1f8d50>] (_netdev_open+0xe4/0x28c [r8723bs])
+[<bf1f8d50>] (_netdev_open [r8723bs]) from [<bf1f8f58>] (netdev_open+0x60/0x88 [r8723bs])
+[<bf1f8f58>] (netdev_open [r8723bs]) from [<c0bb3730>] (__dev_open+0x178/0x220)
+[<c0bb3730>] (__dev_open) from [<c0bb3cdc>] (__dev_change_flags+0x258/0x2c4)
+[<c0bb3cdc>] (__dev_change_flags) from [<c0bb3d88>] (dev_change_flags+0x40/0x80)
+[<c0bb3d88>] (dev_change_flags) from [<c0bc86fc>] (do_setlink+0x538/0x1160)
+[<c0bc86fc>] (do_setlink) from [<c0bcf9e8>] (__rtnl_newlink+0x65c/0xad8)
+[<c0bcf9e8>] (__rtnl_newlink) from [<c0bcfeb0>] (rtnl_newlink+0x4c/0x6c)
+[<c0bcfeb0>] (rtnl_newlink) from [<c0bc67c8>] (rtnetlink_rcv_msg+0x1f8/0x454)
+[<c0bc67c8>] (rtnetlink_rcv_msg) from [<c0c330e4>] (netlink_rcv_skb+0xc4/0x1e0)
+[<c0c330e4>] (netlink_rcv_skb) from [<c0c32478>] (netlink_unicast+0x2c8/0x3c4)
+[<c0c32478>] (netlink_unicast) from [<c0c32894>] (netlink_sendmsg+0x320/0x5f0)
+[<c0c32894>] (netlink_sendmsg) from [<c0b75eb0>] (____sys_sendmsg+0x320/0x3e0)
+[<c0b75eb0>] (____sys_sendmsg) from [<c0b78394>] (___sys_sendmsg+0xe8/0x12c)
+[<c0b78394>] (___sys_sendmsg) from [<c0b78a50>] (__sys_sendmsg+0xc0/0x120)
+[<c0b78a50>] (__sys_sendmsg) from [<c0100060>] (ret_fast_syscall+0x0/0x58)
+Exception stack(0xc5693fa8 to 0xc5693ff0)
+3fa0:                   00000074 c7a39800 00000003 b6cee648 00000000 00000000
+3fc0: 00000074 c7a39800 00000001 00000128 78d18349 00000000 b6ceeda0 004f7cb0
+3fe0: 00000128 b6cee5e8 aeca151f aec1d746
+
+The buggy address belongs to the variable:
+ rtw_drv_halt+0xf908/0x6b4 [r8723bs]
+
+Memory state around the buggy address:
+ bf20c100: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
+ bf20c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>bf20c200: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
+                                         ^
+ bf20c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ bf20c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+==================================================================
+
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20210108141401.31741-1-wens@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+index 578b9f734231e..65592bf84f380 100644
+--- a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
++++ b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+@@ -34,7 +34,7 @@
+ 	NL80211_RRF_PASSIVE_SCAN)
+ 
+ static const struct ieee80211_regdomain rtw_regdom_rd = {
+-	.n_reg_rules = 3,
++	.n_reg_rules = 2,
+ 	.alpha2 = "99",
+ 	.reg_rules = {
+ 		RTW_2GHZ_CH01_11,
+-- 
+2.27.0
+
diff --git a/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch b/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch
new file mode 100644
index 00000000000..93cf6065b76
--- /dev/null
+++ b/queue-5.4/take-mmap-lock-in-cacheflush-syscall.patch
@@ -0,0 +1,61 @@
+From 3cc567f67f91469d57e4777720b585e4b8cd0f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 14:59:35 +0800
+Subject: Take mmap lock in cacheflush syscall
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ]
+
+We need to take the mmap lock around find_vma() and subsequent use of the
+VMA. Otherwise, we can race with concurrent operations like munmap(), which
+can lead to use-after-free accesses to freed VMAs.
+
+Fixes: 1000197d8013 ("nios2: System calls handling")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/sys_nios2.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c
+index cd390ec4f88bf..b1ca856999521 100644
+--- a/arch/nios2/kernel/sys_nios2.c
++++ b/arch/nios2/kernel/sys_nios2.c
+@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
+ 				unsigned int op)
+ {
+ 	struct vm_area_struct *vma;
++	struct mm_struct *mm = current->mm;
+ 
+ 	if (len == 0)
+ 		return 0;
+@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
+ 	if (addr + len < addr)
+ 		return -EFAULT;
+ 
++	if (mmap_read_lock_killable(mm))
++		return -EINTR;
++
+ 	/*
+ 	 * Verify that the specified address region actually belongs
+ 	 * to this process.
+ 	 */
+-	vma = find_vma(current->mm, addr);
+-	if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end)
++	vma = find_vma(mm, addr);
++	if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) {
++		mmap_read_unlock(mm);
+ 		return -EFAULT;
++	}
+ 
+ 	flush_cache_range(vma, addr, addr + len);
+ 
++	mmap_read_unlock(mm);
+ 	return 0;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch b/queue-5.4/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch
new file mode 100644
index 00000000000..a9be8936ff5
--- /dev/null
+++ b/queue-5.4/tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch
@@ -0,0 +1,67 @@
+From d2a42973008a8853cabbcc316fb34d8f47503218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 15:22:13 -0800
+Subject: tcp: fix SO_RCVLOWAT related hangs under mem pressure
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f969dc5a885736842c3511ecdea240fbb02d25d9 ]
+
+While commit 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
+fixed an issue vs too small sk_rcvbuf for given sk_rcvlowat constraint,
+it missed to address issue caused by memory pressure.
+
+1) If we are under memory pressure and socket receive queue is empty.
+First incoming packet is allowed to be queued, after commit
+76dfa6082032 ("tcp: allow one skb to be received per socket under memory pressure")
+
+But we do not send EPOLLIN yet, in case tcp_data_ready() sees sk_rcvlowat
+is bigger than skb length.
+
+2) Then, when next packet comes, it is dropped, and we directly
+call sk->sk_data_ready().
+
+3) If application is using poll(), tcp_poll() will then use
+tcp_stream_is_readable() and decide the socket receive queue is
+not yet filled, so nothing will happen.
+
+Even when sender retransmits packets, phases 2) & 3) repeat
+and flow is effectively frozen, until memory pressure is off.
+
+Fix is to consider tcp_under_memory_pressure() to take care
+of global memory pressure or memcg pressure.
+
+Fixes: 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Arjun Roy <arjunroy@google.com>
+Suggested-by: Wei Wang <weiwan@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 37b51456784f8..b914959cd2c67 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1409,8 +1409,13 @@ static inline int tcp_full_space(const struct sock *sk)
+  */
+ static inline bool tcp_rmem_pressure(const struct sock *sk)
+ {
+-	int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
+-	int threshold = rcvbuf - (rcvbuf >> 3);
++	int rcvbuf, threshold;
++
++	if (tcp_under_memory_pressure(sk))
++		return true;
++
++	rcvbuf = READ_ONCE(sk->sk_rcvbuf);
++	threshold = rcvbuf - (rcvbuf >> 3);
+ 
+ 	return atomic_read(&sk->sk_rmem_alloc) > threshold;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.4/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch b/queue-5.4/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch
new file mode 100644
index 00000000000..b89a4ac39a0
--- /dev/null
+++ b/queue-5.4/tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch
@@ -0,0 +1,205 @@
+From a0781aaacb1e433d1bbf7e1bfdce2b0946a0c67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:34:05 -0500
+Subject: tracepoint: Do not fail unregistering a probe due to memory failure
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit befe6d946551d65cddbd32b9cb0170b0249fd5ed ]
+
+The list of tracepoint callbacks is managed by an array that is protected
+by RCU. To update this array, a new array is allocated, the updates are
+copied over to the new array, and then the list of functions for the
+tracepoint is switched over to the new array. After a completion of an RCU
+grace period, the old array is freed.
+
+This process happens for both adding a callback as well as removing one.
+But on removing a callback, if the new array fails to be allocated, the
+callback is not removed, and may be used after it is freed by the clients
+of the tracepoint.
+
+There's really no reason to fail if the allocation for a new array fails
+when removing a function. Instead, the function can simply be replaced by a
+stub function that could be cleaned up on the next modification of the
+array. That is, instead of calling the function registered to the
+tracepoint, it would call a stub function in its place.
+
+Link: https://lore.kernel.org/r/20201115055256.65625-1-mmullins@mmlx.us
+Link: https://lore.kernel.org/r/20201116175107.02db396d@gandalf.local.home
+Link: https://lore.kernel.org/r/20201117211836.54acaef2@oasis.local.home
+Link: https://lkml.kernel.org/r/20201118093405.7a6d2290@gandalf.local.home
+
+[ Note, this version does use undefined compiler behavior (assuming that
+  a stub function with no parameters or return, can be called by a location
+  that thinks it has parameters but still no return value. Static calls
+  do the same thing, so this trick is not without precedent.
+
+  There's another solution that uses RCU tricks and is more complex, but
+  can be an alternative if this solution becomes an issue.
+
+  Link: https://lore.kernel.org/lkml/20210127170721.58bce7cc@gandalf.local.home/
+]
+
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: KP Singh <kpsingh@chromium.org>
+Cc: netdev <netdev@vger.kernel.org>
+Cc: bpf <bpf@vger.kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Florian Weimer <fw@deneb.enyo.de>
+Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints")
+Reported-by: syzbot+83aa762ef23b6f0d1991@syzkaller.appspotmail.com
+Reported-by: syzbot+d29e58bb557324e55e5e@syzkaller.appspotmail.com
+Reported-by: Matt Mullins <mmullins@mmlx.us>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Tested-by: Matt Mullins <mmullins@mmlx.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/tracepoint.c | 80 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index 73956eaff8a9c..be51df4508cbe 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -53,6 +53,12 @@ struct tp_probes {
+ 	struct tracepoint_func probes[0];
+ };
+ 
++/* Called in removal of a func but failed to allocate a new tp_funcs */
++static void tp_stub_func(void)
++{
++	return;
++}
++
+ static inline void *allocate_probes(int count)
+ {
+ 	struct tp_probes *p  = kmalloc(struct_size(p, probes, count),
+@@ -131,6 +137,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ {
+ 	struct tracepoint_func *old, *new;
+ 	int nr_probes = 0;
++	int stub_funcs = 0;
+ 	int pos = -1;
+ 
+ 	if (WARN_ON(!tp_func->func))
+@@ -147,14 +154,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ 			if (old[nr_probes].func == tp_func->func &&
+ 			    old[nr_probes].data == tp_func->data)
+ 				return ERR_PTR(-EEXIST);
++			if (old[nr_probes].func == tp_stub_func)
++				stub_funcs++;
+ 		}
+ 	}
+-	/* + 2 : one for new probe, one for NULL func */
+-	new = allocate_probes(nr_probes + 2);
++	/* + 2 : one for new probe, one for NULL func - stub functions */
++	new = allocate_probes(nr_probes + 2 - stub_funcs);
+ 	if (new == NULL)
+ 		return ERR_PTR(-ENOMEM);
+ 	if (old) {
+-		if (pos < 0) {
++		if (stub_funcs) {
++			/* Need to copy one at a time to remove stubs */
++			int probes = 0;
++
++			pos = -1;
++			for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
++				if (old[nr_probes].func == tp_stub_func)
++					continue;
++				if (pos < 0 && old[nr_probes].prio < prio)
++					pos = probes++;
++				new[probes++] = old[nr_probes];
++			}
++			nr_probes = probes;
++			if (pos < 0)
++				pos = probes;
++			else
++				nr_probes--; /* Account for insertion */
++
++		} else if (pos < 0) {
+ 			pos = nr_probes;
+ 			memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
+ 		} else {
+@@ -188,8 +215,9 @@ static void *func_remove(struct tracepoint_func **funcs,
+ 	/* (N -> M), (N > 1, M >= 0) probes */
+ 	if (tp_func->func) {
+ 		for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
+-			if (old[nr_probes].func == tp_func->func &&
+-			     old[nr_probes].data == tp_func->data)
++			if ((old[nr_probes].func == tp_func->func &&
++			     old[nr_probes].data == tp_func->data) ||
++			    old[nr_probes].func == tp_stub_func)
+ 				nr_del++;
+ 		}
+ 	}
+@@ -208,14 +236,32 @@ static void *func_remove(struct tracepoint_func **funcs,
+ 		/* N -> M, (N > 1, M > 0) */
+ 		/* + 1 for NULL */
+ 		new = allocate_probes(nr_probes - nr_del + 1);
+-		if (new == NULL)
+-			return ERR_PTR(-ENOMEM);
+-		for (i = 0; old[i].func; i++)
+-			if (old[i].func != tp_func->func
+-					|| old[i].data != tp_func->data)
+-				new[j++] = old[i];
+-		new[nr_probes - nr_del].func = NULL;
+-		*funcs = new;
++		if (new) {
++			for (i = 0; old[i].func; i++)
++				if ((old[i].func != tp_func->func
++				     || old[i].data != tp_func->data)
++				    && old[i].func != tp_stub_func)
++					new[j++] = old[i];
++			new[nr_probes - nr_del].func = NULL;
++			*funcs = new;
++		} else {
++			/*
++			 * Failed to allocate, replace the old function
++			 * with calls to tp_stub_func.
++			 */
++			for (i = 0; old[i].func; i++)
++				if (old[i].func == tp_func->func &&
++				    old[i].data == tp_func->data) {
++					old[i].func = tp_stub_func;
++					/* Set the prio to the next event. */
++					if (old[i + 1].func)
++						old[i].prio =
++							old[i + 1].prio;
++					else
++						old[i].prio = -1;
++				}
++			*funcs = old;
++		}
+ 	}
+ 	debug_print_probes(*funcs);
+ 	return old;
+@@ -271,10 +317,12 @@ static int tracepoint_remove_func(struct tracepoint *tp,
+ 	tp_funcs = rcu_dereference_protected(tp->funcs,
+ 			lockdep_is_held(&tracepoints_mutex));
+ 	old = func_remove(&tp_funcs, func);
+-	if (IS_ERR(old)) {
+-		WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
++	if (WARN_ON_ONCE(IS_ERR(old)))
+ 		return PTR_ERR(old);
+-	}
++
++	if (tp_funcs == old)
++		/* Failed allocating new tp_funcs, replaced func with stub */
++		return 0;
+ 
+ 	if (!tp_funcs) {
+ 		/* Removed last function */
+-- 
+2.27.0
+
diff --git a/queue-5.4/ubifs-fix-error-return-code-in-alloc_wbufs.patch b/queue-5.4/ubifs-fix-error-return-code-in-alloc_wbufs.patch
new file mode 100644
index 00000000000..d8dff2540a7
--- /dev/null
+++ b/queue-5.4/ubifs-fix-error-return-code-in-alloc_wbufs.patch
@@ -0,0 +1,40 @@
+From 035eb602fdc1c02f699c890a723e385a4b22e1a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 16:23:43 +0800
+Subject: ubifs: Fix error return code in alloc_wbufs()
+
+From: Wang ShaoBo <bobo.shaobowang@huawei.com>
+
+[ Upstream commit 42119dbe571eb419dae99b81dd20fa42f47464e1 ]
+
+Fix to return PTR_ERR() error code from the error handling case instead
+fo 0 in function alloc_wbufs(), as done elsewhere in this function.
+
+Fixes: 6a98bc4614de ("ubifs: Add authentication nodes to journal")
+Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/super.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index e49bd69dfc1c8..701f15ba61352 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -820,8 +820,10 @@ static int alloc_wbufs(struct ubifs_info *c)
+ 		c->jheads[i].wbuf.jhead = i;
+ 		c->jheads[i].grouped = 1;
+ 		c->jheads[i].log_hash = ubifs_hash_get_desc(c);
+-		if (IS_ERR(c->jheads[i].log_hash))
++		if (IS_ERR(c->jheads[i].log_hash)) {
++			err = PTR_ERR(c->jheads[i].log_hash);
+ 			goto out;
++		}
+ 	}
+ 
+ 	/*
+-- 
+2.27.0
+
diff --git a/queue-5.4/ubifs-fix-memleak-in-ubifs_init_authentication.patch b/queue-5.4/ubifs-fix-memleak-in-ubifs_init_authentication.patch
new file mode 100644
index 00000000000..65053582533
--- /dev/null
+++ b/queue-5.4/ubifs-fix-memleak-in-ubifs_init_authentication.patch
@@ -0,0 +1,38 @@
+From b9051c31436fb902950dd59de57a5735ecc5d7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 14:03:40 +0800
+Subject: ubifs: Fix memleak in ubifs_init_authentication
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 11b8ab3836454a2600e396f34731e491b661f9d5 ]
+
+When crypto_shash_digestsize() fails, c->hmac_tfm
+has not been freed before returning, which leads
+to memleak.
+
+Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/auth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
+index b10418b5fb719..8be17a7731961 100644
+--- a/fs/ubifs/auth.c
++++ b/fs/ubifs/auth.c
+@@ -342,7 +342,7 @@ int ubifs_init_authentication(struct ubifs_info *c)
+ 		ubifs_err(c, "hmac %s is bigger than maximum allowed hmac size (%d > %d)",
+ 			  hmac_name, c->hmac_desc_len, UBIFS_HMAC_ARR_SZ);
+ 		err = -EINVAL;
+-		goto out_free_hash;
++		goto out_free_hmac;
+ 	}
+ 
+ 	err = crypto_shash_setkey(c->hmac_tfm, ukp->data, ukp->datalen);
+-- 
+2.27.0
+
diff --git a/queue-5.4/usb-dwc2-abort-transaction-after-errors-with-unknown.patch b/queue-5.4/usb-dwc2-abort-transaction-after-errors-with-unknown.patch
new file mode 100644
index 00000000000..a28fab493f9
--- /dev/null
+++ b/queue-5.4/usb-dwc2-abort-transaction-after-errors-with-unknown.patch
@@ -0,0 +1,84 @@
+From 6a6811f8ab6e2f2895f37432c51fc7c60797c333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:50 +0100
+Subject: usb: dwc2: Abort transaction after errors with unknown reason
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ]
+
+In some situations, the following error messages are reported.
+
+dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown
+dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021
+
+This is sometimes followed by:
+
+dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length
+
+and then:
+
+WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913
+			dwc2_assign_and_init_hc+0x98c/0x990
+
+The warning suggests that an odd buffer address is to be used for DMA.
+
+After an error is observed, the receive buffer may be full
+(urb->actual_length >= urb->length). However, the urb is still left in
+the queue unless three errors were observed in a row. When it is queued
+again, the dwc2 hcd code translates this into a 1-block transfer.
+If urb->actual_length (ie the total expected receive length) is not
+DMA-aligned, the buffer pointer programmed into the chip will be
+unaligned. This results in the observed warning.
+
+To solve the problem, abort input transactions after an error with
+unknown cause if the entire packet was already received. This may be
+a bit drastic, but we don't really know why the transfer was aborted
+even though the entire packet was received. Aborting the transfer in
+this situation is less risky than accepting a potentially corrupted
+packet.
+
+With this patch in place, the 'ChHltd set' and 'trimming xfer length'
+messages are still observed, but there are no more transfer attempts
+with odd buffer addresses.
+
+Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better")
+Cc: Boris ARZUR <boris@konbu.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index a052d39b4375e..12819e019e13c 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -1977,6 +1977,18 @@ error:
+ 		qtd->error_count++;
+ 		dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
+ 					  qtd, DWC2_HC_XFER_XACT_ERR);
++		/*
++		 * We can get here after a completed transaction
++		 * (urb->actual_length >= urb->length) which was not reported
++		 * as completed. If that is the case, and we do not abort
++		 * the transfer, a transfer of size 0 will be enqueued
++		 * subsequently. If urb->actual_length is not DMA-aligned,
++		 * the buffer will then point to an unaligned address, and
++		 * the resulting behavior is undefined. Bail out in that
++		 * situation.
++		 */
++		if (qtd->urb->actual_length >= qtd->urb->length)
++			qtd->error_count = 3;
+ 		dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
+ 		dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch b/queue-5.4/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch
new file mode 100644
index 00000000000..b54953c6586
--- /dev/null
+++ b/queue-5.4/usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch
@@ -0,0 +1,63 @@
+From aef878a7be905476307229c8103af5f8872bb009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:49 +0100
+Subject: usb: dwc2: Do not update data length if it is 0 on inbound transfers
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 415fa1c7305dedbb345e2cc8ac91769bc1c83f1a ]
+
+The DWC2 documentation states that transfers with zero data length should
+set the number of packets to 1 and the transfer length to 0. This is not
+currently the case for inbound transfers: the transfer length is set to
+the maximum packet length. This can have adverse effects if the chip
+actually does transfer data as it is programmed to do. Follow chip
+documentation and keep the transfer length set to 0 in that situation.
+
+Fixes: 56f5b1cff22a1 ("staging: Core files for the DWC2 driver")
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-2-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 81afe553aa666..a91f2aa24118a 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1313,19 +1313,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
+ 			if (num_packets > max_hc_pkt_count) {
+ 				num_packets = max_hc_pkt_count;
+ 				chan->xfer_len = num_packets * chan->max_packet;
++			} else if (chan->ep_is_in) {
++				/*
++				 * Always program an integral # of max packets
++				 * for IN transfers.
++				 * Note: This assumes that the input buffer is
++				 * aligned and sized accordingly.
++				 */
++				chan->xfer_len = num_packets * chan->max_packet;
+ 			}
+ 		} else {
+ 			/* Need 1 packet for transfer length of 0 */
+ 			num_packets = 1;
+ 		}
+ 
+-		if (chan->ep_is_in)
+-			/*
+-			 * Always program an integral # of max packets for IN
+-			 * transfers
+-			 */
+-			chan->xfer_len = num_packets * chan->max_packet;
+-
+ 		if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
+ 		    chan->ep_type == USB_ENDPOINT_XFER_ISOC)
+ 			/*
+-- 
+2.27.0
+
diff --git a/queue-5.4/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch b/queue-5.4/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch
new file mode 100644
index 00000000000..c7d3426cf0f
--- /dev/null
+++ b/queue-5.4/usb-dwc2-make-trimming-xfer-length-a-debug-message.patch
@@ -0,0 +1,48 @@
+From 8df9195749c2efed111be892a59311afcf623f43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:51 +0100
+Subject: usb: dwc2: Make "trimming xfer length" a debug message
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ]
+
+With some USB network adapters, such as DM96xx, the following message
+is seen for each maximum size receive packet.
+
+dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length
+
+This happens because the packet size requested by the driver is 1522
+bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to
+receive 24*64 = 1536 bytes, and the chip does indeed send more than
+1522 bytes of data. Since the event does not indicate an error condition,
+the message is just noise. Demote it to debug level.
+
+Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver")
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index 12819e019e13c..d5f4ec1b73b15 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -500,7 +500,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
+ 						      &short_read);
+ 
+ 	if (urb->actual_length + xfer_length > urb->length) {
+-		dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
++		dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+ 		xfer_length = urb->length - urb->actual_length;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/usb-gadget-u_audio-free-requests-only-after-callback.patch b/queue-5.4/usb-gadget-u_audio-free-requests-only-after-callback.patch
new file mode 100644
index 00000000000..bca232ec311
--- /dev/null
+++ b/queue-5.4/usb-gadget-u_audio-free-requests-only-after-callback.patch
@@ -0,0 +1,72 @@
+From ca13a9a6137f77b9ae7d7ec5c624bc38a8707409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 09:46:39 +0100
+Subject: usb: gadget: u_audio: Free requests only after callback
+
+From: Jack Pham <jackp@codeaurora.org>
+
+[ Upstream commit 7de8681be2cde9f6953d3be1fa6ce05f9fe6e637 ]
+
+As per the kernel doc for usb_ep_dequeue(), it states that "this
+routine is asynchronous, that is, it may return before the completion
+routine runs". And indeed since v5.0 the dwc3 gadget driver updated
+its behavior to place dequeued requests on to a cancelled list to be
+given back later after the endpoint is stopped.
+
+The free_ep() was incorrectly assuming that a request was ready to
+be freed after calling dequeue which results in a use-after-free
+in dwc3 when it traverses its cancelled list. Fix this by moving
+the usb_ep_free_request() call to the callback itself in case the
+ep is disabled.
+
+Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
+Reported-and-tested-by: Ferry Toth <fntoth@gmail.com>
+Reviewed-and-tested-by: Peter Chen <peter.chen@nxp.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_audio.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 56906d15fb551..223029fa84459 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
+ 	struct snd_uac_chip *uac = prm->uac;
+ 
+ 	/* i/f shutting down */
+-	if (!prm->ep_enabled || req->status == -ESHUTDOWN)
++	if (!prm->ep_enabled) {
++		usb_ep_free_request(ep, req);
++		return;
++	}
++
++	if (req->status == -ESHUTDOWN)
+ 		return;
+ 
+ 	/*
+@@ -351,8 +356,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ 
+ 	for (i = 0; i < params->req_number; i++) {
+ 		if (prm->ureq[i].req) {
+-			usb_ep_dequeue(ep, prm->ureq[i].req);
+-			usb_ep_free_request(ep, prm->ureq[i].req);
++			if (usb_ep_dequeue(ep, prm->ureq[i].req))
++				usb_ep_free_request(ep, prm->ureq[i].req);
++			/*
++			 * If usb_ep_dequeue() cannot successfully dequeue the
++			 * request, the request will be freed by the completion
++			 * callback.
++			 */
++
+ 			prm->ureq[i].req = NULL;
+ 		}
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.4/vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch b/queue-5.4/vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch
new file mode 100644
index 00000000000..4b0bbea6168
--- /dev/null
+++ b/queue-5.4/vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch
@@ -0,0 +1,101 @@
+From 93ab314fcea14bb073b0430303c8fce25b14c11c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 17:26:35 +0800
+Subject: vfio/iommu_type1: Fix some sanity checks in detach group
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit 4a19f37a3dd3f29997735e61b25ddad24b8abe73 ]
+
+vfio_sanity_check_pfn_list() is used to check whether pfn_list and
+notifier are empty when remove the external domain, so it makes a
+wrong assumption that only external domain will use the pinning
+interface.
+
+Now we apply the pfn_list check when a vfio_dma is removed and apply
+the notifier check when all domains are removed.
+
+Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices")
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 31 ++++++++-----------------------
+ 1 file changed, 8 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index bc6ba41686fa3..9cbe058a530f0 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -866,6 +866,7 @@ static long vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma,
+ 
+ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
+ {
++	WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list));
+ 	vfio_unmap_unpin(iommu, dma, true);
+ 	vfio_unlink_dma(iommu, dma);
+ 	put_task_struct(dma->task);
+@@ -1974,23 +1975,6 @@ static void vfio_iommu_unmap_unpin_reaccount(struct vfio_iommu *iommu)
+ 	}
+ }
+ 
+-static void vfio_sanity_check_pfn_list(struct vfio_iommu *iommu)
+-{
+-	struct rb_node *n;
+-
+-	n = rb_first(&iommu->dma_list);
+-	for (; n; n = rb_next(n)) {
+-		struct vfio_dma *dma;
+-
+-		dma = rb_entry(n, struct vfio_dma, node);
+-
+-		if (WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list)))
+-			break;
+-	}
+-	/* mdev vendor driver must unregister notifier */
+-	WARN_ON(iommu->notifier.head);
+-}
+-
+ /*
+  * Called when a domain is removed in detach. It is possible that
+  * the removed domain decided the iova aperture window. Modify the
+@@ -2088,10 +2072,10 @@ static void vfio_iommu_type1_detach_group(void *iommu_data,
+ 			kfree(group);
+ 
+ 			if (list_empty(&iommu->external_domain->group_list)) {
+-				vfio_sanity_check_pfn_list(iommu);
+-
+-				if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu))
++				if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu)) {
++					WARN_ON(iommu->notifier.head);
+ 					vfio_iommu_unmap_unpin_all(iommu);
++				}
+ 
+ 				kfree(iommu->external_domain);
+ 				iommu->external_domain = NULL;
+@@ -2124,10 +2108,12 @@ static void vfio_iommu_type1_detach_group(void *iommu_data,
+ 		 */
+ 		if (list_empty(&domain->group_list)) {
+ 			if (list_is_singular(&iommu->domain_list)) {
+-				if (!iommu->external_domain)
++				if (!iommu->external_domain) {
++					WARN_ON(iommu->notifier.head);
+ 					vfio_iommu_unmap_unpin_all(iommu);
+-				else
++				} else {
+ 					vfio_iommu_unmap_unpin_reaccount(iommu);
++				}
+ 			}
+ 			iommu_domain_free(domain->domain);
+ 			list_del(&domain->next);
+@@ -2201,7 +2187,6 @@ static void vfio_iommu_type1_release(void *iommu_data)
+ 
+ 	if (iommu->external_domain) {
+ 		vfio_release_domain(iommu->external_domain, true);
+-		vfio_sanity_check_pfn_list(iommu);
+ 		kfree(iommu->external_domain);
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/vfio-type1-use-follow_pte.patch b/queue-5.4/vfio-type1-use-follow_pte.patch
new file mode 100644
index 00000000000..39abf03f97e
--- /dev/null
+++ b/queue-5.4/vfio-type1-use-follow_pte.patch
@@ -0,0 +1,70 @@
+From 972c0d0e1e65476566c9cd85ef15d2a075c557a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:49:34 -0700
+Subject: vfio/type1: Use follow_pte()
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit 07956b6269d3ed05d854233d5bb776dca91751dd ]
+
+follow_pfn() doesn't make sure that we're using the correct page
+protections, get the pte with follow_pte() so that we can test
+protections and get the pfn from the pte.
+
+Fixes: 5cbf3264bc71 ("vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn()")
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 9cbe058a530f0..6b1e8cba17984 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -24,6 +24,7 @@
+ #include <linux/compat.h>
+ #include <linux/device.h>
+ #include <linux/fs.h>
++#include <linux/highmem.h>
+ #include <linux/iommu.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+@@ -339,9 +340,11 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
+ 			    unsigned long vaddr, unsigned long *pfn,
+ 			    bool write_fault)
+ {
++	pte_t *ptep;
++	spinlock_t *ptl;
+ 	int ret;
+ 
+-	ret = follow_pfn(vma, vaddr, pfn);
++	ret = follow_pte(vma->vm_mm, vaddr, &ptep, &ptl);
+ 	if (ret) {
+ 		bool unlocked = false;
+ 
+@@ -355,9 +358,17 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
+ 		if (ret)
+ 			return ret;
+ 
+-		ret = follow_pfn(vma, vaddr, pfn);
++		ret = follow_pte(vma->vm_mm, vaddr, &ptep, &ptl);
++		if (ret)
++			return ret;
+ 	}
+ 
++	if (write_fault && !pte_write(*ptep))
++		ret = -EFAULT;
++	else
++		*pfn = pte_pfn(*ptep);
++
++	pte_unmap_unlock(ptep, ptl);
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.4/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch b/queue-5.4/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch
new file mode 100644
index 00000000000..709126e0455
--- /dev/null
+++ b/queue-5.4/vmci-use-set_page_dirty_lock-when-unregistering-gues.patch
@@ -0,0 +1,43 @@
+From e1b6eb4f6a9b0deb05da80d58b3c2385cca7c446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 08:32:40 -0800
+Subject: VMCI: Use set_page_dirty_lock() when unregistering guest memory
+
+From: Jorgen Hansen <jhansen@vmware.com>
+
+[ Upstream commit 5a16c535409f8dcb7568e20737309e3027ae3e49 ]
+
+When the VMCI host support releases guest memory in the case where
+the VM was killed, the pinned guest pages aren't locked. Use
+set_page_dirty_lock() instead of set_page_dirty().
+
+Testing done: Killed VM while having an active VMCI based vSocket
+connection and observed warning from ext4. With this fix, no
+warning was observed. Ran various vSocket tests without issues.
+
+Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
+Link: https://lore.kernel.org/r/1611160360-30299-1-git-send-email-jhansen@vmware.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index c49065887e8f5..df6b19c4c49b5 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -630,7 +630,7 @@ static void qp_release_pages(struct page **pages,
+ 
+ 	for (i = 0; i < num_pages; i++) {
+ 		if (dirty)
+-			set_page_dirty(pages[i]);
++			set_page_dirty_lock(pages[i]);
+ 
+ 		put_page(pages[i]);
+ 		pages[i] = NULL;
+-- 
+2.27.0
+
diff --git a/queue-5.4/vxlan-move-debug-check-after-netdev-unregister.patch b/queue-5.4/vxlan-move-debug-check-after-netdev-unregister.patch
new file mode 100644
index 00000000000..74c2e9d0c75
--- /dev/null
+++ b/queue-5.4/vxlan-move-debug-check-after-netdev-unregister.patch
@@ -0,0 +1,106 @@
+From 55f544e6a65e7d105b7011a80f1015b00f0090b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Feb 2021 15:45:52 +0000
+Subject: vxlan: move debug check after netdev unregister
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 92584ddf550ae72d492858c19d1f9025e07a9350 ]
+
+The debug check must be done after unregister_netdevice_many() call --
+the hlist_del_rcu() for this is done inside .ndo_stop.
+
+This is the same with commit 0fda7600c2e1 ("geneve: move debug check after
+netdev unregister")
+
+Test commands:
+    ip netns del A
+    ip netns add A
+    ip netns add B
+
+    ip netns exec B ip link add vxlan0 type vxlan vni 100 local 10.0.0.1 \
+	    remote 10.0.0.2 dstport 4789 srcport 4789 4789
+    ip netns exec B ip link set vxlan0 netns A
+    ip netns exec A ip link set vxlan0 up
+    ip netns del B
+
+Splat looks like:
+[   73.176249][    T7] ------------[ cut here ]------------
+[   73.178662][    T7] WARNING: CPU: 4 PID: 7 at drivers/net/vxlan.c:4743 vxlan_exit_batch_net+0x52e/0x720 [vxlan]
+[   73.182597][    T7] Modules linked in: vxlan openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 mlx5_core nfp mlxfw ixgbevf tls sch_fq_codel nf_tables nfnetlink ip_tables x_tables unix
+[   73.190113][    T7] CPU: 4 PID: 7 Comm: kworker/u16:0 Not tainted 5.11.0-rc7+ #838
+[   73.193037][    T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[   73.196986][    T7] Workqueue: netns cleanup_net
+[   73.198946][    T7] RIP: 0010:vxlan_exit_batch_net+0x52e/0x720 [vxlan]
+[   73.201509][    T7] Code: 00 01 00 00 0f 84 39 fd ff ff 48 89 ca 48 c1 ea 03 80 3c 1a 00 0f 85 a6 00 00 00 89 c2 48 83 c2 02 49 8b 14 d4 48 85 d2 74 ce <0f> 0b eb ca e8 b9 51 db dd 84 c0 0f 85 4a fe ff ff 48 c7 c2 80 bc
+[   73.208813][    T7] RSP: 0018:ffff888100907c10 EFLAGS: 00010286
+[   73.211027][    T7] RAX: 000000000000003c RBX: dffffc0000000000 RCX: ffff88800ec411f0
+[   73.213702][    T7] RDX: ffff88800a278000 RSI: ffff88800fc78c70 RDI: ffff88800fc78070
+[   73.216169][    T7] RBP: ffff88800b5cbdc0 R08: fffffbfff424de61 R09: fffffbfff424de61
+[   73.218463][    T7] R10: ffffffffa126f307 R11: fffffbfff424de60 R12: ffff88800ec41000
+[   73.220794][    T7] R13: ffff888100907d08 R14: ffff888100907c50 R15: ffff88800fc78c40
+[   73.223337][    T7] FS:  0000000000000000(0000) GS:ffff888114800000(0000) knlGS:0000000000000000
+[   73.225814][    T7] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   73.227616][    T7] CR2: 0000562b5cb4f4d0 CR3: 0000000105fbe001 CR4: 00000000003706e0
+[   73.229700][    T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[   73.231820][    T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[   73.233844][    T7] Call Trace:
+[   73.234698][    T7]  ? vxlan_err_lookup+0x3c0/0x3c0 [vxlan]
+[   73.235962][    T7]  ? ops_exit_list.isra.11+0x93/0x140
+[   73.237134][    T7]  cleanup_net+0x45e/0x8a0
+[ ... ]
+
+Fixes: 57b61127ab7d ("vxlan: speedup vxlan tunnels dismantle")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20210221154552.11749-1-ap420073@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 5502e145aa17b..8443df79fabc7 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -4424,7 +4424,6 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ 	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ 	struct vxlan_dev *vxlan, *next;
+ 	struct net_device *dev, *aux;
+-	unsigned int h;
+ 
+ 	for_each_netdev_safe(net, dev, aux)
+ 		if (dev->rtnl_link_ops == &vxlan_link_ops)
+@@ -4438,14 +4437,13 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ 			unregister_netdevice_queue(vxlan->dev, head);
+ 	}
+ 
+-	for (h = 0; h < PORT_HASH_SIZE; ++h)
+-		WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
+ }
+ 
+ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+ {
+ 	struct net *net;
+ 	LIST_HEAD(list);
++	unsigned int h;
+ 
+ 	rtnl_lock();
+ 	list_for_each_entry(net, net_list, exit_list)
+@@ -4453,6 +4451,13 @@ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+ 
+ 	unregister_netdevice_many(&list);
+ 	rtnl_unlock();
++
++	list_for_each_entry(net, net_list, exit_list) {
++		struct vxlan_net *vn = net_generic(net, vxlan_net_id);
++
++		for (h = 0; h < PORT_HASH_SIZE; ++h)
++			WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
++	}
+ }
+ 
+ static struct pernet_operations vxlan_net_ops = {
+-- 
+2.27.0
+
diff --git a/queue-5.4/xen-netback-fix-spurious-event-detection-for-common-.patch b/queue-5.4/xen-netback-fix-spurious-event-detection-for-common-.patch
new file mode 100644
index 00000000000..24d88364f29
--- /dev/null
+++ b/queue-5.4/xen-netback-fix-spurious-event-detection-for-common-.patch
@@ -0,0 +1,56 @@
+From e46b0ed1d8dcad1659936ab2b4a56c8ff49decf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 11:16:12 +0100
+Subject: xen/netback: fix spurious event detection for common event case
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ]
+
+In case of a common event for rx and tx queue the event should be
+regarded to be spurious if no rx and no tx requests are pending.
+
+Unfortunately the condition for testing that is wrong causing to
+decide a event being spurious if no rx OR no tx requests are
+pending.
+
+Fix that plus using local variables for rx/tx pending indicators in
+order to split function calls and if condition.
+
+Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Paul Durrant <paul@xen.org>
+Reviewed-by: Wei Liu <wl@xen.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/interface.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index e889488b84a03..8090895873011 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -162,13 +162,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
+ {
+ 	struct xenvif_queue *queue = dev_id;
+ 	int old;
++	bool has_rx, has_tx;
+ 
+ 	old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
+ 	WARN(old, "Interrupt while EOI pending\n");
+ 
+-	/* Use bitwise or as we need to call both functions. */
+-	if ((!xenvif_handle_tx_interrupt(queue) |
+-	     !xenvif_handle_rx_interrupt(queue))) {
++	has_tx = xenvif_handle_tx_interrupt(queue);
++	has_rx = xenvif_handle_rx_interrupt(queue);
++
++	if (!has_rx && !has_tx) {
+ 		atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
+ 		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+ 	}
+-- 
+2.27.0
+
-- 
2.47.3