From 9e003649b57cbe88f0c2205db0401329a6e1066c Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sun, 27 Dec 2020 23:33:21 -0500
Subject: [PATCH] Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...x-error-return-code-in-adm8211_probe.patch |  56 ++
 ...x-silent-stream-for-first-playback-t.patch | 175 ++++++
 ...-omit-fp-emulation-for-und-exception.patch | 180 +++++++
 ...press-fix-dbgadtb-size-parameter-nam.patch |  46 ++
 ...se-undef-hook-for-vfp-support-detect.patch | 131 +++++
 ...s-aspeed-g6-fix-the-gpio-memory-size.patch |  42 ++
 ...2600wf-fix-vga-memory-region-locatio.patch |  49 ++
 ...rm-dts-aspeed-tiogapass-remove-vuart.patch |  41 ++
 ...dts-at91-at91sam9rl-fix-adc-triggers.patch |  62 +++
 ...-sam9x60-add-pincontrol-for-usb-host.patch |  53 ++
 ...t91-sam9x60ek-remove-bypass-property.patch |  42 ++
 ...s-at91-sama5d2-map-securam-as-device.patch |  39 ++
 ...a5d3_xplained-add-pincontrol-for-usb.patch |  51 ++
 ...a5d4_xplained-add-pincontrol-for-usb.patch |  51 ++
 ...fix-phy-deassert-timing-requirements.patch |  55 ++
 ...move-non-existent-i2c1-from-98dx3236.patch |  40 ++
 ...ix-node-vs-reg-mismatch-for-flash-me.patch |  38 ++
 ...dling-of-lpae-translation-in-be-mode.patch |  55 ++
 ...-3720-turris-mox-update-ethernet-phy.patch |  44 ++
 ...-correct-psci-compatible-used-on-exy.patch |  50 ++
 ...-include-common-syscon-restart-power.patch |  55 ++
 ...cale-sl28-combine-spi-mtd-partitions.patch |  54 ++
 ...6018-update-the-reserved-memory-node.patch |  51 ++
 ...ts-ls1028a-fix-enetc-ptp-clock-input.patch |  41 ++
 ...-dts-ls1028a-fix-flexspi-clock-input.patch |  36 ++
 ...ek-mt8183-fix-gce-incorrect-mbox-cel.patch |  43 ++
 ...fix-phy-deassert-timing-requirements.patch | 157 ++++++
 ...fix-spi-max-frequency-on-khadas-vim2.patch |  38 ++
 ...g12a-x96-max-fix-phy-deassert-timing.patch |  41 ++
 ...g12b-odroid-n2-fix-phy-deassert-timi.patch |  46 ++
 ...g12b-w400-fix-phy-deassert-timing-re.patch |  40 ++
 ...-dts-meson-sm1-fix-typo-in-opp-table.patch |  37 ++
 ...com-c630-fix-pinctrl-pins-properties.patch |  64 +++
 ...dts-qcom-c630-polish-i2c-hid-devices.patch | 131 +++++
 ...sm8916-samsung-a2015-disable-muic-i2.patch |  55 ++
 ...c7180-fix-one-forgotten-interconnect.patch |  46 ++
 ...-qcom-sc7180-limit-ipa-iommu-streams.patch |  44 ++
 ...-qcom-sdm845-limit-ipa-iommu-streams.patch |  42 ++
 ...m8250-correct-compatible-for-sm8250-.patch |  39 ++
 ...s-cat875-remove-rxc-skew-ps-from-eth.patch |  38 ++
 ...s-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch |  38 ++
 ...rockchip-fix-uart-pull-ups-on-rk3328.patch |  75 +++
 ...ip-set-dr_mode-to-host-for-otg-on-rk.patch |  37 ++
 ...am65-j721e-fix-unit-address-format-e.patch |  59 ++
 ...ctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch |  41 ++
 ...dt-binding-for-io-high-voltage-entry.patch |  46 ++
 ...clk_get-to-devm_clk_get-and-add-miss.patch |  48 ++
 ...ona-fix-a-wrong-free-in-wm8997_probe.patch |  40 ++
 ...-atmel-mchp-spdifrx-needs-common_clk.patch |  40 ++
 ..._codec-fix-uninitialized-memory-read.patch |  44 ++
 ...s-tgl_max98373-update-tdm-slot_width.patch |  48 ++
 ...oc_intel_keembay-should-depend-on-ar.patch |  39 ++
 ...40-i2s-add-missed-checks-for-clk_get.patch |  44 ++
 ...fix-error-codes-in-max98390_dsm_init.patch |  43 ++
 .../asoc-meson-fix-compile_test-error.patch   |  45 ++
 .../asoc-pcm-drain-support-reactivation.patch |  51 ++
 ...clocks-add-missing-parent-clock-rate.patch |  40 ++
 ...-fix-refcounting-in-qcom_snd_parse_o.patch |  81 +++
 ...com-fix-qdsp6-dependencies-attempt-3.patch |  43 ++
 ...signed-int-bitwidth-compared-to-less.patch |  38 ++
 ...ix-kconfig-dependency-for-snd_intel_.patch |  57 ++
 ...ix-lrck_period-computation-for-i2s-j.patch |  54 ++
 ...-pm-disable-depth-imbalance-on-error.patch |  44 ++
 ...-pm-disable-depth-imbalance-on-error.patch |  48 ++
 ...ove-ctl-from-list-on-error-in-wm_ads.patch |  50 ++
 .../ath10k-fix-an-error-handling-path.patch   |  37 ++
 ...arsing-error-in-service-available-ev.patch |  92 ++++
 ...ome-resources-in-an-error-handling-p.patch |  47 ++
 ...t-ath11k_skb_cb-to-ieee80211_tx_info.patch | 148 +++++
 .../ath11k-fix-an-error-handling-path.patch   |  50 ++
 ...incorrect-tlvs-in-scan-start-command.patch |  71 +++
 ...r-of-rules-in-filtered-etsi-regdomai.patch |  73 +++
 ...x_filter-flag-setting-for-peer-rssi-.patch |  44 ++
 .../ath11k-fix-wmi-init-configuration.patch   |  53 ++
 ...handle-errors-if-peer-creation-fails.patch |  90 ++++
 ...e-complete-alpha2-for-regulatory-cha.patch |  52 ++
 ...h11k_skb_cb-before-setting-new-flags.patch |  67 +++
 ...ynamically-alloc-buffer-for-pathname.patch | 127 +++++
 .../block-rnbd-clt-fix-possible-memleak.patch |  51 ++
 ...et-rid-of-warning-regarding-size-arg.patch |  50 ++
 ...-null-pointer-dereference-on-dev-blk.patch |  40 ++
 ...dio-add-the-missed-release_firmware-.patch |  38 ++
 ...add-the-missed-release_firmware-in-b.patch |  38 ++
 ...fix-detection-of-some-fake-csr-contr.patch |  62 +++
 ...-privacy-ble-device-fails-to-connect.patch |  72 +++
 ...ll-pointer-dereference-in-hci_event_.patch |  49 ++
 ...h-hci_h5-fix-memory-leak-in-h5_close.patch |  42 ++
 ...x-crash-when-using-bt_sndmtu-bt_rcvm.patch |  73 +++
 ...raw_tracepoint-s-use-of-__module_add.patch |  47 ++
 .../bpf-fix-tests-for-local_storage.patch     | 105 ++++
 ...or-return-code-in-brcmf_cfg80211_con.patch |  40 ++
 ...ory-leak-for-unpaired-brcmf_-alloc-f.patch |  64 +++
 ...ack-accidentally-dropped-error-check.patch |  40 ++
 ...rror-return-code-in-fsl_mc_object_al.patch |  42 ++
 ...-null-pointer-access-when-parsing-mh.patch |  50 ++
 ...ove-double-locking-from-mhi_driver_r.patch |  43 ++
 ...config_endisable-remove-double-clear.patch |  45 ++
 .../checkpatch-fix-unescaped-left-brace.patch |  42 ++
 ...9x60-remove-atmel-osc-bypass-support.patch |  51 ++
 ...k-at91-sama7g5-fix-compilation-error.patch |  59 ++
 .../clk-bcm-dvp-add-module_device_table.patch |  38 ++
 queue-5.10/clk-fsl-sai-fix-memory-leak.patch  |  57 ++
 ...eson-kconfig-fix-dependency-for-g12a.patch |  38 ++
 ...c-sc7180-use-floor-ops-for-sdcc-clks.patch |  54 ++
 ...enesas-r8a779a0-fix-r-and-osc-clocks.patch |  71 +++
 ...a-resource-leak-in-error-handling-pa.patch |  41 ++
 ...ke-sure-divider-tables-have-sentinel.patch |  54 ++
 ...-tegra-fix-duplicated-se-clock-entry.patch |  55 ++
 ...-fix-memleak-in-ti_fapll_synth_setup.patch |  60 +++
 ...voltage-microvolt-instead-of-idt-vol.patch |  47 ++
 ...ers-arm_arch_timer-correct-fault-pro.patch |  70 +++
 ...ers-arm_arch_timer-use-stable-count-.patch |  47 ++
 ...ers-cadence_ttc-fix-memory-leak-in-t.patch |  74 +++
 ...drivers-ingenic-fix-section-mismatch.patch |  47 ++
 ...ers-orion-add-missing-clk_disable_un.patch |  68 +++
 ...ers-riscv-make-riscv_timer-depends-o.patch |  39 ++
 ...ght-remove-broken-__exit-annotations.patch | 231 ++++++++
 ...p806-add-missing-module_device_table.patch |  44 ++
 ...bank-add-missing-module_device_table.patch |  45 ++
 ...q-imx-fix-nvmem_imx_ocotp-dependency.patch |  45 ++
 ...q-loongson1-add-missing-module_alias.patch |  38 ++
 ...atek-add-missing-module_device_table.patch |  39 ++
 ...qcom-add-missing-module_device_table.patch |  39 ++
 ...pufreq-scpi-add-missing-module_alias.patch |  38 ++
 ...q-st-add-missing-module_device_table.patch |  45 ++
 ...n50i-add-missing-module_device_table.patch |  40 ++
 ...express-spc-add-missing-module_alias.patch |  38 ++
 ...neonbs-fix-usage-of-cbc-aes-fallback.patch |  64 +++
 ...y1305-neon-reorder-pac-authenticatio.patch |  69 +++
 ...o-atmel-i2c-select-config_bitreverse.patch |  42 ++
 ...printing-on-xts-fallback-allocation-.patch |  78 +++
 ...-replace-bitwise-or-with-logical-or-.patch |  60 +++
 ...to-inside-secure-fix-sizeof-mismatch.patch |  40 ++
 ...rypto_manager_extra_tests-requires-t.patch |  39 ++
 ...fix-pm-disable-depth-imbalance-in-om.patch |  45 ++
 ...tatus-check-in-qat_hal_put_rel_rd_xf.patch |  44 ++
 ...-ce-fix-two-error-path-s-memory-leak.patch |  86 +++
 ...alitos-endianess-in-current_desc_hdr.patch |  53 ++
 ...-fix-return-type-of-current_desc_hdr.patch |  55 ++
 ...ng-destroy_workqueue-on-error-in-cw1.patch |  46 ++
 ...ul-macro-instead-of-bit-in-the-uapi-.patch |  39 ++
 ...-error-return-code-in-target_message.patch |  36 ++
 ..._v2-fix-error-return-code-in-mv_xor_.patch |  41 ++
 ...udma-correct-normal-channel-offset-w.patch |  40 ++
 ...ix-the-size-of-the-mapped-sgt-buffer.patch |  73 +++
 ...nav_qmss_queue-fix-error-return-code.patch |  41 ++
 ...dgpu-fix-build_coefficients-argument.patch |  45 ++
 ...ompute-queue-priority-if-num_kcq-is-.patch | 141 +++++
 .../drm-amdgpu-fix-incorrect-enum-type.patch  |  50 ++
 ...egression-in-vbios-reservation-handl.patch |  46 ++
 ...amdkfd-put-acpi-table-after-using-it.patch |  74 +++
 ...config-warning-subsequent-build-erro.patch |  63 +++
 ...s015-fix-irq-registering-in-tpd12s01.patch |  41 ++
 ...nitialized-variable-in-drm_cvt_modes.patch |  44 ++
 ...500-fix-double-free-of-gma_connector.patch |  45 ++
 ...-rotations-for-vivante-tiled-formats.patch |  69 +++
 ...x-handling-of-platform_get_irq-error.patch |  40 ++
 ...id-dereferencing-a-null-hdmi_phy-on-.patch |  47 ++
 ...tek-use-correct-aliases-name-for-ovl.patch |  37 ++
 ...mi-disable-clocks-on-driver-teardown.patch |  96 ++++
 ...i-enable-the-iahb-clock-early-enough.patch |  63 +++
 ...i-ensure-that-clocks-are-enabled-bef.patch |  54 ++
 ...i-register-a-callback-to-disable-the.patch |  78 +++
 ...dma-resources-after-tearing-down-drm.patch |  92 ++++
 ...ind-all-connectors-on-module-removal.patch | 105 ++++
 ...drm-msm-a5xx-clear-shadow-on-suspend.patch |  53 ++
 ...make-preemption-reset-case-reentrant.patch |  61 +++
 ...drm-msm-a6xx-clear-shadow-on-suspend.patch |  59 ++
 ...drm-msm-add-iommu_support-dependency.patch |  45 ++
 .../drm-msm-add-missing-stub-definition.patch |  39 ++
 ...splayport-phy-compliance-tests-fixup.patch | 105 ++++
 ...t-notify-audio-subsystem-if-sink-doe.patch |  51 ++
 ...n-correct-connection-status-after-su.patch | 440 +++++++++++++++
 ...kip-checking-link_status_updated-bit.patch | 114 ++++
 ...ix-clock-scaling-on-non-sc7180-board.patch |  54 ++
 ...10nm-restore-vco-rate-during-restore.patch |  50 ++
 ...7nm-restore-vco-rate-during-restore_.patch |  50 ++
 ...e-eprobe_defer-while-waiting-for-bri.patch |  66 +++
 ...er-fix-return-error-code-in-omap_dmm.patch |  36 ++
 ...simple-add-flags-to-boe_nv133fhm_n61.patch |  39 ++
 ...x-handling-of-platform_get_irq-error.patch |  40 ++
 ...sing-error-code-in-udl_handle_damage.patch |  40 ++
 ...-struct-cpuinfo_x86.cpu_die_id-for-a.patch |  55 ++
 ...events-when-removing-a-timed-out-thr.patch | 128 +++++
 ...erofs-avoid-using-generic_block_bmap.patch |  78 +++
 .../extcon-max77693-fix-modalias-string.patch |  34 ++
 ...2fs_get_meta_page_retry-for-nat-page.patch |  36 ++
 .../f2fs-fix-double-free-of-unicode-map.patch |  38 ++
 ...m_scmi-fix-missing-destroy_workqueue.patch |  54 ++
 ...-tegra-fix-strncpy-strncat-confusion.patch |  66 +++
 ...cache-in-iput_final-instead-of-gener.patch |  66 +++
 ...speed-add-mutex-to-protect-hw-access.patch | 153 ++++++
 ...-don-t-try-to-free-an-interrupt-that.patch |  55 ++
 ...s-fix-recursion-in-gpiochip_irq_unma.patch |  43 ++
 ...-t-jump-to-free-id-in-ssi_add_contro.patch |  36 ++
 ...-error-code-in-hugetlb_reserve_pages.patch |  40 ++
 ...x-pm-usage-counter-unbalance-in-ina3.patch |  42 ++
 ...he-status-bits-for-the-next_to_use-d.patch |  58 ++
 ...e-status-bits-for-the-next_to_use-de.patch |  58 ++
 ...-add-kconfig-dep-on-the-of-symbol-an.patch |  69 +++
 ...ger-mark-hrtimer-to-expire-in-hard-i.patch |  56 ++
 ...x-integer-overflow-on-rt-calculation.patch |  52 ++
 ...ix-race-that-causes-missing-releases.patch | 103 ++++
 ...ads7846-fix-unaligned-access-on-7845.patch |  43 ++
 ...keypad-fix-runtime-pm-error-handling.patch | 202 +++++++
 ...cancel-only-requests-of-current-task.patch |  90 ++++
 ...el-reqs-shouldn-t-kill-overflow-list.patch |  57 ++
 ...uring-fix-racy-iopoll-flush-overflow.patch |  80 +++
 ...de-conditionally-on-config_intel_iom.patch |  52 ++
 ...ge-set_rx_mode-from_ndo-to-can_sleep.patch |  93 ++++
 ...c-flatten-calls-to-ionic_lif_rx_mode.patch |  82 +++
 ...ic-use-mc-sync-for-multicast-filters.patch |  69 +++
 ...si-fix-freeing-of-interrupts-on-allo.patch |  43 ++
 ...-fix-phantom-irq-when-changing-betwe.patch | 100 ++++
 ...nta-fix-printing-of-inta-id-on-probe.patch |  38 ++
 ...chip-ti-sci-intr-fix-freeing-of-irqs.patch |  76 +++
 ...fix-old-length-in-is_trig_data_conta.patch |  40 ++
 ...wifi-mvm-hook-up-missing-rx-handlers.patch |  43 ++
 ...nfig-fix-return-value-of-do_error_if.patch |  36 ++
 ...fix-rx_napi_poll-interrupt-ping-pong.patch | 148 +++++
 ...an-error-handling-path-in-lp50xx_pro.patch |  44 ++
 ...-missing-put_device-call-in-netxbig_.patch | 105 ++++
 ...a-check-for-led_color_id_rgb-instead.patch |  43 ++
 ...ata-layout-checks-and-allow-empty-bt.patch |  64 +++
 ...pf-sanitise-map-names-before-pinning.patch |  73 +++
 ...return-enxio-for-no-slot-in-__blk_la.patch |  40 ++
 ...se-interval-based-rebinding-over-tcp.patch |  99 ++++
 ...et-set-tdls-sta-bandwidth-wider-than.patch |  71 +++
 ...-a-mistake-check-for-rx_stats-update.patch |  41 ++
 ...p-always-wait-for-reply-message-from.patch |  95 ++++
 ...sh-adb-iop-send-correct-poll-command.patch | 116 ++++
 ...db-fix-mhu_db_shutdown-by-replacing-.patch |  73 +++
 ...-reference-leak-in-cedrus_start_stre.patch |  41 ++
 ...2c-imx219-selection-compliance-fixes.patch |  93 ++++
 .../media-imx214-fix-stop-streaming.patch     |  39 ++
 ...-fix-max2175_set_csm_mode-error-code.patch |  36 ++
 ...edia-max9271-fix-gpio-enable-disable.patch |  63 +++
 ...-add-missing-put_device-call-in-mtk_.patch |  74 +++
 ...missing-put_device-call-in-mtk_.patch-4640 |  44 ++
 ...missing-put_device-call-in-mtk_.patch-7942 |  94 ++++
 ...ov5640-fix-support-of-bt656-bus-mode.patch | 168 ++++++
 ...dd-missing-put_device-call-in-mtk_jp.patch |  37 ++
 ...sing-put_device-call-in-mtk_jp.patch-21183 |  59 ++
 ...edia-rdacm20-enable-gpio1-explicitly.patch |  53 ++
 ...fix-array-overflow-in-vidioc_s_audio.patch |  56 ++
 ...memory-leak-of-debugfs-members-in-sm.patch |  47 ++
 ...ix-missing-snd_card_free-in-error-ha.patch |  38 ++
 ...isp1-cap-fix-runtime-pm-imbalance-on.patch |  38 ++
 .../media-tm6000-fix-sizeof-mismatches.patch  |  49 ++
 ...x-wrong-return-value-of-tvp5150_pars.patch |  38 ++
 ...e-return-einval-for-invalid-bus-type.patch |  68 +++
 ...e-v4l2_fwnode_endpoint_parse-caller-.patch |  57 ++
 ...-change-clk-enable-and-disable-order.patch |  76 +++
 ...a-venus-core-vote-for-video-mem-path.patch |  70 +++
 ...-vote-with-average-bandwidth-and-pea.patch |  47 ++
 ...dummy-vote-on-video-mem-path-after-l.patch |  54 ++
 ...mc-fix-potential-null-dereference-in.patch |  42 ++
 ...ry-ti-emif-sram-only-build-for-armv7.patch |  41 ++
 ...-a-double-free-bug-in-memstick_check.patch |  37 ++
 ...-r592-fix-error-return-in-r592_probe.patch |  57 ++
 ...terrupt-regression-with-regmap-clear.patch |  82 +++
 ...dd-the-missed-i2c_put_adapter-in-htc.patch |  44 ++
 ...pld-should-depend-on-arch_layerscape.patch |  38 ++
 ...ev_err_probe-call-in-stmfx_chip_init.patch |  44 ++
 ...-kconfig-dependency-bug-for-bcm47xx_.patch |  48 ++
 ...e-after-free-in-mips_cdmm_bus_discov.patch |  41 ++
 ...-up-kernel-sections-size-for-membloc.patch |  44 ++
 ...t_test-fix-return-value-of-error-bra.patch |  54 ++
 ...wapd-prematurely-when-watermark-boos.patch |  94 ++++
 ...ut_compound_head-and-unpin_user_page.patch | 190 +++++++
 ...up_fast-from-racing-with-cow-during-.patch | 234 ++++++++
 ...rganize-internal_get_user_pages_fast.patch | 182 +++++++
 ...x-return-of-child-memcg-objcg-for-ro.patch |  61 +++
 ...x-use-after-free-in-obj_cgroup_charg.patch |  56 ++
 ...e-always-pin-the-page-in-madvise_inj.patch |  95 ++++
 .../mm-rmap-always-do-ttu_ignore_access.patch | 221 ++++++++
 ...m-vmalloc-fix-unlock-order-in-s_stop.patch |  55 ++
 ...oc.c-fix-kasan-shadow-poisoning-size.patch |  56 ++
 ...ix-error-return-code-in-pxamci_probe.patch |  37 ++
 ...gra-fix-wrong-unit-with-busy_timeout.patch |  38 ++
 ...sible-deadlock-running-mt76_dma_clea.patch | 111 ++++
 ...-memory-leak-if-device-probing-fails.patch | 107 ++++
 ...onfiguration-for-mt7615-7663-devices.patch |  51 ++
 ...s-fix-a-possible-ple-quota-underflow.patch |  36 ++
 ...-fops_sta_stats.owner-to-this_module.patch |  36 ++
 ...t-fops_tx_stats.owner-to-this_module.patch |  36 ++
 ...-fix-reference-count-leak-in-gpmi-op.patch |  60 +++
 ...pmi-fix-the-random-dma-timeout-issue.patch | 216 ++++++++
 ...nd-meson-fix-a-resource-leak-in-init.patch |  42 ++
 ...mel-fix-unlock_all-for-at25fs010-040.patch | 119 ++++
 ...-atmel-remove-global-protection-flag.patch | 103 ++++
 ...-ignore-errors-in-spi_nor_unlock_all.patch |  88 +++
 ...sst-fix-bpn-bits-for-the-sst25vf064c.patch |  42 ++
 ...iex_shutdown_sw-causing-sw-reset-fai.patch |  78 +++
 ...x-some-resources-leak-in-the-error-h.patch |  65 +++
 ...-a-resource-leak-in-an-error-handlin.patch |  42 ++
 ...31-fix-sleeping-function-called-from.patch | 153 ++++++
 ...te-net.ipv4.conf.all.proxy_arp_pvlan.patch |  38 ++
 ....ipvx.conf.all.ignore_routes_with_li.patch | 111 ++++
 queue-5.10/net-korina-fix-return-value.patch  |  43 ++
 ...ly-convey-driver-version-to-firmware.patch |  47 ++
 ...fix-a-resource-leak-in-the-error-han.patch |  55 ++
 ...nprintf-return-value-check-in-do_xpr.patch |  45 ++
 ...nfc-s3fwrn5-release-the-nfc-firmware.patch |  41 ++
 ...t-block-cleanup-to-flower-app-stop-c.patch |  57 ++
 ...a-typo-in-ff_layout_resend_pnfs_read.patch |  34 ++
 ...ch-nfsiod-to-be-an-unbound-workqueue.patch |  52 ++
 ...lock-during-iterate-through-the-list.patch |  79 +++
 ...ds-delay-when-doing-inter-server-cop.patch |  52 ++
 ...message-level-for-normal-termination.patch |  41 ++
 ...ignment-of-page-data-in-the-getdevic.patch |  48 ++
 ...n-readdir-s-mask-for-security-label-.patch |  74 +++
 ...cfg80211-fix-potential-infinite-loop.patch |  40 ++
 ...text-allocation-after-processing-the.patch |  60 +++
 ...-command-line-resource-alignment-req.patch |  56 ++
 ...ci-brcmstb-initialize-tmp-before-use.patch |  44 ++
 ...ble-msi-for-pericom-pcie-usb-adapter.patch |  65 +++
 ...-in-command-line-resource-alignment-.patch |  40 ++
 ...proc-fix-out-of-bound-array-accesses.patch |  74 +++
 ...alidate-correct-paxb-inbound-windows.patch |  60 +++
 ...emory-leak-when-synthesizing-sdt-pro.patch |  77 +++
 ...memory-leak-when-using-user-regs-to-.patch |  45 ++
 .../perf-test-fix-metric-parsing-test.patch   |  78 +++
 ...neric-event-for-expand_libpfm_events.patch |  45 ++
 ...k-allow-compile-testing-the-hdmi-phy.patch |  56 ++
 ...-gen3-usb2-disable-runtime-pm-in-cas.patch |  42 ++
 ...xusb-fix-usb_phy-device-driver-field.patch | 106 ++++
 ...ore-add-missing-ifdef-config_gpiolib.patch |  50 ++
 ...dd-missing-put_device-call-in-pinctr.patch |  64 +++
 ...x-irq-bank-map-for-the-allwinner-a10.patch |  37 ++
 ...cros_ec_spi-don-t-overwrite-spi-mode.patch |  49 ++
 ...l-smbios-base-fix-error-return-code-.patch |  39 ++
 ...el-vbtn-fix-sw_tablet_mode-always-re.patch |  75 +++
 ...-platform-fix-item-counter-assignmen.patch |  58 ++
 ...form-fix-item-counter-assignmen.patch-3823 |  58 ++
 ...-platform-remove-psu-eeprom-from-def.patch |  57 ++
 ...-platform-remove-psu-eeprom-from-msn.patch |  56 ++
 ...288_charger-fix-hp-pavilion-x2-10-dm.patch | 102 ++++
 ...y-bq24190_charger-fix-reference-leak.patch |  91 ++++
 ...5890-use-the-correct-range-for-iilim.patch |  40 ++
 ...17042_battery-fix-current_-avg-now-h.patch |  41 ++
 ...-cleanup_cpu_mmu_context-compile-bug.patch |  47 ++
 ...4-fix-an-emit_bug_entry-in-head_64.s.patch |  41 ++
 ...p-a-kernel-stack-for-secondaries-bef.patch | 105 ++++
 ...id-broken-gcc-__attribute__-optimize.patch | 108 ++++
 .../powerpc-boot-fix-build-of-dts-fsl.patch   |  49 ++
 ...fix-cpu_ftrs_always-by-removing-cpu_.patch |  68 +++
 ...y_check_fault-should-work-for-all-no.patch |  62 +++
 ...-crash-with-is_sier_available-when-p.patch |  71 +++
 ...-the-pmu-group-constraints-for-thres.patch |  67 +++
 ...-threshold-event-counter-multiplier-.patch |  61 +++
 ...-to-update-radix_scope_qual-in-power.patch | 152 ++++++
 ...ate-the-pmu-group-constraints-for-l2.patch |  56 ++
 ...-fix-low_sleep_handler-with-config_v.patch | 297 ++++++++++
 ...sriov-fix-unsigned-int-win-compared-.patch |  45 ++
 .../powerpc-ps3-use-dma_mapping_error.patch   |  41 ++
 ...hibernation-drop-pseries_suspend_beg.patch |  73 +++
 ...hibernation-remove-redundant-cachein.patch |  53 ++
 ...rpc-smp-add-__init-to-init_big_cores.patch |  45 ++
 ...ver-new-vsx-instructions-under-confi.patch |  54 ++
 ...ulate-prefixed-instructions-only-whe.patch |  54 ++
 ...werpc-xmon-fix-build-failure-for-8xx.patch |  49 ++
 ...in-proc-net-subdirectories-after-set.patch | 173 ++++++
 ...ountinfo-make-splice-available-again.patch |  73 +++
 ...mx27-fix-overflow-for-bigger-periods.patch |  49 ++
 ...3-dynamically-allocate-pwm-chip-base.patch |  44 ++
 ...m-sun4i-remove-erroneous-else-branch.patch |  56 ++
 ...zx-add-missing-cleanup-in-error-path.patch |  39 ++
 .../qlcnic-fix-error-code-in-probe.patch      |  36 ++
 ...error-return-code-in-qtnf_pcie_probe.patch |  52 ++
 ...ow-rcu_irq_enter_check_tick-from-nmi.patch |  49 ++
 .../rcu-ftrace-fix-ftrace-recursion.patch     |  50 ++
 ...vfree_rcu-allocation-to-a-clean-cont.patch | 233 ++++++++
 ..._re-fix-entry-size-during-srq-create.patch |  40 ++
 ...-queue-pair-state-when-being-queried.patch |  37 ++
 ...-missing-error-handling-of-listen_id.patch | 258 +++++++++
 ...verwrite-sgid_attr-after-device-is-r.patch |  78 +++
 ...dlock-on-lock-in-rdma_cma_listen_on_.patch | 133 +++++
 ...-indicate-device-ready-when-device-e.patch |  60 +++
 ...re-fix-error-return-in-_ib_modify_qp.patch |  41 ++
 .../rdma-core-track-device-memory-mrs.patch   |  56 ++
 ...ma-cxgb4-validate-the-number-of-cqes.patch |  38 ++
 ...etting-loopback-indicator-when-smac-.patch |  52 ++
 ...gfix-for-calculation-of-extended-sge.patch |  47 ++
 ...t-on-traffic-class-when-using-rocev2.patch |  83 +++
 ...s-fix-0-length-sge-calculation-error.patch |  84 +++
 ...fix-missing-fields-in-address-vector.patch |  54 ++
 ...he-length-of-data-copied-between-ker.patch | 149 +++++
 ...zation-the-judgment-of-some-features.patch |  99 ++++
 ...-hns-only-record-vlan-info-for-hip08.patch | 159 ++++++
 ...rruption-of-reg_pages-in-mlx5_ib_rer.patch | 107 ++++
 .../rdma-mlx5-fix-mr-cache-memory-leak.patch  |  54 ++
 ...work-around-wenum-conversion-warning.patch |  61 +++
 ...ssing-error-from-rtrs_rdma_conn_esta.patch |  42 ++
 ...move-destroy_con_cq_qp-in-case-route.patch |  46 ++
 ...n-t-guard-the-whole-__alloc_srv-with.patch | 193 +++++++
 ...ma-rxe-compute-psn-windows-correctly.patch |  43 ++
 ...a-uverbs-fix-incorrect-variable-type.patch |  90 ++++
 ...p-fix-return-value-check-in-k3_dsp_r.patch |  45 ++
 ...atek-change-mt8192-cfg-register-base.patch |  64 +++
 ...tek-unprepare-clk-if-scp_before_load.patch |  40 ++
 ...cp-surround-dt-device-ids-with-confi.patch |  47 ++
 ...mss-fix-error-handling-in-q6v5_pds_e.patch |  50 ++
 ...fix-potential-null-dereference-in-ad.patch |  63 +++
 ...com-fix-reference-leak-in-adsp_start.patch |  41 ++
 ...pas-fix-error-handling-in-adsp_pds_e.patch |  50 ++
 ...-i2c-qcom-geni-fix-dma-transfer-race.patch |  75 +++
 ...series-hotplug-cpu-remove-double-fre.patch |  44 ++
 ...-error-return-code-in-rsi_reset_card.patch |  69 +++
 ...fix-pcf2127_nvmem_read-write-returns.patch |  56 ++
 ...-after-free-in-ccw_device_destroy_co.patch |  48 ++
 ...-test_unwind-fix-call_on_stack-tests.patch |  53 ++
 ...lwt_len_hist-reusing-previous-bpf-ma.patch |  50 ++
 ...possible-hang-in-xdpsock-with-multip.patch |  42 ++
 ...eadline-fix-sched_dl_global_validate.patch | 143 +++++
 ...eenable-interrupts-in-do_sched_yield.patch |  45 ++
 ...oc-fix-parsing-function-like-typedef.patch |  55 ++
 ...l-doc-restore-anonymous-enum-parsing.patch |  41 ++
 ...acraid-improve-compat_ioctl-handlers.patch | 165 ++++++
 ...fix-vpd-lun-id-designator-priorities.patch | 261 +++++++++
 ...-fix-error-return-code-in-fnic_probe.patch |  38 ++
 ...ix-up-probe-error-handling-for-v3-hw.patch | 108 ++++
 ...-fix-inappropriate-use-of-put_device.patch |  42 ++
 ...m80xx-do-not-sleep-in-atomic-context.patch |  51 ++
 ...fix-error-return-in-pm8001_pci_probe.patch |  41 ++
 ...ssing-destroy_workqueue-on-error-in-.patch |  47 ++
 ...-fw-initialization-error-on-big-endi.patch | 104 ++++
 ...x-n2n-and-nvme-connect-retry-failure.patch | 138 +++++
 ...oid-to-call-req_clks_off-to-clks_off.patch |  38 ++
 .../scsi-ufs-fix-clkgating-on-off.patch       |  53 ++
 ...test-bpf-add-missed-ip6ip6-test-back.patch | 242 +++++++++
 ...selftests-bpf-fix-broken-riscv-build.patch |  48 ++
 ...x-invalid-use-of-strncat-in-test_soc.patch | 109 ++++
 ...ts-run_kselftest.sh-fix-dry-run-typo.patch |  35 ++
 ...lftests-seccomp-update-kernel-config.patch |  39 ++
 ...r-initialization-in-inode_doinit_wit.patch |  62 +++
 ...e_doinit_with_dentry-label_invalid-e.patch | 101 ++++
 ...avoid-type-mismatch-for-seq_buf_init.patch |  68 +++
 ...-fix-reference-leak-in-mtk8250_probe.patch |  55 ++
 queue-5.10/series                             | 508 ++++++++++++++++++
 ...-potential-null-dereference-in-qcom_.patch |  62 +++
 ...-ctrl-avoid-sending-power-requests-w.patch |  51 ++
 ...le-io_uring-kernel-thread-privileges.patch |  43 ++
 ...as-add-missing-put_device-call-in-me.patch |  43 ++
 ...ck-if-power-domains-can-be-powered-o.patch |  55 ++
 ...eni-more-properly-switch-to-dma-mode.patch | 107 ++++
 .../soc-qcom-initialize-local-variable.patch  |  48 ++
 ...ile-sysc-fix-some-leaks-in-rmobile_i.patch |  36 ++
 ...domain-fix-error-return-code-in-rock.patch |  38 ++
 ...eference-imbalance-in-knav_dma_probe.patch |  73 +++
 ...-fix-reference-leak-in-knav_queue_pr.patch |  36 ++
 ...do-not-check-rstst-bit-on-deassert-i.patch |  39 ++
 ...bug_locks_warn_on-for-uninitialized-.patch |  83 +++
 ...ter-use-pm_runtime_set_active-on-add.patch |  75 +++
 ...ix-build-failure-when-slimbus-is-mod.patch |  48 ++
 ...ng-of-page-table-constructor-failure.patch |  43 ++
 ...speakup-fix-uninitialized-flush_lock.patch |  39 ++
 ...i-fix-missing-clk_disable_unprepare-.patch |  42 ++
 ...build-error-by-selecting-multiplexer.patch |  44 ++
 ...rror-return-code-in-dw_spi_bt1_probe.patch |  42 ++
 ...-leak-for-drivers-without-.remove-ca.patch |  80 +++
 ...ix-reference-leak-in-img_spfi_resume.patch |  41 ++
 ...reference-leak-in-two-imx-operations.patch |  46 ++
 ...issing-clk_disable_unprepare-on-erro.patch |  45 ++
 ...-fix-reference-leak-in-mxs_spi_probe.patch |  37 ++
 ...-use-max_native_cs-instead-of-num_ch.patch |  57 ++
 ...reference-leak-in-spi_mem_access_sta.patch |  37 ++
 ...-fix-reference-leak-in-ti_qspi_setup.patch |  37 ++
 ...ix-reference-leak-in-sprd_spi_remove.patch |  38 ++
 ...x-reference-leak-in-stm32_spi_resume.patch |  38 ++
 ...ix-reference-leak-in-stm32-qspi-oper.patch |  55 ++
 ...-fix-reference-leak-in-tegra-spi-ops.patch |  46 ++
 ...sh-fix-reference-leak-in-tegra_sflas.patch |  37 ++
 ...k-fix-reference-leak-in-slink-ops-of.patch |  46 ++
 ...-bcm2835-fix-vchiq_mmal-dependencies.patch |  58 ++
 ...nterrupt-fix-the-missed-eventfd_ctx_.patch |  65 +++
 ...audio-fix-possible-leak-free-widgets.patch |  44 ++
 ...codecs-fix-reference-counter-leak-in.patch |  47 ++
 ...21-spmi-pmic-fix-error-return-code-i.patch |  42 ++
 ...ad_xdr_buf-for-partial-pages-receive.patch |  55 ++
 ...up-should-wake-up-tasks-in-the-corre.patch | 118 ++++
 ..._transport-needs-to-support-the-neti.patch | 185 +++++++
 ...missing-libcap-to-test-all.bin-targe.patch |  81 +++
 ...return-code-in-ubifs_init_authentica.patch |  41 ++
 queue-5.10/um-chan_xterm-fix-fd-leak.patch    |  66 +++
 ...nitor-error-events-in-irq-controller.patch |  36 ++
 ...y-fix-handling-of-close-in-tty-lines.patch |  49 ++
 ...x-pm-disable-depth-umbalance-in-ehci.patch |  39 ++
 ...x-return-error-code-in-max3421_probe.patch |  47 ++
 ...hp-hcd-fix-memory-leak-in-oxu_create.patch |  42 ++
 ...ite-memory-barrier-after-updating-cq.patch |  44 ++
 ...io_remap_pfn_range-for-pci-io-memory.patch |  46 ++
 ...rror-return-code-in-vhost_scsi_set_e.patch |  39 ++
 ...l_lcdfb-fix-return-error-code-in-atm.patch |  40 ++
 .../virtio_net-fix-error-code-in-probe.patch  |  39 ++
 ...and-paste-bugs-in-vring_create_virtq.patch |  44 ++
 ...tio_ring-fix-two-use-after-free-bugs.patch |  64 +++
 queue-5.10/virtiofs-fix-leak-in-setup.patch   |  38 ++
 ...37xx-add-missing-dependency-on-has_i.patch |  48 ++
 ...-coh901327-add-common_clk-dependency.patch |  45 ++
 ...ential-dereferencing-of-null-pointer.patch |  71 +++
 ...oid-context-switch-in-restart-handle.patch |  69 +++
 ...-add-missing-dependency-on-has_iomem.patch |  41 ++
 ...eck-busy-bit-before-new-loading-rath.patch |  74 +++
 ...move-watchdog-disable-from-resume-fa.patch |  54 ++
 ...pic-enablement-without-interrupt-rem.patch | 105 ++++
 ...ore-btf-if-the-single-stepping-is-ca.patch |  46 ++
 ...the-detection-of-invalid-notifier-pr.patch |  60 +++
 ...-check-for-errors-from-ident_pud_ini.patch |  73 +++
 509 files changed, 33235 insertions(+)
 create mode 100644 queue-5.10/adm8211-fix-error-return-code-in-adm8211_probe.patch
 create mode 100644 queue-5.10/alsa-hda-hdmi-fix-silent-stream-for-first-playback-t.patch
 create mode 100644 queue-5.10/arm-9030-1-entry-omit-fp-emulation-for-und-exception.patch
 create mode 100644 queue-5.10/arm-9036-1-uncompress-fix-dbgadtb-size-parameter-nam.patch
 create mode 100644 queue-5.10/arm-9044-1-vfp-use-undef-hook-for-vfp-support-detect.patch
 create mode 100644 queue-5.10/arm-dts-aspeed-g6-fix-the-gpio-memory-size.patch
 create mode 100644 queue-5.10/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch
 create mode 100644 queue-5.10/arm-dts-aspeed-tiogapass-remove-vuart.patch
 create mode 100644 queue-5.10/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch
 create mode 100644 queue-5.10/arm-dts-at91-sam9x60-add-pincontrol-for-usb-host.patch
 create mode 100644 queue-5.10/arm-dts-at91-sam9x60ek-remove-bypass-property.patch
 create mode 100644 queue-5.10/arm-dts-at91-sama5d2-map-securam-as-device.patch
 create mode 100644 queue-5.10/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch
 create mode 100644 queue-5.10/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch
 create mode 100644 queue-5.10/arm-dts-meson-fix-phy-deassert-timing-requirements.patch
 create mode 100644 queue-5.10/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch
 create mode 100644 queue-5.10/arm-dts-tacoma-fix-node-vs-reg-mismatch-for-flash-me.patch
 create mode 100644 queue-5.10/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch
 create mode 100644 queue-5.10/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch
 create mode 100644 queue-5.10/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch
 create mode 100644 queue-5.10/arm64-dts-exynos-include-common-syscon-restart-power.patch
 create mode 100644 queue-5.10/arm64-dts-freescale-sl28-combine-spi-mtd-partitions.patch
 create mode 100644 queue-5.10/arm64-dts-ipq6018-update-the-reserved-memory-node.patch
 create mode 100644 queue-5.10/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch
 create mode 100644 queue-5.10/arm64-dts-ls1028a-fix-flexspi-clock-input.patch
 create mode 100644 queue-5.10/arm64-dts-mediatek-mt8183-fix-gce-incorrect-mbox-cel.patch
 create mode 100644 queue-5.10/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch
 create mode 100644 queue-5.10/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch
 create mode 100644 queue-5.10/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch
 create mode 100644 queue-5.10/arm64-dts-meson-g12b-odroid-n2-fix-phy-deassert-timi.patch
 create mode 100644 queue-5.10/arm64-dts-meson-g12b-w400-fix-phy-deassert-timing-re.patch
 create mode 100644 queue-5.10/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-c630-fix-pinctrl-pins-properties.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-msm8916-samsung-a2015-disable-muic-i2.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sc7180-fix-one-forgotten-interconnect.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sc7180-limit-ipa-iommu-streams.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sdm845-limit-ipa-iommu-streams.patch
 create mode 100644 queue-5.10/arm64-dts-qcom-sm8250-correct-compatible-for-sm8250-.patch
 create mode 100644 queue-5.10/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch
 create mode 100644 queue-5.10/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch
 create mode 100644 queue-5.10/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch
 create mode 100644 queue-5.10/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch
 create mode 100644 queue-5.10/arm64-dts-ti-k3-am65-j721e-fix-unit-address-format-e.patch
 create mode 100644 queue-5.10/arm64-mte-fix-prctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch
 create mode 100644 queue-5.10/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch
 create mode 100644 queue-5.10/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch
 create mode 100644 queue-5.10/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch
 create mode 100644 queue-5.10/asoc-atmel-mchp-spdifrx-needs-common_clk.patch
 create mode 100644 queue-5.10/asoc-cros_ec_codec-fix-uninitialized-memory-read.patch
 create mode 100644 queue-5.10/asoc-intel-boards-tgl_max98373-update-tdm-slot_width.patch
 create mode 100644 queue-5.10/asoc-intel-snd_soc_intel_keembay-should-depend-on-ar.patch
 create mode 100644 queue-5.10/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch
 create mode 100644 queue-5.10/asoc-max98390-fix-error-codes-in-max98390_dsm_init.patch
 create mode 100644 queue-5.10/asoc-meson-fix-compile_test-error.patch
 create mode 100644 queue-5.10/asoc-pcm-drain-support-reactivation.patch
 create mode 100644 queue-5.10/asoc-q6afe-clocks-add-missing-parent-clock-rate.patch
 create mode 100644 queue-5.10/asoc-qcom-common-fix-refcounting-in-qcom_snd_parse_o.patch
 create mode 100644 queue-5.10/asoc-qcom-fix-qdsp6-dependencies-attempt-3.patch
 create mode 100644 queue-5.10/asoc-qcom-fix-unsigned-int-bitwidth-compared-to-less.patch
 create mode 100644 queue-5.10/asoc-sof-intel-fix-kconfig-dependency-for-snd_intel_.patch
 create mode 100644 queue-5.10/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch
 create mode 100644 queue-5.10/asoc-wm8994-fix-pm-disable-depth-imbalance-on-error.patch
 create mode 100644 queue-5.10/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch
 create mode 100644 queue-5.10/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch
 create mode 100644 queue-5.10/ath10k-fix-an-error-handling-path.patch
 create mode 100644 queue-5.10/ath10k-fix-the-parsing-error-in-service-available-ev.patch
 create mode 100644 queue-5.10/ath10k-release-some-resources-in-an-error-handling-p.patch
 create mode 100644 queue-5.10/ath11k-don-t-cast-ath11k_skb_cb-to-ieee80211_tx_info.patch
 create mode 100644 queue-5.10/ath11k-fix-an-error-handling-path.patch
 create mode 100644 queue-5.10/ath11k-fix-incorrect-tlvs-in-scan-start-command.patch
 create mode 100644 queue-5.10/ath11k-fix-number-of-rules-in-filtered-etsi-regdomai.patch
 create mode 100644 queue-5.10/ath11k-fix-the-rx_filter-flag-setting-for-peer-rssi-.patch
 create mode 100644 queue-5.10/ath11k-fix-wmi-init-configuration.patch
 create mode 100644 queue-5.10/ath11k-handle-errors-if-peer-creation-fails.patch
 create mode 100644 queue-5.10/ath11k-initialize-complete-alpha2-for-regulatory-cha.patch
 create mode 100644 queue-5.10/ath11k-reset-ath11k_skb_cb-before-setting-new-flags.patch
 create mode 100644 queue-5.10/block-rnbd-clt-dynamically-alloc-buffer-for-pathname.patch
 create mode 100644 queue-5.10/block-rnbd-clt-fix-possible-memleak.patch
 create mode 100644 queue-5.10/block-rnbd-clt-get-rid-of-warning-regarding-size-arg.patch
 create mode 100644 queue-5.10/block-rnbd-fix-a-null-pointer-dereference-on-dev-blk.patch
 create mode 100644 queue-5.10/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch
 create mode 100644 queue-5.10/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch
 create mode 100644 queue-5.10/bluetooth-btusb-fix-detection-of-some-fake-csr-contr.patch
 create mode 100644 queue-5.10/bluetooth-fix-ll-privacy-ble-device-fails-to-connect.patch
 create mode 100644 queue-5.10/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch
 create mode 100644 queue-5.10/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch
 create mode 100644 queue-5.10/bluetooth-sco-fix-crash-when-using-bt_sndmtu-bt_rcvm.patch
 create mode 100644 queue-5.10/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch
 create mode 100644 queue-5.10/bpf-fix-tests-for-local_storage.patch
 create mode 100644 queue-5.10/brcmfmac-fix-error-return-code-in-brcmf_cfg80211_con.patch
 create mode 100644 queue-5.10/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch
 create mode 100644 queue-5.10/bus-fsl-mc-add-back-accidentally-dropped-error-check.patch
 create mode 100644 queue-5.10/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch
 create mode 100644 queue-5.10/bus-mhi-core-fix-null-pointer-access-when-parsing-mh.patch
 create mode 100644 queue-5.10/bus-mhi-core-remove-double-locking-from-mhi_driver_r.patch
 create mode 100644 queue-5.10/can-m_can-m_can_config_endisable-remove-double-clear.patch
 create mode 100644 queue-5.10/checkpatch-fix-unescaped-left-brace.patch
 create mode 100644 queue-5.10/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch
 create mode 100644 queue-5.10/clk-at91-sama7g5-fix-compilation-error.patch
 create mode 100644 queue-5.10/clk-bcm-dvp-add-module_device_table.patch
 create mode 100644 queue-5.10/clk-fsl-sai-fix-memory-leak.patch
 create mode 100644 queue-5.10/clk-meson-kconfig-fix-dependency-for-g12a.patch
 create mode 100644 queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-sdcc-clks.patch
 create mode 100644 queue-5.10/clk-renesas-r8a779a0-fix-r-and-osc-clocks.patch
 create mode 100644 queue-5.10/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch
 create mode 100644 queue-5.10/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch
 create mode 100644 queue-5.10/clk-tegra-fix-duplicated-se-clock-entry.patch
 create mode 100644 queue-5.10/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch
 create mode 100644 queue-5.10/clk-vc5-use-idt-voltage-microvolt-instead-of-idt-vol.patch
 create mode 100644 queue-5.10/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch
 create mode 100644 queue-5.10/clocksource-drivers-arm_arch_timer-use-stable-count-.patch
 create mode 100644 queue-5.10/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch
 create mode 100644 queue-5.10/clocksource-drivers-ingenic-fix-section-mismatch.patch
 create mode 100644 queue-5.10/clocksource-drivers-orion-add-missing-clk_disable_un.patch
 create mode 100644 queue-5.10/clocksource-drivers-riscv-make-riscv_timer-depends-o.patch
 create mode 100644 queue-5.10/coresight-remove-broken-__exit-annotations.patch
 create mode 100644 queue-5.10/cpufreq-ap806-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-highbank-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-imx-fix-nvmem_imx_ocotp-dependency.patch
 create mode 100644 queue-5.10/cpufreq-loongson1-add-missing-module_alias.patch
 create mode 100644 queue-5.10/cpufreq-mediatek-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-qcom-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-scpi-add-missing-module_alias.patch
 create mode 100644 queue-5.10/cpufreq-st-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-sun50i-add-missing-module_device_table.patch
 create mode 100644 queue-5.10/cpufreq-vexpress-spc-add-missing-module_alias.patch
 create mode 100644 queue-5.10/crypto-arm-aes-neonbs-fix-usage-of-cbc-aes-fallback.patch
 create mode 100644 queue-5.10/crypto-arm64-poly1305-neon-reorder-pac-authenticatio.patch
 create mode 100644 queue-5.10/crypto-atmel-i2c-select-config_bitreverse.patch
 create mode 100644 queue-5.10/crypto-caam-fix-printing-on-xts-fallback-allocation-.patch
 create mode 100644 queue-5.10/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch
 create mode 100644 queue-5.10/crypto-inside-secure-fix-sizeof-mismatch.patch
 create mode 100644 queue-5.10/crypto-kconfig-crypto_manager_extra_tests-requires-t.patch
 create mode 100644 queue-5.10/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch
 create mode 100644 queue-5.10/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch
 create mode 100644 queue-5.10/crypto-sun8i-ce-fix-two-error-path-s-memory-leak.patch
 create mode 100644 queue-5.10/crypto-talitos-endianess-in-current_desc_hdr.patch
 create mode 100644 queue-5.10/crypto-talitos-fix-return-type-of-current_desc_hdr.patch
 create mode 100644 queue-5.10/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch
 create mode 100644 queue-5.10/devlink-use-_bitul-macro-instead-of-bit-in-the-uapi-.patch
 create mode 100644 queue-5.10/dm-ioctl-fix-error-return-code-in-target_message.patch
 create mode 100644 queue-5.10/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch
 create mode 100644 queue-5.10/dmaengine-ti-k3-udma-correct-normal-channel-offset-w.patch
 create mode 100644 queue-5.10/dpaa2-eth-fix-the-size-of-the-mapped-sgt-buffer.patch
 create mode 100644 queue-5.10/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch
 create mode 100644 queue-5.10/drm-amdgpu-fix-build_coefficients-argument.patch
 create mode 100644 queue-5.10/drm-amdgpu-fix-compute-queue-priority-if-num_kcq-is-.patch
 create mode 100644 queue-5.10/drm-amdgpu-fix-incorrect-enum-type.patch
 create mode 100644 queue-5.10/drm-amdgpu-fix-regression-in-vbios-reservation-handl.patch
 create mode 100644 queue-5.10/drm-amdkfd-put-acpi-table-after-using-it.patch
 create mode 100644 queue-5.10/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch
 create mode 100644 queue-5.10/drm-bridge-tpd12s015-fix-irq-registering-in-tpd12s01.patch
 create mode 100644 queue-5.10/drm-edid-fix-uninitialized-variable-in-drm_cvt_modes.patch
 create mode 100644 queue-5.10/drm-gma500-fix-double-free-of-gma_connector.patch
 create mode 100644 queue-5.10/drm-imx-dcss-fix-rotations-for-vivante-tiled-formats.patch
 create mode 100644 queue-5.10/drm-mcde-fix-handling-of-platform_get_irq-error.patch
 create mode 100644 queue-5.10/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch
 create mode 100644 queue-5.10/drm-mediatek-use-correct-aliases-name-for-ovl.patch
 create mode 100644 queue-5.10/drm-meson-dw-hdmi-disable-clocks-on-driver-teardown.patch
 create mode 100644 queue-5.10/drm-meson-dw-hdmi-enable-the-iahb-clock-early-enough.patch
 create mode 100644 queue-5.10/drm-meson-dw-hdmi-ensure-that-clocks-are-enabled-bef.patch
 create mode 100644 queue-5.10/drm-meson-dw-hdmi-register-a-callback-to-disable-the.patch
 create mode 100644 queue-5.10/drm-meson-free-rdma-resources-after-tearing-down-drm.patch
 create mode 100644 queue-5.10/drm-meson-unbind-all-connectors-on-module-removal.patch
 create mode 100644 queue-5.10/drm-msm-a5xx-clear-shadow-on-suspend.patch
 create mode 100644 queue-5.10/drm-msm-a5xx-make-preemption-reset-case-reentrant.patch
 create mode 100644 queue-5.10/drm-msm-a6xx-clear-shadow-on-suspend.patch
 create mode 100644 queue-5.10/drm-msm-add-iommu_support-dependency.patch
 create mode 100644 queue-5.10/drm-msm-add-missing-stub-definition.patch
 create mode 100644 queue-5.10/drm-msm-dp-displayport-phy-compliance-tests-fixup.patch
 create mode 100644 queue-5.10/drm-msm-dp-do-not-notify-audio-subsystem-if-sink-doe.patch
 create mode 100644 queue-5.10/drm-msm-dp-return-correct-connection-status-after-su.patch
 create mode 100644 queue-5.10/drm-msm-dp-skip-checking-link_status_updated-bit.patch
 create mode 100644 queue-5.10/drm-msm-dpu-fix-clock-scaling-on-non-sc7180-board.patch
 create mode 100644 queue-5.10/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch
 create mode 100644 queue-5.10/drm-msm-dsi_pll_7nm-restore-vco-rate-during-restore_.patch
 create mode 100644 queue-5.10/drm-mxsfb-silence-eprobe_defer-while-waiting-for-bri.patch
 create mode 100644 queue-5.10/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch
 create mode 100644 queue-5.10/drm-panel-simple-add-flags-to-boe_nv133fhm_n61.patch
 create mode 100644 queue-5.10/drm-tve200-fix-handling-of-platform_get_irq-error.patch
 create mode 100644 queue-5.10/drm-udl-fix-missing-error-code-in-udl_handle_damage.patch
 create mode 100644 queue-5.10/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch
 create mode 100644 queue-5.10/epoll-check-for-events-when-removing-a-timed-out-thr.patch
 create mode 100644 queue-5.10/erofs-avoid-using-generic_block_bmap.patch
 create mode 100644 queue-5.10/extcon-max77693-fix-modalias-string.patch
 create mode 100644 queue-5.10/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch
 create mode 100644 queue-5.10/f2fs-fix-double-free-of-unicode-map.patch
 create mode 100644 queue-5.10/firmware-arm_scmi-fix-missing-destroy_workqueue.patch
 create mode 100644 queue-5.10/firmware-tegra-fix-strncpy-strncat-confusion.patch
 create mode 100644 queue-5.10/fs-handle-i_dontcache-in-iput_final-instead-of-gener.patch
 create mode 100644 queue-5.10/fsi-aspeed-add-mutex-to-protect-hw-access.patch
 create mode 100644 queue-5.10/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch
 create mode 100644 queue-5.10/gpiolib-irq-hooks-fix-recursion-in-gpiochip_irq_unma.patch
 create mode 100644 queue-5.10/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch
 create mode 100644 queue-5.10/hugetlb-fix-an-error-code-in-hugetlb_reserve_pages.patch
 create mode 100644 queue-5.10/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch
 create mode 100644 queue-5.10/i40e-xsk-clear-the-status-bits-for-the-next_to_use-d.patch
 create mode 100644 queue-5.10/ice-xsk-clear-the-status-bits-for-the-next_to_use-de.patch
 create mode 100644 queue-5.10/iio-adc-at91_adc-add-kconfig-dep-on-the-of-symbol-an.patch
 create mode 100644 queue-5.10/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch
 create mode 100644 queue-5.10/input-ads7846-fix-integer-overflow-on-rt-calculation.patch
 create mode 100644 queue-5.10/input-ads7846-fix-race-that-causes-missing-releases.patch
 create mode 100644 queue-5.10/input-ads7846-fix-unaligned-access-on-7845.patch
 create mode 100644 queue-5.10/input-omap4-keypad-fix-runtime-pm-error-handling.patch
 create mode 100644 queue-5.10/io_uring-cancel-only-requests-of-current-task.patch
 create mode 100644 queue-5.10/io_uring-cancel-reqs-shouldn-t-kill-overflow-list.patch
 create mode 100644 queue-5.10/io_uring-fix-racy-iopoll-flush-overflow.patch
 create mode 100644 queue-5.10/iommu-vt-d-include-conditionally-on-config_intel_iom.patch
 create mode 100644 queue-5.10/ionic-change-set_rx_mode-from_ndo-to-can_sleep.patch
 create mode 100644 queue-5.10/ionic-flatten-calls-to-ionic_lif_rx_mode.patch
 create mode 100644 queue-5.10/ionic-use-mc-sync-for-multicast-filters.patch
 create mode 100644 queue-5.10/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch
 create mode 100644 queue-5.10/irqchip-qcom-pdc-fix-phantom-irq-when-changing-betwe.patch
 create mode 100644 queue-5.10/irqchip-ti-sci-inta-fix-printing-of-inta-id-on-probe.patch
 create mode 100644 queue-5.10/irqchip-ti-sci-intr-fix-freeing-of-irqs.patch
 create mode 100644 queue-5.10/iwlwifi-dbg-tlv-fix-old-length-in-is_trig_data_conta.patch
 create mode 100644 queue-5.10/iwlwifi-mvm-hook-up-missing-rx-handlers.patch
 create mode 100644 queue-5.10/kconfig-fix-return-value-of-do_error_if.patch
 create mode 100644 queue-5.10/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch
 create mode 100644 queue-5.10/leds-lp50xx-fix-an-error-handling-path-in-lp50xx_pro.patch
 create mode 100644 queue-5.10/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch
 create mode 100644 queue-5.10/leds-turris-omnia-check-for-led_color_id_rgb-instead.patch
 create mode 100644 queue-5.10/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch
 create mode 100644 queue-5.10/libbpf-sanitise-map-names-before-pinning.patch
 create mode 100644 queue-5.10/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch
 create mode 100644 queue-5.10/lockd-don-t-use-interval-based-rebinding-over-tcp.patch
 create mode 100644 queue-5.10/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch
 create mode 100644 queue-5.10/mac80211-fix-a-mistake-check-for-rx_stats-update.patch
 create mode 100644 queue-5.10/macintosh-adb-iop-always-wait-for-reply-message-from.patch
 create mode 100644 queue-5.10/macintosh-adb-iop-send-correct-poll-command.patch
 create mode 100644 queue-5.10/mailbox-arm_mhu_db-fix-mhu_db_shutdown-by-replacing-.patch
 create mode 100644 queue-5.10/media-cedrus-fix-reference-leak-in-cedrus_start_stre.patch
 create mode 100644 queue-5.10/media-i2c-imx219-selection-compliance-fixes.patch
 create mode 100644 queue-5.10/media-imx214-fix-stop-streaming.patch
 create mode 100644 queue-5.10/media-max2175-fix-max2175_set_csm_mode-error-code.patch
 create mode 100644 queue-5.10/media-max9271-fix-gpio-enable-disable.patch
 create mode 100644 queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch
 create mode 100644 queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-4640
 create mode 100644 queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-7942
 create mode 100644 queue-5.10/media-ov5640-fix-support-of-bt656-bus-mode.patch
 create mode 100644 queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch
 create mode 100644 queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch-21183
 create mode 100644 queue-5.10/media-rdacm20-enable-gpio1-explicitly.patch
 create mode 100644 queue-5.10/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch
 create mode 100644 queue-5.10/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch
 create mode 100644 queue-5.10/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch
 create mode 100644 queue-5.10/media-staging-rkisp1-cap-fix-runtime-pm-imbalance-on.patch
 create mode 100644 queue-5.10/media-tm6000-fix-sizeof-mismatches.patch
 create mode 100644 queue-5.10/media-tvp5150-fix-wrong-return-value-of-tvp5150_pars.patch
 create mode 100644 queue-5.10/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch
 create mode 100644 queue-5.10/media-v4l2-fwnode-v4l2_fwnode_endpoint_parse-caller-.patch
 create mode 100644 queue-5.10/media-venus-core-change-clk-enable-and-disable-order.patch
 create mode 100644 queue-5.10/media-venus-core-vote-for-video-mem-path.patch
 create mode 100644 queue-5.10/media-venus-core-vote-with-average-bandwidth-and-pea.patch
 create mode 100644 queue-5.10/media-venus-put-dummy-vote-on-video-mem-path-after-l.patch
 create mode 100644 queue-5.10/memory-jz4780_nemc-fix-potential-null-dereference-in.patch
 create mode 100644 queue-5.10/memory-ti-emif-sram-only-build-for-armv7.patch
 create mode 100644 queue-5.10/memstick-fix-a-double-free-bug-in-memstick_check.patch
 create mode 100644 queue-5.10/memstick-r592-fix-error-return-in-r592_probe.patch
 create mode 100644 queue-5.10/mfd-cpcap-fix-interrupt-regression-with-regmap-clear.patch
 create mode 100644 queue-5.10/mfd-htc-i2cpld-add-the-missed-i2c_put_adapter-in-htc.patch
 create mode 100644 queue-5.10/mfd-mfd_sl28cpld-should-depend-on-arch_layerscape.patch
 create mode 100644 queue-5.10/mfd-stmfx-fix-dev_err_probe-call-in-stmfx_chip_init.patch
 create mode 100644 queue-5.10/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch
 create mode 100644 queue-5.10/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch
 create mode 100644 queue-5.10/mips-don-t-round-up-kernel-sections-size-for-membloc.patch
 create mode 100644 queue-5.10/misc-pci_endpoint_test-fix-return-value-of-error-bra.patch
 create mode 100644 queue-5.10/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch
 create mode 100644 queue-5.10/mm-gup-combine-put_compound_head-and-unpin_user_page.patch
 create mode 100644 queue-5.10/mm-gup-prevent-gup_fast-from-racing-with-cow-during-.patch
 create mode 100644 queue-5.10/mm-gup-reorganize-internal_get_user_pages_fast.patch
 create mode 100644 queue-5.10/mm-memcg-slab-fix-return-of-child-memcg-objcg-for-ro.patch
 create mode 100644 queue-5.10/mm-memcg-slab-fix-use-after-free-in-obj_cgroup_charg.patch
 create mode 100644 queue-5.10/mm-memory_failure-always-pin-the-page-in-madvise_inj.patch
 create mode 100644 queue-5.10/mm-rmap-always-do-ttu_ignore_access.patch
 create mode 100644 queue-5.10/mm-vmalloc-fix-unlock-order-in-s_stop.patch
 create mode 100644 queue-5.10/mm-vmalloc.c-fix-kasan-shadow-poisoning-size.patch
 create mode 100644 queue-5.10/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch
 create mode 100644 queue-5.10/mmc-sdhci-tegra-fix-wrong-unit-with-busy_timeout.patch
 create mode 100644 queue-5.10/mt76-dma-fix-possible-deadlock-running-mt76_dma_clea.patch
 create mode 100644 queue-5.10/mt76-fix-memory-leak-if-device-probing-fails.patch
 create mode 100644 queue-5.10/mt76-fix-tkip-configuration-for-mt7615-7663-devices.patch
 create mode 100644 queue-5.10/mt76-mt7663s-fix-a-possible-ple-quota-underflow.patch
 create mode 100644 queue-5.10/mt76-mt7915-set-fops_sta_stats.owner-to-this_module.patch
 create mode 100644 queue-5.10/mt76-set-fops_tx_stats.owner-to-this_module.patch
 create mode 100644 queue-5.10/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch
 create mode 100644 queue-5.10/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch
 create mode 100644 queue-5.10/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch
 create mode 100644 queue-5.10/mtd-spi-nor-atmel-fix-unlock_all-for-at25fs010-040.patch
 create mode 100644 queue-5.10/mtd-spi-nor-atmel-remove-global-protection-flag.patch
 create mode 100644 queue-5.10/mtd-spi-nor-ignore-errors-in-spi_nor_unlock_all.patch
 create mode 100644 queue-5.10/mtd-spi-nor-sst-fix-bpn-bits-for-the-sst25vf064c.patch
 create mode 100644 queue-5.10/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch
 create mode 100644 queue-5.10/net-allwinner-fix-some-resources-leak-in-the-error-h.patch
 create mode 100644 queue-5.10/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch
 create mode 100644 queue-5.10/net-dsa-qca-ar9331-fix-sleeping-function-called-from.patch
 create mode 100644 queue-5.10/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch
 create mode 100644 queue-5.10/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch
 create mode 100644 queue-5.10/net-korina-fix-return-value.patch
 create mode 100644 queue-5.10/net-mlx5-properly-convey-driver-version-to-firmware.patch
 create mode 100644 queue-5.10/net-mscc-ocelot-fix-a-resource-leak-in-the-error-han.patch
 create mode 100644 queue-5.10/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch
 create mode 100644 queue-5.10/nfc-s3fwrn5-release-the-nfc-firmware.patch
 create mode 100644 queue-5.10/nfp-move-indirect-block-cleanup-to-flower-app-stop-c.patch
 create mode 100644 queue-5.10/nfs-pnfs-fix-a-typo-in-ff_layout_resend_pnfs_read.patch
 create mode 100644 queue-5.10/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch
 create mode 100644 queue-5.10/nfs_common-need-lock-during-iterate-through-the-list.patch
 create mode 100644 queue-5.10/nfsd-fix-5-seconds-delay-when-doing-inter-server-cop.patch
 create mode 100644 queue-5.10/nfsd-fix-message-level-for-normal-termination.patch
 create mode 100644 queue-5.10/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch
 create mode 100644 queue-5.10/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch
 create mode 100644 queue-5.10/nl80211-cfg80211-fix-potential-infinite-loop.patch
 create mode 100644 queue-5.10/orinoco-move-context-allocation-after-processing-the.patch
 create mode 100644 queue-5.10/pci-bounds-check-command-line-resource-alignment-req.patch
 create mode 100644 queue-5.10/pci-brcmstb-initialize-tmp-before-use.patch
 create mode 100644 queue-5.10/pci-disable-msi-for-pericom-pcie-usb-adapter.patch
 create mode 100644 queue-5.10/pci-fix-overflow-in-command-line-resource-alignment-.patch
 create mode 100644 queue-5.10/pci-iproc-fix-out-of-bound-array-accesses.patch
 create mode 100644 queue-5.10/pci-iproc-invalidate-correct-paxb-inbound-windows.patch
 create mode 100644 queue-5.10/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch
 create mode 100644 queue-5.10/perf-record-fix-memory-leak-when-using-user-regs-to-.patch
 create mode 100644 queue-5.10/perf-test-fix-metric-parsing-test.patch
 create mode 100644 queue-5.10/perf-test-use-generic-event-for-expand_libpfm_events.patch
 create mode 100644 queue-5.10/phy-mediatek-allow-compile-testing-the-hdmi-phy.patch
 create mode 100644 queue-5.10/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch
 create mode 100644 queue-5.10/phy-tegra-xusb-fix-usb_phy-device-driver-field.patch
 create mode 100644 queue-5.10/pinctrl-core-add-missing-ifdef-config_gpiolib.patch
 create mode 100644 queue-5.10/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch
 create mode 100644 queue-5.10/pinctrl-sunxi-fix-irq-bank-map-for-the-allwinner-a10.patch
 create mode 100644 queue-5.10/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch
 create mode 100644 queue-5.10/platform-x86-dell-smbios-base-fix-error-return-code-.patch
 create mode 100644 queue-5.10/platform-x86-intel-vbtn-fix-sw_tablet_mode-always-re.patch
 create mode 100644 queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch
 create mode 100644 queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch-3823
 create mode 100644 queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch
 create mode 100644 queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch
 create mode 100644 queue-5.10/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch
 create mode 100644 queue-5.10/power-supply-bq24190_charger-fix-reference-leak.patch
 create mode 100644 queue-5.10/power-supply-bq25890-use-the-correct-range-for-iilim.patch
 create mode 100644 queue-5.10/power-supply-max17042_battery-fix-current_-avg-now-h.patch
 create mode 100644 queue-5.10/powerpc-32s-fix-cleanup_cpu_mmu_context-compile-bug.patch
 create mode 100644 queue-5.10/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch
 create mode 100644 queue-5.10/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch
 create mode 100644 queue-5.10/powerpc-avoid-broken-gcc-__attribute__-optimize.patch
 create mode 100644 queue-5.10/powerpc-boot-fix-build-of-dts-fsl.patch
 create mode 100644 queue-5.10/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch
 create mode 100644 queue-5.10/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch
 create mode 100644 queue-5.10/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch
 create mode 100644 queue-5.10/powerpc-perf-fix-the-pmu-group-constraints-for-thres.patch
 create mode 100644 queue-5.10/powerpc-perf-fix-threshold-event-counter-multiplier-.patch
 create mode 100644 queue-5.10/powerpc-perf-fix-to-update-radix_scope_qual-in-power.patch
 create mode 100644 queue-5.10/powerpc-perf-update-the-pmu-group-constraints-for-l2.patch
 create mode 100644 queue-5.10/powerpc-powermac-fix-low_sleep_handler-with-config_v.patch
 create mode 100644 queue-5.10/powerpc-powernv-sriov-fix-unsigned-int-win-compared-.patch
 create mode 100644 queue-5.10/powerpc-ps3-use-dma_mapping_error.patch
 create mode 100644 queue-5.10/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch
 create mode 100644 queue-5.10/powerpc-pseries-hibernation-remove-redundant-cachein.patch
 create mode 100644 queue-5.10/powerpc-smp-add-__init-to-init_big_cores.patch
 create mode 100644 queue-5.10/powerpc-sstep-cover-new-vsx-instructions-under-confi.patch
 create mode 100644 queue-5.10/powerpc-sstep-emulate-prefixed-instructions-only-whe.patch
 create mode 100644 queue-5.10/powerpc-xmon-fix-build-failure-for-8xx.patch
 create mode 100644 queue-5.10/proc-fix-lookup-in-proc-net-subdirectories-after-set.patch
 create mode 100644 queue-5.10/proc-mountinfo-make-splice-available-again.patch
 create mode 100644 queue-5.10/pwm-imx27-fix-overflow-for-bigger-periods.patch
 create mode 100644 queue-5.10/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch
 create mode 100644 queue-5.10/pwm-sun4i-remove-erroneous-else-branch.patch
 create mode 100644 queue-5.10/pwm-zx-add-missing-cleanup-in-error-path.patch
 create mode 100644 queue-5.10/qlcnic-fix-error-code-in-probe.patch
 create mode 100644 queue-5.10/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch
 create mode 100644 queue-5.10/rcu-allow-rcu_irq_enter_check_tick-from-nmi.patch
 create mode 100644 queue-5.10/rcu-ftrace-fix-ftrace-recursion.patch
 create mode 100644 queue-5.10/rcu-tree-defer-kvfree_rcu-allocation-to-a-clean-cont.patch
 create mode 100644 queue-5.10/rdma-bnxt_re-fix-entry-size-during-srq-create.patch
 create mode 100644 queue-5.10/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch
 create mode 100644 queue-5.10/rdma-cma-add-missing-error-handling-of-listen_id.patch
 create mode 100644 queue-5.10/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch
 create mode 100644 queue-5.10/rdma-cma-fix-deadlock-on-lock-in-rdma_cma_listen_on_.patch
 create mode 100644 queue-5.10/rdma-core-do-not-indicate-device-ready-when-device-e.patch
 create mode 100644 queue-5.10/rdma-core-fix-error-return-in-_ib_modify_qp.patch
 create mode 100644 queue-5.10/rdma-core-track-device-memory-mrs.patch
 create mode 100644 queue-5.10/rdma-cxgb4-validate-the-number-of-cqes.patch
 create mode 100644 queue-5.10/rdma-hns-avoid-setting-loopback-indicator-when-smac-.patch
 create mode 100644 queue-5.10/rdma-hns-bugfix-for-calculation-of-extended-sge.patch
 create mode 100644 queue-5.10/rdma-hns-do-shift-on-traffic-class-when-using-rocev2.patch
 create mode 100644 queue-5.10/rdma-hns-fix-0-length-sge-calculation-error.patch
 create mode 100644 queue-5.10/rdma-hns-fix-missing-fields-in-address-vector.patch
 create mode 100644 queue-5.10/rdma-hns-limit-the-length-of-data-copied-between-ker.patch
 create mode 100644 queue-5.10/rdma-hns-normalization-the-judgment-of-some-features.patch
 create mode 100644 queue-5.10/rdma-hns-only-record-vlan-info-for-hip08.patch
 create mode 100644 queue-5.10/rdma-mlx5-fix-corruption-of-reg_pages-in-mlx5_ib_rer.patch
 create mode 100644 queue-5.10/rdma-mlx5-fix-mr-cache-memory-leak.patch
 create mode 100644 queue-5.10/rdma-mthca-work-around-wenum-conversion-warning.patch
 create mode 100644 queue-5.10/rdma-rtrs-clt-missing-error-from-rtrs_rdma_conn_esta.patch
 create mode 100644 queue-5.10/rdma-rtrs-clt-remove-destroy_con_cq_qp-in-case-route.patch
 create mode 100644 queue-5.10/rdma-rtrs-srv-don-t-guard-the-whole-__alloc_srv-with.patch
 create mode 100644 queue-5.10/rdma-rxe-compute-psn-windows-correctly.patch
 create mode 100644 queue-5.10/rdma-uverbs-fix-incorrect-variable-type.patch
 create mode 100644 queue-5.10/remoteproc-k3-dsp-fix-return-value-check-in-k3_dsp_r.patch
 create mode 100644 queue-5.10/remoteproc-mediatek-change-mt8192-cfg-register-base.patch
 create mode 100644 queue-5.10/remoteproc-mediatek-unprepare-clk-if-scp_before_load.patch
 create mode 100644 queue-5.10/remoteproc-mtk_scp-surround-dt-device-ids-with-confi.patch
 create mode 100644 queue-5.10/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch
 create mode 100644 queue-5.10/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch
 create mode 100644 queue-5.10/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch
 create mode 100644 queue-5.10/remoteproc-qcom-pas-fix-error-handling-in-adsp_pds_e.patch
 create mode 100644 queue-5.10/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch
 create mode 100644 queue-5.10/revert-powerpc-pseries-hotplug-cpu-remove-double-fre.patch
 create mode 100644 queue-5.10/rsi-fix-error-return-code-in-rsi_reset_card.patch
 create mode 100644 queue-5.10/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch
 create mode 100644 queue-5.10/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch
 create mode 100644 queue-5.10/s390-test_unwind-fix-call_on_stack-tests.patch
 create mode 100644 queue-5.10/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch
 create mode 100644 queue-5.10/samples-bpf-fix-possible-hang-in-xdpsock-with-multip.patch
 create mode 100644 queue-5.10/sched-deadline-fix-sched_dl_global_validate.patch
 create mode 100644 queue-5.10/sched-reenable-interrupts-in-do_sched_yield.patch
 create mode 100644 queue-5.10/scripts-kernel-doc-fix-parsing-function-like-typedef.patch
 create mode 100644 queue-5.10/scripts-kernel-doc-restore-anonymous-enum-parsing.patch
 create mode 100644 queue-5.10/scsi-aacraid-improve-compat_ioctl-handlers.patch
 create mode 100644 queue-5.10/scsi-core-fix-vpd-lun-id-designator-priorities.patch
 create mode 100644 queue-5.10/scsi-fnic-fix-error-return-code-in-fnic_probe.patch
 create mode 100644 queue-5.10/scsi-hisi_sas-fix-up-probe-error-handling-for-v3-hw.patch
 create mode 100644 queue-5.10/scsi-iscsi-fix-inappropriate-use-of-put_device.patch
 create mode 100644 queue-5.10/scsi-pm80xx-do-not-sleep-in-atomic-context.patch
 create mode 100644 queue-5.10/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch
 create mode 100644 queue-5.10/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch
 create mode 100644 queue-5.10/scsi-qla2xxx-fix-fw-initialization-error-on-big-endi.patch
 create mode 100644 queue-5.10/scsi-qla2xxx-fix-n2n-and-nvme-connect-retry-failure.patch
 create mode 100644 queue-5.10/scsi-ufs-avoid-to-call-req_clks_off-to-clks_off.patch
 create mode 100644 queue-5.10/scsi-ufs-fix-clkgating-on-off.patch
 create mode 100644 queue-5.10/selftest-bpf-add-missed-ip6ip6-test-back.patch
 create mode 100644 queue-5.10/selftests-bpf-fix-broken-riscv-build.patch
 create mode 100644 queue-5.10/selftests-bpf-fix-invalid-use-of-strncat-in-test_soc.patch
 create mode 100644 queue-5.10/selftests-run_kselftest.sh-fix-dry-run-typo.patch
 create mode 100644 queue-5.10/selftests-seccomp-update-kernel-config.patch
 create mode 100644 queue-5.10/selinux-fix-error-initialization-in-inode_doinit_wit.patch
 create mode 100644 queue-5.10/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch
 create mode 100644 queue-5.10/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch
 create mode 100644 queue-5.10/serial-8250-mtk-fix-reference-leak-in-mtk8250_probe.patch
 create mode 100644 queue-5.10/slimbus-qcom-fix-potential-null-dereference-in-qcom_.patch
 create mode 100644 queue-5.10/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch
 create mode 100644 queue-5.10/smack-handle-io_uring-kernel-thread-privileges.patch
 create mode 100644 queue-5.10/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch
 create mode 100644 queue-5.10/soc-mediatek-check-if-power-domains-can-be-powered-o.patch
 create mode 100644 queue-5.10/soc-qcom-geni-more-properly-switch-to-dma-mode.patch
 create mode 100644 queue-5.10/soc-qcom-initialize-local-variable.patch
 create mode 100644 queue-5.10/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch
 create mode 100644 queue-5.10/soc-rockchip-io-domain-fix-error-return-code-in-rock.patch
 create mode 100644 queue-5.10/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch
 create mode 100644 queue-5.10/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch
 create mode 100644 queue-5.10/soc-ti-omap-prm-do-not-check-rstst-bit-on-deassert-i.patch
 create mode 100644 queue-5.10/soundwire-fix-debug_locks_warn_on-for-uninitialized-.patch
 create mode 100644 queue-5.10/soundwire-master-use-pm_runtime_set_active-on-add.patch
 create mode 100644 queue-5.10/soundwire-qcom-fix-build-failure-when-slimbus-is-mod.patch
 create mode 100644 queue-5.10/sparc-fix-handling-of-page-table-constructor-failure.patch
 create mode 100644 queue-5.10/speakup-fix-uninitialized-flush_lock.patch
 create mode 100644 queue-5.10/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch
 create mode 100644 queue-5.10/spi-dw-fix-build-error-by-selecting-multiplexer.patch
 create mode 100644 queue-5.10/spi-dw-fix-error-return-code-in-dw_spi_bt1_probe.patch
 create mode 100644 queue-5.10/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch
 create mode 100644 queue-5.10/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch
 create mode 100644 queue-5.10/spi-imx-fix-reference-leak-in-two-imx-operations.patch
 create mode 100644 queue-5.10/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch
 create mode 100644 queue-5.10/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch
 create mode 100644 queue-5.10/spi-spi-fsl-dspi-use-max_native_cs-instead-of-num_ch.patch
 create mode 100644 queue-5.10/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch
 create mode 100644 queue-5.10/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch
 create mode 100644 queue-5.10/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch
 create mode 100644 queue-5.10/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch
 create mode 100644 queue-5.10/spi-stm32-qspi-fix-reference-leak-in-stm32-qspi-oper.patch
 create mode 100644 queue-5.10/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch
 create mode 100644 queue-5.10/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch
 create mode 100644 queue-5.10/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch
 create mode 100644 queue-5.10/staging-bcm2835-fix-vchiq_mmal-dependencies.patch
 create mode 100644 queue-5.10/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch
 create mode 100644 queue-5.10/staging-greybus-audio-fix-possible-leak-free-widgets.patch
 create mode 100644 queue-5.10/staging-greybus-codecs-fix-reference-counter-leak-in.patch
 create mode 100644 queue-5.10/staging-mfd-hi6421-spmi-pmic-fix-error-return-code-i.patch
 create mode 100644 queue-5.10/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch
 create mode 100644 queue-5.10/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch
 create mode 100644 queue-5.10/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch
 create mode 100644 queue-5.10/tools-build-add-missing-libcap-to-test-all.bin-targe.patch
 create mode 100644 queue-5.10/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch
 create mode 100644 queue-5.10/um-chan_xterm-fix-fd-leak.patch
 create mode 100644 queue-5.10/um-monitor-error-events-in-irq-controller.patch
 create mode 100644 queue-5.10/um-tty-fix-handling-of-close-in-tty-lines.patch
 create mode 100644 queue-5.10/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch
 create mode 100644 queue-5.10/usb-max3421-fix-return-error-code-in-max3421_probe.patch
 create mode 100644 queue-5.10/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch
 create mode 100644 queue-5.10/vdpa-mlx5-use-write-memory-barrier-after-updating-cq.patch
 create mode 100644 queue-5.10/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch
 create mode 100644 queue-5.10/vhost-scsi-fix-error-return-code-in-vhost_scsi_set_e.patch
 create mode 100644 queue-5.10/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch
 create mode 100644 queue-5.10/virtio_net-fix-error-code-in-probe.patch
 create mode 100644 queue-5.10/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch
 create mode 100644 queue-5.10/virtio_ring-fix-two-use-after-free-bugs.patch
 create mode 100644 queue-5.10/virtiofs-fix-leak-in-setup.patch
 create mode 100644 queue-5.10/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch
 create mode 100644 queue-5.10/watchdog-coh901327-add-common_clk-dependency.patch
 create mode 100644 queue-5.10/watchdog-fix-potential-dereferencing-of-null-pointer.patch
 create mode 100644 queue-5.10/watchdog-qcom-avoid-context-switch-in-restart-handle.patch
 create mode 100644 queue-5.10/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch
 create mode 100644 queue-5.10/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch
 create mode 100644 queue-5.10/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch
 create mode 100644 queue-5.10/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch
 create mode 100644 queue-5.10/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch
 create mode 100644 queue-5.10/x86-mce-correct-the-detection-of-invalid-notifier-pr.patch
 create mode 100644 queue-5.10/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch

diff --git a/queue-5.10/adm8211-fix-error-return-code-in-adm8211_probe.patch b/queue-5.10/adm8211-fix-error-return-code-in-adm8211_probe.patch
new file mode 100644
index 00000000000..c673e2064b2
--- /dev/null
+++ b/queue-5.10/adm8211-fix-error-return-code-in-adm8211_probe.patch
@@ -0,0 +1,56 @@
+From b19df64ce0b7367dec4db85fe42bbbf69d7d6795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:47:17 +0800
+Subject: adm8211: fix error return code in adm8211_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 05c2a61d69ea306e891884a86486e1ef37c4b78d ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: cc0b88cf5ecf ("[PATCH] Add adm8211 802.11b wireless driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1607071638-33619-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/admtek/adm8211.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/admtek/adm8211.c b/drivers/net/wireless/admtek/adm8211.c
+index 5cf2045fadeff..c41e72508d3db 100644
+--- a/drivers/net/wireless/admtek/adm8211.c
++++ b/drivers/net/wireless/admtek/adm8211.c
+@@ -1796,6 +1796,7 @@ static int adm8211_probe(struct pci_dev *pdev,
+ 	if (io_len < 256 || mem_len < 1024) {
+ 		printk(KERN_ERR "%s (adm8211): Too short PCI resources\n",
+ 		       pci_name(pdev));
++		err = -ENOMEM;
+ 		goto err_disable_pdev;
+ 	}
+ 
+@@ -1805,6 +1806,7 @@ static int adm8211_probe(struct pci_dev *pdev,
+ 	if (reg != ADM8211_SIG1 && reg != ADM8211_SIG2) {
+ 		printk(KERN_ERR "%s (adm8211): Invalid signature (0x%x)\n",
+ 		       pci_name(pdev), reg);
++		err = -EINVAL;
+ 		goto err_disable_pdev;
+ 	}
+ 
+@@ -1815,8 +1817,8 @@ static int adm8211_probe(struct pci_dev *pdev,
+ 		return err; /* someone else grabbed it? don't disable it */
+ 	}
+ 
+-	if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(32)) ||
+-	    dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32))) {
++	err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++	if (err) {
+ 		printk(KERN_ERR "%s (adm8211): No suitable DMA available\n",
+ 		       pci_name(pdev));
+ 		goto err_free_reg;
+-- 
+2.27.0
+
diff --git a/queue-5.10/alsa-hda-hdmi-fix-silent-stream-for-first-playback-t.patch b/queue-5.10/alsa-hda-hdmi-fix-silent-stream-for-first-playback-t.patch
new file mode 100644
index 00000000000..098db0e7ebb
--- /dev/null
+++ b/queue-5.10/alsa-hda-hdmi-fix-silent-stream-for-first-playback-t.patch
@@ -0,0 +1,175 @@
+From a906036c7347e34188ddb8499bcbcf275c45c8f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 19:44:45 +0200
+Subject: ALSA: hda/hdmi: fix silent stream for first playback to DP
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit b1a5039759cb7bfcb2157f28604dbda0bca58598 ]
+
+A problem exists in enabling silent stream when connection type is
+DisplayPort. Silent stream programming is completed when a new DP
+receiver is connected, but infoframe transmission does not actually
+start until PCM is opened for the first time. This can result in audible
+gap of multiple seconds. This only affects the first PCM open.
+
+Fix the issue by properly assigning a converter to the silent stream,
+and modifying the required stream ID programming sequence.
+
+This change only affects Intel display audio codecs.
+
+BugLink: https://github.com/thesofproject/linux/issues/2468
+Fixes: 951894cf30f4 ("ALSA: hda/hdmi: Add Intel silent stream support")
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20201210174445.3134104-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 98 +++++++++++++++++++++++++++++++++-----
+ 1 file changed, 86 insertions(+), 12 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b0068f8ca46dd..2ddc27db8c012 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -78,6 +78,7 @@ struct hdmi_spec_per_pin {
+ 	int pcm_idx; /* which pcm is attached. -1 means no pcm is attached */
+ 	int repoll_count;
+ 	bool setup; /* the stream has been set up by prepare callback */
++	bool silent_stream;
+ 	int channels; /* current number of channels */
+ 	bool non_pcm;
+ 	bool chmap_set;		/* channel-map override by ALSA API? */
+@@ -979,6 +980,13 @@ static int hdmi_choose_cvt(struct hda_codec *codec,
+ 	else
+ 		per_pin = get_pin(spec, pin_idx);
+ 
++	if (per_pin && per_pin->silent_stream) {
++		cvt_idx = cvt_nid_to_cvt_index(codec, per_pin->cvt_nid);
++		if (cvt_id)
++			*cvt_id = cvt_idx;
++		return 0;
++	}
++
+ 	/* Dynamically assign converter to stream */
+ 	for (cvt_idx = 0; cvt_idx < spec->num_cvts; cvt_idx++) {
+ 		per_cvt = get_cvt(spec, cvt_idx);
+@@ -1642,30 +1650,95 @@ static void hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
+ 	snd_hda_power_down_pm(codec);
+ }
+ 
++#define I915_SILENT_RATE		48000
++#define I915_SILENT_CHANNELS		2
++#define I915_SILENT_FORMAT		SNDRV_PCM_FORMAT_S16_LE
++#define I915_SILENT_FORMAT_BITS	16
++#define I915_SILENT_FMT_MASK		0xf
++
+ static void silent_stream_enable(struct hda_codec *codec,
+-				struct hdmi_spec_per_pin *per_pin)
++				 struct hdmi_spec_per_pin *per_pin)
+ {
+-	unsigned int newval, oldval;
+-
+-	codec_dbg(codec, "hdmi: enabling silent stream for NID %d\n",
+-			per_pin->pin_nid);
++	struct hdmi_spec *spec = codec->spec;
++	struct hdmi_spec_per_cvt *per_cvt;
++	int cvt_idx, pin_idx, err;
++	unsigned int format;
+ 
+ 	mutex_lock(&per_pin->lock);
+ 
+-	if (!per_pin->channels)
+-		per_pin->channels = 2;
++	if (per_pin->setup) {
++		codec_dbg(codec, "hdmi: PCM already open, no silent stream\n");
++		goto unlock_out;
++	}
+ 
+-	oldval = snd_hda_codec_read(codec, per_pin->pin_nid, 0,
+-			AC_VERB_GET_CONV, 0);
+-	newval = (oldval & 0xF0) | 0xF;
+-	snd_hda_codec_write(codec, per_pin->pin_nid, 0,
+-			AC_VERB_SET_CHANNEL_STREAMID, newval);
++	pin_idx = pin_id_to_pin_index(codec, per_pin->pin_nid, per_pin->dev_id);
++	err = hdmi_choose_cvt(codec, pin_idx, &cvt_idx);
++	if (err) {
++		codec_err(codec, "hdmi: no free converter to enable silent mode\n");
++		goto unlock_out;
++	}
++
++	per_cvt = get_cvt(spec, cvt_idx);
++	per_cvt->assigned = 1;
++	per_pin->cvt_nid = per_cvt->cvt_nid;
++	per_pin->silent_stream = true;
+ 
++	codec_dbg(codec, "hdmi: enabling silent stream pin-NID=0x%x cvt-NID=0x%x\n",
++		  per_pin->pin_nid, per_cvt->cvt_nid);
++
++	snd_hda_set_dev_select(codec, per_pin->pin_nid, per_pin->dev_id);
++	snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
++				  AC_VERB_SET_CONNECT_SEL,
++				  per_pin->mux_idx);
++
++	/* configure unused pins to choose other converters */
++	pin_cvt_fixup(codec, per_pin, 0);
++
++	snd_hdac_sync_audio_rate(&codec->core, per_pin->pin_nid,
++				 per_pin->dev_id, I915_SILENT_RATE);
++
++	/* trigger silent stream generation in hw */
++	format = snd_hdac_calc_stream_format(I915_SILENT_RATE, I915_SILENT_CHANNELS,
++					     I915_SILENT_FORMAT, I915_SILENT_FORMAT_BITS, 0);
++	snd_hda_codec_setup_stream(codec, per_pin->cvt_nid,
++				   I915_SILENT_FMT_MASK, I915_SILENT_FMT_MASK, format);
++	usleep_range(100, 200);
++	snd_hda_codec_setup_stream(codec, per_pin->cvt_nid, I915_SILENT_FMT_MASK, 0, format);
++
++	per_pin->channels = I915_SILENT_CHANNELS;
+ 	hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+ 
++ unlock_out:
+ 	mutex_unlock(&per_pin->lock);
+ }
+ 
++static void silent_stream_disable(struct hda_codec *codec,
++				  struct hdmi_spec_per_pin *per_pin)
++{
++	struct hdmi_spec *spec = codec->spec;
++	struct hdmi_spec_per_cvt *per_cvt;
++	int cvt_idx;
++
++	mutex_lock(&per_pin->lock);
++	if (!per_pin->silent_stream)
++		goto unlock_out;
++
++	codec_dbg(codec, "HDMI: disable silent stream on pin-NID=0x%x cvt-NID=0x%x\n",
++		  per_pin->pin_nid, per_pin->cvt_nid);
++
++	cvt_idx = cvt_nid_to_cvt_index(codec, per_pin->cvt_nid);
++	if (cvt_idx >= 0 && cvt_idx < spec->num_cvts) {
++		per_cvt = get_cvt(spec, cvt_idx);
++		per_cvt->assigned = 0;
++	}
++
++	per_pin->cvt_nid = 0;
++	per_pin->silent_stream = false;
++
++ unlock_out:
++	mutex_unlock(&spec->pcm_lock);
++}
++
+ /* update ELD and jack state via audio component */
+ static void sync_eld_via_acomp(struct hda_codec *codec,
+ 			       struct hdmi_spec_per_pin *per_pin)
+@@ -1701,6 +1774,7 @@ static void sync_eld_via_acomp(struct hda_codec *codec,
+ 				pm_ret);
+ 			silent_stream_enable(codec, per_pin);
+ 		} else if (monitor_prev && !monitor_next) {
++			silent_stream_disable(codec, per_pin);
+ 			pm_ret = snd_hda_power_down_pm(codec);
+ 			if (pm_ret < 0)
+ 				codec_err(codec,
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-9030-1-entry-omit-fp-emulation-for-und-exception.patch b/queue-5.10/arm-9030-1-entry-omit-fp-emulation-for-und-exception.patch
new file mode 100644
index 00000000000..39a2de2a145
--- /dev/null
+++ b/queue-5.10/arm-9030-1-entry-omit-fp-emulation-for-und-exception.patch
@@ -0,0 +1,180 @@
+From 29d391b36e534c244ddeb13f862ce81e1358c12c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 18:09:16 +0100
+Subject: ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in
+ kernel mode
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit f77ac2e378be9dd61eb88728f0840642f045d9d1 ]
+
+There are a couple of problems with the exception entry code that deals
+with FP exceptions (which are reported as UND exceptions) when building
+the kernel in Thumb2 mode:
+- the conditional branch to vfp_kmode_exception in vfp_support_entry()
+  may be out of range for its target, depending on how the linker decides
+  to arrange the sections;
+- when the UND exception is taken in kernel mode, the emulation handling
+  logic is entered via the 'call_fpe' label, which means we end up using
+  the wrong value/mask pairs to match and detect the NEON opcodes.
+
+Since UND exceptions in kernel mode are unlikely to occur on a hot path
+(as opposed to the user mode version which is invoked for VFP support
+code and lazy restore), we can use the existing undef hook machinery for
+any kernel mode instruction emulation that is needed, including calling
+the existing vfp_kmode_exception() routine for unexpected cases. So drop
+the call to call_fpe, and instead, install an undef hook that will get
+called for NEON and VFP instructions that trigger an UND exception in
+kernel mode.
+
+While at it, make sure that the PC correction is accurate for the
+execution mode where the exception was taken, by checking the PSR
+Thumb bit.
+
+Cc: Dmitry Osipenko <digetx@gmail.com>
+Cc: Kees Cook <keescook@chromium.org>
+Fixes: eff8728fe698 ("vmlinux.lds.h: Add PGO and AutoFDO input sections")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-armv.S | 25 ++----------------
+ arch/arm/vfp/vfphw.S         |  5 ----
+ arch/arm/vfp/vfpmodule.c     | 49 ++++++++++++++++++++++++++++++++++--
+ 3 files changed, 49 insertions(+), 30 deletions(-)
+
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 55a47df047738..1c9e6d1452c5b 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -252,31 +252,10 @@ __und_svc:
+ #else
+ 	svc_entry
+ #endif
+-	@
+-	@ call emulation code, which returns using r9 if it has emulated
+-	@ the instruction, or the more conventional lr if we are to treat
+-	@ this as a real undefined instruction
+-	@
+-	@  r0 - instruction
+-	@
+-#ifndef CONFIG_THUMB2_KERNEL
+-	ldr	r0, [r4, #-4]
+-#else
+-	mov	r1, #2
+-	ldrh	r0, [r4, #-2]			@ Thumb instruction at LR - 2
+-	cmp	r0, #0xe800			@ 32-bit instruction if xx >= 0
+-	blo	__und_svc_fault
+-	ldrh	r9, [r4]			@ bottom 16 bits
+-	add	r4, r4, #2
+-	str	r4, [sp, #S_PC]
+-	orr	r0, r9, r0, lsl #16
+-#endif
+-	badr	r9, __und_svc_finish
+-	mov	r2, r4
+-	bl	call_fpe
+ 
+ 	mov	r1, #4				@ PC correction to apply
+-__und_svc_fault:
++ THUMB(	tst	r5, #PSR_T_BIT		)	@ exception taken in Thumb mode?
++ THUMB(	movne	r1, #2			)	@ if so, fix up PC correction
+ 	mov	r0, sp				@ struct pt_regs *regs
+ 	bl	__und_fault
+ 
+diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
+index 4fcff9f59947d..d5837bf05a9a5 100644
+--- a/arch/arm/vfp/vfphw.S
++++ b/arch/arm/vfp/vfphw.S
+@@ -79,11 +79,6 @@ ENTRY(vfp_support_entry)
+ 	DBGSTR3	"instr %08x pc %08x state %p", r0, r2, r10
+ 
+ 	.fpu	vfpv2
+-	ldr	r3, [sp, #S_PSR]	@ Neither lazy restore nor FP exceptions
+-	and	r3, r3, #MODE_MASK	@ are supported in kernel mode
+-	teq	r3, #USR_MODE
+-	bne	vfp_kmode_exception	@ Returns through lr
+-
+ 	VFPFMRX	r1, FPEXC		@ Is the VFP enabled?
+ 	DBGSTR1	"fpexc %08x", r1
+ 	tst	r1, #FPEXC_EN
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 8c9e7f9f0277d..c3b6451c18bda 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -23,6 +23,7 @@
+ #include <asm/cputype.h>
+ #include <asm/system_info.h>
+ #include <asm/thread_notify.h>
++#include <asm/traps.h>
+ #include <asm/vfp.h>
+ 
+ #include "vfpinstr.h"
+@@ -642,7 +643,9 @@ static int vfp_starting_cpu(unsigned int unused)
+ 	return 0;
+ }
+ 
+-void vfp_kmode_exception(void)
++#ifdef CONFIG_KERNEL_MODE_NEON
++
++static int vfp_kmode_exception(struct pt_regs *regs, unsigned int instr)
+ {
+ 	/*
+ 	 * If we reach this point, a floating point exception has been raised
+@@ -660,9 +663,51 @@ void vfp_kmode_exception(void)
+ 		pr_crit("BUG: unsupported FP instruction in kernel mode\n");
+ 	else
+ 		pr_crit("BUG: FP instruction issued in kernel mode with FP unit disabled\n");
++	pr_crit("FPEXC == 0x%08x\n", fmrx(FPEXC));
++	return 1;
+ }
+ 
+-#ifdef CONFIG_KERNEL_MODE_NEON
++static struct undef_hook vfp_kmode_exception_hook[] = {{
++	.instr_mask	= 0xfe000000,
++	.instr_val	= 0xf2000000,
++	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
++	.cpsr_val	= SVC_MODE,
++	.fn		= vfp_kmode_exception,
++}, {
++	.instr_mask	= 0xff100000,
++	.instr_val	= 0xf4000000,
++	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
++	.cpsr_val	= SVC_MODE,
++	.fn		= vfp_kmode_exception,
++}, {
++	.instr_mask	= 0xef000000,
++	.instr_val	= 0xef000000,
++	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
++	.cpsr_val	= SVC_MODE | PSR_T_BIT,
++	.fn		= vfp_kmode_exception,
++}, {
++	.instr_mask	= 0xff100000,
++	.instr_val	= 0xf9000000,
++	.cpsr_mask	= MODE_MASK | PSR_T_BIT,
++	.cpsr_val	= SVC_MODE | PSR_T_BIT,
++	.fn		= vfp_kmode_exception,
++}, {
++	.instr_mask	= 0x0c000e00,
++	.instr_val	= 0x0c000a00,
++	.cpsr_mask	= MODE_MASK,
++	.cpsr_val	= SVC_MODE,
++	.fn		= vfp_kmode_exception,
++}};
++
++static int __init vfp_kmode_exception_hook_init(void)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(vfp_kmode_exception_hook); i++)
++		register_undef_hook(&vfp_kmode_exception_hook[i]);
++	return 0;
++}
++core_initcall(vfp_kmode_exception_hook_init);
+ 
+ /*
+  * Kernel-side NEON support functions
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-9036-1-uncompress-fix-dbgadtb-size-parameter-nam.patch b/queue-5.10/arm-9036-1-uncompress-fix-dbgadtb-size-parameter-nam.patch
new file mode 100644
index 00000000000..1d02e07dbe7
--- /dev/null
+++ b/queue-5.10/arm-9036-1-uncompress-fix-dbgadtb-size-parameter-nam.patch
@@ -0,0 +1,46 @@
+From bd84b41b133f2f1761d64e4c82b447fc3234d2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 10:37:14 +0100
+Subject: ARM: 9036/1: uncompress: Fix dbgadtb size parameter name
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ecec38547d415054fdb63a231234f44396b6d06 ]
+
+The dbgadtb macro is passed the size of the appended DTB, not the end
+address.
+
+Fixes: c03e41470e901123 ("ARM: 9010/1: uncompress: Print the location of appended DTB")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index caa27322a0ab7..3a392983ac079 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -116,7 +116,7 @@
+ 		/*
+ 		 * Debug print of the final appended DTB location
+ 		 */
+-		.macro dbgadtb, begin, end
++		.macro dbgadtb, begin, size
+ #ifdef DEBUG
+ 		kputc   #'D'
+ 		kputc   #'T'
+@@ -129,7 +129,7 @@
+ 		kputc	#'('
+ 		kputc	#'0'
+ 		kputc	#'x'
+-		kphex	\end, 8		/* End of appended DTB */
++		kphex	\size, 8	/* Size of appended DTB */
+ 		kputc	#')'
+ 		kputc	#'\n'
+ #endif
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-9044-1-vfp-use-undef-hook-for-vfp-support-detect.patch b/queue-5.10/arm-9044-1-vfp-use-undef-hook-for-vfp-support-detect.patch
new file mode 100644
index 00000000000..244f7ee2d4d
--- /dev/null
+++ b/queue-5.10/arm-9044-1-vfp-use-undef-hook-for-vfp-support-detect.patch
@@ -0,0 +1,131 @@
+From 2110be9ff91fc2f66169173cbd88381d37660843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Dec 2020 16:29:58 +0100
+Subject: ARM: 9044/1: vfp: use undef hook for VFP support detection
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 3cce9d44321e460e7c88cdec4e4537a6e9ad7c0d ]
+
+Commit f77ac2e378be9dd6 ("ARM: 9030/1: entry: omit FP emulation for UND
+exceptions taken in kernel mode") failed to take into account that there
+is in fact a case where we relied on this code path: during boot, the
+VFP detection code issues a read of FPSID, which will trigger an undef
+exception on cores that lack VFP support.
+
+So let's reinstate this logic using an undef hook which is registered
+only for the duration of the initcall to vpf_init(), and which sets
+VFP_arch to a non-zero value - as before - if no VFP support is present.
+
+Fixes: f77ac2e378be9dd6 ("ARM: 9030/1: entry: omit FP emulation for UND ...")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/vfp/entry.S     | 17 -----------------
+ arch/arm/vfp/vfpmodule.c | 25 ++++++++++++++++++++-----
+ 2 files changed, 20 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
+index 0186cf9da890b..27b0a1f27fbdf 100644
+--- a/arch/arm/vfp/entry.S
++++ b/arch/arm/vfp/entry.S
+@@ -37,20 +37,3 @@ ENDPROC(vfp_null_entry)
+ 	.align	2
+ .LCvfp:
+ 	.word	vfp_vector
+-
+-@ This code is called if the VFP does not exist. It needs to flag the
+-@ failure to the VFP initialisation code.
+-
+-	__INIT
+-ENTRY(vfp_testing_entry)
+-	dec_preempt_count_ti r10, r4
+-	ldr	r0, VFP_arch_address
+-	str	r0, [r0]		@ set to non-zero value
+-	ret	r9			@ we have handled the fault
+-ENDPROC(vfp_testing_entry)
+-
+-	.align	2
+-VFP_arch_address:
+-	.word	VFP_arch
+-
+-	__FINIT
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index c3b6451c18bda..2cb355c1b5b71 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -32,7 +32,6 @@
+ /*
+  * Our undef handlers (in entry.S)
+  */
+-asmlinkage void vfp_testing_entry(void);
+ asmlinkage void vfp_support_entry(void);
+ asmlinkage void vfp_null_entry(void);
+ 
+@@ -43,7 +42,7 @@ asmlinkage void (*vfp_vector)(void) = vfp_null_entry;
+  * Used in startup: set to non-zero if VFP checks fail
+  * After startup, holds VFP architecture
+  */
+-unsigned int VFP_arch;
++static unsigned int __initdata VFP_arch;
+ 
+ /*
+  * The pointer to the vfpstate structure of the thread which currently
+@@ -437,7 +436,7 @@ static void vfp_enable(void *unused)
+  * present on all CPUs within a SMP complex. Needs to be called prior to
+  * vfp_init().
+  */
+-void vfp_disable(void)
++void __init vfp_disable(void)
+ {
+ 	if (VFP_arch) {
+ 		pr_debug("%s: should be called prior to vfp_init\n", __func__);
+@@ -707,7 +706,7 @@ static int __init vfp_kmode_exception_hook_init(void)
+ 		register_undef_hook(&vfp_kmode_exception_hook[i]);
+ 	return 0;
+ }
+-core_initcall(vfp_kmode_exception_hook_init);
++subsys_initcall(vfp_kmode_exception_hook_init);
+ 
+ /*
+  * Kernel-side NEON support functions
+@@ -753,6 +752,21 @@ EXPORT_SYMBOL(kernel_neon_end);
+ 
+ #endif /* CONFIG_KERNEL_MODE_NEON */
+ 
++static int __init vfp_detect(struct pt_regs *regs, unsigned int instr)
++{
++	VFP_arch = UINT_MAX;	/* mark as not present */
++	regs->ARM_pc += 4;
++	return 0;
++}
++
++static struct undef_hook vfp_detect_hook __initdata = {
++	.instr_mask	= 0x0c000e00,
++	.instr_val	= 0x0c000a00,
++	.cpsr_mask	= MODE_MASK,
++	.cpsr_val	= SVC_MODE,
++	.fn		= vfp_detect,
++};
++
+ /*
+  * VFP support code initialisation.
+  */
+@@ -773,10 +787,11 @@ static int __init vfp_init(void)
+ 	 * The handler is already setup to just log calls, so
+ 	 * we just need to read the VFPSID register.
+ 	 */
+-	vfp_vector = vfp_testing_entry;
++	register_undef_hook(&vfp_detect_hook);
+ 	barrier();
+ 	vfpsid = fmrx(FPSID);
+ 	barrier();
++	unregister_undef_hook(&vfp_detect_hook);
+ 	vfp_vector = vfp_null_entry;
+ 
+ 	pr_info("VFP support v0.3: ");
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-aspeed-g6-fix-the-gpio-memory-size.patch b/queue-5.10/arm-dts-aspeed-g6-fix-the-gpio-memory-size.patch
new file mode 100644
index 00000000000..e8401b78c5e
--- /dev/null
+++ b/queue-5.10/arm-dts-aspeed-g6-fix-the-gpio-memory-size.patch
@@ -0,0 +1,42 @@
+From 3f972bf1efecf1faa0433d3ddec5255ed536eef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 11:31:48 +0800
+Subject: ARM: dts: aspeed-g6: Fix the GPIO memory size
+
+From: Billy Tsai <billy_tsai@aspeedtech.com>
+
+[ Upstream commit 886f82ce9f1f4559c139fdb2d79d158999ca38cd ]
+
+The GPIO controller is a GPIO controller followed by some SGPIO
+controllers, which are a different type of device with their own binding
+and drivers.
+
+Make the gpio node cover the only conventional GPIO controller.
+
+Fixes: 8dbcb5b709b9 ("ARM: dts: aspeed-g6: Add gpio devices")
+Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201012033150.21056-2-billy_tsai@aspeedtech.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g6.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed-g6.dtsi
+index b58220a49cbd8..bf97aaad7be9b 100644
+--- a/arch/arm/boot/dts/aspeed-g6.dtsi
++++ b/arch/arm/boot/dts/aspeed-g6.dtsi
+@@ -357,7 +357,7 @@
+ 				#gpio-cells = <2>;
+ 				gpio-controller;
+ 				compatible = "aspeed,ast2600-gpio";
+-				reg = <0x1e780000 0x800>;
++				reg = <0x1e780000 0x400>;
+ 				interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+ 				gpio-ranges = <&pinctrl 0 0 208>;
+ 				ngpios = <208>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch b/queue-5.10/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch
new file mode 100644
index 00000000000..69366e032fb
--- /dev/null
+++ b/queue-5.10/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch
@@ -0,0 +1,49 @@
+From 8a00f456630350a849de5c6a3ee896801f778676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 16:12:34 +0930
+Subject: ARM: dts: aspeed: s2600wf: Fix VGA memory region location
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ]
+
+The VGA memory region is always from the top of RAM. On this board, that
+is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000.
+
+This was not an issue in practice as the region is "reserved" by the
+vendor's u-boot reducing the amount of available RAM, and the only user
+is the host VGA device poking at RAM over PCIe. That is, nothing from
+the ARM touches it.
+
+It is worth fixing as developers copy existing device trees when
+building their machines, and the XDMA driver does use the memory region
+from the ARM side.
+
+Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine")
+Reported-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+index 1deb30ec912cf..6e9baf3bba531 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+@@ -22,9 +22,9 @@
+ 		#size-cells = <1>;
+ 		ranges;
+ 
+-		vga_memory: framebuffer@7f000000 {
++		vga_memory: framebuffer@9f000000 {
+ 			no-map;
+-			reg = <0x7f000000 0x01000000>;
++			reg = <0x9f000000 0x01000000>; /* 16M */
+ 		};
+ 	};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-aspeed-tiogapass-remove-vuart.patch b/queue-5.10/arm-dts-aspeed-tiogapass-remove-vuart.patch
new file mode 100644
index 00000000000..d3a9a7c9bc8
--- /dev/null
+++ b/queue-5.10/arm-dts-aspeed-tiogapass-remove-vuart.patch
@@ -0,0 +1,41 @@
+From 2c9471bb717817b4c4bae49cc791f250af82cb20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Aug 2020 12:04:30 -0700
+Subject: ARM: dts: aspeed: tiogapass: Remove vuart
+
+From: Vijay Khemka <vijaykhemka@fb.com>
+
+[ Upstream commit 14f100c00f1e35e5890340d4c6a64bda5dff4320 ]
+
+Removed vuart for facebook tiogapass platform as it uses uart2 and
+uart3 pin with aspeed uart routing feature.
+
+Signed-off-by: Vijay Khemka <vijaykhemka@fb.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Fixes: ffdbf494821d ("ARM: dts: aspeed: tiogapass: Enable VUART")
+Link: https://lore.kernel.org/r/20200813190431.3331026-1-vijaykhemka@fb.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
+index 2d44d9ad4e400..e6ad821a86359 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
+@@ -82,11 +82,6 @@
+ 	status = "okay";
+ };
+ 
+-&vuart {
+-	// VUART Host Console
+-	status = "okay";
+-};
+-
+ &uart1 {
+ 	// Host Console
+ 	status = "okay";
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch b/queue-5.10/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch
new file mode 100644
index 00000000000..f5d0028111a
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch
@@ -0,0 +1,62 @@
+From 6be5d8e3b55cdee5ae3d93a72dfc138055f4568f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 23:28:17 +0100
+Subject: ARM: dts: at91: at91sam9rl: fix ADC triggers
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]
+
+The triggers for the ADC were taken from at91sam9260 dtsi but are not
+correct.
+
+Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
+index 5653e70c84b4b..36a42a9fe1957 100644
+--- a/arch/arm/boot/dts/at91sam9rl.dtsi
++++ b/arch/arm/boot/dts/at91sam9rl.dtsi
+@@ -282,23 +282,26 @@
+ 				atmel,adc-use-res = "highres";
+ 
+ 				trigger0 {
+-					trigger-name = "timer-counter-0";
++					trigger-name = "external-rising";
+ 					trigger-value = <0x1>;
++					trigger-external;
+ 				};
++
+ 				trigger1 {
+-					trigger-name = "timer-counter-1";
+-					trigger-value = <0x3>;
++					trigger-name = "external-falling";
++					trigger-value = <0x2>;
++					trigger-external;
+ 				};
+ 
+ 				trigger2 {
+-					trigger-name = "timer-counter-2";
+-					trigger-value = <0x5>;
++					trigger-name = "external-any";
++					trigger-value = <0x3>;
++					trigger-external;
+ 				};
+ 
+ 				trigger3 {
+-					trigger-name = "external";
+-					trigger-value = <0x13>;
+-					trigger-external;
++					trigger-name = "continuous";
++					trigger-value = <0x6>;
+ 				};
+ 			};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-sam9x60-add-pincontrol-for-usb-host.patch b/queue-5.10/arm-dts-at91-sam9x60-add-pincontrol-for-usb-host.patch
new file mode 100644
index 00000000000..c1218e5381d
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-sam9x60-add-pincontrol-for-usb-host.patch
@@ -0,0 +1,53 @@
+From e30f3ca29285fc3c1df9b6c81044d1830cc0fbd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 14:00:17 +0200
+Subject: ARM: dts: at91: sam9x60: add pincontrol for USB Host
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit 5ba6291086d2ae8006be9e0f19bf2001a85c9dc1 ]
+
+The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
+it the driver probes but VBus is not powered because of wrong pincontrol
+configuration.
+
+Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20201118120019.1257580-2-cristian.birsan@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sam9x60ek.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
+index eae28b82c7fd0..0e3b6147069f9 100644
+--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
+@@ -569,6 +569,13 @@
+ 			atmel,pins = <AT91_PIOB 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+ 		};
+ 	};
++
++	usb1 {
++		pinctrl_usb_default: usb_default {
++			atmel,pins = <AT91_PIOD 15 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++				      AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++		};
++	};
+ }; /* pinctrl */
+ 
+ &pmc {
+@@ -684,6 +691,8 @@
+ 	atmel,vbus-gpio = <0
+ 			   &pioD 15 GPIO_ACTIVE_HIGH
+ 			   &pioD 16 GPIO_ACTIVE_HIGH>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_usb_default>;
+ 	status = "okay";
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-sam9x60ek-remove-bypass-property.patch b/queue-5.10/arm-dts-at91-sam9x60ek-remove-bypass-property.patch
new file mode 100644
index 00000000000..7961dc99682
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-sam9x60ek-remove-bypass-property.patch
@@ -0,0 +1,42 @@
+From 6c0181d709a546e8a6b60ec7a36d4fc1956a90f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:57:04 +0200
+Subject: ARM: dts: at91: sam9x60ek: remove bypass property
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit ab8a9bb41b2c330a0b280280bf37b6f3b1dd1e58 ]
+
+atmel,osc-bypass property sets the bit 1 at main oscillator register.
+On SAM9X60 this bit is not valid according to datasheet (chapter
+28.16.9 PMC Clock Generator Main Oscillator Register).
+
+Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: Marco Cardellini <marco.cardellini@microchip.com>
+Link: https://lore.kernel.org/r/1606903025-14197-2-git-send-email-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sam9x60ek.dts | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
+index 0e3b6147069f9..73b6b1f89de99 100644
+--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
+@@ -578,10 +578,6 @@
+ 	};
+ }; /* pinctrl */
+ 
+-&pmc {
+-	atmel,osc-bypass;
+-};
+-
+ &pwm0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinctrl_pwm0_0 &pinctrl_pwm0_1 &pinctrl_pwm0_2 &pinctrl_pwm0_3>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-sama5d2-map-securam-as-device.patch b/queue-5.10/arm-dts-at91-sama5d2-map-securam-as-device.patch
new file mode 100644
index 00000000000..5186ca8333d
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-sama5d2-map-securam-as-device.patch
@@ -0,0 +1,39 @@
+From b1d890874ef2a8bd64d64470d558773da7ed183f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:57:05 +0200
+Subject: ARM: dts: at91: sama5d2: map securam as device
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]
+
+Due to strobe signal not being propagated from CPU to securam
+the securam needs to be mapped as device or strongly ordered memory
+to work properly. Otherwise, updating to one offset may affect
+the adjacent locations in securam.
+
+Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama5d2.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index 2ddc85dff8ce9..6d399ac0385d4 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -656,6 +656,7 @@
+ 				clocks = <&pmc PMC_TYPE_PERIPHERAL 51>;
+ 				#address-cells = <1>;
+ 				#size-cells = <1>;
++				no-memory-wc;
+ 				ranges = <0 0xf8044000 0x1420>;
+ 			};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch b/queue-5.10/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch
new file mode 100644
index 00000000000..6652be3f407
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch
@@ -0,0 +1,51 @@
+From 104302564f55257e41ca5eeb3b5a0cbfcd71e390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 14:00:19 +0200
+Subject: ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]
+
+The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
+it the driver probes but VBus is not powered because of wrong pincontrol
+configuration.
+
+Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+index cf13632edd444..5179258f92470 100644
+--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+@@ -242,6 +242,11 @@
+ 						atmel,pins =
+ 							<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PE9, conflicts with A9 */
+ 					};
++					pinctrl_usb_default: usb_default {
++						atmel,pins =
++							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++					};
+ 				};
+ 			};
+ 		};
+@@ -259,6 +264,8 @@
+ 					   &pioE 3 GPIO_ACTIVE_LOW
+ 					   &pioE 4 GPIO_ACTIVE_LOW
+ 					  >;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pinctrl_usb_default>;
+ 			status = "okay";
+ 		};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch b/queue-5.10/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch
new file mode 100644
index 00000000000..8698130980f
--- /dev/null
+++ b/queue-5.10/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch
@@ -0,0 +1,51 @@
+From 99e2bf17d61bcc705598e834d9e6b529330430b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 14:00:18 +0200
+Subject: ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]
+
+The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
+it the driver probes but VBus is not powered because of wrong pincontrol
+configuration.
+
+Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+index e5974a17374cf..0b3ad1b580b83 100644
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -134,6 +134,11 @@
+ 						atmel,pins =
+ 							<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
+ 					};
++					pinctrl_usb_default: usb_default {
++						atmel,pins =
++							<AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++							 AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++					};
+ 					pinctrl_key_gpio: key_gpio_0 {
+ 						atmel,pins =
+ 							<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+@@ -159,6 +164,8 @@
+ 					   &pioE 11 GPIO_ACTIVE_HIGH
+ 					   &pioE 14 GPIO_ACTIVE_HIGH
+ 					  >;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pinctrl_usb_default>;
+ 			status = "okay";
+ 		};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-meson-fix-phy-deassert-timing-requirements.patch b/queue-5.10/arm-dts-meson-fix-phy-deassert-timing-requirements.patch
new file mode 100644
index 00000000000..1c5cdbdf99c
--- /dev/null
+++ b/queue-5.10/arm-dts-meson-fix-phy-deassert-timing-requirements.patch
@@ -0,0 +1,55 @@
+From 0f5a9df90458eb5c0d91a3c4c3e387ca2d863787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 18:58:01 +0100
+Subject: ARM: dts: meson: fix PHY deassert timing requirements
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 656ab1bdcd2b755dc161a9774201100d5bf74b8d ]
+
+According to the datasheet (Rev. 1.9) the RTL8211F requires at least
+72ms "for internal circuits settling time" before accessing the PHY
+registers. On similar boards with the same PHY this fixes an issue where
+Ethernet link would not come up when using ip link set down/up.
+
+Fixes: a2c6e82e5341 ("ARM: dts: meson: switch to the generic Ethernet PHY reset bindings")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> # on Odroid-C1+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/ff78772b306411e145769c46d4090554344db41e.1607363522.git.stefan@agner.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b-odroidc1.dts    | 2 +-
+ arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
+index 0c26467de4d03..5963566dbcc9d 100644
+--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
+@@ -224,7 +224,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
+ 
+ 			interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+index cc498191ddd1d..8f4eb1ed45816 100644
+--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
++++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+@@ -81,7 +81,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
+ 		};
+ 	};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch b/queue-5.10/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch
new file mode 100644
index 00000000000..29d0afcd2f8
--- /dev/null
+++ b/queue-5.10/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch
@@ -0,0 +1,40 @@
+From a986b89777ef924b154c43aea8631d1b81b4404b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 09:17:11 +1200
+Subject: ARM: dts: Remove non-existent i2c1 from 98dx3236
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]
+
+The switches with integrated CPUs have only got a single i2c controller.
+They incorrectly gained one when they were split from the Armada-XP.
+
+Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+index 654648b05c7c2..aeccedd125740 100644
+--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+@@ -266,11 +266,6 @@
+ 	reg = <0x11000 0x100>;
+ };
+ 
+-&i2c1 {
+-	compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
+-	reg = <0x11100 0x100>;
+-};
+-
+ &mpic {
+ 	reg = <0x20a00 0x2d0>, <0x21070 0x58>;
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-dts-tacoma-fix-node-vs-reg-mismatch-for-flash-me.patch b/queue-5.10/arm-dts-tacoma-fix-node-vs-reg-mismatch-for-flash-me.patch
new file mode 100644
index 00000000000..0c9dfe91fe3
--- /dev/null
+++ b/queue-5.10/arm-dts-tacoma-fix-node-vs-reg-mismatch-for-flash-me.patch
@@ -0,0 +1,38 @@
+From 6dcd7ae94ab3e23e71b9a538296acbc5bb083670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 12:17:26 +1030
+Subject: ARM: dts: tacoma: Fix node vs reg mismatch for flash memory
+
+From: Andrew Jeffery <andrew@aj.id.au>
+
+[ Upstream commit cbee028da69d31cb927142e2828710de55a49f2a ]
+
+The mismatch lead to a miscalculation of regions in another patch, and
+shouldn't be mismatched anyway, so make them consistent.
+
+Fixes: 575640201e66 ("ARM: dts: aspeed: tacoma: Use 64MB for firmware memory")
+Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201022014731.2035438-2-andrew@aj.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts b/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
+index 4d070d6ba09f9..e86c22ce6d123 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-opp-tacoma.dts
+@@ -26,7 +26,7 @@
+ 		#size-cells = <1>;
+ 		ranges;
+ 
+-		flash_memory: region@ba000000 {
++		flash_memory: region@b8000000 {
+ 			no-map;
+ 			reg = <0xb8000000 0x4000000>; /* 64M */
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch b/queue-5.10/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch
new file mode 100644
index 00000000000..dc5b77bb806
--- /dev/null
+++ b/queue-5.10/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch
@@ -0,0 +1,55 @@
+From 55063d9378bb555bc6aea7af552e3c44789a4440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Sep 2020 00:10:16 +0200
+Subject: ARM: p2v: fix handling of LPAE translation in BE mode
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]
+
+When running in BE mode on LPAE hardware with a PA-to-VA translation
+that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
+byte of the opcode. So fix that, by rotating the offset in r0 to the
+right by 8 bits, which will put the 8-bit immediate in bits 31:24.
+
+Note that this will also move bit #22 in its correct place when
+applying the rotation to the constant #0x400000.
+
+Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
+Acked-by: Nicolas Pitre <nico@fluxnic.net>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head.S | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index f8904227e7fdc..98c1e68bdfcbb 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -671,12 +671,8 @@ ARM_BE8(rev16	ip, ip)
+ 	ldrcc	r7, [r4], #4	@ use branch for delay slot
+ 	bcc	1b
+ 	bx	lr
+-#else
+-#ifdef CONFIG_CPU_ENDIAN_BE8
+-	moveq	r0, #0x00004000	@ set bit 22, mov to mvn instruction
+ #else
+ 	moveq	r0, #0x400000	@ set bit 22, mov to mvn instruction
+-#endif
+ 	b	2f
+ 1:	ldr	ip, [r7, r3]
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+@@ -685,7 +681,7 @@ ARM_BE8(rev16	ip, ip)
+ 	tst	ip, #0x000f0000	@ check the rotation field
+ 	orrne	ip, ip, r6, lsl #24 @ mask in offset bits 31-24
+ 	biceq	ip, ip, #0x00004000 @ clear bit 22
+-	orreq	ip, ip, r0      @ mask in offset bits 7-0
++	orreq	ip, ip, r0, ror #8  @ mask in offset bits 7-0
+ #else
+ 	bic	ip, ip, #0x000000ff
+ 	tst	ip, #0xf00	@ check the rotation field
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch b/queue-5.10/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch
new file mode 100644
index 00000000000..148f351954b
--- /dev/null
+++ b/queue-5.10/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch
@@ -0,0 +1,44 @@
+From 86a26a2d16729433350030b696c3fc05271c0ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 21:42:53 +0100
+Subject: arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 3aa669a994c9110a2dc7e08a5c0958a9ea5eb17c ]
+
+Use property name `phy-handle` instead of the deprecated `phy` to
+connect eth2 to the PHY.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
+Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: devicetree@vger.kernel.org
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index f3a678e0fd99b..bf76ebe463794 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -146,7 +146,7 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&rgmii_pins>;
+ 	phy-mode = "rgmii-id";
+-	phy = <&phy1>;
++	phy-handle = <&phy1>;
+ 	status = "okay";
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch b/queue-5.10/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch
new file mode 100644
index 00000000000..8306d7d797c
--- /dev/null
+++ b/queue-5.10/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch
@@ -0,0 +1,50 @@
+From 3a24e920ac1b1c59992be722bd6d23a07431eabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 14:39:26 +0100
+Subject: arm64: dts: exynos: Correct psci compatible used on Exynos7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]
+
+It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
+we need to use syscon reboot/poweroff drivers, like it's done for other
+Exynos SoCs. This was confirmed by checking vendor source and testing it
+on Samsung Galaxy S6 device based on this SoC.
+
+To be able to use custom restart/poweroff handlers instead of PSCI
+functions, we need to correct psci compatible. This also requires us to
+provide function ids for CPU_ON and CPU_OFF.
+
+Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
+Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 545e67901938a..7599e1a00ff51 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -79,8 +79,10 @@
+ 	};
+ 
+ 	psci {
+-		compatible = "arm,psci-0.2";
++		compatible = "arm,psci";
+ 		method = "smc";
++		cpu_off = <0x84000002>;
++		cpu_on = <0xC4000003>;
+ 	};
+ 
+ 	soc: soc@0 {
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-exynos-include-common-syscon-restart-power.patch b/queue-5.10/arm64-dts-exynos-include-common-syscon-restart-power.patch
new file mode 100644
index 00000000000..66f4407ea91
--- /dev/null
+++ b/queue-5.10/arm64-dts-exynos-include-common-syscon-restart-power.patch
@@ -0,0 +1,55 @@
+From a45b3d366cbd853d2ed5fd3c9853d6278203b0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 14:39:25 +0100
+Subject: arm64: dts: exynos: Include common syscon restart/poweroff for
+ Exynos7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ]
+
+Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos
+SoCs, so instead of duplicating code we can just include common dtsi
+file, which already contains definitions of them. After this change,
+poweroff node will be also available, previously this dts file did
+contain only reboot node.
+
+Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
+Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index b9ed6a33e2901..545e67901938a 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -481,13 +481,6 @@
+ 		pmu_system_controller: system-controller@105c0000 {
+ 			compatible = "samsung,exynos7-pmu", "syscon";
+ 			reg = <0x105c0000 0x5000>;
+-
+-			reboot: syscon-reboot {
+-				compatible = "syscon-reboot";
+-				regmap = <&pmu_system_controller>;
+-				offset = <0x0400>;
+-				mask = <0x1>;
+-			};
+ 		};
+ 
+ 		rtc: rtc@10590000 {
+@@ -687,3 +680,4 @@
+ };
+ 
+ #include "exynos7-pinctrl.dtsi"
++#include "arm/exynos-syscon-restart.dtsi"
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-freescale-sl28-combine-spi-mtd-partitions.patch b/queue-5.10/arm64-dts-freescale-sl28-combine-spi-mtd-partitions.patch
new file mode 100644
index 00000000000..7ea8d614c43
--- /dev/null
+++ b/queue-5.10/arm64-dts-freescale-sl28-combine-spi-mtd-partitions.patch
@@ -0,0 +1,54 @@
+From 8156154c513e63386f746a86583febfe4942bdbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 23:54:35 +0100
+Subject: arm64: dts: freescale: sl28: combine SPI MTD partitions
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 91ab1c12285c9999afe56c09aa296d8b96862976 ]
+
+The upstream port, doesn't really follow the vendor partitioning. The
+bootloader partition has one U-Boot FIT image containing all needed
+bits and pieces. Even today the bootloader is already larger than the
+current "bootloader" partition. Thus, fold all the partitions into one
+and keep the environment one. The latter is still valid.
+We keep the failsafe partitions because the first half of the SPI flash
+is preinstalled by the vendor and immutable.
+
+Fixes: 815364d0424e ("arm64: dts: freescale: add Kontron sl28 support")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts  | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
+index 8161dd2379712..b3fa4dbeebd52 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts
+@@ -155,20 +155,10 @@
+ 		};
+ 
+ 		partition@210000 {
+-			reg = <0x210000 0x0f0000>;
++			reg = <0x210000 0x1d0000>;
+ 			label = "bootloader";
+ 		};
+ 
+-		partition@300000 {
+-			reg = <0x300000 0x040000>;
+-			label = "DP firmware";
+-		};
+-
+-		partition@340000 {
+-			reg = <0x340000 0x0a0000>;
+-			label = "trusted firmware";
+-		};
+-
+ 		partition@3e0000 {
+ 			reg = <0x3e0000 0x020000>;
+ 			label = "bootloader environment";
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-ipq6018-update-the-reserved-memory-node.patch b/queue-5.10/arm64-dts-ipq6018-update-the-reserved-memory-node.patch
new file mode 100644
index 00000000000..ccf22112947
--- /dev/null
+++ b/queue-5.10/arm64-dts-ipq6018-update-the-reserved-memory-node.patch
@@ -0,0 +1,51 @@
+From e97f58606b5415f7d42d203b436cab03be40b1a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Oct 2020 21:16:17 +0530
+Subject: arm64: dts: ipq6018: update the reserved-memory node
+
+From: Kathiravan T <kathirav@codeaurora.org>
+
+[ Upstream commit 4af5c6dc255ca64e5263a5254bb7553f05bb682c ]
+
+Memory region reserved for the TZ is changed long back. Let's
+update the same to align with the corret region. Its size also
+increased to 4MB from 2MB.
+
+Along with that, bump the Q6 region size to 85MB.
+
+Fixes: 1e8277854b49 ("arm64: dts: Add ipq6018 SoC and CP01 board support")
+Signed-off-by: Kathiravan T <kathirav@codeaurora.org>
+Link: https://lore.kernel.org/r/1602690377-21304-1-git-send-email-kathirav@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index 59e0cbfa22143..cdc1e3d60c58e 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -156,8 +156,8 @@
+ 			no-map;
+ 		};
+ 
+-		tz: tz@48500000 {
+-			reg = <0x0 0x48500000 0x0 0x00200000>;
++		tz: memory@4a600000 {
++			reg = <0x0 0x4a600000 0x0 0x00400000>;
+ 			no-map;
+ 		};
+ 
+@@ -167,7 +167,7 @@
+ 		};
+ 
+ 		q6_region: memory@4ab00000 {
+-			reg = <0x0 0x4ab00000 0x0 0x02800000>;
++			reg = <0x0 0x4ab00000 0x0 0x05500000>;
+ 			no-map;
+ 		};
+ 	};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch b/queue-5.10/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch
new file mode 100644
index 00000000000..809d310651e
--- /dev/null
+++ b/queue-5.10/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch
@@ -0,0 +1,41 @@
+From 706c152aba3fb17fd9120c58c24be52c5a0e68fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 19:51:05 +0100
+Subject: arm64: dts: ls1028a: fix ENETC PTP clock input
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit d0570a575aa83116bd0f6a99c4de548af773d950 ]
+
+On the LS1028A the ENETC reference clock is connected to 4th HWA output,
+see Figure 7 "Clock subsystem block diagram".
+
+The PHC may run with a wrong frequency. ptp_qoriq_auto_config() will read
+the clock speed of the clock given in the device tree. It is likely that,
+on the reference board this wasn't noticed because both clocks have the
+same frequency. But this must not be always the case. Fix it.
+
+Fixes: 49401003e260 ("arm64: dts: fsl: ls1028a: add ENETC 1588 timer node")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 7a6fb7e1fb82f..060b0d5c2669e 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -934,7 +934,7 @@
+ 			ethernet@0,4 {
+ 				compatible = "fsl,enetc-ptp";
+ 				reg = <0x000400 0 0 0 0>;
+-				clocks = <&clockgen 4 0>;
++				clocks = <&clockgen 2 3>;
+ 				little-endian;
+ 				fsl,extts-fifo;
+ 			};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-ls1028a-fix-flexspi-clock-input.patch b/queue-5.10/arm64-dts-ls1028a-fix-flexspi-clock-input.patch
new file mode 100644
index 00000000000..1e9b203aba5
--- /dev/null
+++ b/queue-5.10/arm64-dts-ls1028a-fix-flexspi-clock-input.patch
@@ -0,0 +1,36 @@
+From 99115df532ff732ae603fc94d9dfb915cb08c0c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 19:51:06 +0100
+Subject: arm64: dts: ls1028a: fix FlexSPI clock input
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 588b17eda1356e06efa4b888d0af02c80a2788f6 ]
+
+On the LS1028A the FlexSPI clock is connected to the first HWA output,
+see Figure 7 "Clock subsystem block diagram".
+
+Fixes: c77fae5ba09a ("arm64: dts: ls1028a: Add FlexSPI support")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 060b0d5c2669e..33aa0efa2293a 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -309,7 +309,7 @@
+ 			      <0x0 0x20000000 0x0 0x10000000>;
+ 			reg-names = "fspi_base", "fspi_mmap";
+ 			interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&clockgen 4 3>, <&clockgen 4 3>;
++			clocks = <&clockgen 2 0>, <&clockgen 2 0>;
+ 			clock-names = "fspi_en", "fspi";
+ 			status = "disabled";
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-mediatek-mt8183-fix-gce-incorrect-mbox-cel.patch b/queue-5.10/arm64-dts-mediatek-mt8183-fix-gce-incorrect-mbox-cel.patch
new file mode 100644
index 00000000000..e78d372be61
--- /dev/null
+++ b/queue-5.10/arm64-dts-mediatek-mt8183-fix-gce-incorrect-mbox-cel.patch
@@ -0,0 +1,43 @@
+From 6ea43b0074c6e9df5017ed44ece84c7b70fbfa80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Oct 2020 21:42:25 +0200
+Subject: arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit e55c56df43dd11de4a6c08e3ea52ca45b51c8800 ]
+
+The binding documentation says:
+- #mbox-cells: Should be 2.
+	<&phandle channel priority>
+	phandle: Label name of a gce node.
+	channel: Channel of mailbox. Be equal to the thread id of GCE.
+	priority: Priority of GCE thread.
+
+Fix the value of #mbox-cells.
+
+Fixes: d3c306e31bc7 ("arm64: dts: add gce node for mt8183")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Link: https://lore.kernel.org/r/20201018194225.3361182-1-fparent@baylibre.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 9cfd961c45eb3..08a914d3a6435 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -363,7 +363,7 @@
+ 			compatible = "mediatek,mt8183-gce";
+ 			reg = <0 0x10238000 0 0x4000>;
+ 			interrupts = <GIC_SPI 162 IRQ_TYPE_LEVEL_LOW>;
+-			#mbox-cells = <3>;
++			#mbox-cells = <2>;
+ 			clocks = <&infracfg CLK_INFRA_GCE>;
+ 			clock-names = "gce";
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch b/queue-5.10/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch
new file mode 100644
index 00000000000..db38d87652e
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch
@@ -0,0 +1,157 @@
+From ba8fb9835983228fa3621e8d8e6b356fb3099cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 18:58:00 +0100
+Subject: arm64: dts: meson: fix PHY deassert timing requirements
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c183c406c4321002fe85b345b51bc1a3a04b6d33 ]
+
+According to the datasheet (Rev. 1.9) the RTL8211F requires at least
+72ms "for internal circuits settling time" before accessing the PHY
+registers. This fixes an issue seen on ODROID-C2 where the Ethernet
+link doesn't come up when using ip link set down/up:
+  [ 6630.714855] meson8b-dwmac c9410000.ethernet eth0: Link is Down
+  [ 6630.785775] meson8b-dwmac c9410000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=36)
+  [ 6630.893071] meson8b-dwmac c9410000.ethernet: Failed to reset the dma
+  [ 6630.893800] meson8b-dwmac c9410000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed
+  [ 6630.902835] meson8b-dwmac c9410000.ethernet eth0: stmmac_open: Hw setup failed
+
+Fixes: f29cabf240ed ("arm64: dts: meson: use the generic Ethernet PHY reset GPIO bindings")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/4a322c198b86e4c8b3dda015560a683babea4d63.1607363522.git.stefan@agner.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts  | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts   | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi  | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi     | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts  | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts   | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts        | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts    | 2 +-
+ 9 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+index 7be3e354093bf..de27beafe9db9 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+@@ -165,7 +165,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 			interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 70fcfb7b0683d..50de1d01e5655 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -200,7 +200,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 			interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+index 222ee8069cfaa..9b0b81f191f1f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+@@ -126,7 +126,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 			interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+index ad812854a107f..a350fee1264d7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+@@ -147,7 +147,7 @@
+ 			reg = <0>;
+ 
+ 			reset-assert-us = <10000>;
+-			reset-deassert-us = <30000>;
++			reset-deassert-us = <80000>;
+ 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 			interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
+index b08c4537f260d..b2ab05c220903 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
+@@ -82,7 +82,7 @@
+ 
+ 		/* External PHY reset is shared with internal PHY Led signal */
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index e2bd9c7c817d7..62d3e04299b67 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -194,7 +194,7 @@
+ 		reg = <0>;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+index 83eca3af44ce7..dfa7a37a1281f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+@@ -112,7 +112,7 @@
+ 		max-speed = <1000>;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
+index ea45ae0c71b7f..8edbfe040805c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
+@@ -64,7 +64,7 @@
+ 
+ 		/* External PHY reset is shared with internal PHY Led signal */
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+index c89c9f846fb10..dde7cfe12cffa 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+@@ -114,7 +114,7 @@
+ 		max-speed = <1000>;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch b/queue-5.10/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch
new file mode 100644
index 00000000000..e0d601a2bbf
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch
@@ -0,0 +1,38 @@
+From 8f9ad389ae67bdd7e7af77240e139178ced08f64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 02:40:01 +0000
+Subject: arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
+
+From: Artem Lapkin <art@khadas.com>
+
+[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]
+
+The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc
+chip should be 104Mhz not 30MHz.
+
+Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
+Signed-off-by: Artem Lapkin <art@khadas.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index bff8ec2c1c70c..e2bd9c7c817d7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -341,7 +341,7 @@
+ 		#size-cells = <1>;
+ 		compatible = "winbond,w25q16", "jedec,spi-nor";
+ 		reg = <0>;
+-		spi-max-frequency = <3000000>;
++		spi-max-frequency = <104000000>;
+ 	};
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch b/queue-5.10/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch
new file mode 100644
index 00000000000..904025f93d7
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch
@@ -0,0 +1,41 @@
+From 8213767141a7abaae2de0feb6b82d56d8bffee9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 18:58:02 +0100
+Subject: arm64: dts: meson: g12a: x96-max: fix PHY deassert timing
+ requirements
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 3d07c3b3a886fefd583c1b485b5e4e3c4e2da493 ]
+
+According to the datasheet (Rev. 1.9) the RTL8211F requires at least
+72ms "for internal circuits settling time" before accessing the PHY
+registers. On similar boards with the same PHY this fixes an issue where
+Ethernet link would not come up when using ip link set down/up.
+
+Fixes: ed5e8f689154 ("arm64: dts: meson: g12a: x96-max: fix the Ethernet PHY reset line")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/12506964ca5d5f936579a280ad0a7e7f9a0a2d4c.1607363522.git.stefan@agner.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
+index 1b07c8c06eac5..463a72d6bb7c7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
+@@ -340,7 +340,7 @@
+ 		eee-broken-1000t;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-g12b-odroid-n2-fix-phy-deassert-timi.patch b/queue-5.10/arm64-dts-meson-g12b-odroid-n2-fix-phy-deassert-timi.patch
new file mode 100644
index 00000000000..49427a2b87f
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-g12b-odroid-n2-fix-phy-deassert-timi.patch
@@ -0,0 +1,46 @@
+From 73c9e3093982e6dcb233c50caf123cfb29733b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 18:57:59 +0100
+Subject: arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing
+ requirements
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 1c7412530d5d0e0a0b27f1642f5c13c8b9f36f05 ]
+
+According to the datasheet (Rev. 1.9) the RTL8211F requires at least
+72ms "for internal circuits settling time" before accessing the PHY
+registers. This fixes an issue where the Ethernet link doesn't come up
+when using ip link set down/up:
+  [   29.360965] meson8b-dwmac ff3f0000.ethernet eth0: Link is Down
+  [   34.569012] meson8b-dwmac ff3f0000.ethernet eth0: PHY [0.0:00] driver [RTL8211F Gigabit Ethernet] (irq=31)
+  [   34.676732] meson8b-dwmac ff3f0000.ethernet: Failed to reset the dma
+  [   34.678874] meson8b-dwmac ff3f0000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed
+  [   34.687850] meson8b-dwmac ff3f0000.ethernet eth0: stmmac_open: Hw setup failed
+
+Fixes: 658e4129bb81 ("arm64: dts: meson: g12b: odroid-n2: add the Ethernet PHY reset line")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/df3f5c4fc6e43c55429fd3662a636036a21eed49.1607363522.git.stefan@agner.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+index 6982632ae6461..39a09661c5f62 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+@@ -413,7 +413,7 @@
+ 		max-speed = <1000>;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-g12b-w400-fix-phy-deassert-timing-re.patch b/queue-5.10/arm64-dts-meson-g12b-w400-fix-phy-deassert-timing-re.patch
new file mode 100644
index 00000000000..138885841b6
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-g12b-w400-fix-phy-deassert-timing-re.patch
@@ -0,0 +1,40 @@
+From fdf49d0ff322f6f4f4545a59c193ac03cbece8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 18:58:03 +0100
+Subject: arm64: dts: meson: g12b: w400: fix PHY deassert timing requirements
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 9e454e37dc7c0ee9e108d70b983e7a71332aedff ]
+
+According to the datasheet (Rev. 1.9) the RTL8211F requires at least
+72ms "for internal circuits settling time" before accessing the PHY
+egisters. On similar boards with the same PHY this fixes an issue where
+Ethernet link would not come up when using ip link set down/up.
+
+Fixes: 2cd2310fca4c ("arm64: dts: meson-g12b-ugoos-am6: add initial device-tree")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/46298e66572784c44f873f1b71cc4ab3d8fc5aa6.1607363522.git.stefan@agner.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+index 2802ddbb83ac7..feb0885047400 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+@@ -264,7 +264,7 @@
+ 		max-speed = <1000>;
+ 
+ 		reset-assert-us = <10000>;
+-		reset-deassert-us = <30000>;
++		reset-deassert-us = <80000>;
+ 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
+ 
+ 		interrupt-parent = <&gpio_intc>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch b/queue-5.10/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch
new file mode 100644
index 00000000000..55fd9295d6a
--- /dev/null
+++ b/queue-5.10/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch
@@ -0,0 +1,37 @@
+From ef62b57dcbf676b1d3b1dfb3a46b57cb1b26f42b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 15:03:20 +0900
+Subject: arm64: dts: meson-sm1: fix typo in opp table
+
+From: Dongjin Kim <tobetter@gmail.com>
+
+[ Upstream commit b6a1c8a1eaa73b1e2ae251399308e9445d74cef7 ]
+
+The freqency 1512000000 should be 1500000000.
+
+Signed-off-by: Dongjin Kim <tobetter@gmail.com>
+Fixes: 3d9e76483049 ("arm64: dts: meson-sm1-sei610: enable DVFS")
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20201130060320.GA30098@anyang-linuxfactory-or-kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
+index 71317f5aada1d..c309517abae32 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
+@@ -130,7 +130,7 @@
+ 			opp-microvolt = <790000>;
+ 		};
+ 
+-		opp-1512000000 {
++		opp-1500000000 {
+ 			opp-hz = /bits/ 64 <1500000000>;
+ 			opp-microvolt = <800000>;
+ 		};
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-c630-fix-pinctrl-pins-properties.patch b/queue-5.10/arm64-dts-qcom-c630-fix-pinctrl-pins-properties.patch
new file mode 100644
index 00000000000..d9680e6e58d
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-c630-fix-pinctrl-pins-properties.patch
@@ -0,0 +1,64 @@
+From 0f975b7c6dc7bd13054436c30dbac7127d81ecb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 11:00:28 -0600
+Subject: arm64: dts: qcom: c630: Fix pinctrl pins properties
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit f55d373f7953909160cb4c1398f62123cdbe7650 ]
+
+The "pins" property takes an array of pin _names_, not pin numbers. Fix
+this.
+
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
+Link: https://lore.kernel.org/r/20201130170028.319798-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index 60c6ab8162e21..76a8c996d497f 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -432,7 +432,7 @@
+ 	gpio-reserved-ranges = <0 4>, <81 4>;
+ 
+ 	i2c3_hid_active: i2c2-hid-active {
+-		pins = <37>;
++		pins = "gpio37";
+ 		function = "gpio";
+ 
+ 		input-enable;
+@@ -441,7 +441,7 @@
+ 	};
+ 
+ 	i2c5_hid_active: i2c5-hid-active {
+-		pins = <125>;
++		pins = "gpio125";
+ 		function = "gpio";
+ 
+ 		input-enable;
+@@ -450,7 +450,7 @@
+ 	};
+ 
+ 	i2c11_hid_active: i2c11-hid-active {
+-		pins = <92>;
++		pins = "gpio92";
+ 		function = "gpio";
+ 
+ 		input-enable;
+@@ -459,7 +459,7 @@
+ 	};
+ 
+ 	wcd_intr_default: wcd_intr_default {
+-		pins = <54>;
++		pins = "gpio54";
+ 		function = "gpio";
+ 
+ 		input-enable;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch b/queue-5.10/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch
new file mode 100644
index 00000000000..16accd297c1
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch
@@ -0,0 +1,131 @@
+From 34f21349fd07258b8e9007c1548fbc940f32ddee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 10:59:24 -0600
+Subject: arm64: dts: qcom: c630: Polish i2c-hid devices
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 11d0e4f281565ef757479764ce7fd8d35eeb01b0 ]
+
+The numbering of the i2c busses differs from ACPI and a number of typos
+was made in the original patch. Further more the irq flags for the
+various resources was not correct and i2c3 only has one of the two
+client devices active in any one device.
+
+Also label the various devices, for easier comparison with the ACPI
+tables.
+
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
+Link: https://lore.kernel.org/r/20201130165924.319708-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 31 +++++++++++--------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index d03ca31907466..60c6ab8162e21 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -264,23 +264,28 @@
+ 	status = "okay";
+ 	clock-frequency = <400000>;
+ 
+-	hid@15 {
++	tsel: hid@15 {
+ 		compatible = "hid-over-i2c";
+ 		reg = <0x15>;
+ 		hid-descr-addr = <0x1>;
+ 
+-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
++		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
++
++		pinctrl-names = "default";
++		pinctrl-0 = <&i2c3_hid_active>;
+ 	};
+ 
+-	hid@2c {
++	tsc2: hid@2c {
+ 		compatible = "hid-over-i2c";
+ 		reg = <0x2c>;
+ 		hid-descr-addr = <0x20>;
+ 
+-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
++		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&i2c2_hid_active>;
++		pinctrl-0 = <&i2c3_hid_active>;
++
++		status = "disabled";
+ 	};
+ };
+ 
+@@ -288,15 +293,15 @@
+ 	status = "okay";
+ 	clock-frequency = <400000>;
+ 
+-	hid@10 {
++	tsc1: hid@10 {
+ 		compatible = "hid-over-i2c";
+ 		reg = <0x10>;
+ 		hid-descr-addr = <0x1>;
+ 
+-		interrupts-extended = <&tlmm 125 IRQ_TYPE_EDGE_FALLING>;
++		interrupts-extended = <&tlmm 125 IRQ_TYPE_LEVEL_LOW>;
+ 
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&i2c6_hid_active>;
++		pinctrl-0 = <&i2c5_hid_active>;
+ 	};
+ };
+ 
+@@ -304,7 +309,7 @@
+ 	status = "okay";
+ 	clock-frequency = <400000>;
+ 
+-	hid@5c {
++	ecsh: hid@5c {
+ 		compatible = "hid-over-i2c";
+ 		reg = <0x5c>;
+ 		hid-descr-addr = <0x1>;
+@@ -312,7 +317,7 @@
+ 		interrupts-extended = <&tlmm 92 IRQ_TYPE_LEVEL_LOW>;
+ 
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&i2c12_hid_active>;
++		pinctrl-0 = <&i2c11_hid_active>;
+ 	};
+ };
+ 
+@@ -426,7 +431,7 @@
+ &tlmm {
+ 	gpio-reserved-ranges = <0 4>, <81 4>;
+ 
+-	i2c2_hid_active: i2c2-hid-active {
++	i2c3_hid_active: i2c2-hid-active {
+ 		pins = <37>;
+ 		function = "gpio";
+ 
+@@ -435,7 +440,7 @@
+ 		drive-strength = <2>;
+ 	};
+ 
+-	i2c6_hid_active: i2c6-hid-active {
++	i2c5_hid_active: i2c5-hid-active {
+ 		pins = <125>;
+ 		function = "gpio";
+ 
+@@ -444,7 +449,7 @@
+ 		drive-strength = <2>;
+ 	};
+ 
+-	i2c12_hid_active: i2c12-hid-active {
++	i2c11_hid_active: i2c11-hid-active {
+ 		pins = <92>;
+ 		function = "gpio";
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-msm8916-samsung-a2015-disable-muic-i2.patch b/queue-5.10/arm64-dts-qcom-msm8916-samsung-a2015-disable-muic-i2.patch
new file mode 100644
index 00000000000..6b634c89b1f
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-msm8916-samsung-a2015-disable-muic-i2.patch
@@ -0,0 +1,55 @@
+From d7d60734a1cafd5c69a457ac6962968749169be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 22:59:17 +0500
+Subject: arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias
+
+From: Nikita Travkin <nikitos.tr@gmail.com>
+
+[ Upstream commit 4e8692c2ee3d4ac6b669f7e306364d77a574c810 ]
+
+Some versions of the firmware leave i2c gpios in a wrong state.
+Add pinctrl that disables pin bias since external pull-up resistors
+are present.
+
+Reviewed-by: Stephan Gerhold <stephan@gerhold.net>
+Fixes: 1329c1ab0730 ("arm64: dts: qcom: Add device tree for Samsung Galaxy A3U/A5U")
+Signed-off-by: Nikita Travkin <nikitos.tr@gmail.com>
+Link: https://lore.kernel.org/r/20201113175917.189123-6-nikitos.tr@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/msm8916-samsung-a2015-common.dtsi   | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+index b18d21e42f596..f7ac4c4033db6 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+@@ -78,6 +78,9 @@
+ 		sda-gpios = <&msmgpio 105 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+ 		scl-gpios = <&msmgpio 106 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
+ 
++		pinctrl-names = "default";
++		pinctrl-0 = <&muic_i2c_default>;
++
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+@@ -314,6 +317,14 @@
+ 		};
+ 	};
+ 
++	muic_i2c_default: muic-i2c-default {
++		pins = "gpio105", "gpio106";
++		function = "gpio";
++
++		drive-strength = <2>;
++		bias-disable;
++	};
++
+ 	muic_int_default: muic-int-default {
+ 		pins = "gpio12";
+ 		function = "gpio";
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-sc7180-fix-one-forgotten-interconnect.patch b/queue-5.10/arm64-dts-qcom-sc7180-fix-one-forgotten-interconnect.patch
new file mode 100644
index 00000000000..55fa94c224c
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sc7180-fix-one-forgotten-interconnect.patch
@@ -0,0 +1,46 @@
+From e11f6a7d0766b275d1c3579aad00c6cb549e6c44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 14:18:55 -0700
+Subject: arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 228813aaa71113d7a12313b87c4905a9d3f9df37 ]
+
+In commit e23b1220a246 ("arm64: dts: qcom: sc7180: Increase the number
+of interconnect cells") we missed increasing the cells on one
+interconnect.  That's no bueno.  Fix it.
+
+NOTE: it appears that things aren't totally broken without this fix,
+but clearly something isn't going to be working right.  If nothing
+else, without this fix I see this in the logs:
+
+  OF: /soc@0/mdss@ae00000: could not get #interconnect-cells for /soc@0/interrupt-controller@17a00000
+
+Fixes: e23b1220a246 ("arm64: dts: qcom: sc7180: Increase the number of interconnect cells")
+Reviewed-by: Georgi Djakov <georgi.djakov@linaro.org>
+Reviewed-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20201001141838.1.I08054d1d976eed64ffa1b0e21d568e0dc6040b54@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 6678f1e8e3958..a02776ce77a10 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -2811,7 +2811,7 @@
+ 			interrupt-controller;
+ 			#interrupt-cells = <1>;
+ 
+-			interconnects = <&mmss_noc MASTER_MDP0 &mc_virt SLAVE_EBI1>;
++			interconnects = <&mmss_noc MASTER_MDP0 0 &mc_virt SLAVE_EBI1 0>;
+ 			interconnect-names = "mdp0-mem";
+ 
+ 			iommus = <&apps_smmu 0x800 0x2>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-sc7180-limit-ipa-iommu-streams.patch b/queue-5.10/arm64-dts-qcom-sc7180-limit-ipa-iommu-streams.patch
new file mode 100644
index 00000000000..560059c7f23
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sc7180-limit-ipa-iommu-streams.patch
@@ -0,0 +1,44 @@
+From 1356b171f52d26ebd369ba55dd0fe91e85983832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 19:54:55 -0600
+Subject: arm64: dts: qcom: sc7180: limit IPA iommu streams
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 8f34831d3659d38f480fddccb76d84c6c3e0ac0b ]
+
+Recently we learned that Android and Windows firmware don't seem to
+like using 3 as an iommu mask value for IPA.  A simple fix was to
+specify exactly the streams needed explicitly, rather than implying
+a range with the mask.  Make the same change for the SC7180 platform.
+
+See also:
+  https://lore.kernel.org/linux-arm-msm/20201123052305.157686-1-bjorn.andersson@linaro.org/
+
+Fixes: d82fade846aa8 ("arm64: dts: qcom: sc7180: add IPA information")
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Link: https://lore.kernel.org/r/20201126015457.6557-2-elder@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index a02776ce77a10..c71f3afc1cc9f 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -1394,7 +1394,8 @@
+ 		ipa: ipa@1e40000 {
+ 			compatible = "qcom,sc7180-ipa";
+ 
+-			iommus = <&apps_smmu 0x440 0x3>;
++			iommus = <&apps_smmu 0x440 0x0>,
++				 <&apps_smmu 0x442 0x0>;
+ 			reg = <0 0x1e40000 0 0x7000>,
+ 			      <0 0x1e47000 0 0x2000>,
+ 			      <0 0x1e04000 0 0x2c000>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-sdm845-limit-ipa-iommu-streams.patch b/queue-5.10/arm64-dts-qcom-sdm845-limit-ipa-iommu-streams.patch
new file mode 100644
index 00000000000..c37d7ac2683
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sdm845-limit-ipa-iommu-streams.patch
@@ -0,0 +1,42 @@
+From 18dedf80d7933ef25a0c9398211b725981ea7969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 23:23:05 -0600
+Subject: arm64: dts: qcom: sdm845: Limit ipa iommu streams
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 95e6f8467c83c4074a6f6b47bad00653549ff90a ]
+
+The Android and Windows firmware does not accept the use of 3 as a mask
+to cover the IPA streams. But with 0x721 being related to WiFi and 0x723
+being unsed the mapping can be reduced to just cover 0x720 and 0x722,
+which is accepted.
+
+Acked-by: Alex Elder <elder@linaro.org>
+Tested-by: Alex Elder <elder@linaro.org>
+Fixes: e9e89c45bfeb ("arm64: dts: sdm845: add IPA iommus property")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20201123052305.157686-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 40e8c11f23ab0..f97f354af86f4 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2141,7 +2141,8 @@
+ 		ipa: ipa@1e40000 {
+ 			compatible = "qcom,sdm845-ipa";
+ 
+-			iommus = <&apps_smmu 0x720 0x3>;
++			iommus = <&apps_smmu 0x720 0x0>,
++				 <&apps_smmu 0x722 0x0>;
+ 			reg = <0 0x1e40000 0 0x7000>,
+ 			      <0 0x1e47000 0 0x2000>,
+ 			      <0 0x1e04000 0 0x2c000>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-qcom-sm8250-correct-compatible-for-sm8250-.patch b/queue-5.10/arm64-dts-qcom-sm8250-correct-compatible-for-sm8250-.patch
new file mode 100644
index 00000000000..bd12df66f7f
--- /dev/null
+++ b/queue-5.10/arm64-dts-qcom-sm8250-correct-compatible-for-sm8250-.patch
@@ -0,0 +1,39 @@
+From f0915b5e750aa8e3afc4f200928062712e478b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 14:21:33 +0300
+Subject: arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d371a931540bc36fd1199de3ec365a1187b7b282 ]
+
+Qualcomm boards should define two compatible strings: one for board,
+anoter one for SoC family. sm8250-mtp.dts lists just the board
+compatible, which makes it incompatible with qcom.yaml schema.
+
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: 60378f1a171e ("arm64: dts: qcom: sm8250: Add sm8250 dts file")
+Link: https://lore.kernel.org/r/20200930112133.2091505-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250-mtp.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
+index fd194ed7fbc86..98675e1f8204f 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
+@@ -14,7 +14,7 @@
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. SM8250 MTP";
+-	compatible = "qcom,sm8250-mtp";
++	compatible = "qcom,sm8250-mtp", "qcom,sm8250";
+ 
+ 	aliases {
+ 		serial0 = &uart12;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch b/queue-5.10/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch
new file mode 100644
index 00000000000..97504fe3daa
--- /dev/null
+++ b/queue-5.10/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch
@@ -0,0 +1,38 @@
+From 278f8d63641fd4d4d63b6261ab487ceb4ae1ce03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:23:50 +0100
+Subject: arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy
+ node
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 53e573dc39fba1834f3e4fa002cb754b61a30701 ]
+
+The CAT875 sub board from Silicon Linux uses Realtek phy and the driver
+does not support rxc-skew-ps property.
+
+Fixes: 6b170cd3ed02949f ("arm64: dts: renesas: cat875: Add ethernet support")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20201015132350.8360-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/cat875.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi
+index 33daa95706840..801ea54b027c4 100644
+--- a/arch/arm64/boot/dts/renesas/cat875.dtsi
++++ b/arch/arm64/boot/dts/renesas/cat875.dtsi
+@@ -21,7 +21,6 @@
+ 	status = "okay";
+ 
+ 	phy0: ethernet-phy@0 {
+-		rxc-skew-ps = <1500>;
+ 		reg = <0>;
+ 		interrupt-parent = <&gpio2>;
+ 		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch b/queue-5.10/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch
new file mode 100644
index 00000000000..86de6a2a65e
--- /dev/null
+++ b/queue-5.10/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch
@@ -0,0 +1,38 @@
+From 8a0a6648670bed7e1ce3a06e18b09872b8a48fc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:23:49 +0100
+Subject: arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from
+ ethernet-phy node
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 67d3dcf12a3d245b6fd6ca5672893f7ae4e137ed ]
+
+HiHope RZG2[HMN] boards uses Realtek phy and the driver does not support
+rxc-skew-ps property. So remove rxc-skew-ps from ethernet-phy node.
+
+Fixes: 7433f1fb8ec8fe ("arm64: dts: renesas: Add HiHope RZ/G2M sub board support")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20201015132350.8360-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+index 178401a34cbf8..b9e46aed53362 100644
+--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
++++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+@@ -23,7 +23,6 @@
+ 	status = "okay";
+ 
+ 	phy0: ethernet-phy@0 {
+-		rxc-skew-ps = <1500>;
+ 		reg = <0>;
+ 		interrupt-parent = <&gpio2>;
+ 		interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch b/queue-5.10/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch
new file mode 100644
index 00000000000..e0b5bc508ad
--- /dev/null
+++ b/queue-5.10/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch
@@ -0,0 +1,75 @@
+From 3a1b2fde5088cfdb09d91f583f4e6c7507756802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:48:05 +0800
+Subject: arm64: dts: rockchip: Fix UART pull-ups on rk3328
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]
+
+For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
+UARTs transmit active-low, so a disconnected RX pin should be pulled
+high instead of left floating to prevent noise being interpreted as
+transmissions.
+
+This gets rid of bogus sysrq events when the UART console is not
+connected.
+
+Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index bbdb19a3e85d1..db0d5c8e5f96a 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -1237,8 +1237,8 @@
+ 
+ 		uart0 {
+ 			uart0_xfer: uart0-xfer {
+-				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
+-						<1 RK_PB0 1 &pcfg_pull_none>;
++				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
++						<1 RK_PB0 1 &pcfg_pull_up>;
+ 			};
+ 
+ 			uart0_cts: uart0-cts {
+@@ -1256,8 +1256,8 @@
+ 
+ 		uart1 {
+ 			uart1_xfer: uart1-xfer {
+-				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
+-						<3 RK_PA6 4 &pcfg_pull_none>;
++				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
++						<3 RK_PA6 4 &pcfg_pull_up>;
+ 			};
+ 
+ 			uart1_cts: uart1-cts {
+@@ -1275,15 +1275,15 @@
+ 
+ 		uart2-0 {
+ 			uart2m0_xfer: uart2m0-xfer {
+-				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
+-						<1 RK_PA1 2 &pcfg_pull_none>;
++				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
++						<1 RK_PA1 2 &pcfg_pull_up>;
+ 			};
+ 		};
+ 
+ 		uart2-1 {
+ 			uart2m1_xfer: uart2m1-xfer {
+-				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
+-						<2 RK_PA1 1 &pcfg_pull_none>;
++				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
++						<2 RK_PA1 1 &pcfg_pull_up>;
+ 			};
+ 		};
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch b/queue-5.10/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch
new file mode 100644
index 00000000000..67e0e2199e4
--- /dev/null
+++ b/queue-5.10/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch
@@ -0,0 +1,37 @@
+From a62d978c122faf381cc30a33a13d90d925900818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 15:33:34 +0800
+Subject: arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]
+
+The board has a standard USB A female port connected to the USB OTG
+controller's data pins. Set dr_mode in the OTG controller node to
+indicate this usage, instead of having the implementation guess.
+
+Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index b70ffb1c6a630..b76282e704de1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -334,6 +334,7 @@
+ };
+ 
+ &usb20_otg {
++	dr_mode = "host";
+ 	status = "okay";
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-dts-ti-k3-am65-j721e-fix-unit-address-format-e.patch b/queue-5.10/arm64-dts-ti-k3-am65-j721e-fix-unit-address-format-e.patch
new file mode 100644
index 00000000000..e02b9e694ab
--- /dev/null
+++ b/queue-5.10/arm64-dts-ti-k3-am65-j721e-fix-unit-address-format-e.patch
@@ -0,0 +1,59 @@
+From 6d198e2311b1bda39f8e955fd9a05f104cdd8479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 16:25:19 -0600
+Subject: arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for
+ dss node
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit cfbf17e69ae82f647c287366b7573e532fc281ee ]
+
+Fix the node address to follow the device tree convention.
+
+This fixes the dtc warning:
+<stdout>: Warning (simple_bus_reg): /bus@100000/dss@04a00000: simple-bus
+unit address format error, expected "4a00000"
+
+Fixes: 76921f15acc0 ("arm64: dts: ti: k3-j721e-main: Add DSS node")
+Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Jyri Sarha <jsarha@ti.com>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://lore.kernel.org/r/20201104222519.12308-1-nm@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi  | 2 +-
+ arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index 533525229a8db..27f6fd9eaa0ab 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -834,7 +834,7 @@
+ 		};
+ 	};
+ 
+-	dss: dss@04a00000 {
++	dss: dss@4a00000 {
+ 		compatible = "ti,am65x-dss";
+ 		reg =	<0x0 0x04a00000 0x0 0x1000>, /* common */
+ 			<0x0 0x04a02000 0x0 0x1000>, /* vidl1 */
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+index e2a96b2c423c4..c66ded9079be4 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+@@ -1278,7 +1278,7 @@
+ 		};
+ 	};
+ 
+-	dss: dss@04a00000 {
++	dss: dss@4a00000 {
+ 		compatible = "ti,j721e-dss";
+ 		reg =
+ 			<0x00 0x04a00000 0x00 0x10000>, /* common_m */
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-mte-fix-prctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch b/queue-5.10/arm64-mte-fix-prctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch
new file mode 100644
index 00000000000..015a0f20283
--- /dev/null
+++ b/queue-5.10/arm64-mte-fix-prctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch
@@ -0,0 +1,41 @@
+From 7011c888f8fa55b306109f67e7c53b6a6bd1c54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 23:51:10 -0800
+Subject: arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
+
+From: Peter Collingbourne <pcc@google.com>
+
+[ Upstream commit 929c1f3384d7e5cd319d03242cb925c3f91236f7 ]
+
+Previously we were always returning a tag inclusion mask of zero via
+PR_GET_TAGGED_ADDR_CTRL if TCF0 was set to NONE. Fix it by making
+the code for the NONE case match the others.
+
+Signed-off-by: Peter Collingbourne <pcc@google.com>
+Link: https://linux-review.googlesource.com/id/Iefbea66cf7d2b4c80b82f9639b9ea7f33f7fac53
+Fixes: af5ce95282dc ("arm64: mte: Allow user control of the generated random tags via prctl()")
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/20201203075110.2781021-1-pcc@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/mte.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
+index 52a0638ed967b..ef15c8a2a49dc 100644
+--- a/arch/arm64/kernel/mte.c
++++ b/arch/arm64/kernel/mte.c
+@@ -189,7 +189,8 @@ long get_mte_ctrl(struct task_struct *task)
+ 
+ 	switch (task->thread.sctlr_tcf0) {
+ 	case SCTLR_EL1_TCF0_NONE:
+-		return PR_MTE_TCF_NONE;
++		ret |= PR_MTE_TCF_NONE;
++		break;
+ 	case SCTLR_EL1_TCF0_SYNC:
+ 		ret |= PR_MTE_TCF_SYNC;
+ 		break;
+-- 
+2.27.0
+
diff --git a/queue-5.10/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch b/queue-5.10/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch
new file mode 100644
index 00000000000..db51de15ee6
--- /dev/null
+++ b/queue-5.10/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch
@@ -0,0 +1,46 @@
+From 9b18c8bf4500cefb10a84608c55bb5d7ef54d366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 12:09:02 +0530
+Subject: arm64: tegra: Fix DT binding for IO High Voltage entry
+
+From: Vidya Sagar <vidyas@nvidia.com>
+
+[ Upstream commit 6b26c1a034885923822f6c4d94f8644d32bc2481 ]
+
+Fix the device-tree entry that represents I/O High Voltage property
+by replacing 'nvidia,io-high-voltage' with 'nvidia,io-hv' as the former
+entry is deprecated.
+
+Fixes: dbb72e2c305b ("arm64: tegra: Add configuration for PCIe C5 sideband signals")
+Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index 93438d2b94696..6946fb210e484 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -378,7 +378,7 @@
+ 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
+ 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
+ 					nvidia,enable-input = <TEGRA_PIN_DISABLE>;
+-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
++					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
+ 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ 				};
+@@ -390,7 +390,7 @@
+ 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
+ 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
+ 					nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
++					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
+ 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ 				};
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch b/queue-5.10/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch
new file mode 100644
index 00000000000..fb36d5e8c23
--- /dev/null
+++ b/queue-5.10/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch
@@ -0,0 +1,48 @@
+From 4b19c6885e9b405999b99c5cdc59779abe666aef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:36:10 +0800
+Subject: ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 95d3befbc5e1ee39fc8a78713924cf7ed2b3cabe ]
+
+cz_da7219_init() does not check the return values of clk_get(),
+while da7219_clk_enable() calls clk_set_rate() to dereference
+the pointers.
+Add checks to fix the problems.
+Also, change clk_get() to devm_clk_get() to avoid data leak after
+failures.
+
+Fixes: bb24a31ed584 ("ASoC: AMD: Configure wclk and bclk of master codec")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20201204063610.513556-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp-da7219-max98357a.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
+index a7702e64ec512..849288d01c6b4 100644
+--- a/sound/soc/amd/acp-da7219-max98357a.c
++++ b/sound/soc/amd/acp-da7219-max98357a.c
+@@ -73,8 +73,13 @@ static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd)
+ 		return ret;
+ 	}
+ 
+-	da7219_dai_wclk = clk_get(component->dev, "da7219-dai-wclk");
+-	da7219_dai_bclk = clk_get(component->dev, "da7219-dai-bclk");
++	da7219_dai_wclk = devm_clk_get(component->dev, "da7219-dai-wclk");
++	if (IS_ERR(da7219_dai_wclk))
++		return PTR_ERR(da7219_dai_wclk);
++
++	da7219_dai_bclk = devm_clk_get(component->dev, "da7219-dai-bclk");
++	if (IS_ERR(da7219_dai_bclk))
++		return PTR_ERR(da7219_dai_bclk);
+ 
+ 	ret = snd_soc_card_jack_new(card, "Headset Jack",
+ 				SND_JACK_HEADSET | SND_JACK_LINEOUT |
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch b/queue-5.10/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch
new file mode 100644
index 00000000000..63fd648beda
--- /dev/null
+++ b/queue-5.10/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch
@@ -0,0 +1,40 @@
+From 622f8102b008bdb1feb6d9cddbeb7af94b97b978 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 21:09:20 +0800
+Subject: ASoC: arizona: Fix a wrong free in wm8997_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]
+
+In the normal path, we should not free the arizona,
+we should return immediately. It will be free when
+call remove operation.
+
+Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
+Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8997.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index 37e4bb3dbd8a9..229f2986cd96b 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -1177,6 +1177,8 @@ static int wm8997_probe(struct platform_device *pdev)
+ 		goto err_spk_irqs;
+ 	}
+ 
++	return ret;
++
+ err_spk_irqs:
+ 	arizona_free_spk_irqs(arizona);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-atmel-mchp-spdifrx-needs-common_clk.patch b/queue-5.10/asoc-atmel-mchp-spdifrx-needs-common_clk.patch
new file mode 100644
index 00000000000..be993742d7d
--- /dev/null
+++ b/queue-5.10/asoc-atmel-mchp-spdifrx-needs-common_clk.patch
@@ -0,0 +1,40 @@
+From 2ffbcf8bd207c69b7049c5c9497150f4ba77aa2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:38:05 +0100
+Subject: ASoC: atmel: mchp-spdifrx needs COMMON_CLK
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 29275309b0e32bb838d67158c6b6e687275f43e9 ]
+
+Compile-testing this driver on an older platform without CONFIG_COMMON_CLK fails with
+
+ERROR: modpost: "clk_set_min_rate" [sound/soc/atmel/snd-soc-mchp-spdifrx.ko] undefined!
+
+Make this is a strict dependency.
+
+Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20201203223815.1353451-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index bd8854bfd2ee4..142373ec411ad 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -148,6 +148,7 @@ config SND_MCHP_SOC_SPDIFTX
+ config SND_MCHP_SOC_SPDIFRX
+ 	tristate "Microchip ASoC driver for boards using S/PDIF RX"
+ 	depends on OF && (ARCH_AT91 || COMPILE_TEST)
++	depends on COMMON_CLK
+ 	select SND_SOC_GENERIC_DMAENGINE_PCM
+ 	select REGMAP_MMIO
+ 	help
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-cros_ec_codec-fix-uninitialized-memory-read.patch b/queue-5.10/asoc-cros_ec_codec-fix-uninitialized-memory-read.patch
new file mode 100644
index 00000000000..7515d6b094d
--- /dev/null
+++ b/queue-5.10/asoc-cros_ec_codec-fix-uninitialized-memory-read.patch
@@ -0,0 +1,44 @@
+From bde5fd9666d0643a17e4841f0f9d290d99195af9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:54:41 +0100
+Subject: ASoC: cros_ec_codec: fix uninitialized memory read
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7061b8a52296e044eed47b605d136a48da1a7761 ]
+
+gcc points out a memory area that is copied to a device
+but not initialized:
+
+sound/soc/codecs/cros_ec_codec.c: In function 'i2s_rx_event':
+arch/x86/include/asm/string_32.h:83:20: error: '*((void *)&p+4)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+   83 |   *((int *)to + 1) = *((int *)from + 1);
+
+Initialize all the unused fields to zero.
+
+Fixes: 727f1c71c780 ("ASoC: cros_ec_codec: refactor I2S RX")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20201203225458.1477830-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cros_ec_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cros_ec_codec.c b/sound/soc/codecs/cros_ec_codec.c
+index 28f039adfa138..5c3b7e5e55d23 100644
+--- a/sound/soc/codecs/cros_ec_codec.c
++++ b/sound/soc/codecs/cros_ec_codec.c
+@@ -332,7 +332,7 @@ static int i2s_rx_event(struct snd_soc_dapm_widget *w,
+ 		snd_soc_dapm_to_component(w->dapm);
+ 	struct cros_ec_codec_priv *priv =
+ 		snd_soc_component_get_drvdata(component);
+-	struct ec_param_ec_codec_i2s_rx p;
++	struct ec_param_ec_codec_i2s_rx p = {};
+ 
+ 	switch (event) {
+ 	case SND_SOC_DAPM_PRE_PMU:
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-intel-boards-tgl_max98373-update-tdm-slot_width.patch b/queue-5.10/asoc-intel-boards-tgl_max98373-update-tdm-slot_width.patch
new file mode 100644
index 00000000000..d257dd2c97c
--- /dev/null
+++ b/queue-5.10/asoc-intel-boards-tgl_max98373-update-tdm-slot_width.patch
@@ -0,0 +1,48 @@
+From a1578fc8bbd5bc934fe75182cc4a0e3cba4df23f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 13:11:50 -0800
+Subject: ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit 0d7f2459ae926a964ab211aac413d72074131727 ]
+
+Speaker amp's SSP bclk configuration was changed in the topology file to be
+based on 12.288MHz and dai_ops->hw_params is based on s32le format.
+But, the TDM slot size remained set to 24 bits.
+This inconsistency created audible noises and needs to be corrected.
+This patch updates TDM slot width to 32.
+
+Fixes: bc7477fc2ab4 ("ASoC: Intel: Boards: tgl_max98373: Update TDM configuration in hw_params")
+
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20201201211150.433472-1-ranjani.sridharan@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_maxim_common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_maxim_common.c b/sound/soc/intel/boards/sof_maxim_common.c
+index b6e63ea13d64e..c2a9757181fe1 100644
+--- a/sound/soc/intel/boards/sof_maxim_common.c
++++ b/sound/soc/intel/boards/sof_maxim_common.c
+@@ -49,11 +49,11 @@ static int max98373_hw_params(struct snd_pcm_substream *substream,
+ 	for_each_rtd_codec_dais(rtd, j, codec_dai) {
+ 		if (!strcmp(codec_dai->component->name, MAX_98373_DEV0_NAME)) {
+ 			/* DEV0 tdm slot configuration */
+-			snd_soc_dai_set_tdm_slot(codec_dai, 0x03, 3, 8, 24);
++			snd_soc_dai_set_tdm_slot(codec_dai, 0x03, 3, 8, 32);
+ 		}
+ 		if (!strcmp(codec_dai->component->name, MAX_98373_DEV1_NAME)) {
+ 			/* DEV1 tdm slot configuration */
+-			snd_soc_dai_set_tdm_slot(codec_dai, 0x0C, 3, 8, 24);
++			snd_soc_dai_set_tdm_slot(codec_dai, 0x0C, 3, 8, 32);
+ 		}
+ 	}
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-intel-snd_soc_intel_keembay-should-depend-on-ar.patch b/queue-5.10/asoc-intel-snd_soc_intel_keembay-should-depend-on-ar.patch
new file mode 100644
index 00000000000..5d5796c1aed
--- /dev/null
+++ b/queue-5.10/asoc-intel-snd_soc_intel_keembay-should-depend-on-ar.patch
@@ -0,0 +1,39 @@
+From d20debf50be5ef278742ed9f19ed75d7a5d510ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 15:50:01 +0100
+Subject: ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9a207228bdf0a4933b794c944d7111564353ea94 ]
+
+The Intel Keem Bay audio module is only present on Intel Keem Bay SoCs.
+Hence add a dependency on ARCH_KEEMBAY, to prevent asking the user about
+this driver when configuring a kernel without Intel Keem Bay platform
+support.
+
+Fixes: c544912bcc2dc806 ("ASoC: Intel: Add makefiles and kconfig changes for KeemBay")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20201110145001.3280479-1-geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
+index a5b446d5af19f..c1bf69a0bcfe1 100644
+--- a/sound/soc/intel/Kconfig
++++ b/sound/soc/intel/Kconfig
+@@ -198,7 +198,7 @@ endif ## SND_SOC_INTEL_SST_TOPLEVEL || SND_SOC_SOF_INTEL_TOPLEVEL
+ 
+ config SND_SOC_INTEL_KEEMBAY
+ 	tristate "Keembay Platforms"
+-	depends on ARM64 || COMPILE_TEST
++	depends on ARCH_KEEMBAY || COMPILE_TEST
+ 	depends on COMMON_CLK
+ 	help
+ 	  If you have a Intel Keembay platform then enable this option
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch b/queue-5.10/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch
new file mode 100644
index 00000000000..c67d07d62dc
--- /dev/null
+++ b/queue-5.10/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch
@@ -0,0 +1,44 @@
+From 753d17d1ccaf227857b1908c93dfa18be0cd2efb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 22:42:27 +0800
+Subject: ASoC: jz4740-i2s: add missed checks for clk_get()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]
+
+jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
+while the file dereferences the pointers in clk_put().
+Add the missed checks to fix it.
+
+Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/jz4740/jz4740-i2s.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
+index c7bd20104b204..0793e284d0e78 100644
+--- a/sound/soc/jz4740/jz4740-i2s.c
++++ b/sound/soc/jz4740/jz4740-i2s.c
+@@ -312,10 +312,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
+ 	switch (clk_id) {
+ 	case JZ4740_I2S_CLKSRC_EXT:
+ 		parent = clk_get(NULL, "ext");
++		if (IS_ERR(parent))
++			return PTR_ERR(parent);
+ 		clk_set_parent(i2s->clk_i2s, parent);
+ 		break;
+ 	case JZ4740_I2S_CLKSRC_PLL:
+ 		parent = clk_get(NULL, "pll half");
++		if (IS_ERR(parent))
++			return PTR_ERR(parent);
+ 		clk_set_parent(i2s->clk_i2s, parent);
+ 		ret = clk_set_rate(i2s->clk_i2s, freq);
+ 		break;
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-max98390-fix-error-codes-in-max98390_dsm_init.patch b/queue-5.10/asoc-max98390-fix-error-codes-in-max98390_dsm_init.patch
new file mode 100644
index 00000000000..ff945289696
--- /dev/null
+++ b/queue-5.10/asoc-max98390-fix-error-codes-in-max98390_dsm_init.patch
@@ -0,0 +1,43 @@
+From 9c8223613e85aa8746ff0c2aa42dbc3508fa5aa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 09:54:51 +0300
+Subject: ASoC: max98390: Fix error codes in max98390_dsm_init()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3cea33b6f2d7782d1be17c71509986f33ee93541 ]
+
+These error paths return success but they should return -EINVAL.
+
+Fixes: 97ed3e509ee6 ("ASoC: max98390: Fix potential crash during param fw loading")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9B0uz4svyNTqeMb@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98390.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
+index ff5cc9bbec291..bb736c44e68a3 100644
+--- a/sound/soc/codecs/max98390.c
++++ b/sound/soc/codecs/max98390.c
+@@ -784,6 +784,7 @@ static int max98390_dsm_init(struct snd_soc_component *component)
+ 	if (fw->size < MAX98390_DSM_PARAM_MIN_SIZE) {
+ 		dev_err(component->dev,
+ 			"param fw is invalid.\n");
++		ret = -EINVAL;
+ 		goto err_alloc;
+ 	}
+ 	dsm_param = (char *)fw->data;
+@@ -794,6 +795,7 @@ static int max98390_dsm_init(struct snd_soc_component *component)
+ 		fw->size < param_size + MAX98390_DSM_PAYLOAD_OFFSET) {
+ 		dev_err(component->dev,
+ 			"param fw is invalid.\n");
++		ret = -EINVAL;
+ 		goto err_alloc;
+ 	}
+ 	regmap_write(max98390->regmap, MAX98390_R203A_AMP_EN, 0x80);
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-meson-fix-compile_test-error.patch b/queue-5.10/asoc-meson-fix-compile_test-error.patch
new file mode 100644
index 00000000000..37b0af05a1b
--- /dev/null
+++ b/queue-5.10/asoc-meson-fix-compile_test-error.patch
@@ -0,0 +1,45 @@
+From 85ce2b797747a46bd9d258eabe5f1150d1af6182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 18:24:23 +0100
+Subject: ASoC: meson: fix COMPILE_TEST error
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ]
+
+When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the
+clock API. This is usually selected by the platform and the sound drivers
+should not really care about this. However COMPILE_TEST is special and the
+platform required may not have been selected, leading to this type of
+error:
+
+> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent'
+
+Since we need a sane provider of the API with COMPILE_TEST, depends on
+COMMON_CLK.
+
+Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
+index 363dc3b1bbe47..ce0cbdc69b2ec 100644
+--- a/sound/soc/meson/Kconfig
++++ b/sound/soc/meson/Kconfig
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ menu "ASoC support for Amlogic platforms"
+-	depends on ARCH_MESON || COMPILE_TEST
++	depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
+ 
+ config SND_MESON_AIU
+ 	tristate "Amlogic AIU"
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-pcm-drain-support-reactivation.patch b/queue-5.10/asoc-pcm-drain-support-reactivation.patch
new file mode 100644
index 00000000000..cfee410cbb3
--- /dev/null
+++ b/queue-5.10/asoc-pcm-drain-support-reactivation.patch
@@ -0,0 +1,51 @@
+From 90c0a5e1aa27f9d6fee43f0e587d6bd11be11923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 11:01:29 +0100
+Subject: ASoC: pcm: DRAIN support reactivation
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]
+
+soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
+v5.4 where explicit switch(cmd) has been introduced which takes into
+account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
+switch statement to reactive support for it.
+
+As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
+behaviour of dpcm_fe_dai_do_trigger() for said command back to its
+pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.
+
+Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index dcab9527ba3d7..91bf339581590 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2231,6 +2231,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ 		case SNDRV_PCM_TRIGGER_START:
+ 		case SNDRV_PCM_TRIGGER_RESUME:
+ 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		case SNDRV_PCM_TRIGGER_DRAIN:
+ 			ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
+ 			break;
+ 		case SNDRV_PCM_TRIGGER_STOP:
+@@ -2248,6 +2249,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ 		case SNDRV_PCM_TRIGGER_START:
+ 		case SNDRV_PCM_TRIGGER_RESUME:
+ 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++		case SNDRV_PCM_TRIGGER_DRAIN:
+ 			ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
+ 			break;
+ 		case SNDRV_PCM_TRIGGER_STOP:
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-q6afe-clocks-add-missing-parent-clock-rate.patch b/queue-5.10/asoc-q6afe-clocks-add-missing-parent-clock-rate.patch
new file mode 100644
index 00000000000..33537b1b079
--- /dev/null
+++ b/queue-5.10/asoc-q6afe-clocks-add-missing-parent-clock-rate.patch
@@ -0,0 +1,40 @@
+From aa6ccd268afb121e05a46b175287c121fe80a08d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:42:28 +0000
+Subject: ASoC: q6afe-clocks: Add missing parent clock rate
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 7e20ae1208daaf6dad85c2dcb968fc590b6f3b99 ]
+
+setting clock rate on child clocks without a parent clock rate will
+result in zero clk rate for child. This also means that when audio
+is started dsp will attempt to access registers without enabling
+clock resulting in board boot up.
+
+Fix this by adding the missing parent clock rate.
+
+Fixes: 520a1c396d196 ("ASoC: q6afe-clocks: add q6afe clock controller")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20201204164228.1826-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6afe-clocks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/qcom/qdsp6/q6afe-clocks.c b/sound/soc/qcom/qdsp6/q6afe-clocks.c
+index 2efc2eaa04243..acfc0c698f6a1 100644
+--- a/sound/soc/qcom/qdsp6/q6afe-clocks.c
++++ b/sound/soc/qcom/qdsp6/q6afe-clocks.c
+@@ -16,6 +16,7 @@
+ 		.afe_clk_id	= Q6AFE_##id,		\
+ 		.name = #id,				\
+ 		.attributes = LPASS_CLK_ATTRIBUTE_COUPLE_NO, \
++		.rate = 19200000,			\
+ 		.hw.init = &(struct clk_init_data) {	\
+ 			.ops = &clk_q6afe_ops,		\
+ 			.name = #id,			\
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-qcom-common-fix-refcounting-in-qcom_snd_parse_o.patch b/queue-5.10/asoc-qcom-common-fix-refcounting-in-qcom_snd_parse_o.patch
new file mode 100644
index 00000000000..72209887eb8
--- /dev/null
+++ b/queue-5.10/asoc-qcom-common-fix-refcounting-in-qcom_snd_parse_o.patch
@@ -0,0 +1,81 @@
+From 1aa5b2f9c86d5b5ad6b227d6f6b1161b6553d696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 15:51:54 +0300
+Subject: ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4e59dd249cd513a211e2ecce2cb31f4e29a5ce5b ]
+
+There are two issues in this function.
+
+1) We can't drop the refrences on "cpu", "codec" and "platform" before
+   we take the reference.  This doesn't cause a problem on the first
+   iteration because those pointers start as NULL so the of_node_put()
+   is a no-op.  But on the subsequent iterations, it will lead to a use
+   after free.
+
+2) If the devm_kzalloc() allocation failed then the code returned
+   directly instead of cleaning up.
+
+Fixes: c1e6414cdc37 ("ASoC: qcom: common: Fix refcount imbalance on error")
+Fixes: 1e36ea360ab9 ("ASoC: qcom: common: use modern dai_link style")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20201105125154.GA176426@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/common.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
+index 54660f126d09e..09af007007007 100644
+--- a/sound/soc/qcom/common.c
++++ b/sound/soc/qcom/common.c
+@@ -58,7 +58,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ 		dlc = devm_kzalloc(dev, 2 * sizeof(*dlc), GFP_KERNEL);
+ 		if (!dlc) {
+ 			ret = -ENOMEM;
+-			goto err;
++			goto err_put_np;
+ 		}
+ 
+ 		link->cpus	= &dlc[0];
+@@ -70,7 +70,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ 		ret = of_property_read_string(np, "link-name", &link->name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting codec dai_link name\n");
+-			goto err;
++			goto err_put_np;
+ 		}
+ 
+ 		cpu = of_get_child_by_name(np, "cpu");
+@@ -130,8 +130,10 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ 		} else {
+ 			/* DPCM frontend */
+ 			dlc = devm_kzalloc(dev, sizeof(*dlc), GFP_KERNEL);
+-			if (!dlc)
+-				return -ENOMEM;
++			if (!dlc) {
++				ret = -ENOMEM;
++				goto err;
++			}
+ 
+ 			link->codecs	 = dlc;
+ 			link->num_codecs = 1;
+@@ -158,10 +160,11 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ 
+ 	return 0;
+ err:
+-	of_node_put(np);
+ 	of_node_put(cpu);
+ 	of_node_put(codec);
+ 	of_node_put(platform);
++err_put_np:
++	of_node_put(np);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(qcom_snd_parse_of);
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-qcom-fix-qdsp6-dependencies-attempt-3.patch b/queue-5.10/asoc-qcom-fix-qdsp6-dependencies-attempt-3.patch
new file mode 100644
index 00000000000..56c06c1cce8
--- /dev/null
+++ b/queue-5.10/asoc-qcom-fix-qdsp6-dependencies-attempt-3.patch
@@ -0,0 +1,43 @@
+From c25f79041a63462e62dc58539e85def9cc847263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 00:14:18 +0100
+Subject: ASoC: qcom: fix QDSP6 dependencies, attempt #3
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b1b8eb1283c90a953089d988930d7b6156418958 ]
+
+The previous fix left another warning in randconfig builds:
+
+WARNING: unmet direct dependencies detected for SND_SOC_QDSP6
+  Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && QCOM_APR [=y] && COMMON_CLK [=n]
+  Selected by [y]:
+  - SND_SOC_MSM8996 [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && QCOM_APR [=y]
+
+Add one more dependency for this one.
+
+Fixes: 2bc8831b135c ("ASoC: qcom: fix SDM845 & QDSP6 dependencies more")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20201203231443.1483763-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
+index 2696ffcba880f..a824f793811be 100644
+--- a/sound/soc/qcom/Kconfig
++++ b/sound/soc/qcom/Kconfig
+@@ -106,6 +106,7 @@ config SND_SOC_QDSP6
+ config SND_SOC_MSM8996
+ 	tristate "SoC Machine driver for MSM8996 and APQ8096 boards"
+ 	depends on QCOM_APR
++	depends on COMMON_CLK
+ 	select SND_SOC_QDSP6
+ 	select SND_SOC_QCOM_COMMON
+ 	help
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-qcom-fix-unsigned-int-bitwidth-compared-to-less.patch b/queue-5.10/asoc-qcom-fix-unsigned-int-bitwidth-compared-to-less.patch
new file mode 100644
index 00000000000..762f205c77b
--- /dev/null
+++ b/queue-5.10/asoc-qcom-fix-unsigned-int-bitwidth-compared-to-less.patch
@@ -0,0 +1,38 @@
+From 6b5e471e320e5d11ef42bf7e61bdff8fd1b5cffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 11:51:12 +0000
+Subject: ASoC: qcom: fix unsigned int bitwidth compared to less than zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit bcc96dc3cf8048c80af7c487af17e19be27ac57d ]
+
+The check for an error return from the call to snd_pcm_format_width
+is never true as the unsigned int bitwidth can never be less than
+zero. Fix this by making bitwidth an int.
+
+Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201028115112.109017-1-colin.king@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-hdmi.c b/sound/soc/qcom/lpass-hdmi.c
+index 172952d3a5d66..abfb8737a89f4 100644
+--- a/sound/soc/qcom/lpass-hdmi.c
++++ b/sound/soc/qcom/lpass-hdmi.c
+@@ -24,7 +24,7 @@ static int lpass_hdmi_daiops_hw_params(struct snd_pcm_substream *substream,
+ 	unsigned int rate = params_rate(params);
+ 	unsigned int channels = params_channels(params);
+ 	unsigned int ret;
+-	unsigned int bitwidth;
++	int bitwidth;
+ 	unsigned int word_length;
+ 	unsigned int ch_sts_buf0;
+ 	unsigned int ch_sts_buf1;
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-sof-intel-fix-kconfig-dependency-for-snd_intel_.patch b/queue-5.10/asoc-sof-intel-fix-kconfig-dependency-for-snd_intel_.patch
new file mode 100644
index 00000000000..621d558593c
--- /dev/null
+++ b/queue-5.10/asoc-sof-intel-fix-kconfig-dependency-for-snd_intel_.patch
@@ -0,0 +1,57 @@
+From b59ef5a7305404ea3ac89dbf3c5b791777de7be8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 10:44:25 -0600
+Subject: ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 358f0ac1f2791c80c19cc26706cf34664c9fd756 ]
+
+SND_INTEL_DSP_CONFIG is selected by the HDaudio, Skylake and SOF
+drivers. When the HDaudio link is not selected as a option, this
+Kconfig option is not touched and will default to whatever other
+drivers selected. In the case e.g. where HDaudio is compiled as
+built-in, the linker will complain:
+
+ld: sound/soc/sof/sof-pci-dev.o: in function `sof_pci_probe':
+sof-pci-dev.c:(.text+0x5c): undefined reference to
+`snd_intel_dsp_driver_probe'
+
+Adding the select for all HDaudio platforms, regardless of whether
+they rely on the HDaudio link or not, solves the problem.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Fixes: 82d9d54a6c0ee ('ALSA: hda: add Intel DSP configuration / probe code')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20201112164425.25603-5-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/Kconfig b/sound/soc/sof/intel/Kconfig
+index a066e08860cbf..5bfc2f8b13b90 100644
+--- a/sound/soc/sof/intel/Kconfig
++++ b/sound/soc/sof/intel/Kconfig
+@@ -271,6 +271,7 @@ config SND_SOC_SOF_JASPERLAKE
+ 
+ config SND_SOC_SOF_HDA_COMMON
+ 	tristate
++	select SND_INTEL_DSP_CONFIG
+ 	select SND_SOC_SOF_INTEL_COMMON
+ 	select SND_SOC_SOF_HDA_LINK_BASELINE
+ 	help
+@@ -330,7 +331,6 @@ config SND_SOC_SOF_HDA
+ 	tristate
+ 	select SND_HDA_EXT_CORE if SND_SOC_SOF_HDA_LINK
+ 	select SND_SOC_HDAC_HDA if SND_SOC_SOF_HDA_AUDIO_CODEC
+-	select SND_INTEL_DSP_CONFIG
+ 	help
+ 	  This option is not user-selectable but automagically handled by
+ 	  'select' statements at a higher level
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch b/queue-5.10/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch
new file mode 100644
index 00000000000..cc5f03fc45e
--- /dev/null
+++ b/queue-5.10/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch
@@ -0,0 +1,54 @@
+From 6d84ed9f6fac52e61b0515bc5decd8740af06d3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 15:46:34 +0100
+Subject: ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Péron <peron.clem@gmail.com>
+
+[ Upstream commit 93c0210671d8f3ec2262da703fab93a1497158a8 ]
+
+Left and Right justified mode are computed using the same formula
+as DSP_A and DSP_B mode.
+Which is wrong and the user manual explicitly says:
+
+LRCK_PERDIOD:
+PCM Mode: Number of BCLKs within (Left + Right) channel width.
+I2S/Left-Justified/Right-Justified Mode: Number of BCLKs within each
+individual channel width(Left or Right)
+
+Fix this by using the same formula as the I2S mode.
+
+Fixes: 7ae7834ec446 ("ASoC: sun4i-i2s: Add support for DSP formats")
+Signed-off-by: Clément Péron <peron.clem@gmail.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Link: https://lore.kernel.org/r/20201030144648.397824-2-peron.clem@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index f23ff29e7c1d3..a994b5cf87b31 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -450,11 +450,11 @@ static int sun8i_i2s_set_chan_cfg(const struct sun4i_i2s *i2s,
+ 	switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) {
+ 	case SND_SOC_DAIFMT_DSP_A:
+ 	case SND_SOC_DAIFMT_DSP_B:
+-	case SND_SOC_DAIFMT_LEFT_J:
+-	case SND_SOC_DAIFMT_RIGHT_J:
+ 		lrck_period = params_physical_width(params) * slots;
+ 		break;
+ 
++	case SND_SOC_DAIFMT_LEFT_J:
++	case SND_SOC_DAIFMT_RIGHT_J:
+ 	case SND_SOC_DAIFMT_I2S:
+ 		lrck_period = params_physical_width(params);
+ 		break;
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-wm8994-fix-pm-disable-depth-imbalance-on-error.patch b/queue-5.10/asoc-wm8994-fix-pm-disable-depth-imbalance-on-error.patch
new file mode 100644
index 00000000000..c897a73a433
--- /dev/null
+++ b/queue-5.10/asoc-wm8994-fix-pm-disable-depth-imbalance-on-error.patch
@@ -0,0 +1,44 @@
+From 6355f397dee5747ceefec520b1e9bf21e63aaa26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 12:13:24 +0800
+Subject: ASoC: wm8994: Fix PM disable depth imbalance on error
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b8161cbe55a1892a19a318eaebbda92438fa708c ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+
+Fixes: 57e265c8d71fb ("ASoC: wm8994: Move runtime PM init to platform device init")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20201111041326.1257558-2-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8994.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index fc9ea198ac799..f57884113406b 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -4645,8 +4645,12 @@ static int wm8994_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_idle(&pdev->dev);
+ 
+-	return devm_snd_soc_register_component(&pdev->dev, &soc_component_dev_wm8994,
++	ret = devm_snd_soc_register_component(&pdev->dev, &soc_component_dev_wm8994,
+ 			wm8994_dai, ARRAY_SIZE(wm8994_dai));
++	if (ret < 0)
++		pm_runtime_disable(&pdev->dev);
++
++	return ret;
+ }
+ 
+ static int wm8994_remove(struct platform_device *pdev)
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch b/queue-5.10/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch
new file mode 100644
index 00000000000..d5099a6a35a
--- /dev/null
+++ b/queue-5.10/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch
@@ -0,0 +1,48 @@
+From 90e752499673e5370cee2310cd9041d2570802b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 12:13:26 +0800
+Subject: ASoC: wm8998: Fix PM disable depth imbalance on error
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+
+Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8998.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
+index f6c5cc80c970b..5413254295b70 100644
+--- a/sound/soc/codecs/wm8998.c
++++ b/sound/soc/codecs/wm8998.c
+@@ -1375,7 +1375,7 @@ static int wm8998_probe(struct platform_device *pdev)
+ 
+ 	ret = arizona_init_spk_irqs(arizona);
+ 	if (ret < 0)
+-		return ret;
++		goto err_pm_disable;
+ 
+ 	ret = devm_snd_soc_register_component(&pdev->dev,
+ 					      &soc_component_dev_wm8998,
+@@ -1390,6 +1390,8 @@ static int wm8998_probe(struct platform_device *pdev)
+ 
+ err_spk_irqs:
+ 	arizona_free_spk_irqs(arizona);
++err_pm_disable:
++	pm_runtime_disable(&pdev->dev);
+ 
+ 	return ret;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch b/queue-5.10/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch
new file mode 100644
index 00000000000..c13be199620
--- /dev/null
+++ b/queue-5.10/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch
@@ -0,0 +1,50 @@
+From efcc7c7c69a762d2915b4d7efacc1e32aa5c0769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 09:54:09 +0300
+Subject: ASoC: wm_adsp: remove "ctl" from list on error in
+ wm_adsp_create_control()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]
+
+The error handling frees "ctl" but it's still on the "dsp->ctl_list"
+list so that could result in a use after free.  Remove it from the list
+before returning.
+
+Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index e61d00486c653..dec8716aa8ef5 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1519,7 +1519,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+ 	ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
+ 	if (!ctl_work) {
+ 		ret = -ENOMEM;
+-		goto err_ctl_cache;
++		goto err_list_del;
+ 	}
+ 
+ 	ctl_work->dsp = dsp;
+@@ -1529,7 +1529,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+ 
+ 	return 0;
+ 
+-err_ctl_cache:
++err_list_del:
++	list_del(&ctl->list);
+ 	kfree(ctl->cache);
+ err_ctl_subname:
+ 	kfree(ctl->subname);
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath10k-fix-an-error-handling-path.patch b/queue-5.10/ath10k-fix-an-error-handling-path.patch
new file mode 100644
index 00000000000..03d60e249fc
--- /dev/null
+++ b/queue-5.10/ath10k-fix-an-error-handling-path.patch
@@ -0,0 +1,37 @@
+From 926e1bdb8658cdb72195b935f159f22fba9853e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:18 +0200
+Subject: ath10k: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]
+
+If 'ath10k_usb_create()' fails, we should release some resources and report
+an error instead of silently continuing.
+
+Fixes: 4db66499df91 ("ath10k: add initial USB support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index 05a620ff6fe2c..0b47c3a09794c 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -997,6 +997,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ 
+ 	ar_usb = ath10k_usb_priv(ar);
+ 	ret = ath10k_usb_create(ar, interface);
++	if (ret)
++		goto err;
+ 	ar_usb->ar = ar;
+ 
+ 	ar->dev_id = product_id;
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath10k-fix-the-parsing-error-in-service-available-ev.patch b/queue-5.10/ath10k-fix-the-parsing-error-in-service-available-ev.patch
new file mode 100644
index 00000000000..5c62ad6a0f6
--- /dev/null
+++ b/queue-5.10/ath10k-fix-the-parsing-error-in-service-available-ev.patch
@@ -0,0 +1,92 @@
+From e0afa1a0bc25917982cb15d0cd91104e4d6a05bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:17 +0200
+Subject: ath10k: Fix the parsing error in service available event
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]
+
+The wmi service available event has been
+extended to contain extra 128 bit for new services
+to be indicated by firmware.
+
+Currently the presence of any optional TLVs in
+the wmi service available event leads to a parsing
+error with the below error message:
+ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71
+
+The wmi service available event parsing should
+not return error for the newly added optional TLV.
+Fix this parsing for service available event message.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1
+
+Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
+ drivers/net/wireless/ath/ath10k/wmi.c     | 9 +++++++--
+ drivers/net/wireless/ath/ath10k/wmi.h     | 1 +
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 932266d1111bd..7b5834157fe51 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -1401,13 +1401,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
+ 
+ 	switch (tag) {
+ 	case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
++		arg->service_map_ext_valid = true;
+ 		arg->service_map_ext_len = *(__le32 *)ptr;
+ 		arg->service_map_ext = ptr + sizeof(__le32);
+ 		return 0;
+ 	default:
+ 		break;
+ 	}
+-	return -EPROTO;
++
++	return 0;
+ }
+ 
+ static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 1fa7107a50515..37b53af760d76 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5751,8 +5751,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
+ 			    ret);
+ 	}
+ 
+-	ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+-			       __le32_to_cpu(arg.service_map_ext_len));
++	/*
++	 * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
++	 * for the below logic to work.
++	 */
++	if (arg.service_map_ext_valid)
++		ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
++				       __le32_to_cpu(arg.service_map_ext_len));
+ }
+ 
+ static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index 4898e19b0af65..66ecf09068c19 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6917,6 +6917,7 @@ struct wmi_svc_rdy_ev_arg {
+ };
+ 
+ struct wmi_svc_avail_ev_arg {
++	bool service_map_ext_valid;
+ 	__le32 service_map_ext_len;
+ 	const __le32 *service_map_ext;
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath10k-release-some-resources-in-an-error-handling-p.patch b/queue-5.10/ath10k-release-some-resources-in-an-error-handling-p.patch
new file mode 100644
index 00000000000..59a1dd6a5c8
--- /dev/null
+++ b/queue-5.10/ath10k-release-some-resources-in-an-error-handling-p.patch
@@ -0,0 +1,47 @@
+From 6af392c861ab8d74afd81706f0fd23a2db925286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:18 +0200
+Subject: ath10k: Release some resources in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]
+
+Should an error occur after calling 'ath10k_usb_create()', it should be
+undone by a corresponding 'ath10k_usb_destroy()' call
+
+Fixes: 4db66499df91 ("ath10k: add initial USB support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index 0b47c3a09794c..19b9c27e30e20 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -1011,7 +1011,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ 	ret = ath10k_core_register(ar, &bus_params);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to register driver core: %d\n", ret);
+-		goto err;
++		goto err_usb_destroy;
+ 	}
+ 
+ 	/* TODO: remove this once USB support is fully implemented */
+@@ -1019,6 +1019,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ 
+ 	return 0;
+ 
++err_usb_destroy:
++	ath10k_usb_destroy(ar);
++
+ err:
+ 	ath10k_core_destroy(ar);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-don-t-cast-ath11k_skb_cb-to-ieee80211_tx_info.patch b/queue-5.10/ath11k-don-t-cast-ath11k_skb_cb-to-ieee80211_tx_info.patch
new file mode 100644
index 00000000000..2a374d0ddb5
--- /dev/null
+++ b/queue-5.10/ath11k-don-t-cast-ath11k_skb_cb-to-ieee80211_tx_info.patch
@@ -0,0 +1,148 @@
+From 745bb41b376af8c24a6569f7a4b1aa8af8e95d5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:15 +0200
+Subject: ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit f4d291b43f809b74c66b21f5190cd578af43070b ]
+
+The driver_data area of ieee80211_tx_info is used in ath11k for
+ath11k_skb_cb. The first function in the TX patch which rewrites it to
+ath11k_skb_cb is already ath11k_mac_op_tx. No one else in the code path
+must use it for something else before it reinitializes it. Otherwise the
+data has to be considered uninitialized or corrupt.
+
+But the ieee80211_tx_info.control shares exactly the same area as
+ieee80211_tx_info.driver_data and ath11k is still using it. This results in
+best case in a
+
+  ath11k c000000.wifi1: no vif found for mgmt frame, flags 0x0
+
+or (slightly worse) in a kernel oops.
+
+Instead, the interesting data must be moved first into the ath11k_skb_cb
+and ieee80211_tx_info.control must then not be used anymore.
+
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201119154235.263250-1-sven@narfation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h  |  2 ++
+ drivers/net/wireless/ath/ath11k/dp_tx.c |  5 ++---
+ drivers/net/wireless/ath/ath11k/mac.c   | 26 ++++++++++++++++---------
+ 3 files changed, 21 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
+index 18b97420f0d8a..5a7915f75e1e2 100644
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -75,12 +75,14 @@ static inline enum wme_ac ath11k_tid_to_ac(u32 tid)
+ 
+ enum ath11k_skb_flags {
+ 	ATH11K_SKB_HW_80211_ENCAP = BIT(0),
++	ATH11K_SKB_CIPHER_SET = BIT(1),
+ };
+ 
+ struct ath11k_skb_cb {
+ 	dma_addr_t paddr;
+ 	u8 eid;
+ 	u8 flags;
++	u32 cipher;
+ 	struct ath11k *ar;
+ 	struct ieee80211_vif *vif;
+ } __packed;
+diff --git a/drivers/net/wireless/ath/ath11k/dp_tx.c b/drivers/net/wireless/ath/ath11k/dp_tx.c
+index 3d962eee4d61d..21dfd08d3debb 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_tx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_tx.c
+@@ -84,7 +84,6 @@ int ath11k_dp_tx(struct ath11k *ar, struct ath11k_vif *arvif,
+ 	struct ath11k_dp *dp = &ab->dp;
+ 	struct hal_tx_info ti = {0};
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+-	struct ieee80211_key_conf *key = info->control.hw_key;
+ 	struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb);
+ 	struct hal_srng *tcl_ring;
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+@@ -149,9 +148,9 @@ tcl_ring_sel:
+ 	ti.meta_data_flags = arvif->tcl_metadata;
+ 
+ 	if (ti.encap_type == HAL_TCL_ENCAP_TYPE_RAW) {
+-		if (key) {
++		if (skb_cb->flags & ATH11K_SKB_CIPHER_SET) {
+ 			ti.encrypt_type =
+-				ath11k_dp_tx_get_encrypt_type(key->cipher);
++				ath11k_dp_tx_get_encrypt_type(skb_cb->cipher);
+ 
+ 			if (ieee80211_has_protected(hdr->frame_control))
+ 				skb_put(skb, IEEE80211_CCMP_MIC_LEN);
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index f5e49e1c11ed7..6b7f00e0086f5 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3977,21 +3977,20 @@ static void ath11k_mgmt_over_wmi_tx_purge(struct ath11k *ar)
+ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ {
+ 	struct ath11k *ar = container_of(work, struct ath11k, wmi_mgmt_tx_work);
+-	struct ieee80211_tx_info *info;
++	struct ath11k_skb_cb *skb_cb;
+ 	struct ath11k_vif *arvif;
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
+ 	while ((skb = skb_dequeue(&ar->wmi_mgmt_tx_queue)) != NULL) {
+-		info = IEEE80211_SKB_CB(skb);
+-		if (!info->control.vif) {
+-			ath11k_warn(ar->ab, "no vif found for mgmt frame, flags 0x%x\n",
+-				    info->control.flags);
++		skb_cb = ATH11K_SKB_CB(skb);
++		if (!skb_cb->vif) {
++			ath11k_warn(ar->ab, "no vif found for mgmt frame\n");
+ 			ieee80211_free_txskb(ar->hw, skb);
+ 			continue;
+ 		}
+ 
+-		arvif = ath11k_vif_to_arvif(info->control.vif);
++		arvif = ath11k_vif_to_arvif(skb_cb->vif);
+ 		if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) &&
+ 		    arvif->is_started) {
+ 			ret = ath11k_mac_mgmt_tx_wmi(ar, arvif, skb);
+@@ -4004,8 +4003,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ 			}
+ 		} else {
+ 			ath11k_warn(ar->ab,
+-				    "dropping mgmt frame for vdev %d, flags 0x%x is_started %d\n",
+-				    arvif->vdev_id, info->control.flags,
++				    "dropping mgmt frame for vdev %d, is_started %d\n",
++				    arvif->vdev_id,
+ 				    arvif->is_started);
+ 			ieee80211_free_txskb(ar->hw, skb);
+ 		}
+@@ -4053,10 +4052,19 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
+ 	struct ieee80211_vif *vif = info->control.vif;
+ 	struct ath11k_vif *arvif = ath11k_vif_to_arvif(vif);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	struct ieee80211_key_conf *key = info->control.hw_key;
++	u32 info_flags = info->flags;
+ 	bool is_prb_rsp;
+ 	int ret;
+ 
+-	if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
++	skb_cb->vif = vif;
++
++	if (key) {
++		skb_cb->cipher = key->cipher;
++		skb_cb->flags |= ATH11K_SKB_CIPHER_SET;
++	}
++
++	if (info_flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
+ 		skb_cb->flags |= ATH11K_SKB_HW_80211_ENCAP;
+ 	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
+ 		is_prb_rsp = ieee80211_is_probe_resp(hdr->frame_control);
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-fix-an-error-handling-path.patch b/queue-5.10/ath11k-fix-an-error-handling-path.patch
new file mode 100644
index 00000000000..57d41845a32
--- /dev/null
+++ b/queue-5.10/ath11k-fix-an-error-handling-path.patch
@@ -0,0 +1,50 @@
+From 3f08dabbef5dd65274593c794862606de1340ea4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:16 +0200
+Subject: ath11k: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e7bcc145bcd035e56da7b97b033c463b32a5ff80 ]
+
+If 'kzalloc' fails, we must return an error code.
+
+While at it, remove a useless initialization of 'err' which could hide the
+issue.
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201122173943.1366167-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
+index c2b1651582259..99a88ca83deaa 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1585,15 +1585,17 @@ static int ath11k_qmi_fw_ind_register_send(struct ath11k_base *ab)
+ 	struct qmi_wlanfw_ind_register_resp_msg_v01 *resp;
+ 	struct qmi_handle *handle = &ab->qmi.handle;
+ 	struct qmi_txn txn;
+-	int ret = 0;
++	int ret;
+ 
+ 	req = kzalloc(sizeof(*req), GFP_KERNEL);
+ 	if (!req)
+ 		return -ENOMEM;
+ 
+ 	resp = kzalloc(sizeof(*resp), GFP_KERNEL);
+-	if (!resp)
++	if (!resp) {
++		ret = -ENOMEM;
+ 		goto resp_out;
++	}
+ 
+ 	req->client_id_valid = 1;
+ 	req->client_id = QMI_WLANFW_CLIENT_ID;
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-fix-incorrect-tlvs-in-scan-start-command.patch b/queue-5.10/ath11k-fix-incorrect-tlvs-in-scan-start-command.patch
new file mode 100644
index 00000000000..a6cfc1d9a81
--- /dev/null
+++ b/queue-5.10/ath11k-fix-incorrect-tlvs-in-scan-start-command.patch
@@ -0,0 +1,71 @@
+From dbb12cbd51062430d59caf08485a9ec5aa57d83e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 16:05:24 +0200
+Subject: ath11k: Fix incorrect tlvs in scan start command
+
+From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+
+[ Upstream commit f57ad6a9885e8399897daee3249cabccf9c972f8 ]
+
+Currently 6G specific tlvs have duplicate entries which is causing
+scan failures. Fix this by removing the duplicate entries of the same
+tlv. This also fixes out-of-bound memory writes caused due to
+adding tlvs when num_hint_bssid and num_hint_s_ssid are ZEROs.
+
+Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.4.0.1-01386-QCAHKSWPL_SILICONZ-1
+
+Fixes: 74601ecfef6e ("ath11k: Add support for 6g scan hint")
+Reported-by: Carl Huang <cjhuang@codeaurora.org>
+Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1607609124-17250-7-git-send-email-kvalo@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/wmi.c | 31 ---------------------------
+ 1 file changed, 31 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
+index 8eca92520837e..04b8b002edfe0 100644
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -2198,37 +2198,6 @@ int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,
+ 		}
+ 	}
+ 
+-	len = params->num_hint_s_ssid * sizeof(struct hint_short_ssid);
+-	tlv = ptr;
+-	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+-		      FIELD_PREP(WMI_TLV_LEN, len);
+-	ptr += TLV_HDR_SIZE;
+-	if (params->num_hint_s_ssid) {
+-		s_ssid = ptr;
+-		for (i = 0; i < params->num_hint_s_ssid; ++i) {
+-			s_ssid->freq_flags = params->hint_s_ssid[i].freq_flags;
+-			s_ssid->short_ssid = params->hint_s_ssid[i].short_ssid;
+-			s_ssid++;
+-		}
+-	}
+-	ptr += len;
+-
+-	len = params->num_hint_bssid * sizeof(struct hint_bssid);
+-	tlv = ptr;
+-	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_FIXED_STRUCT) |
+-		      FIELD_PREP(WMI_TLV_LEN, len);
+-	ptr += TLV_HDR_SIZE;
+-	if (params->num_hint_bssid) {
+-		hint_bssid = ptr;
+-		for (i = 0; i < params->num_hint_bssid; ++i) {
+-			hint_bssid->freq_flags =
+-				params->hint_bssid[i].freq_flags;
+-			ether_addr_copy(&params->hint_bssid[i].bssid.addr[0],
+-					&hint_bssid->bssid.addr[0]);
+-			hint_bssid++;
+-		}
+-	}
+-
+ 	ret = ath11k_wmi_cmd_send(wmi, skb,
+ 				  WMI_START_SCAN_CMDID);
+ 	if (ret) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-fix-number-of-rules-in-filtered-etsi-regdomai.patch b/queue-5.10/ath11k-fix-number-of-rules-in-filtered-etsi-regdomai.patch
new file mode 100644
index 00000000000..2a4a255e6d1
--- /dev/null
+++ b/queue-5.10/ath11k-fix-number-of-rules-in-filtered-etsi-regdomai.patch
@@ -0,0 +1,73 @@
+From e4eb114090bf80a242daa103bd87f0ddc916850d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 11:19:40 +0100
+Subject: ath11k: Fix number of rules in filtered ETSI regdomain
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 6189be7d145c3a2d48514eb8755483602ff5a4b4 ]
+
+The ath11k code will try to insert wheather rader related limits when the
+DFS region is set to ETSI. For this reason, it will add two more entries in
+the array of reg_rules. But the 2.4.0.1 firmware is prefiltering the list
+of reg rules it returns for 2.4GHz PHYs. They will then not contain the
+list of 5GHz rules and thus no wheather radar band rules were inserted by
+this code.
+
+But the code didn't fix the n_reg_rules for this regulatory domain and PHY
+when this happened. This resulted in a rejection by is_valid_rd because it
+found rules which start and end at 0khz. This resulted in a splat like:
+
+  Invalid regulatory domain detected
+  ------------[ cut here ]------------
+  WARNING: at backports-20200628-4.4.60-9a94b73e75/net/wireless/reg.c:3721
+  [...]
+  ath11k c000000.wifi1: failed to perform regd update : -22
+
+The number of rules must therefore be saved after they were converted from
+the ath11k format to the ieee80211_regdomain format and not before.
+
+Tested with IPQ8074 WLAN.HK.2.4.0.1.r1-00019-QCAHKSWPL_SILICONZ-1
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201030101940.2387952-1-sven@narfation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index 83f75f8855ebe..678d0885fcee7 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -585,7 +585,6 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
+ 	if (!tmp_regd)
+ 		goto ret;
+ 
+-	tmp_regd->n_reg_rules = num_rules;
+ 	memcpy(tmp_regd->alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	memcpy(alpha2, reg_info->alpha2, REG_ALPHA2_LEN + 1);
+ 	alpha2[2] = '\0';
+@@ -598,7 +597,7 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
+ 	/* Update reg_rules[] below. Firmware is expected to
+ 	 * send these rules in order(2G rules first and then 5G)
+ 	 */
+-	for (; i < tmp_regd->n_reg_rules; i++) {
++	for (; i < num_rules; i++) {
+ 		if (reg_info->num_2g_reg_rules &&
+ 		    (i < reg_info->num_2g_reg_rules)) {
+ 			reg_rule = reg_info->reg_rules_2g_ptr + i;
+@@ -653,6 +652,8 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
+ 			   flags);
+ 	}
+ 
++	tmp_regd->n_reg_rules = i;
++
+ 	if (intersect) {
+ 		default_regd = ab->default_regd[reg_info->phy_id];
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-fix-the-rx_filter-flag-setting-for-peer-rssi-.patch b/queue-5.10/ath11k-fix-the-rx_filter-flag-setting-for-peer-rssi-.patch
new file mode 100644
index 00000000000..9948e3f0445
--- /dev/null
+++ b/queue-5.10/ath11k-fix-the-rx_filter-flag-setting-for-peer-rssi-.patch
@@ -0,0 +1,44 @@
+From 9f451ca5ec1741c994bd63524f302041a199cbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 16:08:37 +0530
+Subject: ath11k: Fix the rx_filter flag setting for peer rssi stats
+
+From: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+
+[ Upstream commit 11af6de4799ee6eeae3730f18fd417414d212e2d ]
+
+Set the rx_filter in ath11k_mac_config_mon_status_default(),
+only when the rx_filter value exists in ath11k_debug_rx_filter().
+
+Without this change, rx_filter gets set to 0 and peer rssi stats
+aren't updating properly from firmware.
+
+Tested-on: IPQ8074 WLAN.HK.2.1.0.1-01230-QCAHKSWPL_SILICONZ-4
+
+Fixes: ec48d28ba291 ("ath11k: Fix rx_filter flags setting for per peer rx_stats")
+
+Signed-off-by: Maharaja Kennadyrajan <mkenna@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1605091117-11005-1-git-send-email-mkenna@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index 7a2c9708693ec..f5e49e1c11ed7 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4094,7 +4094,8 @@ static int ath11k_mac_config_mon_status_default(struct ath11k *ar, bool enable)
+ 
+ 	if (enable) {
+ 		tlv_filter = ath11k_mac_mon_status_filter_default;
+-		tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
++		if (ath11k_debugfs_rx_filter(ar))
++			tlv_filter.rx_filter = ath11k_debugfs_rx_filter(ar);
+ 	}
+ 
+ 	for (i = 0; i < ab->hw_params.num_rxmda_per_pdev; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-fix-wmi-init-configuration.patch b/queue-5.10/ath11k-fix-wmi-init-configuration.patch
new file mode 100644
index 00000000000..05179ed3718
--- /dev/null
+++ b/queue-5.10/ath11k-fix-wmi-init-configuration.patch
@@ -0,0 +1,53 @@
+From 8b4e564a8ef44223878008e3c90c78306a48bc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 23:17:00 +0530
+Subject: ath11k: fix wmi init configuration
+
+From: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+
+[ Upstream commit 36c7c640ffeb87168e5ff79b7a36ae3a020bd378 ]
+
+Assign the correct hw_op ath11k_init_wmi_config_ipq8074 to
+the hw IPQ8074. Also update the correct TWT radio count.
+Incorrect TWT radio count cause TWT feature fails on radio2
+because physical device count is hardcoded to 2. so set
+the value dynamically.
+
+Found this during code review.
+
+Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2
+
+Fixes: 2d4bcbed5b7d53e1 ("ath11k: initialize wmi config based on hw_params")
+Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1604512020-25197-1-git-send-email-periyasa@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/hw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/hw.c b/drivers/net/wireless/ath/ath11k/hw.c
+index 11a411b76fe42..66331da350129 100644
+--- a/drivers/net/wireless/ath/ath11k/hw.c
++++ b/drivers/net/wireless/ath/ath11k/hw.c
+@@ -127,7 +127,7 @@ static void ath11k_init_wmi_config_ipq8074(struct ath11k_base *ab,
+ 	config->beacon_tx_offload_max_vdev = ab->num_radios * TARGET_MAX_BCN_OFFLD;
+ 	config->rx_batchmode = TARGET_RX_BATCHMODE;
+ 	config->peer_map_unmap_v2_support = 1;
+-	config->twt_ap_pdev_count = 2;
++	config->twt_ap_pdev_count = ab->num_radios;
+ 	config->twt_ap_sta_count = 1000;
+ }
+ 
+@@ -157,7 +157,7 @@ static int ath11k_hw_mac_id_to_srng_id_qca6390(struct ath11k_hw_params *hw,
+ 
+ const struct ath11k_hw_ops ipq8074_ops = {
+ 	.get_hw_mac_from_pdev_id = ath11k_hw_ipq8074_mac_from_pdev_id,
+-	.wmi_init_config = ath11k_init_wmi_config_qca6390,
++	.wmi_init_config = ath11k_init_wmi_config_ipq8074,
+ 	.mac_id_to_pdev_id = ath11k_hw_mac_id_to_pdev_id_ipq8074,
+ 	.mac_id_to_srng_id = ath11k_hw_mac_id_to_srng_id_ipq8074,
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-handle-errors-if-peer-creation-fails.patch b/queue-5.10/ath11k-handle-errors-if-peer-creation-fails.patch
new file mode 100644
index 00000000000..abcde6f776d
--- /dev/null
+++ b/queue-5.10/ath11k-handle-errors-if-peer-creation-fails.patch
@@ -0,0 +1,90 @@
+From ec1bac7a1575ae2018819e26f29fded24b85b227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:16:29 +0200
+Subject: ath11k: Handle errors if peer creation fails
+
+From: Alex Dewar <alex.dewar90@gmail.com>
+
+[ Upstream commit c134d1f8c436d96b3f62896c630278e3ec001280 ]
+
+ath11k_peer_create() is called without its return value being checked,
+meaning errors will be unhandled. Add missing check and, as the mutex is
+unconditionally unlocked on leaving this function, simplify the exit
+path.
+
+Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
+Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
+Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201004100218.311653-1-alex.dewar90@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index 7f8dd47d23333..7a2c9708693ec 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -5225,20 +5225,26 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
+ 	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
+ 	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
+ 		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
+-		mutex_unlock(&ar->conf_mutex);
+-		return 0;
++		ret = 0;
++		goto out;
+ 	}
+ 
+ 	if (WARN_ON(arvif->is_started)) {
+-		mutex_unlock(&ar->conf_mutex);
+-		return -EBUSY;
++		ret = -EBUSY;
++		goto out;
+ 	}
+ 
+ 	if (ab->hw_params.vdev_start_delay) {
+ 		param.vdev_id = arvif->vdev_id;
+ 		param.peer_type = WMI_PEER_TYPE_DEFAULT;
+ 		param.peer_addr = ar->mac_addr;
++
+ 		ret = ath11k_peer_create(ar, arvif, NULL, &param);
++		if (ret) {
++			ath11k_warn(ab, "failed to create peer after vdev start delay: %d",
++				    ret);
++			goto out;
++		}
+ 	}
+ 
+ 	ret = ath11k_mac_vdev_start(arvif, &ctx->def);
+@@ -5246,23 +5252,21 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
+ 		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
+ 			    arvif->vdev_id, vif->addr,
+ 			    ctx->def.chan->center_freq, ret);
+-		goto err;
++		goto out;
+ 	}
+ 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
+ 		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
+ 		if (ret)
+-			goto err;
++			goto out;
+ 	}
+ 
+ 	arvif->is_started = true;
+ 
+ 	/* TODO: Setup ps and cts/rts protection */
+ 
+-	mutex_unlock(&ar->conf_mutex);
+-
+-	return 0;
++	ret = 0;
+ 
+-err:
++out:
+ 	mutex_unlock(&ar->conf_mutex);
+ 
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-initialize-complete-alpha2-for-regulatory-cha.patch b/queue-5.10/ath11k-initialize-complete-alpha2-for-regulatory-cha.patch
new file mode 100644
index 00000000000..986f64540f2
--- /dev/null
+++ b/queue-5.10/ath11k-initialize-complete-alpha2-for-regulatory-cha.patch
@@ -0,0 +1,52 @@
+From c6d2915134ecf00017d5c369dac6d3211f0aa7fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 16:05:55 +0200
+Subject: ath11k: Initialize complete alpha2 for regulatory change
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 383a32cde4172db19d4743d4c782c00af39ff275 ]
+
+The function ath11k_wmi_send_init_country_cmd is taking 3 byte from alpha2
+of the structure wmi_init_country_params. But the function
+ath11k_reg_notifier is only initializing 2 bytes. The third byte is
+therefore always an uninitialized value.
+
+The command can happen to look like
+
+  0c 00 87 02 01 00 00 00 00 00 00 00 43 41 f8 00
+
+instead of
+
+  0c 00 87 02 01 00 00 00 00 00 00 00 43 41 00 00
+
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01161-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00019-QCAHKSWPL_SILICONZ-1
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201021140555.4114715-1-sven@narfation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index f6a1f0352989d..83f75f8855ebe 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -80,6 +80,7 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+ 	 */
+ 	init_country_param.flags = ALPHA_IS_SET;
+ 	memcpy(&init_country_param.cc_info.alpha2, request->alpha2, 2);
++	init_country_param.cc_info.alpha2[2] = 0;
+ 
+ 	ret = ath11k_wmi_send_init_country_cmd(ar, init_country_param);
+ 	if (ret)
+-- 
+2.27.0
+
diff --git a/queue-5.10/ath11k-reset-ath11k_skb_cb-before-setting-new-flags.patch b/queue-5.10/ath11k-reset-ath11k_skb_cb-before-setting-new-flags.patch
new file mode 100644
index 00000000000..51def46a2f6
--- /dev/null
+++ b/queue-5.10/ath11k-reset-ath11k_skb_cb-before-setting-new-flags.patch
@@ -0,0 +1,67 @@
+From b3fcbc6ba46e6718443168eb43e9da30ce99a736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:15 +0200
+Subject: ath11k: Reset ath11k_skb_cb before setting new flags
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 5da7acfec5ec55aa0b69b8760f1d2116b4e2ad26 ]
+
+It was observed that the codepath for the ATH11K_SKB_HW_80211_ENCAP was
+used even when the IEEE80211_TX_CTRL_HW_80211_ENCAP was not enabled for a
+an skbuff. This became even more prominent when the QCAs wlan-open patchset
+for ath11k [1] was applied and a sane looking fix just caused crashes when
+injecting frames via a monitor interface (for example with ratechecker):
+
+  [   86.963152] Unable to handle kernel NULL pointer dereference at virtual address 00000338
+  [   86.963192] pgd = ffffffc0008f0000
+  [   86.971034] [00000338] *pgd=0000000051706003, *pud=0000000051706003, *pmd=0000000051707003, *pte=00e800000b000707
+  [   86.984292] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+  [...]
+  [   87.713339] [<ffffffbffc802480>] ieee80211_tx_status_8023+0xf8/0x220 [mac80211]
+  [   87.715654] [<ffffffbffc98bad4>] ath11k_dp_tx_completion_handler+0x42c/0xa10 [ath11k]
+  [   87.722924] [<ffffffbffc989190>] ath11k_dp_service_srng+0x70/0x3c8 [ath11k]
+  [   87.730831] [<ffffffbffca03460>] 0xffffffbffca03460
+  [   87.737599] [<ffffffc00046ef58>] net_rx_action+0xf8/0x288
+  [   87.742462] [<ffffffc000097554>] __do_softirq+0xfc/0x220
+  [   87.748014] [<ffffffc000097900>] irq_exit+0x98/0xe8
+  [   87.753396] [<ffffffc0000cf188>] __handle_domain_irq+0x90/0xb8
+  [   87.757999] [<ffffffc000081ca4>] gic_handle_irq+0x6c/0xc8
+  [   87.763899] Exception stack(0xffffffc00081bdc0 to 0xffffffc00081bef0)
+
+Problem is that the state of ath11k_skb_cb->flags must be considered
+unknown and could contain anything when it is not manually initialized. So
+it could also contain ATH11K_SKB_HW_80211_ENCAP. And this can result in the
+code to assume that the ath11k_skb_cb->vif is set - even when this is not
+always the case for non ATH11K_SKB_HW_80211_ENCAP transmissions.
+
+Tested-on: IPQ8074 hw2.0 WLAN.HK.2.4.0.1.r1-00026-QCAHKSWPL_SILICONZ-2
+
+[1] https://source.codeaurora.org/quic/qsdk/oss/system/feeds/wlan-open/tree/mac80211/patches?h=NHSS.QSDK.11.4.r3
+    (162 patches at the moment which are often not upstreamed but essential
+     to get ath11k working)
+
+Fixes: e7f33e0c52c0 ("ath11k: add tx hw 802.11 encapsulation offloading support")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201119154235.263250-2-sven@narfation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index 6b7f00e0086f5..af427d9051a07 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4057,6 +4057,7 @@ static void ath11k_mac_op_tx(struct ieee80211_hw *hw,
+ 	bool is_prb_rsp;
+ 	int ret;
+ 
++	memset(skb_cb, 0, sizeof(*skb_cb));
+ 	skb_cb->vif = vif;
+ 
+ 	if (key) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/block-rnbd-clt-dynamically-alloc-buffer-for-pathname.patch b/queue-5.10/block-rnbd-clt-dynamically-alloc-buffer-for-pathname.patch
new file mode 100644
index 00000000000..afa84e9fd65
--- /dev/null
+++ b/queue-5.10/block-rnbd-clt-dynamically-alloc-buffer-for-pathname.patch
@@ -0,0 +1,127 @@
+From 86f7f104183bfe57ea6ebe53c8324e2c6040b0df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 11:47:23 +0100
+Subject: block/rnbd-clt: Dynamically alloc buffer for pathname &
+ blk_symlink_name
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit 64e8a6ece1a5b1fa21316918053d068baeac84af ]
+
+For every rnbd_clt_dev, we alloc the pathname and blk_symlink_name
+statically to NAME_MAX which is 255 bytes. In most of the cases we only
+need less than 10 bytes, so 500 bytes per block device are wasted.
+
+This commit dynamically allocates memory buffer for pathname and
+blk_symlink_name.
+
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Lutz Pogrell <lutz.pogrell@cloud.ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-clt-sysfs.c | 12 ++++++++++--
+ drivers/block/rnbd/rnbd-clt.c       | 14 +++++++++++---
+ drivers/block/rnbd/rnbd-clt.h       |  4 ++--
+ 3 files changed, 23 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
+index 4f4474eecadb7..b53df40c9a97f 100644
+--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
++++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
+@@ -435,6 +435,7 @@ void rnbd_clt_remove_dev_symlink(struct rnbd_clt_dev *dev)
+ 	 */
+ 	if (strlen(dev->blk_symlink_name) && try_module_get(THIS_MODULE)) {
+ 		sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name);
++		kfree(dev->blk_symlink_name);
+ 		module_put(THIS_MODULE);
+ 	}
+ }
+@@ -487,10 +488,17 @@ static int rnbd_clt_get_path_name(struct rnbd_clt_dev *dev, char *buf,
+ static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
+ {
+ 	struct kobject *gd_kobj = &disk_to_dev(dev->gd)->kobj;
+-	int ret;
++	int ret, len;
++
++	len = strlen(dev->pathname) + strlen(dev->sess->sessname) + 2;
++	dev->blk_symlink_name = kzalloc(len, GFP_KERNEL);
++	if (!dev->blk_symlink_name) {
++		rnbd_clt_err(dev, "Failed to allocate memory for blk_symlink_name\n");
++		goto out_err;
++	}
+ 
+ 	ret = rnbd_clt_get_path_name(dev, dev->blk_symlink_name,
+-				      sizeof(dev->blk_symlink_name));
++				      len);
+ 	if (ret) {
+ 		rnbd_clt_err(dev, "Failed to get /sys/block symlink path, err: %d\n",
+ 			      ret);
+diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
+index 8b2411ccbda97..f180ebf1e11c9 100644
+--- a/drivers/block/rnbd/rnbd-clt.c
++++ b/drivers/block/rnbd/rnbd-clt.c
+@@ -59,6 +59,7 @@ static void rnbd_clt_put_dev(struct rnbd_clt_dev *dev)
+ 	ida_simple_remove(&index_ida, dev->clt_device_id);
+ 	mutex_unlock(&ida_lock);
+ 	kfree(dev->hw_queues);
++	kfree(dev->pathname);
+ 	rnbd_clt_put_sess(dev->sess);
+ 	mutex_destroy(&dev->lock);
+ 	kfree(dev);
+@@ -1381,10 +1382,17 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
+ 		       pathname, sess->sessname, ret);
+ 		goto out_queues;
+ 	}
++
++	dev->pathname = kzalloc(strlen(pathname) + 1, GFP_KERNEL);
++	if (!dev->pathname) {
++		ret = -ENOMEM;
++		goto out_queues;
++	}
++	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
++
+ 	dev->clt_device_id	= ret;
+ 	dev->sess		= sess;
+ 	dev->access_mode	= access_mode;
+-	strlcpy(dev->pathname, pathname, sizeof(dev->pathname));
+ 	mutex_init(&dev->lock);
+ 	refcount_set(&dev->refcount, 1);
+ 	dev->dev_state = DEV_STATE_INIT;
+@@ -1413,8 +1421,8 @@ static bool __exists_dev(const char *pathname)
+ 	list_for_each_entry(sess, &sess_list, list) {
+ 		mutex_lock(&sess->lock);
+ 		list_for_each_entry(dev, &sess->devs_list, list) {
+-			if (!strncmp(dev->pathname, pathname,
+-				     sizeof(dev->pathname))) {
++			if (strlen(dev->pathname) == strlen(pathname) &&
++			    !strcmp(dev->pathname, pathname)) {
+ 				found = true;
+ 				break;
+ 			}
+diff --git a/drivers/block/rnbd/rnbd-clt.h b/drivers/block/rnbd/rnbd-clt.h
+index ed33654aa4868..b193d59040503 100644
+--- a/drivers/block/rnbd/rnbd-clt.h
++++ b/drivers/block/rnbd/rnbd-clt.h
+@@ -108,7 +108,7 @@ struct rnbd_clt_dev {
+ 	u32			clt_device_id;
+ 	struct mutex		lock;
+ 	enum rnbd_clt_dev_state	dev_state;
+-	char			pathname[NAME_MAX];
++	char			*pathname;
+ 	enum rnbd_access_mode	access_mode;
+ 	bool			read_only;
+ 	bool			rotational;
+@@ -126,7 +126,7 @@ struct rnbd_clt_dev {
+ 	struct list_head        list;
+ 	struct gendisk		*gd;
+ 	struct kobject		kobj;
+-	char			blk_symlink_name[NAME_MAX];
++	char			*blk_symlink_name;
+ 	refcount_t		refcount;
+ 	struct work_struct	unmap_on_rmmod_work;
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/block-rnbd-clt-fix-possible-memleak.patch b/queue-5.10/block-rnbd-clt-fix-possible-memleak.patch
new file mode 100644
index 00000000000..e349885538d
--- /dev/null
+++ b/queue-5.10/block-rnbd-clt-fix-possible-memleak.patch
@@ -0,0 +1,51 @@
+From 408f2fd37029e235a0852f197f8286e7b60d1093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 11:18:21 +0100
+Subject: block/rnbd-clt: Fix possible memleak
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 46067844efdb8275ade705923120fc5391543b53 ]
+
+In error case, we do not free the memory for blk_symlink_name.
+
+Do it by free the memory in error case, and set to NULL
+afterwards.
+
+Also fix the condition in rnbd_clt_remove_dev_symlink.
+
+Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-clt-sysfs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
+index d854f057056bb..d9dd138ca9c64 100644
+--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
++++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
+@@ -433,7 +433,7 @@ void rnbd_clt_remove_dev_symlink(struct rnbd_clt_dev *dev)
+ 	 * i.e. rnbd_clt_unmap_dev_store() leading to a sysfs warning because
+ 	 * of sysfs link already was removed already.
+ 	 */
+-	if (strlen(dev->blk_symlink_name) && try_module_get(THIS_MODULE)) {
++	if (dev->blk_symlink_name && try_module_get(THIS_MODULE)) {
+ 		sysfs_remove_link(rnbd_devs_kobj, dev->blk_symlink_name);
+ 		kfree(dev->blk_symlink_name);
+ 		module_put(THIS_MODULE);
+@@ -516,7 +516,8 @@ static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
+ 	return 0;
+ 
+ out_err:
+-	dev->blk_symlink_name[0] = '\0';
++	kfree(dev->blk_symlink_name);
++	dev->blk_symlink_name = NULL ;
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/block-rnbd-clt-get-rid-of-warning-regarding-size-arg.patch b/queue-5.10/block-rnbd-clt-get-rid-of-warning-regarding-size-arg.patch
new file mode 100644
index 00000000000..5fb0019724a
--- /dev/null
+++ b/queue-5.10/block-rnbd-clt-get-rid-of-warning-regarding-size-arg.patch
@@ -0,0 +1,50 @@
+From 157a97ab052bed06a6466d84aa751664aa339e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 11:18:20 +0100
+Subject: block/rnbd-clt: Get rid of warning regarding size argument in strlcpy
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit e7508d48565060af5d89f10cb83c9359c8ae1310 ]
+
+The kernel test robot triggerred the following warning,
+
+>> drivers/block/rnbd/rnbd-clt.c:1397:42: warning: size argument in
+'strlcpy' call appears to be size of the source; expected the size of the
+destination [-Wstrlcpy-strlcat-size]
+	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
+					      ~~~~~~~^~~~~~~~~~~~~
+
+To get rid of the above warning, use a kstrdup as Bart suggested.
+
+Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-clt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c
+index f180ebf1e11c9..7af1b60582fe5 100644
+--- a/drivers/block/rnbd/rnbd-clt.c
++++ b/drivers/block/rnbd/rnbd-clt.c
+@@ -1383,12 +1383,11 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
+ 		goto out_queues;
+ 	}
+ 
+-	dev->pathname = kzalloc(strlen(pathname) + 1, GFP_KERNEL);
++	dev->pathname = kstrdup(pathname, GFP_KERNEL);
+ 	if (!dev->pathname) {
+ 		ret = -ENOMEM;
+ 		goto out_queues;
+ 	}
+-	strlcpy(dev->pathname, pathname, strlen(pathname) + 1);
+ 
+ 	dev->clt_device_id	= ret;
+ 	dev->sess		= sess;
+-- 
+2.27.0
+
diff --git a/queue-5.10/block-rnbd-fix-a-null-pointer-dereference-on-dev-blk.patch b/queue-5.10/block-rnbd-fix-a-null-pointer-dereference-on-dev-blk.patch
new file mode 100644
index 00000000000..d6d2d9b25b4
--- /dev/null
+++ b/queue-5.10/block-rnbd-fix-a-null-pointer-dereference-on-dev-blk.patch
@@ -0,0 +1,40 @@
+From 5ff202b560a86c95083c0286e13ca4a2e3541838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 14:54:46 +0000
+Subject: block/rnbd: fix a null pointer dereference on dev->blk_symlink_name
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 733c15bd3a944b8eeaacdddf061759b6a83dd3f4 ]
+
+Currently in the case where dev->blk_symlink_name fails to be allocates
+the error return path attempts to set an end-of-string character to
+the unallocated dev->blk_symlink_name causing a null pointer dereference
+error. Fix this by returning with an explicity ENOMEM error (which also
+is missing in the original code as was not initialized).
+
+Fixes: 1eb54f8f5dd8 ("block/rnbd: client: sysfs interface functions")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Addresses-Coverity: ("Dereference after null check")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-clt-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/rnbd/rnbd-clt-sysfs.c b/drivers/block/rnbd/rnbd-clt-sysfs.c
+index b53df40c9a97f..d854f057056bb 100644
+--- a/drivers/block/rnbd/rnbd-clt-sysfs.c
++++ b/drivers/block/rnbd/rnbd-clt-sysfs.c
+@@ -494,7 +494,7 @@ static int rnbd_clt_add_dev_symlink(struct rnbd_clt_dev *dev)
+ 	dev->blk_symlink_name = kzalloc(len, GFP_KERNEL);
+ 	if (!dev->blk_symlink_name) {
+ 		rnbd_clt_err(dev, "Failed to allocate memory for blk_symlink_name\n");
+-		goto out_err;
++		return -ENOMEM;
+ 	}
+ 
+ 	ret = rnbd_clt_get_path_name(dev, dev->blk_symlink_name,
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch b/queue-5.10/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch
new file mode 100644
index 00000000000..2597959fc6e
--- /dev/null
+++ b/queue-5.10/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch
@@ -0,0 +1,38 @@
+From 1ffdb1748bdb8350a6df81fed048e229645b22c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 10:43:32 +0800
+Subject: Bluetooth: btmtksdio: Add the missed release_firmware() in
+ mtk_setup_firmware()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit b73b5781a85c03113476f62346c390f0277baa4b ]
+
+mtk_setup_firmware() misses to call release_firmware() in an error
+path. Jump to free_fw to fix it.
+
+Fixes: 737cd06072a7 ("Bluetooth: btmtksdio: fix up firmware download sequence")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtksdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
+index ba45c59bd9f36..5f9f027956317 100644
+--- a/drivers/bluetooth/btmtksdio.c
++++ b/drivers/bluetooth/btmtksdio.c
+@@ -704,7 +704,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
+ 	if (err < 0) {
+ 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
+-		return err;
++		goto free_fw;
+ 	}
+ 
+ 	fw_ptr = fw->data;
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch b/queue-5.10/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch
new file mode 100644
index 00000000000..400a03f6edf
--- /dev/null
+++ b/queue-5.10/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch
@@ -0,0 +1,38 @@
+From 4e7d496857d939e4ea43273be9d16a6f38711416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 10:59:17 +0800
+Subject: Bluetooth: btusb: Add the missed release_firmware() in
+ btusb_mtk_setup_firmware()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit d1e9d232e1e60fa63df1b836ec3ecba5abd3fa9d ]
+
+btusb_mtk_setup_firmware() misses to call release_firmware() in an error
+path. Jump to err_release_fw to fix it.
+
+Fixes: f645125711c8 ("Bluetooth: btusb: fix up firmware download sequence")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 1005b6e8ff743..a9981678199d7 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3067,7 +3067,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
+ 	err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
+ 	if (err < 0) {
+ 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
+-		return err;
++		goto err_release_fw;
+ 	}
+ 
+ 	fw_ptr = fw->data;
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-btusb-fix-detection-of-some-fake-csr-contr.patch b/queue-5.10/bluetooth-btusb-fix-detection-of-some-fake-csr-contr.patch
new file mode 100644
index 00000000000..2ea767f457d
--- /dev/null
+++ b/queue-5.10/bluetooth-btusb-fix-detection-of-some-fake-csr-contr.patch
@@ -0,0 +1,62 @@
+From 415ce282d8c658f3be7e275396703e12af874ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 16:02:00 +0100
+Subject: Bluetooth: btusb: Fix detection of some fake CSR controllers with a
+ bcdDevice val of 0x0134
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit d74e0ae7e03032b47b8631cc1e52a7ae1ce988c0 ]
+
+Commit cde1a8a99287 ("Bluetooth: btusb: Fix and detect most of the
+Chinese Bluetooth controllers") made the detection of fake controllers
+more generic fixing it for much of the newer fakes / clones.
+
+But this does not work for a fake CSR controller with a bcdDevice
+value of 0x0134, which was correctly identified as fake before
+this change.
+
+Add an extra check for this special case, checking for a combination
+of a bcdDevice value of 0x0134, together with a lmp_subver of 0x0c5c
+and a hci_ver of BLUETOOTH_VER_2_0.
+
+The chip inside this fake dongle is marked as with "clockwise cw6629d".
+
+Fixes: cde1a8a99287 ("Bluetooth: btusb: Fix and detect most of the Chinese Bluetooth controllers")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index a9981678199d7..80468745d5c5e 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1763,6 +1763,8 @@ static int btusb_setup_bcm92035(struct hci_dev *hdev)
+ 
+ static int btusb_setup_csr(struct hci_dev *hdev)
+ {
++	struct btusb_data *data = hci_get_drvdata(hdev);
++	u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
+ 	struct hci_rp_read_local_version *rp;
+ 	struct sk_buff *skb;
+ 	bool is_fake = false;
+@@ -1832,6 +1834,12 @@ static int btusb_setup_csr(struct hci_dev *hdev)
+ 		 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
+ 		is_fake = true;
+ 
++	/* Other clones which beat all the above checks */
++	else if (bcdDevice == 0x0134 &&
++		 le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
++		 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
++		is_fake = true;
++
+ 	if (is_fake) {
+ 		bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-fix-ll-privacy-ble-device-fails-to-connect.patch b/queue-5.10/bluetooth-fix-ll-privacy-ble-device-fails-to-connect.patch
new file mode 100644
index 00000000000..ea24f15a88e
--- /dev/null
+++ b/queue-5.10/bluetooth-fix-ll-privacy-ble-device-fails-to-connect.patch
@@ -0,0 +1,72 @@
+From 724b21b7a64a20f3ecb08cfc3a38680d365d0928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 13:18:21 +0530
+Subject: Bluetooth: Fix: LL PRivacy BLE device fails to connect
+
+From: Sathish Narasimman <nsathish41@gmail.com>
+
+[ Upstream commit 1fb17dfc258ff6208f7873cc7b8e40e27515d2d5 ]
+
+When adding device to white list the device is added to resolving list
+also. It has to be added only when HCI_ENABLE_LL_PRIVACY flag is set.
+HCI_ENABLE_LL_PRIVACY flag has to be tested before adding/deleting devices
+to resolving list. use_ll_privacy macro is used only to check if controller
+supports LL_Privacy.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=209745
+
+Fixes: 0eee35bdfa3b ("Bluetooth: Update resolving list when updating whitelist")
+Signed-off-by: Sathish Narasimman <sathish.narasimman@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_request.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 6f12bab4d2fa6..610ed0817bd77 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -698,7 +698,8 @@ static void del_from_white_list(struct hci_request *req, bdaddr_t *bdaddr,
+ 		   cp.bdaddr_type);
+ 	hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(cp), &cp);
+ 
+-	if (use_ll_privacy(req->hdev)) {
++	if (use_ll_privacy(req->hdev) &&
++	    hci_dev_test_flag(req->hdev, HCI_ENABLE_LL_PRIVACY)) {
+ 		struct smp_irk *irk;
+ 
+ 		irk = hci_find_irk_by_addr(req->hdev, bdaddr, bdaddr_type);
+@@ -732,7 +733,8 @@ static int add_to_white_list(struct hci_request *req,
+ 		return -1;
+ 
+ 	/* White list can not be used with RPAs */
+-	if (!allow_rpa && !use_ll_privacy(hdev) &&
++	if (!allow_rpa &&
++	    !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
+ 	    hci_find_irk_by_addr(hdev, &params->addr, params->addr_type)) {
+ 		return -1;
+ 	}
+@@ -750,7 +752,8 @@ static int add_to_white_list(struct hci_request *req,
+ 		   cp.bdaddr_type);
+ 	hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
+ 
+-	if (use_ll_privacy(hdev)) {
++	if (use_ll_privacy(hdev) &&
++	    hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) {
+ 		struct smp_irk *irk;
+ 
+ 		irk = hci_find_irk_by_addr(hdev, &params->addr,
+@@ -812,7 +815,8 @@ static u8 update_white_list(struct hci_request *req)
+ 		}
+ 
+ 		/* White list can not be used with RPAs */
+-		if (!allow_rpa && !use_ll_privacy(hdev) &&
++		if (!allow_rpa &&
++		    !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
+ 		    hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
+ 			return 0x00;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch b/queue-5.10/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch
new file mode 100644
index 00000000000..995851996a6
--- /dev/null
+++ b/queue-5.10/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch
@@ -0,0 +1,49 @@
+From b0701aa7eee77d4c3678b8b81416d3c745b55ce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 19:48:13 +0530
+Subject: Bluetooth: Fix null pointer dereference in hci_event_packet()
+
+From: Anmol Karn <anmol.karan123@gmail.com>
+
+[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]
+
+AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
+from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
+not be found when accessing after initialization of hcon.
+
+- net/bluetooth/hci_event.c:4945
+The bug seems to get triggered in this line:
+
+bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
+
+Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
+
+Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
+Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
+Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index cbdf2a5559754..17a72695865b5 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4941,6 +4941,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
+ 		return;
+ 	}
+ 
++	if (!hcon->amp_mgr) {
++		hci_dev_unlock(hdev);
++		return;
++	}
++
+ 	if (ev->status) {
+ 		hci_conn_del(hcon);
+ 		hci_dev_unlock(hdev);
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch b/queue-5.10/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch
new file mode 100644
index 00000000000..2799764fe52
--- /dev/null
+++ b/queue-5.10/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch
@@ -0,0 +1,42 @@
+From bdcc249844f561c812f46d7a59e0d10a36428fbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 18:44:47 +0530
+Subject: Bluetooth: hci_h5: fix memory leak in h5_close
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ]
+
+When h5_close() is called, h5 is directly freed when !hu->serdev.
+However, h5->rx_skb is not freed, which causes a memory leak.
+
+Freeing h5->rx_skb and setting it to NULL, fixes this memory leak.
+
+Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
+Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
+Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 981d96cc76959..78d635f1d1567 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -245,6 +245,9 @@ static int h5_close(struct hci_uart *hu)
+ 	skb_queue_purge(&h5->rel);
+ 	skb_queue_purge(&h5->unrel);
+ 
++	kfree_skb(h5->rx_skb);
++	h5->rx_skb = NULL;
++
+ 	if (h5->vnd && h5->vnd->close)
+ 		h5->vnd->close(h5);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/bluetooth-sco-fix-crash-when-using-bt_sndmtu-bt_rcvm.patch b/queue-5.10/bluetooth-sco-fix-crash-when-using-bt_sndmtu-bt_rcvm.patch
new file mode 100644
index 00000000000..b5b688a7ef7
--- /dev/null
+++ b/queue-5.10/bluetooth-sco-fix-crash-when-using-bt_sndmtu-bt_rcvm.patch
@@ -0,0 +1,73 @@
+From 724f03345361accd139f7d6c34f6e747be918b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 21:24:21 +0800
+Subject: Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit f6b8c6b5543983e9de29dc14716bfa4eb3f157c4 ]
+
+This commit add the invalid check for connected socket, without it will
+causes the following crash due to sco_pi(sk)->conn being NULL:
+
+KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
+CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
+RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0
+Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00
+      00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
+      c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c
+RSP: 0018:ffff88801bb17d88 EFLAGS: 00010206
+RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83a4ecdf
+RDX: 000000000000000a RSI: ffffc90002fce000 RDI: 0000000000000050
+RBP: 1ffff11003762fb4 R08: 0000000000000001 R09: ffff88810e1008c0
+R10: ffffffffbd695dcf R11: fffffbfff7ad2bb9 R12: 0000000000000000
+R13: ffff888018ff1000 R14: dffffc0000000000 R15: 000000000000000d
+FS:  00007fb4f76c1700(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005555e3b7a938 CR3: 00000001117be001 CR4: 0000000000770ee0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ ? sco_skb_put_cmsg+0x80/0x80
+ ? sco_skb_put_cmsg+0x80/0x80
+ __sys_getsockopt+0x12a/0x220
+ ? __ia32_sys_setsockopt+0x150/0x150
+ ? syscall_enter_from_user_mode+0x18/0x50
+ ? rcu_read_lock_bh_held+0xb0/0xb0
+ __x64_sys_getsockopt+0xba/0x150
+ ? syscall_enter_from_user_mode+0x1d/0x50
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 0fc1a726f897 ("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Luiz Augusto Von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 79ffcdef0b7ad..22a110f37abc6 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -1003,6 +1003,11 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
+ 
+ 	case BT_SNDMTU:
+ 	case BT_RCVMTU:
++		if (sk->sk_state != BT_CONNECTED) {
++			err = -ENOTCONN;
++			break;
++		}
++
+ 		if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
+ 			err = -EFAULT;
+ 		break;
+-- 
+2.27.0
+
diff --git a/queue-5.10/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch b/queue-5.10/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch
new file mode 100644
index 00000000000..ba3170d47ed
--- /dev/null
+++ b/queue-5.10/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch
@@ -0,0 +1,47 @@
+From 92b03d6a8d2ecb733d3fd48f119bf98b6f710425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 12:46:21 -0800
+Subject: bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 12cc126df82c96c89706aa207ad27c56f219047c ]
+
+__module_address() needs to be called with preemption disabled or with
+module_mutex taken. preempt_disable() is enough for read-only uses, which is
+what this fix does. Also, module_put() does internal check for NULL, so drop
+it as well.
+
+Fixes: a38d1107f937 ("bpf: support raw tracepoints in modules")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20201203204634.1325171-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index a125ea5e04cd7..0dde84b9d29fe 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2041,10 +2041,12 @@ struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name)
+ 
+ void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp)
+ {
+-	struct module *mod = __module_address((unsigned long)btp);
++	struct module *mod;
+ 
+-	if (mod)
+-		module_put(mod);
++	preempt_disable();
++	mod = __module_address((unsigned long)btp);
++	module_put(mod);
++	preempt_enable();
+ }
+ 
+ static __always_inline
+-- 
+2.27.0
+
diff --git a/queue-5.10/bpf-fix-tests-for-local_storage.patch b/queue-5.10/bpf-fix-tests-for-local_storage.patch
new file mode 100644
index 00000000000..808acf01ac3
--- /dev/null
+++ b/queue-5.10/bpf-fix-tests-for-local_storage.patch
@@ -0,0 +1,105 @@
+From 6251e7bda3357e024ca02d4dde80fb8ad2f8b4a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 10:37:44 +0000
+Subject: bpf: Fix tests for local_storage
+
+From: KP Singh <kpsingh@google.com>
+
+[ Upstream commit f0e5ba0bc481df77cf0afac2b33e420b33eeb463 ]
+
+The {inode,sk}_storage_result checking if the correct value was retrieved
+was being clobbered unconditionally by the return value of the
+bpf_{inode,sk}_storage_delete call.
+
+Also, consistently use the newly added BPF_LOCAL_STORAGE_GET_F_CREATE
+flag.
+
+Fixes: cd324d7abb3d ("bpf: Add selftests for local_storage")
+Signed-off-by: KP Singh <kpsingh@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20201106103747.2780972-7-kpsingh@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/local_storage.c       | 24 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
+index 0758ba229ae0e..09529e33be982 100644
+--- a/tools/testing/selftests/bpf/progs/local_storage.c
++++ b/tools/testing/selftests/bpf/progs/local_storage.c
+@@ -58,20 +58,22 @@ int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
+ {
+ 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
+ 	struct dummy_storage *storage;
++	int err;
+ 
+ 	if (pid != monitored_pid)
+ 		return 0;
+ 
+ 	storage = bpf_inode_storage_get(&inode_storage_map, victim->d_inode, 0,
+-				     BPF_SK_STORAGE_GET_F_CREATE);
++					BPF_LOCAL_STORAGE_GET_F_CREATE);
+ 	if (!storage)
+ 		return 0;
+ 
+-	if (storage->value == DUMMY_STORAGE_VALUE)
++	if (storage->value != DUMMY_STORAGE_VALUE)
+ 		inode_storage_result = -1;
+ 
+-	inode_storage_result =
+-		bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
++	err = bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
++	if (!err)
++		inode_storage_result = err;
+ 
+ 	return 0;
+ }
+@@ -82,19 +84,23 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address,
+ {
+ 	__u32 pid = bpf_get_current_pid_tgid() >> 32;
+ 	struct dummy_storage *storage;
++	int err;
+ 
+ 	if (pid != monitored_pid)
+ 		return 0;
+ 
+ 	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
+-				     BPF_SK_STORAGE_GET_F_CREATE);
++				     BPF_LOCAL_STORAGE_GET_F_CREATE);
+ 	if (!storage)
+ 		return 0;
+ 
+-	if (storage->value == DUMMY_STORAGE_VALUE)
++	if (storage->value != DUMMY_STORAGE_VALUE)
+ 		sk_storage_result = -1;
+ 
+-	sk_storage_result = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
++	err = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
++	if (!err)
++		sk_storage_result = err;
++
+ 	return 0;
+ }
+ 
+@@ -109,7 +115,7 @@ int BPF_PROG(socket_post_create, struct socket *sock, int family, int type,
+ 		return 0;
+ 
+ 	storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
+-				     BPF_SK_STORAGE_GET_F_CREATE);
++				     BPF_LOCAL_STORAGE_GET_F_CREATE);
+ 	if (!storage)
+ 		return 0;
+ 
+@@ -131,7 +137,7 @@ int BPF_PROG(file_open, struct file *file)
+ 		return 0;
+ 
+ 	storage = bpf_inode_storage_get(&inode_storage_map, file->f_inode, 0,
+-				     BPF_LOCAL_STORAGE_GET_F_CREATE);
++					BPF_LOCAL_STORAGE_GET_F_CREATE);
+ 	if (!storage)
+ 		return 0;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/brcmfmac-fix-error-return-code-in-brcmf_cfg80211_con.patch b/queue-5.10/brcmfmac-fix-error-return-code-in-brcmf_cfg80211_con.patch
new file mode 100644
index 00000000000..29408ce3b68
--- /dev/null
+++ b/queue-5.10/brcmfmac-fix-error-return-code-in-brcmf_cfg80211_con.patch
@@ -0,0 +1,40 @@
+From 2efaaf92e593333b35d9b8abfa3bf60e4a5ab74a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 14:28:16 +0800
+Subject: brcmfmac: fix error return code in brcmf_cfg80211_connect()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 37ff144d29acd7bca3d465ce2fc4cb5c7072a7e5 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 3b1e0a7bdfee ("brcmfmac: add support for SAE authentication offload")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Chi-hsien Lin <chi-hsien.lin@infineon.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1605248896-16812-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index a2dbbb977d0cb..0ee421f30aa24 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2137,7 +2137,8 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
+ 				    BRCMF_WSEC_MAX_PSK_LEN);
+ 	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
+ 		/* clean up user-space RSNE */
+-		if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
++		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
++		if (err) {
+ 			bphy_err(drvr, "failed to clean up user-space RSNE\n");
+ 			goto done;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch b/queue-5.10/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch
new file mode 100644
index 00000000000..762ac0d8cf3
--- /dev/null
+++ b/queue-5.10/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch
@@ -0,0 +1,64 @@
+From ffe8df15480b036959e13a7e13f5d4ff8c115ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 10:52:47 +0900
+Subject: brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
+
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+
+[ Upstream commit 9db946284e07bb27309dd546b7fee528664ba82a ]
+
+There are missig brcmf_free() for brcmf_alloc(). Fix memory leak
+by adding missed brcmf_free().
+
+Reported-by: Jaehoon Chung <jh80.chung@samsung.com>
+Fixes: a1f5aac1765a ("brcmfmac: don't realloc wiphy during PCIe reset")
+Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1603849967-22817-1-git-send-email-sw0312.kim@samsung.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index 39381cbde89e6..d8db0dbcfe091 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1936,16 +1936,18 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
+ 	if (!fwreq) {
+ 		ret = -ENOMEM;
+-		goto fail_bus;
++		goto fail_brcmf;
+ 	}
+ 
+ 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
+ 	if (ret < 0) {
+ 		kfree(fwreq);
+-		goto fail_bus;
++		goto fail_brcmf;
+ 	}
+ 	return 0;
+ 
++fail_brcmf:
++	brcmf_free(&devinfo->pdev->dev);
+ fail_bus:
+ 	kfree(bus->msgbuf);
+ 	kfree(bus);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 99987a789e7e3..59c2b2b6027da 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4541,6 +4541,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
+ 		brcmf_sdiod_intr_unregister(bus->sdiodev);
+ 
+ 		brcmf_detach(bus->sdiodev->dev);
++		brcmf_free(bus->sdiodev->dev);
+ 
+ 		cancel_work_sync(&bus->datawork);
+ 		if (bus->brcmf_wq)
+-- 
+2.27.0
+
diff --git a/queue-5.10/bus-fsl-mc-add-back-accidentally-dropped-error-check.patch b/queue-5.10/bus-fsl-mc-add-back-accidentally-dropped-error-check.patch
new file mode 100644
index 00000000000..1ac4e2361e5
--- /dev/null
+++ b/queue-5.10/bus-fsl-mc-add-back-accidentally-dropped-error-check.patch
@@ -0,0 +1,40 @@
+From bb47d640747f7a7b2f6846ebb74c5c7ba99ef00e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 17:30:49 +0200
+Subject: bus: fsl-mc: add back accidentally dropped error check
+
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+
+[ Upstream commit 61243c03dde238170001093a29716c2369e8358f ]
+
+A previous patch accidentally dropped an error check, so add it back.
+
+Fixes: aef85b56c3c1 ("bus: fsl-mc: MC control registers are not always available")
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Link: https://lore.kernel.org/r/20201105153050.19662-1-laurentiu.tudor@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
+index 76a6ee505d33d..806766b1b45f6 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -967,8 +967,11 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, mc);
+ 
+ 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+-	if (plat_res)
++	if (plat_res) {
+ 		mc->fsl_mc_regs = devm_ioremap_resource(&pdev->dev, plat_res);
++		if (IS_ERR(mc->fsl_mc_regs))
++			return PTR_ERR(mc->fsl_mc_regs);
++	}
+ 
+ 	if (mc->fsl_mc_regs && IS_ENABLED(CONFIG_ACPI) &&
+ 	    !dev_of_node(&pdev->dev)) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch b/queue-5.10/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch
new file mode 100644
index 00000000000..a3df6184a20
--- /dev/null
+++ b/queue-5.10/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch
@@ -0,0 +1,42 @@
+From d37544325791f5a56f4395c714315555adec799c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:02:47 +0800
+Subject: bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 197f4d6a4a00 ("staging: fsl-mc: fsl-mc object allocator driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607068967-31991-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+index e71a6f52ea0cf..2d7c764bb7dcf 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
++++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev,
+ 		goto error;
+ 
+ 	mc_adev = resource->data;
+-	if (!mc_adev)
++	if (!mc_adev) {
++		error = -EINVAL;
+ 		goto error;
++	}
+ 
+ 	mc_adev->consumer_link = device_link_add(&mc_dev->dev,
+ 						 &mc_adev->dev,
+-- 
+2.27.0
+
diff --git a/queue-5.10/bus-mhi-core-fix-null-pointer-access-when-parsing-mh.patch b/queue-5.10/bus-mhi-core-fix-null-pointer-access-when-parsing-mh.patch
new file mode 100644
index 00000000000..6b06d9c6c0e
--- /dev/null
+++ b/queue-5.10/bus-mhi-core-fix-null-pointer-access-when-parsing-mh.patch
@@ -0,0 +1,50 @@
+From b0e6c21c1617a6a5f12b933e51c4cd51d82418fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 20:27:10 +0800
+Subject: bus: mhi: core: Fix null pointer access when parsing MHI
+ configuration
+
+From: Carl Yin <carl.yin@quectel.com>
+
+[ Upstream commit f4d0b39c842585c74bce8f8a80553369181b72df ]
+
+Functions parse_ev_cfg() and parse_ch_cfg() access mhi_cntrl->mhi_dev
+before it is set in function mhi_register_controller(),
+use cntrl_dev instead of mhi_dev.
+
+Fixes: 0cbf260820fa ("bus: mhi: core: Add support for registering MHI controllers")
+Signed-off-by: Carl Yin <carl.yin@quectel.com>
+Reviewed-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
+Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/core/init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
+index 0a09f8215057d..8cefa359fccd8 100644
+--- a/drivers/bus/mhi/core/init.c
++++ b/drivers/bus/mhi/core/init.c
+@@ -610,7 +610,7 @@ static int parse_ev_cfg(struct mhi_controller *mhi_cntrl,
+ {
+ 	struct mhi_event *mhi_event;
+ 	const struct mhi_event_config *event_cfg;
+-	struct device *dev = &mhi_cntrl->mhi_dev->dev;
++	struct device *dev = mhi_cntrl->cntrl_dev;
+ 	int i, num;
+ 
+ 	num = config->num_events;
+@@ -692,7 +692,7 @@ static int parse_ch_cfg(struct mhi_controller *mhi_cntrl,
+ 			const struct mhi_controller_config *config)
+ {
+ 	const struct mhi_channel_config *ch_cfg;
+-	struct device *dev = &mhi_cntrl->mhi_dev->dev;
++	struct device *dev = mhi_cntrl->cntrl_dev;
+ 	int i;
+ 	u32 chan;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/bus-mhi-core-remove-double-locking-from-mhi_driver_r.patch b/queue-5.10/bus-mhi-core-remove-double-locking-from-mhi_driver_r.patch
new file mode 100644
index 00000000000..f762ff63fca
--- /dev/null
+++ b/queue-5.10/bus-mhi-core-remove-double-locking-from-mhi_driver_r.patch
@@ -0,0 +1,43 @@
+From 3c9cf787152911c383132e9e094811a6251c720e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 11:47:51 -0700
+Subject: bus: mhi: core: Remove double locking from mhi_driver_remove()
+
+From: Bhaumik Bhatt <bbhatt@codeaurora.org>
+
+[ Upstream commit 9b627c25e70816a5e1dca940444b5029065b4d60 ]
+
+There is double acquisition of the pm_lock from mhi_driver_remove()
+function. Remove the read_lock_bh/read_unlock_bh calls for pm_lock
+taken during a call to mhi_device_put() as the lock is acquired
+within the function already. This will help avoid a potential
+kernel panic.
+
+Fixes: 189ff97cca53 ("bus: mhi: core: Add support for data transfer")
+Reported-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/core/init.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
+index 0ffdebde82657..0a09f8215057d 100644
+--- a/drivers/bus/mhi/core/init.c
++++ b/drivers/bus/mhi/core/init.c
+@@ -1276,10 +1276,8 @@ static int mhi_driver_remove(struct device *dev)
+ 		mutex_unlock(&mhi_chan->mutex);
+ 	}
+ 
+-	read_lock_bh(&mhi_cntrl->pm_lock);
+ 	while (mhi_dev->dev_wake)
+ 		mhi_device_put(mhi_dev);
+-	read_unlock_bh(&mhi_cntrl->pm_lock);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/can-m_can-m_can_config_endisable-remove-double-clear.patch b/queue-5.10/can-m_can-m_can_config_endisable-remove-double-clear.patch
new file mode 100644
index 00000000000..480dc815271
--- /dev/null
+++ b/queue-5.10/can-m_can-m_can_config_endisable-remove-double-clear.patch
@@ -0,0 +1,45 @@
+From e7e9338e8355cfdd2bf80bed4861481bb2375553 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 07:32:27 +0100
+Subject: can: m_can: m_can_config_endisable(): remove double clearing of clock
+ stop request bit
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+[ Upstream commit c9f4cad6cdfe350ce2637e57f7f2aa7ff326bcc6 ]
+
+The CSR bit is already cleared when arriving here so remove this section of
+duplicate code.
+
+The registers set in m_can_config_endisable() is set to same exact values as
+before this patch.
+
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Acked-by: Sriram Dash <sriram.dash@samsung.com>
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Link: https://lore.kernel.org/r/20191211063227.84259-1-sean@geanix.com
+Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 61a93b1920379..7fc4ac1582afc 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -380,10 +380,6 @@ void m_can_config_endisable(struct m_can_classdev *cdev, bool enable)
+ 		cccr &= ~CCCR_CSR;
+ 
+ 	if (enable) {
+-		/* Clear the Clock stop request if it was set */
+-		if (cccr & CCCR_CSR)
+-			cccr &= ~CCCR_CSR;
+-
+ 		/* enable m_can configuration */
+ 		m_can_write(cdev, M_CAN_CCCR, cccr | CCCR_INIT);
+ 		udelay(5);
+-- 
+2.27.0
+
diff --git a/queue-5.10/checkpatch-fix-unescaped-left-brace.patch b/queue-5.10/checkpatch-fix-unescaped-left-brace.patch
new file mode 100644
index 00000000000..7f6b572655d
--- /dev/null
+++ b/queue-5.10/checkpatch-fix-unescaped-left-brace.patch
@@ -0,0 +1,42 @@
+From ffff7f78e27f09f127ed673db8095e5dcbdb5f5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 20:45:02 -0800
+Subject: checkpatch: fix unescaped left brace
+
+From: Dwaipayan Ray <dwaipayanray1@gmail.com>
+
+[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]
+
+There is an unescaped left brace in a regex in OPEN_BRACE check.  This
+throws a runtime error when checkpatch is run with --fix flag and the
+OPEN_BRACE check is executed.
+
+Fix it by escaping the left brace.
+
+Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
+Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
+Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
+Acked-by: Joe Perches <joe@perches.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkpatch.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index fab38b493cef7..0ad235ee96f91 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -4384,7 +4384,7 @@ sub process {
+ 			    $fix) {
+ 				fix_delete_line($fixlinenr, $rawline);
+ 				my $fixed_line = $rawline;
+-				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
++				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
+ 				my $line1 = $1;
+ 				my $line2 = $2;
+ 				fix_insert_line($fixlinenr, ltrim($line1));
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch b/queue-5.10/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch
new file mode 100644
index 00000000000..20a2372f057
--- /dev/null
+++ b/queue-5.10/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch
@@ -0,0 +1,51 @@
+From fd6a9007913187b1c59daec186652adec4fb4600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 13:58:15 +0100
+Subject: clk: at91: sam9x60: remove atmel,osc-bypass support
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 01324f9e88b5cfc1f4c26eef66bdcb52596c9af8 ]
+
+The sam9x60 doesn't have the MOSCXTBY bit to enable the crystal oscillator
+bypass.
+
+Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
+Reported-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201202125816.168618-1-alexandre.belloni@bootlin.com
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x60.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
+index 3c4c956035954..c8cbec5308f02 100644
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -174,7 +174,6 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
+ 	struct regmap *regmap;
+ 	struct clk_hw *hw;
+ 	int i;
+-	bool bypass;
+ 
+ 	i = of_property_match_string(np, "clock-names", "td_slck");
+ 	if (i < 0)
+@@ -209,10 +208,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 
+-	bypass = of_property_read_bool(np, "atmel,osc-bypass");
+-
+-	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name,
+-					bypass);
++	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name, 0);
+ 	if (IS_ERR(hw))
+ 		goto err_free;
+ 	main_osc_hw = hw;
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-at91-sama7g5-fix-compilation-error.patch b/queue-5.10/clk-at91-sama7g5-fix-compilation-error.patch
new file mode 100644
index 00000000000..fdc296643b0
--- /dev/null
+++ b/queue-5.10/clk-at91-sama7g5-fix-compilation-error.patch
@@ -0,0 +1,59 @@
+From b543e0808dfc37993d73cfa06a987d14f9e1aacc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 17:43:07 +0200
+Subject: clk: at91: sama7g5: fix compilation error
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 91274497c79170aaadc491d4ffe4de35495a060d ]
+
+pmc_data_allocate() has been changed. pmc_data_free() was removed.
+Adapt the code taking this into consideration. With this the programmable
+clocks were also saved in sama7g5_pmc so that they could be later
+referenced.
+
+Fixes: cb783bbbcf54 ("clk: at91: sama7g5: add clock support for sama7g5")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Tested-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/1605800597-16720-2-git-send-email-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sama7g5.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c
+index 0db2ab3eca147..a092a940baa40 100644
+--- a/drivers/clk/at91/sama7g5.c
++++ b/drivers/clk/at91/sama7g5.c
+@@ -838,7 +838,7 @@ static void __init sama7g5_pmc_setup(struct device_node *np)
+ 	sama7g5_pmc = pmc_data_allocate(PMC_I2S1_MUX + 1,
+ 					nck(sama7g5_systemck),
+ 					nck(sama7g5_periphck),
+-					nck(sama7g5_gck));
++					nck(sama7g5_gck), 8);
+ 	if (!sama7g5_pmc)
+ 		return;
+ 
+@@ -980,6 +980,8 @@ static void __init sama7g5_pmc_setup(struct device_node *np)
+ 						    sama7g5_prog_mux_table);
+ 		if (IS_ERR(hw))
+ 			goto err_free;
++
++		sama7g5_pmc->pchws[i] = hw;
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(sama7g5_systemck); i++) {
+@@ -1052,7 +1054,7 @@ err_free:
+ 		kfree(alloc_mem);
+ 	}
+ 
+-	pmc_data_free(sama7g5_pmc);
++	kfree(sama7g5_pmc);
+ }
+ 
+ /* Some clks are used for a clocksource */
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-bcm-dvp-add-module_device_table.patch b/queue-5.10/clk-bcm-dvp-add-module_device_table.patch
new file mode 100644
index 00000000000..2f427d81c58
--- /dev/null
+++ b/queue-5.10/clk-bcm-dvp-add-module_device_table.patch
@@ -0,0 +1,38 @@
+From 804c2970f8f5b569113c5b3ece6cf78e1a871802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:35:18 +0100
+Subject: clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit be439cc4c404f646a8ba090fa786d53c10926b12 ]
+
+Add MODULE_DEVICE_TABLE() so as to be able to use the driver as a
+module. More precisely, for the driver to be loaded automatically at
+boot.
+
+Fixes: 1bc95972715a ("clk: bcm: Add BCM2711 DVP driver")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20201202103518.21889-1-nsaenzjulienne@suse.de
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/bcm/clk-bcm2711-dvp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/bcm/clk-bcm2711-dvp.c b/drivers/clk/bcm/clk-bcm2711-dvp.c
+index 8333e20dc9d22..69e2f85f7029d 100644
+--- a/drivers/clk/bcm/clk-bcm2711-dvp.c
++++ b/drivers/clk/bcm/clk-bcm2711-dvp.c
+@@ -108,6 +108,7 @@ static const struct of_device_id clk_dvp_dt_ids[] = {
+ 	{ .compatible = "brcm,brcm2711-dvp", },
+ 	{ /* sentinel */ }
+ };
++MODULE_DEVICE_TABLE(of, clk_dvp_dt_ids);
+ 
+ static struct platform_driver clk_dvp_driver = {
+ 	.probe	= clk_dvp_probe,
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-fsl-sai-fix-memory-leak.patch b/queue-5.10/clk-fsl-sai-fix-memory-leak.patch
new file mode 100644
index 00000000000..54b9d5f7f6a
--- /dev/null
+++ b/queue-5.10/clk-fsl-sai-fix-memory-leak.patch
@@ -0,0 +1,57 @@
+From b0bf1cdd6f1bd686f2916fddfbf1e5f1e9d2774e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 20:27:44 +0100
+Subject: clk: fsl-sai: fix memory leak
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit e81bed419f032824e7ddf8b5630153be6637e480 ]
+
+If the device is removed we don't unregister the composite clock. Fix
+that.
+
+Fixes: 9cd10205227c ("clk: fsl-sai: new driver")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20201105192746.19564-2-michael@walle.cc
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-fsl-sai.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/clk/clk-fsl-sai.c b/drivers/clk/clk-fsl-sai.c
+index 0221180a4dd73..1e81c8d8a6fd3 100644
+--- a/drivers/clk/clk-fsl-sai.c
++++ b/drivers/clk/clk-fsl-sai.c
+@@ -68,9 +68,20 @@ static int fsl_sai_clk_probe(struct platform_device *pdev)
+ 	if (IS_ERR(hw))
+ 		return PTR_ERR(hw);
+ 
++	platform_set_drvdata(pdev, hw);
++
+ 	return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw);
+ }
+ 
++static int fsl_sai_clk_remove(struct platform_device *pdev)
++{
++	struct clk_hw *hw = platform_get_drvdata(pdev);
++
++	clk_hw_unregister_composite(hw);
++
++	return 0;
++}
++
+ static const struct of_device_id of_fsl_sai_clk_ids[] = {
+ 	{ .compatible = "fsl,vf610-sai-clock" },
+ 	{ }
+@@ -79,6 +90,7 @@ MODULE_DEVICE_TABLE(of, of_fsl_sai_clk_ids);
+ 
+ static struct platform_driver fsl_sai_clk_driver = {
+ 	.probe = fsl_sai_clk_probe,
++	.remove = fsl_sai_clk_remove,
+ 	.driver		= {
+ 		.name	= "fsl-sai-clk",
+ 		.of_match_table = of_fsl_sai_clk_ids,
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-meson-kconfig-fix-dependency-for-g12a.patch b/queue-5.10/clk-meson-kconfig-fix-dependency-for-g12a.patch
new file mode 100644
index 00000000000..b451c7b97eb
--- /dev/null
+++ b/queue-5.10/clk-meson-kconfig-fix-dependency-for-g12a.patch
@@ -0,0 +1,38 @@
+From 9910865ad7f61f71ea30ac559d45767981a8428d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 11:09:30 -0800
+Subject: clk: meson: Kconfig: fix dependency for G12A
+
+From: Kevin Hilman <khilman@baylibre.com>
+
+[ Upstream commit bae69bfa3a586493469078ec4ca35499b754ba5c ]
+
+When building only G12A, ensure that VID_PLL_DIV clock driver is
+selected, otherwise results in this build error:
+
+ERROR: modpost: "meson_vid_pll_div_ro_ops" [drivers/clk/meson/g12a.ko] undefined!
+
+Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller")
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201118190930.34352-1-khilman@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
+index 034da203e8e0e..9a8a548d839d8 100644
+--- a/drivers/clk/meson/Kconfig
++++ b/drivers/clk/meson/Kconfig
+@@ -110,6 +110,7 @@ config COMMON_CLK_G12A
+ 	select COMMON_CLK_MESON_AO_CLKC
+ 	select COMMON_CLK_MESON_EE_CLKC
+ 	select COMMON_CLK_MESON_CPU_DYNDIV
++	select COMMON_CLK_MESON_VID_PLL_DIV
+ 	select MFD_SYSCON
+ 	help
+ 	  Support for the clock controller on Amlogic S905D2, S905X2 and S905Y2
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-sdcc-clks.patch b/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-sdcc-clks.patch
new file mode 100644
index 00000000000..d507f6db822
--- /dev/null
+++ b/queue-5.10/clk-qcom-gcc-sc7180-use-floor-ops-for-sdcc-clks.patch
@@ -0,0 +1,54 @@
+From 94dcf03c33a59d618af0bdf2348a429311fdc634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 10:22:38 -0800
+Subject: clk: qcom: gcc-sc7180: Use floor ops for sdcc clks
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6d37a8d192830267e6b10a6d57ae28d2e89097e7 ]
+
+I would repeat the same commit message that was in commit 5e4b7e82d497
+("clk: qcom: gcc-sdm845: Use floor ops for sdcc clks") but it seems
+silly to do so when you could just go read that commit.
+
+NOTE: this is actually extra terrible because we're missing the 50 MHz
+rate in the table (see the next patch AKA ("clk: qcom: gcc-sc7180: Add
+50 MHz clock rate for SDC2")).  That means then when you run an older
+SD card it'll try to clock it at 100 MHz when it's only specced to run
+at 50 MHz max.  As you can probably guess that doesn't work super
+well.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Fixes: 17269568f726 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180")
+Link: https://lore.kernel.org/r/20201210102234.1.I096779f219625148900fc984dd0084ed1ba87c7f@changeid
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sc7180.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
+index 68d8f7aaf64e1..b080739ab0c33 100644
+--- a/drivers/clk/qcom/gcc-sc7180.c
++++ b/drivers/clk/qcom/gcc-sc7180.c
+@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+ 		.name = "gcc_sdcc1_ice_core_clk_src",
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = 4,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+@@ -666,7 +666,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ 		.name = "gcc_sdcc2_apps_clk_src",
+ 		.parent_data = gcc_parent_data_5,
+ 		.num_parents = 5,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-renesas-r8a779a0-fix-r-and-osc-clocks.patch b/queue-5.10/clk-renesas-r8a779a0-fix-r-and-osc-clocks.patch
new file mode 100644
index 00000000000..c5c8b4c3a97
--- /dev/null
+++ b/queue-5.10/clk-renesas-r8a779a0-fix-r-and-osc-clocks.patch
@@ -0,0 +1,71 @@
+From 75b8de703dc94655e4c01fba84da623359188ccc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 16:26:14 +0100
+Subject: clk: renesas: r8a779a0: Fix R and OSC clocks
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 14653942de7f63e21ece32e3901f09a248598a43 ]
+
+The R-Car V3U clock driver defines the R and OSC clocks using R-Car Gen3
+clock types.  However, The R-Car V3U clock driver does not use the R-Car
+Gen3 clock driver core, hence registering the R and OSC clocks fails:
+
+    renesas-cpg-mssr e6150000.clock-controller: Failed to register core clock osc: -22
+    renesas-cpg-mssr e6150000.clock-controller: Failed to register core clock r: -22
+
+Fix this by introducing clock definition macros specific to R-Car V3U.
+Note that rcar_r8a779a0_cpg_clk_register() already handled the related
+clock types.  Drop the now unneeded include of rcar-gen3-cpg.h.
+
+Fixes: 17bcc8035d2d19fc ("clk: renesas: cpg-mssr: Add support for R-Car V3U")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20201109152614.2465483-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779a0-cpg-mssr.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/renesas/r8a779a0-cpg-mssr.c b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+index 17ebbac7ddfb4..046d79416b7d0 100644
+--- a/drivers/clk/renesas/r8a779a0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+@@ -26,7 +26,6 @@
+ #include <dt-bindings/clock/r8a779a0-cpg-mssr.h>
+ 
+ #include "renesas-cpg-mssr.h"
+-#include "rcar-gen3-cpg.h"
+ 
+ enum rcar_r8a779a0_clk_types {
+ 	CLK_TYPE_R8A779A0_MAIN = CLK_TYPE_CUSTOM,
+@@ -84,6 +83,14 @@ enum clk_ids {
+ 	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_PLL2X_3X, CLK_MAIN, \
+ 		 .offset = _offset)
+ 
++#define DEF_MDSEL(_name, _id, _md, _parent0, _div0, _parent1, _div1) \
++	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_MDSEL,	\
++		 (_parent0) << 16 | (_parent1),		\
++		 .div = (_div0) << 16 | (_div1), .offset = _md)
++
++#define DEF_OSC(_name, _id, _parent, _div)		\
++	DEF_BASE(_name, _id, CLK_TYPE_R8A779A0_OSC, _parent, .div = _div)
++
+ static const struct cpg_core_clk r8a779a0_core_clks[] __initconst = {
+ 	/* External Clock Inputs */
+ 	DEF_INPUT("extal",  CLK_EXTAL),
+@@ -136,8 +143,8 @@ static const struct cpg_core_clk r8a779a0_core_clks[] __initconst = {
+ 	DEF_DIV6P1("canfd",	R8A779A0_CLK_CANFD,	CLK_PLL5_DIV4,	0x878),
+ 	DEF_DIV6P1("csi0",	R8A779A0_CLK_CSI0,	CLK_PLL5_DIV4,	0x880),
+ 
+-	DEF_GEN3_OSC("osc",	R8A779A0_CLK_OSC,	CLK_EXTAL,	8),
+-	DEF_GEN3_MDSEL("r",	R8A779A0_CLK_R, 29, CLK_EXTALR, 1, CLK_OCO, 1),
++	DEF_OSC("osc",		R8A779A0_CLK_OSC,	CLK_EXTAL,	8),
++	DEF_MDSEL("r",		R8A779A0_CLK_R, 29, CLK_EXTALR, 1, CLK_OCO, 1),
+ };
+ 
+ static const struct mssr_mod_clk r8a779a0_mod_clks[] __initconst = {
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch b/queue-5.10/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch
new file mode 100644
index 00000000000..77e88277209
--- /dev/null
+++ b/queue-5.10/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch
@@ -0,0 +1,41 @@
+From c11ed3b30be9406e14b9fff5749392ba47ecfa43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 13:28:18 +0100
+Subject: clk: s2mps11: Fix a resource leak in error handling paths in the
+ probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]
+
+Some resource should be released in the error handling path of the probe
+function, as already done in the remove function.
+
+The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
+missing of_node_put and of_clk_del_provider")
+
+Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-s2mps11.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index aa21371f9104c..a3e883a9f4067 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -195,6 +195,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
+ 	return ret;
+ 
+ err_reg:
++	of_node_put(s2mps11_clks[0].clk_np);
+ 	while (--i >= 0)
+ 		clkdev_drop(s2mps11_clks[i].lookup);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch b/queue-5.10/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch
new file mode 100644
index 00000000000..dc93db1bf93
--- /dev/null
+++ b/queue-5.10/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch
@@ -0,0 +1,54 @@
+From d28f0e149cc930687bad1f92ec1877214fccf955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 21:38:17 +0100
+Subject: clk: sunxi-ng: Make sure divider tables have sentinel
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]
+
+Two clock divider tables are missing sentinel at the end. Effect of that
+is that clock framework reads past the last entry. Fix that with adding
+sentinel at the end.
+
+Issue was discovered with KASan.
+
+Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
+ drivers/clk/sunxi-ng/ccu-sun8i-h3.c   | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 5f66bf8797723..149cfde817cba 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -389,6 +389,7 @@ static struct clk_div_table ths_div_table[] = {
+ 	{ .val = 1, .div = 2 },
+ 	{ .val = 2, .div = 4 },
+ 	{ .val = 3, .div = 6 },
++	{ /* Sentinel */ },
+ };
+ static const char * const ths_parents[] = { "osc24M" };
+ static struct ccu_div ths_clk = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 6b636362379ee..7e629a4493afd 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -322,6 +322,7 @@ static struct clk_div_table ths_div_table[] = {
+ 	{ .val = 1, .div = 2 },
+ 	{ .val = 2, .div = 4 },
+ 	{ .val = 3, .div = 6 },
++	{ /* Sentinel */ },
+ };
+ static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
+ 				     0x074, 0, 2, ths_div_table, BIT(31), 0);
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-tegra-fix-duplicated-se-clock-entry.patch b/queue-5.10/clk-tegra-fix-duplicated-se-clock-entry.patch
new file mode 100644
index 00000000000..fdb5080a93b
--- /dev/null
+++ b/queue-5.10/clk-tegra-fix-duplicated-se-clock-entry.patch
@@ -0,0 +1,55 @@
+From 969cdb4722a5a965e40b63bd5726b4bcc503c39c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 01:42:12 +0300
+Subject: clk: tegra: Fix duplicated SE clock entry
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]
+
+The periph_clks[] array contains duplicated entry for Security Engine
+clock which was meant to be defined for T210, but it wasn't added
+properly. This patch corrects the T210 SE entry and fixes the following
+error message on T114/T124: "Tegra clk 127: register failed with -17".
+
+Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210")
+Tested-by Nicolas Chauvet <kwizart@gmail.com>
+Reported-by Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-id.h           | 1 +
+ drivers/clk/tegra/clk-tegra-periph.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
+index ff7da2d3e94d8..24413812ec5b6 100644
+--- a/drivers/clk/tegra/clk-id.h
++++ b/drivers/clk/tegra/clk-id.h
+@@ -227,6 +227,7 @@ enum clk_id {
+ 	tegra_clk_sdmmc4,
+ 	tegra_clk_sdmmc4_8,
+ 	tegra_clk_se,
++	tegra_clk_se_10,
+ 	tegra_clk_soc_therm,
+ 	tegra_clk_soc_therm_8,
+ 	tegra_clk_sor0,
+diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
+index 2b2a3b81c16ba..60cc34f90cb9b 100644
+--- a/drivers/clk/tegra/clk-tegra-periph.c
++++ b/drivers/clk/tegra/clk-tegra-periph.c
+@@ -630,7 +630,7 @@ static struct tegra_periph_init_data periph_clks[] = {
+ 	INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
+ 	INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
+ 	INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+-	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
++	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
+ 	INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
+ 	INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
+ 	INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch b/queue-5.10/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch
new file mode 100644
index 00000000000..84da5d2fd97
--- /dev/null
+++ b/queue-5.10/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch
@@ -0,0 +1,60 @@
+From f3974783c891b364e3a9d4de31af15df8fa8b577 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:16:23 +0800
+Subject: clk: ti: Fix memleak in ti_fapll_synth_setup
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]
+
+If clk_register fails, we should goto free branch
+before function returns to prevent memleak.
+
+Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/fapll.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
+index 95e36ba64accf..8024c6d2b9e95 100644
+--- a/drivers/clk/ti/fapll.c
++++ b/drivers/clk/ti/fapll.c
+@@ -498,6 +498,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ {
+ 	struct clk_init_data *init;
+ 	struct fapll_synth *synth;
++	struct clk *clk = ERR_PTR(-ENOMEM);
+ 
+ 	init = kzalloc(sizeof(*init), GFP_KERNEL);
+ 	if (!init)
+@@ -520,13 +521,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ 	synth->hw.init = init;
+ 	synth->clk_pll = pll_clk;
+ 
+-	return clk_register(NULL, &synth->hw);
++	clk = clk_register(NULL, &synth->hw);
++	if (IS_ERR(clk)) {
++		pr_err("failed to register clock\n");
++		goto free;
++	}
++
++	return clk;
+ 
+ free:
+ 	kfree(synth);
+ 	kfree(init);
+ 
+-	return ERR_PTR(-ENOMEM);
++	return clk;
+ }
+ 
+ static void __init ti_fapll_setup(struct device_node *node)
+-- 
+2.27.0
+
diff --git a/queue-5.10/clk-vc5-use-idt-voltage-microvolt-instead-of-idt-vol.patch b/queue-5.10/clk-vc5-use-idt-voltage-microvolt-instead-of-idt-vol.patch
new file mode 100644
index 00000000000..f005e182049
--- /dev/null
+++ b/queue-5.10/clk-vc5-use-idt-voltage-microvolt-instead-of-idt-vol.patch
@@ -0,0 +1,47 @@
+From 122901d107482a682799d793d9023ed6f27e01e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 13:52:53 +0100
+Subject: clk: vc5: Use "idt,voltage-microvolt" instead of
+ "idt,voltage-microvolts"
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4b003f5fcadfa2d0e087e907b0c65d023f6e29fb ]
+
+Commit 45c940184b501fc6 ("dt-bindings: clk: versaclock5: convert to
+yaml") accidentally changed "idt,voltage-microvolts" to
+"idt,voltage-microvolt" in the DT bindings, while the driver still used
+the former.
+
+Update the driver to match the bindings, as
+Documentation/devicetree/bindings/property-units.txt actually recommends
+using "microvolt".
+
+Fixes: 260249f929e81d3d ("clk: vc5: Enable addition output configurations of the Versaclock")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20201218125253.3815567-1-geert+renesas@glider.be
+Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock5.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index c90460e7ef215..43db67337bc06 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -739,8 +739,8 @@ static int vc5_update_power(struct device_node *np_output,
+ {
+ 	u32 value;
+ 
+-	if (!of_property_read_u32(np_output,
+-				  "idt,voltage-microvolts", &value)) {
++	if (!of_property_read_u32(np_output, "idt,voltage-microvolt",
++				  &value)) {
+ 		clk_out->clk_output_cfg0_mask |= VC5_CLK_OUTPUT_CFG0_PWR_MASK;
+ 		switch (value) {
+ 		case 1800000:
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch b/queue-5.10/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch
new file mode 100644
index 00000000000..18987aab88d
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch
@@ -0,0 +1,70 @@
+From f6e22c46f19af5cb09dcd1c440d0a737e5c7594e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 15:31:26 +0800
+Subject: clocksource/drivers/arm_arch_timer: Correct fault programming of
+ CNTKCTL_EL1.EVNTI
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]
+
+ARM virtual counter supports event stream, it can only trigger an event
+when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
+so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
+when the trigger bit is 0, then virtual counter trigger an event for every
+two cycles.
+
+While we're at it, rework the way we compute the trigger bit position
+by making it more obvious that when bits [n:n-1] are both set (with n
+being the most significant bit), we pick bit (n + 1).
+
+Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 777d38cb39b09..d0177824c518b 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -822,15 +822,24 @@ static void arch_timer_evtstrm_enable(int divider)
+ 
+ static void arch_timer_configure_evtstream(void)
+ {
+-	int evt_stream_div, pos;
++	int evt_stream_div, lsb;
++
++	/*
++	 * As the event stream can at most be generated at half the frequency
++	 * of the counter, use half the frequency when computing the divider.
++	 */
++	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
++
++	/*
++	 * Find the closest power of two to the divisor. If the adjacent bit
++	 * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
++	 */
++	lsb = fls(evt_stream_div) - 1;
++	if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
++		lsb++;
+ 
+-	/* Find the closest power of two to the divisor */
+-	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
+-	pos = fls(evt_stream_div);
+-	if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
+-		pos--;
+ 	/* enable event stream */
+-	arch_timer_evtstrm_enable(min(pos, 15));
++	arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
+ }
+ 
+ static void arch_counter_set_user_access(void)
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-arm_arch_timer-use-stable-count-.patch b/queue-5.10/clocksource-drivers-arm_arch_timer-use-stable-count-.patch
new file mode 100644
index 00000000000..7b4542624b9
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-arm_arch_timer-use-stable-count-.patch
@@ -0,0 +1,47 @@
+From cd864b25749d7ee4ad6b1f0f97d7fe9b158fb1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 15:31:25 +0800
+Subject: clocksource/drivers/arm_arch_timer: Use stable count reader in
+ erratum sne
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit d8cc3905b8073c7cfbff94af889fa8dc71f21dd5 ]
+
+In commit 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter
+to access stable counters"), we separate stable and normal count reader to omit
+unnecessary overhead on systems that have no timer erratum.
+
+However, in erratum_set_next_event_tval_generic(), count reader becomes normal
+reader. This converts it to stable reader.
+
+Fixes: 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter to access stable counters")
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201204073126.6920-2-zhukeqian1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/arm_arch_timer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 6c3e841801461..777d38cb39b09 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -396,10 +396,10 @@ static void erratum_set_next_event_tval_generic(const int access, unsigned long
+ 	ctrl &= ~ARCH_TIMER_CTRL_IT_MASK;
+ 
+ 	if (access == ARCH_TIMER_PHYS_ACCESS) {
+-		cval = evt + arch_counter_get_cntpct();
++		cval = evt + arch_counter_get_cntpct_stable();
+ 		write_sysreg(cval, cntp_cval_el0);
+ 	} else {
+-		cval = evt + arch_counter_get_cntvct();
++		cval = evt + arch_counter_get_cntvct_stable();
+ 		write_sysreg(cval, cntv_cval_el0);
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch b/queue-5.10/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch
new file mode 100644
index 00000000000..22456fda911
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch
@@ -0,0 +1,74 @@
+From 040c875b89abbc6033e3fc98f939c83f54358fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 21:51:23 +0800
+Subject: clocksource/drivers/cadence_ttc: Fix memory leak in
+ ttc_setup_clockevent()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]
+
+If clk_notifier_register() failed, ttc_setup_clockevent() will return
+without freeing 'ttcce', which will leak memory.
+
+Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-cadence-ttc.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
+index 80e9606020307..4efd0cf3b602d 100644
+--- a/drivers/clocksource/timer-cadence-ttc.c
++++ b/drivers/clocksource/timer-cadence-ttc.c
+@@ -413,10 +413,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ 	ttcce->ttc.clk = clk;
+ 
+ 	err = clk_prepare_enable(ttcce->ttc.clk);
+-	if (err) {
+-		kfree(ttcce);
+-		return err;
+-	}
++	if (err)
++		goto out_kfree;
+ 
+ 	ttcce->ttc.clk_rate_change_nb.notifier_call =
+ 		ttc_rate_change_clockevent_cb;
+@@ -426,7 +424,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ 				    &ttcce->ttc.clk_rate_change_nb);
+ 	if (err) {
+ 		pr_warn("Unable to register clock notifier.\n");
+-		return err;
++		goto out_kfree;
+ 	}
+ 
+ 	ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
+@@ -455,15 +453,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ 
+ 	err = request_irq(irq, ttc_clock_event_interrupt,
+ 			  IRQF_TIMER, ttcce->ce.name, ttcce);
+-	if (err) {
+-		kfree(ttcce);
+-		return err;
+-	}
++	if (err)
++		goto out_kfree;
+ 
+ 	clockevents_config_and_register(&ttcce->ce,
+ 			ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
+ 
+ 	return 0;
++
++out_kfree:
++	kfree(ttcce);
++	return err;
+ }
+ 
+ static int __init ttc_timer_probe(struct platform_device *pdev)
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-ingenic-fix-section-mismatch.patch b/queue-5.10/clocksource-drivers-ingenic-fix-section-mismatch.patch
new file mode 100644
index 00000000000..63723377f08
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-ingenic-fix-section-mismatch.patch
@@ -0,0 +1,47 @@
+From 14456e337eaa2783d31b4b5c04bbc817a2ccb40f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 11:23:45 +0100
+Subject: clocksource/drivers/ingenic: Fix section mismatch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 5bd7cb29eceb52e4b108917786fdbf2a2c2048ef ]
+
+The function ingenic_tcu_get_clock() is annotated for the __init
+section but it is actually called from the online cpu callback.
+
+That will lead to a crash if a CPU is hotplugged after boot time.
+
+Remove the __init annotation for the ingenic_tcu_get_clock()
+function.
+
+Fixes: f19d838d08fc (clocksource/drivers/ingenic: Add high resolution timer support for SMP/SMT)
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
+Link: https://lore.kernel.org/r/20201125102346.1816310-1-daniel.lezcano@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/ingenic-timer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/ingenic-timer.c b/drivers/clocksource/ingenic-timer.c
+index 58fd9189fab7f..905fd6b163a81 100644
+--- a/drivers/clocksource/ingenic-timer.c
++++ b/drivers/clocksource/ingenic-timer.c
+@@ -127,7 +127,7 @@ static irqreturn_t ingenic_tcu_cevt_cb(int irq, void *dev_id)
+ 	return IRQ_HANDLED;
+ }
+ 
+-static struct clk * __init ingenic_tcu_get_clock(struct device_node *np, int id)
++static struct clk *ingenic_tcu_get_clock(struct device_node *np, int id)
+ {
+ 	struct of_phandle_args args;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-orion-add-missing-clk_disable_un.patch b/queue-5.10/clocksource-drivers-orion-add-missing-clk_disable_un.patch
new file mode 100644
index 00000000000..f2285ab1b13
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-orion-add-missing-clk_disable_un.patch
@@ -0,0 +1,68 @@
+From 564da5b69e7a2174e18a36153b66f60673b303b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 14:47:06 +0800
+Subject: clocksource/drivers/orion: Add missing clk_disable_unprepare() on
+ error path
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit c1e6cad00aa2f17845e7270e38ff3cc82c7b022a ]
+
+After calling clk_prepare_enable(), clk_disable_unprepare() need
+be called on error path.
+
+Fixes: fbe4b3566ddc ("clocksource/drivers/orion: Convert init function...")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201111064706.3397156-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-orion.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clocksource/timer-orion.c b/drivers/clocksource/timer-orion.c
+index d01ff41818676..5101e834d78ff 100644
+--- a/drivers/clocksource/timer-orion.c
++++ b/drivers/clocksource/timer-orion.c
+@@ -143,7 +143,8 @@ static int __init orion_timer_init(struct device_node *np)
+ 	irq = irq_of_parse_and_map(np, 1);
+ 	if (irq <= 0) {
+ 		pr_err("%pOFn: unable to parse timer1 irq\n", np);
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto out_unprep_clk;
+ 	}
+ 
+ 	rate = clk_get_rate(clk);
+@@ -160,7 +161,7 @@ static int __init orion_timer_init(struct device_node *np)
+ 				    clocksource_mmio_readl_down);
+ 	if (ret) {
+ 		pr_err("Failed to initialize mmio timer\n");
+-		return ret;
++		goto out_unprep_clk;
+ 	}
+ 
+ 	sched_clock_register(orion_read_sched_clock, 32, rate);
+@@ -170,7 +171,7 @@ static int __init orion_timer_init(struct device_node *np)
+ 			  "orion_event", NULL);
+ 	if (ret) {
+ 		pr_err("%pOFn: unable to setup irq\n", np);
+-		return ret;
++		goto out_unprep_clk;
+ 	}
+ 
+ 	ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ;
+@@ -183,5 +184,9 @@ static int __init orion_timer_init(struct device_node *np)
+ 	orion_delay_timer_init(rate);
+ 
+ 	return 0;
++
++out_unprep_clk:
++	clk_disable_unprepare(clk);
++	return ret;
+ }
+ TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init);
+-- 
+2.27.0
+
diff --git a/queue-5.10/clocksource-drivers-riscv-make-riscv_timer-depends-o.patch b/queue-5.10/clocksource-drivers-riscv-make-riscv_timer-depends-o.patch
new file mode 100644
index 00000000000..fdb311b89fc
--- /dev/null
+++ b/queue-5.10/clocksource-drivers-riscv-make-riscv_timer-depends-o.patch
@@ -0,0 +1,39 @@
+From 7773d2e77dd889450fe3749690d4e2c6a7561e1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 21:12:30 +0800
+Subject: clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+[ Upstream commit ab3105446f1ec4e98fadfc998ee24feec271c16c ]
+
+The riscv timer is set via SBI timer call, let's make RISCV_TIMER
+depends on RISCV_SBI, and it also fixes some build issue.
+
+Fixes: d5be89a8d118 ("RISC-V: Resurrect the MMIO timer implementation for M-mode systems")
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Acked-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201028131230.72907-1-wangkefeng.wang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 68b087bff59cc..2be849bb794ac 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -654,7 +654,7 @@ config ATCPIT100_TIMER
+ 
+ config RISCV_TIMER
+ 	bool "Timer for the RISC-V platform" if COMPILE_TEST
+-	depends on GENERIC_SCHED_CLOCK && RISCV
++	depends on GENERIC_SCHED_CLOCK && RISCV && RISCV_SBI
+ 	select TIMER_PROBE
+ 	select TIMER_OF
+ 	help
+-- 
+2.27.0
+
diff --git a/queue-5.10/coresight-remove-broken-__exit-annotations.patch b/queue-5.10/coresight-remove-broken-__exit-annotations.patch
new file mode 100644
index 00000000000..ee954d81b7a
--- /dev/null
+++ b/queue-5.10/coresight-remove-broken-__exit-annotations.patch
@@ -0,0 +1,231 @@
+From 6b4fb1fb32bc2f1f5b1ccca3c9e0cddc924eb233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 11:26:50 -0700
+Subject: coresight: remove broken __exit annotations
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 45fe7befe0db5e61cd3c846315f0ac48541e8445 ]
+
+Functions that are annotated __exit are discarded for built-in drivers,
+but the .remove callback in a device driver must still be kept around
+to allow bind/unbind operations.
+
+There is now a linker warning for the discarded symbol references:
+
+`tmc_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-tmc-core.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-tmc-core.o
+`tpiu_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-tpiu.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-tpiu.o
+`etb_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-etb10.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-etb10.o
+`static_funnel_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-funnel.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-funnel.o
+`dynamic_funnel_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-funnel.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-funnel.o
+`static_replicator_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-replicator.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-replicator.o
+`dynamic_replicator_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-replicator.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-replicator.o
+`catu_remove' referenced in section `.data' of drivers/hwtracing/coresight/coresight-catu.o: defined in discarded section `.exit.text' of drivers/hwtracing/coresight/coresight-catu.o
+
+Remove all those annotations.
+
+Fixes: 8b0cf82677d1 ("coresight: stm: Allow to build coresight-stm as a module")
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20201208182651.1597945-3-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c       | 2 +-
+ drivers/hwtracing/coresight/coresight-cti-core.c   | 2 +-
+ drivers/hwtracing/coresight/coresight-etb10.c      | 2 +-
+ drivers/hwtracing/coresight/coresight-etm3x-core.c | 4 ++--
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 ++--
+ drivers/hwtracing/coresight/coresight-funnel.c     | 6 +++---
+ drivers/hwtracing/coresight/coresight-replicator.c | 6 +++---
+ drivers/hwtracing/coresight/coresight-stm.c        | 2 +-
+ drivers/hwtracing/coresight/coresight-tmc-core.c   | 2 +-
+ drivers/hwtracing/coresight/coresight-tpiu.c       | 2 +-
+ 10 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index 99430f6cf5a5d..a61313f320bda 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -567,7 +567,7 @@ out:
+ 	return ret;
+ }
+ 
+-static int __exit catu_remove(struct amba_device *adev)
++static int catu_remove(struct amba_device *adev)
+ {
+ 	struct catu_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
+index d28eae93e55c8..61dbc1afd8da5 100644
+--- a/drivers/hwtracing/coresight/coresight-cti-core.c
++++ b/drivers/hwtracing/coresight/coresight-cti-core.c
+@@ -836,7 +836,7 @@ static void cti_device_release(struct device *dev)
+ 	if (drvdata->csdev_release)
+ 		drvdata->csdev_release(dev);
+ }
+-static int __exit cti_remove(struct amba_device *adev)
++static int cti_remove(struct amba_device *adev)
+ {
+ 	struct cti_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index 1b320ab581caf..0cf6f0b947b6f 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -803,7 +803,7 @@ err_misc_register:
+ 	return ret;
+ }
+ 
+-static int __exit etb_remove(struct amba_device *adev)
++static int etb_remove(struct amba_device *adev)
+ {
+ 	struct etb_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+index 47f610b1c2b18..5bf5a5a4ce6d1 100644
+--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+@@ -902,14 +902,14 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
+ 	return 0;
+ }
+ 
+-static void __exit clear_etmdrvdata(void *info)
++static void clear_etmdrvdata(void *info)
+ {
+ 	int cpu = *(int *)info;
+ 
+ 	etmdrvdata[cpu] = NULL;
+ }
+ 
+-static int __exit etm_remove(struct amba_device *adev)
++static int etm_remove(struct amba_device *adev)
+ {
+ 	struct etm_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index e516e5b879e3a..95b54b0a36252 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -1570,14 +1570,14 @@ static struct amba_cs_uci_id uci_id_etm4[] = {
+ 	}
+ };
+ 
+-static void __exit clear_etmdrvdata(void *info)
++static void clear_etmdrvdata(void *info)
+ {
+ 	int cpu = *(int *)info;
+ 
+ 	etmdrvdata[cpu] = NULL;
+ }
+ 
+-static int __exit etm4_remove(struct amba_device *adev)
++static int etm4_remove(struct amba_device *adev)
+ {
+ 	struct etmv4_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
+index af40814ce5603..3fc6c678b51d8 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -274,7 +274,7 @@ out_disable_clk:
+ 	return ret;
+ }
+ 
+-static int __exit funnel_remove(struct device *dev)
++static int funnel_remove(struct device *dev)
+ {
+ 	struct funnel_drvdata *drvdata = dev_get_drvdata(dev);
+ 
+@@ -328,7 +328,7 @@ static int static_funnel_probe(struct platform_device *pdev)
+ 	return ret;
+ }
+ 
+-static int __exit static_funnel_remove(struct platform_device *pdev)
++static int static_funnel_remove(struct platform_device *pdev)
+ {
+ 	funnel_remove(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
+@@ -370,7 +370,7 @@ static int dynamic_funnel_probe(struct amba_device *adev,
+ 	return funnel_probe(&adev->dev, &adev->res);
+ }
+ 
+-static int __exit dynamic_funnel_remove(struct amba_device *adev)
++static int dynamic_funnel_remove(struct amba_device *adev)
+ {
+ 	return funnel_remove(&adev->dev);
+ }
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
+index 62afdde0e5eab..38008aca2c0f4 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -291,7 +291,7 @@ out_disable_clk:
+ 	return ret;
+ }
+ 
+-static int __exit replicator_remove(struct device *dev)
++static int replicator_remove(struct device *dev)
+ {
+ 	struct replicator_drvdata *drvdata = dev_get_drvdata(dev);
+ 
+@@ -318,7 +318,7 @@ static int static_replicator_probe(struct platform_device *pdev)
+ 	return ret;
+ }
+ 
+-static int __exit static_replicator_remove(struct platform_device *pdev)
++static int static_replicator_remove(struct platform_device *pdev)
+ {
+ 	replicator_remove(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
+@@ -388,7 +388,7 @@ static int dynamic_replicator_probe(struct amba_device *adev,
+ 	return replicator_probe(&adev->dev, &adev->res);
+ }
+ 
+-static int __exit dynamic_replicator_remove(struct amba_device *adev)
++static int dynamic_replicator_remove(struct amba_device *adev)
+ {
+ 	return replicator_remove(&adev->dev);
+ }
+diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
+index b0ad912651a99..587c1d7f25208 100644
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -951,7 +951,7 @@ stm_unregister:
+ 	return ret;
+ }
+ 
+-static int __exit stm_remove(struct amba_device *adev)
++static int stm_remove(struct amba_device *adev)
+ {
+ 	struct stm_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 5653e0945c74b..8169dff5a9f6a 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -559,7 +559,7 @@ out:
+ 	spin_unlock_irqrestore(&drvdata->spinlock, flags);
+ }
+ 
+-static int __exit tmc_remove(struct amba_device *adev)
++static int tmc_remove(struct amba_device *adev)
+ {
+ 	struct tmc_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index 566c57e035961..5b35029461a0c 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -173,7 +173,7 @@ static int tpiu_probe(struct amba_device *adev, const struct amba_id *id)
+ 	return PTR_ERR(drvdata->csdev);
+ }
+ 
+-static int __exit tpiu_remove(struct amba_device *adev)
++static int tpiu_remove(struct amba_device *adev)
+ {
+ 	struct tpiu_drvdata *drvdata = dev_get_drvdata(&adev->dev);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-ap806-add-missing-module_device_table.patch b/queue-5.10/cpufreq-ap806-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..fc5847cb7fe
--- /dev/null
+++ b/queue-5.10/cpufreq-ap806-add-missing-module_device_table.patch
@@ -0,0 +1,44 @@
+From 18fb3b3abdaf42224a715bfffb19ce7a496c455c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:31 +0100
+Subject: cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 925a5bcefe105f2790ecbdc252eb2315573f309d ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: f525a670533d9 ("cpufreq: ap806: add cpufreq driver for Armada 8K")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-8k-cpufreq.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c
+index 39e34f5066d3d..b0fc5e84f8570 100644
+--- a/drivers/cpufreq/armada-8k-cpufreq.c
++++ b/drivers/cpufreq/armada-8k-cpufreq.c
+@@ -204,6 +204,12 @@ static void __exit armada_8k_cpufreq_exit(void)
+ }
+ module_exit(armada_8k_cpufreq_exit);
+ 
++static const struct of_device_id __maybe_unused armada_8k_cpufreq_of_match[] = {
++	{ .compatible = "marvell,ap806-cpu-clock" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, armada_8k_cpufreq_of_match);
++
+ MODULE_AUTHOR("Gregory Clement <gregory.clement@bootlin.com>");
+ MODULE_DESCRIPTION("Armada 8K cpufreq driver");
+ MODULE_LICENSE("GPL");
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-highbank-add-missing-module_device_table.patch b/queue-5.10/cpufreq-highbank-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..56e80b66ffe
--- /dev/null
+++ b/queue-5.10/cpufreq-highbank-add-missing-module_device_table.patch
@@ -0,0 +1,45 @@
+From 59b63e72598a0c814558aa20e04d4413b9e761fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:32 +0100
+Subject: cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
+index 5a7f6dafcddb6..ac57cddc5f2fe 100644
+--- a/drivers/cpufreq/highbank-cpufreq.c
++++ b/drivers/cpufreq/highbank-cpufreq.c
+@@ -101,6 +101,13 @@ out_put_node:
+ }
+ module_init(hb_cpufreq_driver_init);
+ 
++static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
++	{ .compatible = "calxeda,highbank" },
++	{ .compatible = "calxeda,ecx-2000" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
++
+ MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
+ MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
+ MODULE_LICENSE("GPL");
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-imx-fix-nvmem_imx_ocotp-dependency.patch b/queue-5.10/cpufreq-imx-fix-nvmem_imx_ocotp-dependency.patch
new file mode 100644
index 00000000000..3c614f53713
--- /dev/null
+++ b/queue-5.10/cpufreq-imx-fix-nvmem_imx_ocotp-dependency.patch
@@ -0,0 +1,45 @@
+From c2b51de3463a1cbbf86e4a054ab48975bcd62baa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:53:32 +0100
+Subject: cpufreq: imx: fix NVMEM_IMX_OCOTP dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fc928b901dc68481ba3e524860a641fe13e25dfe ]
+
+A driver should not 'select' drivers from another subsystem.
+If NVMEM is disabled, this one results in a warning:
+
+WARNING: unmet direct dependencies detected for NVMEM_IMX_OCOTP
+  Depends on [n]: NVMEM [=n] && (ARCH_MXC [=y] || COMPILE_TEST [=y]) && HAS_IOMEM [=y]
+  Selected by [y]:
+  - ARM_IMX6Q_CPUFREQ [=y] && CPU_FREQ [=y] && (ARM || ARM64 [=y]) && ARCH_MXC [=y] && REGULATOR_ANATOP [=y]
+
+Change the 'select' to 'depends on' to prevent it from going wrong,
+and allow compile-testing without that driver, since it is only
+a runtime dependency.
+
+Fixes: 2782ef34ed23 ("cpufreq: imx: Select NVMEM_IMX_OCOTP")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/Kconfig.arm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
+index 015ec0c028358..1f73fa75b1a05 100644
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -94,7 +94,7 @@ config ARM_IMX6Q_CPUFREQ
+ 	tristate "Freescale i.MX6 cpufreq support"
+ 	depends on ARCH_MXC
+ 	depends on REGULATOR_ANATOP
+-	select NVMEM_IMX_OCOTP
++	depends on NVMEM_IMX_OCOTP || COMPILE_TEST
+ 	select PM_OPP
+ 	help
+ 	  This adds cpufreq driver support for Freescale i.MX6 series SoCs.
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-loongson1-add-missing-module_alias.patch b/queue-5.10/cpufreq-loongson1-add-missing-module_alias.patch
new file mode 100644
index 00000000000..9107cfed202
--- /dev/null
+++ b/queue-5.10/cpufreq-loongson1-add-missing-module_alias.patch
@@ -0,0 +1,38 @@
+From 4ebc0a234c53965ad20aa6f1fb9cc3510005702b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:37 +0100
+Subject: cpufreq: loongson1: Add missing MODULE_ALIAS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]
+
+This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
+driver when it is compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/loongson1-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
+index 0ea88778882ac..86f612593e497 100644
+--- a/drivers/cpufreq/loongson1-cpufreq.c
++++ b/drivers/cpufreq/loongson1-cpufreq.c
+@@ -216,6 +216,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
+ 
+ module_platform_driver(ls1x_cpufreq_platdrv);
+ 
++MODULE_ALIAS("platform:ls1x-cpufreq");
+ MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
+ MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
+ MODULE_LICENSE("GPL");
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-mediatek-add-missing-module_device_table.patch b/queue-5.10/cpufreq-mediatek-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..49033499b20
--- /dev/null
+++ b/queue-5.10/cpufreq-mediatek-add-missing-module_device_table.patch
@@ -0,0 +1,39 @@
+From 5edc20f9316573303acb226b04e57bc093fbf65d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:33 +0100
+Subject: cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index 7d1212c9b7c88..a310372dc53e9 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -540,6 +540,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+ 
+ 	{ }
+ };
++MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
+ 
+ static int __init mtk_cpufreq_driver_init(void)
+ {
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-qcom-add-missing-module_device_table.patch b/queue-5.10/cpufreq-qcom-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..930da8afcd7
--- /dev/null
+++ b/queue-5.10/cpufreq-qcom-add-missing-module_device_table.patch
@@ -0,0 +1,39 @@
+From 7a6b1132bc0f1452a126fabfa3d67f67ff4ac8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:34 +0100
+Subject: cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit a5a6031663bc1dd0a10babd49d1bcb3153a8327f ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 46e2856b8e188 ("cpufreq: Add Kryo CPU scaling driver")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/qcom-cpufreq-nvmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+index d06b37822c3df..fba9937a406b3 100644
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -464,6 +464,7 @@ static const struct of_device_id qcom_cpufreq_match_list[] __initconst = {
+ 	{ .compatible = "qcom,msm8960", .data = &match_data_krait },
+ 	{},
+ };
++MODULE_DEVICE_TABLE(of, qcom_cpufreq_match_list);
+ 
+ /*
+  * Since the driver depends on smem and nvmem drivers, which may
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-scpi-add-missing-module_alias.patch b/queue-5.10/cpufreq-scpi-add-missing-module_alias.patch
new file mode 100644
index 00000000000..857b07f417a
--- /dev/null
+++ b/queue-5.10/cpufreq-scpi-add-missing-module_alias.patch
@@ -0,0 +1,38 @@
+From 24e3e39c8009ead950efca61ac2729df9846a560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:38 +0100
+Subject: cpufreq: scpi: Add missing MODULE_ALIAS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]
+
+This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
+driver when it is compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scpi-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index 43db05b949d95..e5140ad63db83 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -233,6 +233,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
+ };
+ module_platform_driver(scpi_cpufreq_platdrv);
+ 
++MODULE_ALIAS("platform:scpi-cpufreq");
+ MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
+ MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
+ MODULE_LICENSE("GPL v2");
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-st-add-missing-module_device_table.patch b/queue-5.10/cpufreq-st-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..23a2978b141
--- /dev/null
+++ b/queue-5.10/cpufreq-st-add-missing-module_device_table.patch
@@ -0,0 +1,45 @@
+From 49ed3b2b8fe4b4d76a9aae5dfd54988ac6da20d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:35 +0100
+Subject: cpufreq: st: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/sti-cpufreq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
+index 4ac6fb23792a0..c40d3d7d4ea43 100644
+--- a/drivers/cpufreq/sti-cpufreq.c
++++ b/drivers/cpufreq/sti-cpufreq.c
+@@ -292,6 +292,13 @@ register_cpufreq_dt:
+ }
+ module_init(sti_cpufreq_init);
+ 
++static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
++	{ .compatible = "st,stih407" },
++	{ .compatible = "st,stih410" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
++
+ MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
+ MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
+ MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-sun50i-add-missing-module_device_table.patch b/queue-5.10/cpufreq-sun50i-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..9acef2acdaf
--- /dev/null
+++ b/queue-5.10/cpufreq-sun50i-add-missing-module_device_table.patch
@@ -0,0 +1,40 @@
+From 3fa59d24354866bee3d5cd22ba14e88e9ab8b026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:36 +0100
+Subject: cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit af2096f285077e3339eb835ad06c50bdd59f01b5 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: f328584f7bff8 ("cpufreq: Add sun50i nvmem based CPU scaling driver")
+Reviewed-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/sun50i-cpufreq-nvmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+index 9907a165135b7..2deed8d8773fa 100644
+--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c
++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+@@ -167,6 +167,7 @@ static const struct of_device_id sun50i_cpufreq_match_list[] = {
+ 	{ .compatible = "allwinner,sun50i-h6" },
+ 	{}
+ };
++MODULE_DEVICE_TABLE(of, sun50i_cpufreq_match_list);
+ 
+ static const struct of_device_id *sun50i_cpufreq_match_node(void)
+ {
+-- 
+2.27.0
+
diff --git a/queue-5.10/cpufreq-vexpress-spc-add-missing-module_alias.patch b/queue-5.10/cpufreq-vexpress-spc-add-missing-module_alias.patch
new file mode 100644
index 00000000000..97538378f84
--- /dev/null
+++ b/queue-5.10/cpufreq-vexpress-spc-add-missing-module_alias.patch
@@ -0,0 +1,38 @@
+From d5ba686ff89ac97ac38a99a553d314ba744e1ca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:39 +0100
+Subject: cpufreq: vexpress-spc: Add missing MODULE_ALIAS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit d15183991c2d53d7cecf27a1555c91b702cef1ea ]
+
+This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
+driver when it is compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 47ac9aa165540 ("cpufreq: arm_big_little: add vexpress SPC interface driver")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/vexpress-spc-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/vexpress-spc-cpufreq.c b/drivers/cpufreq/vexpress-spc-cpufreq.c
+index e89b905754d21..f711d8eaea6a2 100644
+--- a/drivers/cpufreq/vexpress-spc-cpufreq.c
++++ b/drivers/cpufreq/vexpress-spc-cpufreq.c
+@@ -591,6 +591,7 @@ static struct platform_driver ve_spc_cpufreq_platdrv = {
+ };
+ module_platform_driver(ve_spc_cpufreq_platdrv);
+ 
++MODULE_ALIAS("platform:vexpress-spc-cpufreq");
+ MODULE_AUTHOR("Viresh Kumar <viresh.kumar@linaro.org>");
+ MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
+ MODULE_DESCRIPTION("Vexpress SPC ARM big LITTLE cpufreq driver");
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-arm-aes-neonbs-fix-usage-of-cbc-aes-fallback.patch b/queue-5.10/crypto-arm-aes-neonbs-fix-usage-of-cbc-aes-fallback.patch
new file mode 100644
index 00000000000..949af953e42
--- /dev/null
+++ b/queue-5.10/crypto-arm-aes-neonbs-fix-usage-of-cbc-aes-fallback.patch
@@ -0,0 +1,64 @@
+From c582f87009b0a738efe847551aea14c3a4bf1716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 11:03:20 +0200
+Subject: crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Horia Geantă <horia.geanta@nxp.com>
+
+[ Upstream commit a2715fbdc6fc387e85211df917a4778761ec693d ]
+
+Loading the module deadlocks since:
+-local cbc(aes) implementation needs a fallback and
+-crypto API tries to find one but the request_module() resolves back to
+the same module
+
+Fix this by changing the module alias for cbc(aes) and
+using the NEED_FALLBACK flag when requesting for a fallback algorithm.
+
+Fixes: 00b99ad2bac2 ("crypto: arm/aes-neonbs - Use generic cbc encryption path")
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/aes-neonbs-glue.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c
+index bda8bf17631e1..f70af1d0514b9 100644
+--- a/arch/arm/crypto/aes-neonbs-glue.c
++++ b/arch/arm/crypto/aes-neonbs-glue.c
+@@ -19,7 +19,7 @@ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
+ 
+ MODULE_ALIAS_CRYPTO("ecb(aes)");
+-MODULE_ALIAS_CRYPTO("cbc(aes)");
++MODULE_ALIAS_CRYPTO("cbc(aes)-all");
+ MODULE_ALIAS_CRYPTO("ctr(aes)");
+ MODULE_ALIAS_CRYPTO("xts(aes)");
+ 
+@@ -191,7 +191,8 @@ static int cbc_init(struct crypto_skcipher *tfm)
+ 	struct aesbs_cbc_ctx *ctx = crypto_skcipher_ctx(tfm);
+ 	unsigned int reqsize;
+ 
+-	ctx->enc_tfm = crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
++	ctx->enc_tfm = crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC |
++					     CRYPTO_ALG_NEED_FALLBACK);
+ 	if (IS_ERR(ctx->enc_tfm))
+ 		return PTR_ERR(ctx->enc_tfm);
+ 
+@@ -441,7 +442,8 @@ static struct skcipher_alg aes_algs[] = { {
+ 	.base.cra_blocksize	= AES_BLOCK_SIZE,
+ 	.base.cra_ctxsize	= sizeof(struct aesbs_cbc_ctx),
+ 	.base.cra_module	= THIS_MODULE,
+-	.base.cra_flags		= CRYPTO_ALG_INTERNAL,
++	.base.cra_flags		= CRYPTO_ALG_INTERNAL |
++				  CRYPTO_ALG_NEED_FALLBACK,
+ 
+ 	.min_keysize		= AES_MIN_KEY_SIZE,
+ 	.max_keysize		= AES_MAX_KEY_SIZE,
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-arm64-poly1305-neon-reorder-pac-authenticatio.patch b/queue-5.10/crypto-arm64-poly1305-neon-reorder-pac-authenticatio.patch
new file mode 100644
index 00000000000..d5f1db93a00
--- /dev/null
+++ b/queue-5.10/crypto-arm64-poly1305-neon-reorder-pac-authenticatio.patch
@@ -0,0 +1,69 @@
+From bc227873e29e8d4a6bd55a475cb18044d7146cc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 00:00:27 +0100
+Subject: crypto: arm64/poly1305-neon - reorder PAC authentication with SP
+ update
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 519a0d7e495a6d3ce62594e485aea2a3a4a2ca0a ]
+
+PAC pointer authentication signs the return address against the value
+of the stack pointer, to prevent stack overrun exploits from corrupting
+the control flow. However, this requires that the AUTIASP is issued with
+SP holding the same value as it held when the PAC value was generated.
+The Poly1305 NEON code got this wrong, resulting in crashes on PAC
+capable hardware.
+
+Fixes: f569ca164751 ("crypto: arm64/poly1305 - incorporate OpenSSL/CRYPTOGAMS ...")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/crypto/poly1305-armv8.pl       | 2 +-
+ arch/arm64/crypto/poly1305-core.S_shipped | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/crypto/poly1305-armv8.pl b/arch/arm64/crypto/poly1305-armv8.pl
+index 6e5576d19af8f..cbc980fb02e33 100644
+--- a/arch/arm64/crypto/poly1305-armv8.pl
++++ b/arch/arm64/crypto/poly1305-armv8.pl
+@@ -840,7 +840,6 @@ poly1305_blocks_neon:
+ 	 ldp	d14,d15,[sp,#64]
+ 	addp	$ACC2,$ACC2,$ACC2
+ 	 ldr	x30,[sp,#8]
+-	 .inst	0xd50323bf		// autiasp
+ 
+ 	////////////////////////////////////////////////////////////////
+ 	// lazy reduction, but without narrowing
+@@ -882,6 +881,7 @@ poly1305_blocks_neon:
+ 	str	x4,[$ctx,#8]		// set is_base2_26
+ 
+ 	ldr	x29,[sp],#80
++	 .inst	0xd50323bf		// autiasp
+ 	ret
+ .size	poly1305_blocks_neon,.-poly1305_blocks_neon
+ 
+diff --git a/arch/arm64/crypto/poly1305-core.S_shipped b/arch/arm64/crypto/poly1305-core.S_shipped
+index 8d1c4e420ccdc..fb2822abf63aa 100644
+--- a/arch/arm64/crypto/poly1305-core.S_shipped
++++ b/arch/arm64/crypto/poly1305-core.S_shipped
+@@ -779,7 +779,6 @@ poly1305_blocks_neon:
+ 	 ldp	d14,d15,[sp,#64]
+ 	addp	v21.2d,v21.2d,v21.2d
+ 	 ldr	x30,[sp,#8]
+-	 .inst	0xd50323bf		// autiasp
+ 
+ 	////////////////////////////////////////////////////////////////
+ 	// lazy reduction, but without narrowing
+@@ -821,6 +820,7 @@ poly1305_blocks_neon:
+ 	str	x4,[x0,#8]		// set is_base2_26
+ 
+ 	ldr	x29,[sp],#80
++	 .inst	0xd50323bf		// autiasp
+ 	ret
+ .size	poly1305_blocks_neon,.-poly1305_blocks_neon
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-atmel-i2c-select-config_bitreverse.patch b/queue-5.10/crypto-atmel-i2c-select-config_bitreverse.patch
new file mode 100644
index 00000000000..5158329ae79
--- /dev/null
+++ b/queue-5.10/crypto-atmel-i2c-select-config_bitreverse.patch
@@ -0,0 +1,42 @@
+From 7ab395266bb22ccd525a37ab74177f38a3ec332a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 00:20:04 +0100
+Subject: crypto: atmel-i2c - select CONFIG_BITREVERSE
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d33a23b0532d5d1b5b700e8641661261e7dbef61 ]
+
+The bitreverse helper is almost always built into the kernel,
+but in a rare randconfig build it is possible to hit a case
+in which it is a loadable module while the atmel-i2c driver
+is built-in:
+
+arm-linux-gnueabi-ld: drivers/crypto/atmel-i2c.o: in function `atmel_i2c_checksum':
+atmel-i2c.c:(.text+0xa0): undefined reference to `byte_rev_table'
+
+Add one more 'select' statement to prevent this.
+
+Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 37da0c070a883..9d6645b1f0abe 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -548,6 +548,7 @@ config CRYPTO_DEV_ATMEL_SHA
+ 
+ config CRYPTO_DEV_ATMEL_I2C
+ 	tristate
++	select BITREVERSE
+ 
+ config CRYPTO_DEV_ATMEL_ECC
+ 	tristate "Support for Microchip / Atmel ECC hw accelerator"
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-caam-fix-printing-on-xts-fallback-allocation-.patch b/queue-5.10/crypto-caam-fix-printing-on-xts-fallback-allocation-.patch
new file mode 100644
index 00000000000..aaa79e1c412
--- /dev/null
+++ b/queue-5.10/crypto-caam-fix-printing-on-xts-fallback-allocation-.patch
@@ -0,0 +1,78 @@
+From 71487a7600075918fc7cd91a2f24e4c3ccd39eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 22:05:53 +0200
+Subject: crypto: caam - fix printing on xts fallback allocation error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Horia Geantă <horia.geanta@nxp.com>
+
+[ Upstream commit ab95bd2aa904e4f53b7358efeea1d57693fb7889 ]
+
+At the time xts fallback tfm allocation fails the device struct
+hasn't been enabled yet in the caam xts tfm's private context.
+
+Fix this by using the device struct from xts algorithm's private context
+or, when not available, by replacing dev_err with pr_err.
+
+Fixes: 9d9b14dbe077 ("crypto: caam/jr - add fallback for XTS with more than 8B IV")
+Fixes: 83e8aa912138 ("crypto: caam/qi - add fallback for XTS with more than 8B IV")
+Fixes: 36e2d7cfdcf1 ("crypto: caam/qi2 - add fallback for XTS with more than 8B IV")
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg.c     | 4 ++--
+ drivers/crypto/caam/caamalg_qi.c  | 4 ++--
+ drivers/crypto/caam/caamalg_qi2.c | 3 ++-
+ 3 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index cf5bd7666dfcd..8697ae53b0633 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -3404,8 +3404,8 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
+ 		fallback = crypto_alloc_skcipher(tfm_name, 0,
+ 						 CRYPTO_ALG_NEED_FALLBACK);
+ 		if (IS_ERR(fallback)) {
+-			dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
+-				tfm_name, PTR_ERR(fallback));
++			pr_err("Failed to allocate %s fallback: %ld\n",
++			       tfm_name, PTR_ERR(fallback));
+ 			return PTR_ERR(fallback);
+ 		}
+ 
+diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
+index 66f60d78bdc84..a24ae966df4a3 100644
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -2502,8 +2502,8 @@ static int caam_cra_init(struct crypto_skcipher *tfm)
+ 		fallback = crypto_alloc_skcipher(tfm_name, 0,
+ 						 CRYPTO_ALG_NEED_FALLBACK);
+ 		if (IS_ERR(fallback)) {
+-			dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
+-				tfm_name, PTR_ERR(fallback));
++			pr_err("Failed to allocate %s fallback: %ld\n",
++			       tfm_name, PTR_ERR(fallback));
+ 			return PTR_ERR(fallback);
+ 		}
+ 
+diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
+index 98c1ff1744bb1..a780e627838ae 100644
+--- a/drivers/crypto/caam/caamalg_qi2.c
++++ b/drivers/crypto/caam/caamalg_qi2.c
+@@ -1611,7 +1611,8 @@ static int caam_cra_init_skcipher(struct crypto_skcipher *tfm)
+ 		fallback = crypto_alloc_skcipher(tfm_name, 0,
+ 						 CRYPTO_ALG_NEED_FALLBACK);
+ 		if (IS_ERR(fallback)) {
+-			dev_err(ctx->dev, "Failed to allocate %s fallback: %ld\n",
++			dev_err(caam_alg->caam.dev,
++				"Failed to allocate %s fallback: %ld\n",
+ 				tfm_name, PTR_ERR(fallback));
+ 			return PTR_ERR(fallback);
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch b/queue-5.10/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch
new file mode 100644
index 00000000000..8a1834007c1
--- /dev/null
+++ b/queue-5.10/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch
@@ -0,0 +1,60 @@
+From 71ec3aee5134588f9b5b62bc2fef0ceebcae4c1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 13:07:02 -0700
+Subject: crypto: crypto4xx - Replace bitwise OR with logical OR in
+ crypto4xx_build_pd
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ]
+
+Clang warns:
+
+drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has
+lower precedence than '|'; '|' will be evaluated first
+[-Wbitwise-conditional-parentheses]
+                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
+drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
+around the '|' expression to silence this warning
+                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+                                                                         ^
+                                                                        )
+drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
+around the '?:' expression to evaluate it first
+                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+                                                                         ^
+                 (
+1 warning generated.
+
+It looks like this should have been a logical OR so that
+PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type
+is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the
+operator so that everything works properly.
+
+Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1198
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 981de43ea5e24..2e3690f65786d 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -917,7 +917,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ 	}
+ 
+ 	pd->pd_ctl.w = PD_CTL_HOST_READY |
+-		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
++		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
+ 		 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ 			PD_CTL_HASH_FINAL : 0);
+ 	pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-inside-secure-fix-sizeof-mismatch.patch b/queue-5.10/crypto-inside-secure-fix-sizeof-mismatch.patch
new file mode 100644
index 00000000000..5eb30678d69
--- /dev/null
+++ b/queue-5.10/crypto-inside-secure-fix-sizeof-mismatch.patch
@@ -0,0 +1,40 @@
+From d84d118f7cbf832737b0b7fa3666e5aa46b20636 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Oct 2020 17:47:36 +0100
+Subject: crypto: inside-secure - Fix sizeof() mismatch
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ]
+
+An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is
+not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that
+since the size of ** is the same size as * this is not causing any
+issues.
+
+Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
+Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
+index eb2418450f120..2e1562108a858 100644
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -1639,7 +1639,7 @@ static int safexcel_probe_generic(void *pdev,
+ 
+ 		priv->ring[i].rdr_req = devm_kcalloc(dev,
+ 			EIP197_DEFAULT_RING_SIZE,
+-			sizeof(priv->ring[i].rdr_req),
++			sizeof(*priv->ring[i].rdr_req),
+ 			GFP_KERNEL);
+ 		if (!priv->ring[i].rdr_req)
+ 			return -ENOMEM;
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-kconfig-crypto_manager_extra_tests-requires-t.patch b/queue-5.10/crypto-kconfig-crypto_manager_extra_tests-requires-t.patch
new file mode 100644
index 00000000000..5fafcfbe4d8
--- /dev/null
+++ b/queue-5.10/crypto-kconfig-crypto_manager_extra_tests-requires-t.patch
@@ -0,0 +1,39 @@
+From e828d468cb9c8468270be5633505984fc83ceff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 14:48:15 +0100
+Subject: crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit 6569e3097f1c4a490bdf2b23d326855e04942dfd ]
+
+The extra tests in the manager actually require the manager to be
+selected too. Otherwise the linker gives errors like:
+
+ld: arch/x86/crypto/chacha_glue.o: in function `chacha_simd_stream_xor':
+chacha_glue.c:(.text+0x422): undefined reference to `crypto_simd_disabled_for_test'
+
+Fixes: 2343d1529aff ("crypto: Kconfig - allow tests to be disabled when manager is disabled")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 094ef56ab7b42..37de7d006858d 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -145,7 +145,7 @@ config CRYPTO_MANAGER_DISABLE_TESTS
+ 
+ config CRYPTO_MANAGER_EXTRA_TESTS
+ 	bool "Enable extra run-time crypto self tests"
+-	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS
++	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
+ 	help
+ 	  Enable extra run-time self tests of registered crypto algorithms,
+ 	  including randomized fuzz tests.
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch b/queue-5.10/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch
new file mode 100644
index 00000000000..55eee45e35e
--- /dev/null
+++ b/queue-5.10/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch
@@ -0,0 +1,45 @@
+From 89cd0bf66ba4886b3666f4db0b8c303f3e54335c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:17:28 +0800
+Subject: crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]
+
+The pm_runtime_enable will increase power disable depth.
+Thus a pairing decrement is needed on the error handling
+path to keep it balanced according to context.
+
+Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/omap-aes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
+index 4fd14d90cc409..1b1e0ab0a831a 100644
+--- a/drivers/crypto/omap-aes.c
++++ b/drivers/crypto/omap-aes.c
+@@ -1137,7 +1137,7 @@ static int omap_aes_probe(struct platform_device *pdev)
+ 	if (err < 0) {
+ 		dev_err(dev, "%s: failed to get_sync(%d)\n",
+ 			__func__, err);
+-		goto err_res;
++		goto err_pm_disable;
+ 	}
+ 
+ 	omap_aes_dma_stop(dd);
+@@ -1246,6 +1246,7 @@ err_engine:
+ 	omap_aes_dma_cleanup(dd);
+ err_irq:
+ 	tasklet_kill(&dd->done_task);
++err_pm_disable:
+ 	pm_runtime_disable(dev);
+ err_res:
+ 	dd = NULL;
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch b/queue-5.10/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch
new file mode 100644
index 00000000000..7dcb642cb7f
--- /dev/null
+++ b/queue-5.10/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch
@@ -0,0 +1,44 @@
+From e8d2e076d32a858ec9f860b77115b4f1d6b37447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 19:27:40 +0800
+Subject: crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
+
+From: Jack Xu <jack.xu@intel.com>
+
+[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ]
+
+The return value of qat_hal_rd_ae_csr() is always a CSR value and never
+a status and should not be stored in the status variable of
+qat_hal_put_rel_rd_xfer().
+
+This removes the assignment as qat_hal_rd_ae_csr() is not expected to
+fail.
+A more comprehensive handling of the theoretical corner case which could
+result in a fail will be submitted in a separate patch.
+
+Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN")
+Signed-off-by: Jack Xu <jack.xu@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index 6b9d47682d04d..52ef80efeddc6 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -1146,7 +1146,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
+ 	unsigned short mask;
+ 	unsigned short dr_offset = 0x10;
+ 
+-	status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
++	ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+ 	if (CE_INUSE_CONTEXTS & ctx_enables) {
+ 		if (ctx & 0x1) {
+ 			pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-sun8i-ce-fix-two-error-path-s-memory-leak.patch b/queue-5.10/crypto-sun8i-ce-fix-two-error-path-s-memory-leak.patch
new file mode 100644
index 00000000000..ddb3bd702c0
--- /dev/null
+++ b/queue-5.10/crypto-sun8i-ce-fix-two-error-path-s-memory-leak.patch
@@ -0,0 +1,86 @@
+From 954d0243ba744386ff9517003736f1e8f06d845d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 19:08:07 +0000
+Subject: crypto: sun8i-ce - fix two error path's memory leak
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 732b764099f651a088fd931d7b8121b6aa84e62e ]
+
+This patch fixes the following smatch warnings:
+drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c:412
+sun8i_ce_hash_run() warn: possible memory leak of 'result'
+Note: "buf" is leaked as well.
+
+Furthermore, in case of ENOMEM, crypto_finalize_hash_request() was not
+called which was an error.
+
+Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 20 +++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+index a94bf28f858a7..4c5a2c11d7141 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+@@ -262,13 +262,13 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 	u32 common;
+ 	u64 byte_count;
+ 	__le32 *bf;
+-	void *buf;
++	void *buf = NULL;
+ 	int j, i, todo;
+ 	int nbw = 0;
+ 	u64 fill, min_fill;
+ 	__be64 *bebits;
+ 	__le64 *lebits;
+-	void *result;
++	void *result = NULL;
+ 	u64 bs;
+ 	int digestsize;
+ 	dma_addr_t addr_res, addr_pad;
+@@ -285,13 +285,17 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 
+ 	/* the padding could be up to two block. */
+ 	buf = kzalloc(bs * 2, GFP_KERNEL | GFP_DMA);
+-	if (!buf)
+-		return -ENOMEM;
++	if (!buf) {
++		err = -ENOMEM;
++		goto theend;
++	}
+ 	bf = (__le32 *)buf;
+ 
+ 	result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
+-	if (!result)
+-		return -ENOMEM;
++	if (!result) {
++		err = -ENOMEM;
++		goto theend;
++	}
+ 
+ 	flow = rctx->flow;
+ 	chan = &ce->chanlist[flow];
+@@ -403,11 +407,11 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 	dma_unmap_sg(ce->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
+ 	dma_unmap_single(ce->dev, addr_res, digestsize, DMA_FROM_DEVICE);
+ 
+-	kfree(buf);
+ 
+ 	memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
+-	kfree(result);
+ theend:
++	kfree(buf);
++	kfree(result);
+ 	crypto_finalize_hash_request(engine, breq, err);
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-talitos-endianess-in-current_desc_hdr.patch b/queue-5.10/crypto-talitos-endianess-in-current_desc_hdr.patch
new file mode 100644
index 00000000000..75806ec92ed
--- /dev/null
+++ b/queue-5.10/crypto-talitos-endianess-in-current_desc_hdr.patch
@@ -0,0 +1,53 @@
+From 8d6cc3fc3b5d8183eb16e1548f17f6cf93d67115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 09:34:55 +0000
+Subject: crypto: talitos - Endianess in current_desc_hdr()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ]
+
+current_desc_hdr() compares the value of the current descriptor
+with the next_desc member of the talitos_desc struct.
+
+While the current descriptor is obtained from in_be32() which
+return CPU ordered bytes, next_desc member is in big endian order.
+
+Convert the current descriptor into big endian before comparing it
+with next_desc.
+
+This fixes a sparse warning.
+
+Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 66773892f665d..1de6b01381268 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -478,7 +478,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ 
+ 	iter = tail;
+ 	while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
+-	       priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
++	       priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
+ 		iter = (iter + 1) & (priv->fifo_len - 1);
+ 		if (iter == tail) {
+ 			dev_err(dev, "couldn't locate current descriptor\n");
+@@ -486,7 +486,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ 		}
+ 	}
+ 
+-	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
++	if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
+ 		struct talitos_edesc *edesc;
+ 
+ 		edesc = container_of(priv->chan[ch].fifo[iter].desc,
+-- 
+2.27.0
+
diff --git a/queue-5.10/crypto-talitos-fix-return-type-of-current_desc_hdr.patch b/queue-5.10/crypto-talitos-fix-return-type-of-current_desc_hdr.patch
new file mode 100644
index 00000000000..59391ebb16c
--- /dev/null
+++ b/queue-5.10/crypto-talitos-fix-return-type-of-current_desc_hdr.patch
@@ -0,0 +1,55 @@
+From 77f40a71d7041c62462a21ef52f7cc83b43e84bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 09:34:56 +0000
+Subject: crypto: talitos - Fix return type of current_desc_hdr()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]
+
+current_desc_hdr() returns a u32 but in fact this is a __be32,
+leading to a lot of sparse warnings.
+
+Change the return type to __be32 and ensure it is handled as
+sure by the caller.
+
+Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 1de6b01381268..a713a35dc5022 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -460,7 +460,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
+ /*
+  * locate current (offending) descriptor
+  */
+-static u32 current_desc_hdr(struct device *dev, int ch)
++static __be32 current_desc_hdr(struct device *dev, int ch)
+ {
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	int tail, iter;
+@@ -501,13 +501,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ /*
+  * user diagnostics; report root cause of error based on execution unit status
+  */
+-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
++static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
+ {
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	int i;
+ 
+ 	if (!desc_hdr)
+-		desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
++		desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
+ 
+ 	switch (desc_hdr & DESC_HDR_SEL0_MASK) {
+ 	case DESC_HDR_SEL0_AFEU:
+-- 
+2.27.0
+
diff --git a/queue-5.10/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch b/queue-5.10/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch
new file mode 100644
index 00000000000..39dc76ccbc7
--- /dev/null
+++ b/queue-5.10/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch
@@ -0,0 +1,46 @@
+From 1975ddc962620fc77ce83d6b173a733190b54366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 15:08:42 +0800
+Subject: cw1200: fix missing destroy_workqueue() on error in
+ cw1200_init_common
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]
+
+Add the missing destroy_workqueue() before return from
+cw1200_init_common in the error handling case.
+
+Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/st/cw1200/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
+index f7fe56affbcd2..326b1cc1d2bcb 100644
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -381,6 +381,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ 				    CW1200_LINK_ID_MAX,
+ 				    cw1200_skb_dtor,
+ 				    priv)) {
++		destroy_workqueue(priv->workqueue);
+ 		ieee80211_free_hw(hw);
+ 		return NULL;
+ 	}
+@@ -392,6 +393,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ 			for (; i > 0; i--)
+ 				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
+ 			cw1200_queue_stats_deinit(&priv->tx_queue_stats);
++			destroy_workqueue(priv->workqueue);
+ 			ieee80211_free_hw(hw);
+ 			return NULL;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/devlink-use-_bitul-macro-instead-of-bit-in-the-uapi-.patch b/queue-5.10/devlink-use-_bitul-macro-instead-of-bit-in-the-uapi-.patch
new file mode 100644
index 00000000000..911d9918096
--- /dev/null
+++ b/queue-5.10/devlink-use-_bitul-macro-instead-of-bit-in-the-uapi-.patch
@@ -0,0 +1,39 @@
+From 96e4ad353565392e28c61e1d0f81d6d0e79a9c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 11:25:31 +0100
+Subject: devlink: use _BITUL() macro instead of BIT() in the UAPI header
+
+From: Tobias Klauser <tklauser@distanz.ch>
+
+[ Upstream commit 75f4d4544db9fa34e1f04174f27d9f8a387be37d ]
+
+The BIT() macro is not available for the UAPI headers. Moreover, it can
+be defined differently in user space headers. Thus, replace its usage
+with the _BITUL() macro which is already used in other macro definitions
+in <linux/devlink.h>.
+
+Fixes: dc64cc7c6310 ("devlink: Add devlink reload limit option")
+Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
+Link: https://lore.kernel.org/r/20201215102531.16958-1-tklauser@distanz.ch
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/devlink.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
+index 5203f54a2be1c..cf89c318f2ac9 100644
+--- a/include/uapi/linux/devlink.h
++++ b/include/uapi/linux/devlink.h
+@@ -322,7 +322,7 @@ enum devlink_reload_limit {
+ 	DEVLINK_RELOAD_LIMIT_MAX = __DEVLINK_RELOAD_LIMIT_MAX - 1
+ };
+ 
+-#define DEVLINK_RELOAD_LIMITS_VALID_MASK (BIT(__DEVLINK_RELOAD_LIMIT_MAX) - 1)
++#define DEVLINK_RELOAD_LIMITS_VALID_MASK (_BITUL(__DEVLINK_RELOAD_LIMIT_MAX) - 1)
+ 
+ enum devlink_attr {
+ 	/* don't change the order or add anything between, this is ABI! */
+-- 
+2.27.0
+
diff --git a/queue-5.10/dm-ioctl-fix-error-return-code-in-target_message.patch b/queue-5.10/dm-ioctl-fix-error-return-code-in-target_message.patch
new file mode 100644
index 00000000000..4103121f731
--- /dev/null
+++ b/queue-5.10/dm-ioctl-fix-error-return-code-in-target_message.patch
@@ -0,0 +1,36 @@
+From f010599830caa9aaca3e40bd8a6b0d7d5167f155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 18:19:59 +0800
+Subject: dm ioctl: fix error return code in target_message
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index cd0478d44058b..5e306bba43751 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1600,6 +1600,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
+ 
+ 	if (!argc) {
+ 		DMWARN("Empty message received.");
++		r = -EINVAL;
+ 		goto out_argv;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch b/queue-5.10/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch
new file mode 100644
index 00000000000..dc579e793a5
--- /dev/null
+++ b/queue-5.10/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch
@@ -0,0 +1,41 @@
+From ee6dcc0d07fbf315a9d3fc5ed2faf09ea4c96fa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 09:08:13 +0800
+Subject: dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]
+
+Return the corresponding error code when first_msi_entry() returns
+NULL in mv_xor_v2_probe().
+
+Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor_v2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 2753a6b916f60..9b0d463f89bbd 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -771,8 +771,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+ 		goto disable_clk;
+ 
+ 	msi_desc = first_msi_entry(&pdev->dev);
+-	if (!msi_desc)
++	if (!msi_desc) {
++		ret = -ENODEV;
+ 		goto free_msi_irqs;
++	}
+ 	xor_dev->msi_desc = msi_desc;
+ 
+ 	ret = devm_request_irq(&pdev->dev, msi_desc->irq,
+-- 
+2.27.0
+
diff --git a/queue-5.10/dmaengine-ti-k3-udma-correct-normal-channel-offset-w.patch b/queue-5.10/dmaengine-ti-k3-udma-correct-normal-channel-offset-w.patch
new file mode 100644
index 00000000000..8a27cc9158d
--- /dev/null
+++ b/queue-5.10/dmaengine-ti-k3-udma-correct-normal-channel-offset-w.patch
@@ -0,0 +1,40 @@
+From 88b82b9ca3b9c7c472c1a4338bb7caecc301cbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 11:04:21 +0200
+Subject: dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt
+ is not 0
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit e2de925bbfe321ba0588c99f577c59386ab1f428 ]
+
+According to different sections of the TRM, the hchan_cnt of CAP3 includes
+the number of uchan in UDMA, thus the start offset of the normal channels
+are hchan_cnt.
+
+Fixes: daf4ad0499aa4 ("dmaengine: ti: k3-udma: Query throughput level information from hardware")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20201208090440.31792-2-peter.ujfalusi@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/k3-udma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
+index 82cf6c77f5c93..d3902784cae24 100644
+--- a/drivers/dma/ti/k3-udma.c
++++ b/drivers/dma/ti/k3-udma.c
+@@ -3201,8 +3201,7 @@ static int udma_setup_resources(struct udma_dev *ud)
+ 	} else if (UDMA_CAP3_UCHAN_CNT(cap3)) {
+ 		ud->tpl_levels = 3;
+ 		ud->tpl_start_idx[1] = UDMA_CAP3_UCHAN_CNT(cap3);
+-		ud->tpl_start_idx[0] = ud->tpl_start_idx[1] +
+-				       UDMA_CAP3_HCHAN_CNT(cap3);
++		ud->tpl_start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
+ 	} else if (UDMA_CAP3_HCHAN_CNT(cap3)) {
+ 		ud->tpl_levels = 2;
+ 		ud->tpl_start_idx[0] = UDMA_CAP3_HCHAN_CNT(cap3);
+-- 
+2.27.0
+
diff --git a/queue-5.10/dpaa2-eth-fix-the-size-of-the-mapped-sgt-buffer.patch b/queue-5.10/dpaa2-eth-fix-the-size-of-the-mapped-sgt-buffer.patch
new file mode 100644
index 00000000000..8a3a6d3a5cb
--- /dev/null
+++ b/queue-5.10/dpaa2-eth-fix-the-size-of-the-mapped-sgt-buffer.patch
@@ -0,0 +1,73 @@
+From 24aef45c9e8da3880eab9038a8ca57491be9e4bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 19:16:07 +0200
+Subject: dpaa2-eth: fix the size of the mapped SGT buffer
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit 54a57d1c449275ee727154ac106ec1accae012e3 ]
+
+This patch fixes an error condition triggered when the code path which
+transmits a S/G frame descriptor when the skb's headroom is not enough
+for DPAA2's needs.
+
+We are greated with a splat like the one below when a SGT structure is
+recycled and that is because even though a dma_unmap is performed on the
+Tx confirmation path, the unmap is not done with the proper size.
+
+[  714.464927] WARNING: CPU: 13 PID: 0 at drivers/iommu/io-pgtable-arm.c:281 __arm_lpae_map+0x2d4/0x30c
+(...)
+[  714.465343] Call trace:
+[  714.465348]  __arm_lpae_map+0x2d4/0x30c
+[  714.465353]  __arm_lpae_map+0x114/0x30c
+[  714.465357]  __arm_lpae_map+0x114/0x30c
+[  714.465362]  __arm_lpae_map+0x114/0x30c
+[  714.465366]  arm_lpae_map+0xf4/0x180
+[  714.465373]  arm_smmu_map+0x4c/0xc0
+[  714.465379]  __iommu_map+0x100/0x2bc
+[  714.465385]  iommu_map_atomic+0x20/0x30
+[  714.465391]  __iommu_dma_map+0xb0/0x110
+[  714.465397]  iommu_dma_map_page+0xb8/0x120
+[  714.465404]  dma_map_page_attrs+0x1a8/0x210
+[  714.465413]  __dpaa2_eth_tx+0x384/0xbd0 [fsl_dpaa2_eth]
+[  714.465421]  dpaa2_eth_tx+0x84/0x134 [fsl_dpaa2_eth]
+[  714.465427]  dev_hard_start_xmit+0x10c/0x2b0
+[  714.465433]  sch_direct_xmit+0x1a0/0x550
+(...)
+
+The dpaa2-eth driver uses an area of software annotations to transmit
+necessary information from the Tx path to the Tx confirmation one. This
+SWA structure has a different layout for each kind of frame that we are
+dealing with: linear, S/G or XDP.
+
+The commit referenced was incorrectly setting up the 'sgt_size' field
+for the S/G type of SWA even though we are dealing with a linear skb
+here.
+
+Fixes: d70446ee1f40 ("dpaa2-eth: send a scatter-gather FD instead of realloc-ing")
+Reported-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20201211171607.108034-1-ciorneiioana@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index cf9400a9886d7..d880ab2a7d962 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -878,7 +878,7 @@ static int dpaa2_eth_build_sg_fd_single_buf(struct dpaa2_eth_priv *priv,
+ 	swa = (struct dpaa2_eth_swa *)sgt_buf;
+ 	swa->type = DPAA2_ETH_SWA_SINGLE;
+ 	swa->single.skb = skb;
+-	swa->sg.sgt_size = sgt_buf_size;
++	swa->single.sgt_size = sgt_buf_size;
+ 
+ 	/* Separately map the SGT buffer */
+ 	sgt_addr = dma_map_single(dev, sgt_buf, sgt_buf_size, DMA_BIDIRECTIONAL);
+-- 
+2.27.0
+
diff --git a/queue-5.10/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch b/queue-5.10/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch
new file mode 100644
index 00000000000..5429a59014e
--- /dev/null
+++ b/queue-5.10/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch
@@ -0,0 +1,41 @@
+From c9ac7b9e55b62b03c02ba34934ef52fb119694f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:38 -0800
+Subject: drivers: soc: ti: knav_qmss_queue: Fix error return code in
+ knav_queue_probe
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]
+
+Fix to return the error code from of_get_child_by_name() instaed of 0
+in knav_queue_probe().
+
+Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_qmss_queue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index 54afa8f7f4087..53e36d4328d1e 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -1852,9 +1852,10 @@ static int knav_queue_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		goto err;
+ 
+-	regions =  of_get_child_by_name(node, "descriptor-regions");
++	regions = of_get_child_by_name(node, "descriptor-regions");
+ 	if (!regions) {
+ 		dev_err(dev, "descriptor-regions not specified\n");
++		ret = -ENODEV;
+ 		goto err;
+ 	}
+ 	ret = knav_queue_setup_regions(kdev, regions);
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-amdgpu-fix-build_coefficients-argument.patch b/queue-5.10/drm-amdgpu-fix-build_coefficients-argument.patch
new file mode 100644
index 00000000000..4a664fd4fe4
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-fix-build_coefficients-argument.patch
@@ -0,0 +1,45 @@
+From 372f1e45cd84e9fa8ee9812f04fe530841362227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 22:00:32 +0100
+Subject: drm/amdgpu: fix build_coefficients() argument
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]
+
+gcc -Wextra warns about a function taking an enum argument
+being called with a bool:
+
+drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
+drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
+ 1617 |  build_coefficients(&coeff, true);
+
+It appears that a patch was added using the old calling conventions
+after the type was changed, and the value should actually be 0
+(TRANSFER_FUNCTION_SRGB) here instead of 1 (true).
+
+Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index b8695660b480e..09bc2c249e1af 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -1614,7 +1614,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
+ 	struct pwl_float_data_ex *rgb = rgb_regamma;
+ 	const struct hw_x_point *coord_x = coordinates_x;
+ 
+-	build_coefficients(&coeff, true);
++	build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
+ 
+ 	i = 0;
+ 	while (i != hw_points_num + 1) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-amdgpu-fix-compute-queue-priority-if-num_kcq-is-.patch b/queue-5.10/drm-amdgpu-fix-compute-queue-priority-if-num_kcq-is-.patch
new file mode 100644
index 00000000000..df79f31378e
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-fix-compute-queue-priority-if-num_kcq-is-.patch
@@ -0,0 +1,141 @@
+From ceee5655b3bf49aa81942b1419ed0287f2bdcdb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 17:04:51 +0100
+Subject: drm/amdgpu: fix compute queue priority if num_kcq is less than 4
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit 3f66bf401e9fde1c35bb8b02dd7975659c40411d ]
+
+Compute queues are configurable with module param, num_kcq.
+amdgpu_gfx_is_high_priority_compute_queue was setting 1st 4 queues to
+high priority queue leaving a null drm scheduler in
+adev->gpu_sched[hw_ip]["normal_prio"].sched if num_kcq < 5.
+
+This patch tries to fix it by alternating compute queue priority between
+normal and high priority.
+
+Fixes: 33abcb1f5a1719b1c (drm/amdgpu: set compute queue priority at mqd_init)
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +++++++---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h |  2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c  |  6 ++++--
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c   |  6 ++++--
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c   |  7 +++++--
+ 5 files changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index 8c9bacfdbc300..c485ec86804e5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -193,10 +193,14 @@ static bool amdgpu_gfx_is_multipipe_capable(struct amdgpu_device *adev)
+ }
+ 
+ bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
+-					       int queue)
++					       int pipe, int queue)
+ {
+-	/* Policy: make queue 0 of each pipe as high priority compute queue */
+-	return (queue == 0);
++	bool multipipe_policy = amdgpu_gfx_is_multipipe_capable(adev);
++	int cond;
++	/* Policy: alternate between normal and high priority */
++	cond = multipipe_policy ? pipe : queue;
++
++	return ((cond % 2) != 0);
+ 
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+index 258498cbf1eba..f353a5b71804e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+@@ -373,7 +373,7 @@ void amdgpu_queue_mask_bit_to_mec_queue(struct amdgpu_device *adev, int bit,
+ bool amdgpu_gfx_is_mec_queue_enabled(struct amdgpu_device *adev, int mec,
+ 				     int pipe, int queue);
+ bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
+-					       int queue);
++					       int pipe, int queue);
+ int amdgpu_gfx_me_queue_to_bit(struct amdgpu_device *adev, int me,
+ 			       int pipe, int queue);
+ void amdgpu_gfx_bit_to_me_queue(struct amdgpu_device *adev, int bit,
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 55f4b8c3b9338..4ebb43e090999 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4334,7 +4334,8 @@ static int gfx_v10_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ 	irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
+ 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ 		+ ring->pipe;
+-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
++	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
++							    ring->queue) ?
+ 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
+ 	/* type-2 packets are deprecated on MEC, use type-3 instead */
+ 	r = amdgpu_ring_init(adev, ring, 1024,
+@@ -6360,7 +6361,8 @@ static void gfx_v10_0_compute_mqd_set_priority(struct amdgpu_ring *ring, struct
+ 	struct amdgpu_device *adev = ring->adev;
+ 
+ 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
++		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
++							      ring->queue)) {
+ 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ 			mqd->cp_hqd_queue_priority =
+ 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 94b7e0531d092..c36258d56b445 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -1915,7 +1915,8 @@ static int gfx_v8_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ 		+ ring->pipe;
+ 
+-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
++	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
++							    ring->queue) ?
+ 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_RING_PRIO_DEFAULT;
+ 	/* type-2 packets are deprecated on MEC, use type-3 instead */
+ 	r = amdgpu_ring_init(adev, ring, 1024,
+@@ -4433,7 +4434,8 @@ static void gfx_v8_0_mqd_set_priority(struct amdgpu_ring *ring, struct vi_mqd *m
+ 	struct amdgpu_device *adev = ring->adev;
+ 
+ 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
++		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
++							      ring->queue)) {
+ 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ 			mqd->cp_hqd_queue_priority =
+ 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 0d8e203b10efb..957c12b727676 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2228,7 +2228,8 @@ static int gfx_v9_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ 	irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
+ 		+ ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ 		+ ring->pipe;
+-	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue) ?
++	hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
++							    ring->queue) ?
+ 			AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
+ 	/* type-2 packets are deprecated on MEC, use type-3 instead */
+ 	return amdgpu_ring_init(adev, ring, 1024,
+@@ -3383,7 +3384,9 @@ static void gfx_v9_0_mqd_set_priority(struct amdgpu_ring *ring, struct v9_mqd *m
+ 	struct amdgpu_device *adev = ring->adev;
+ 
+ 	if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+-		if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->queue)) {
++		if (amdgpu_gfx_is_high_priority_compute_queue(adev,
++							      ring->pipe,
++							      ring->queue)) {
+ 			mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ 			mqd->cp_hqd_queue_priority =
+ 				AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-amdgpu-fix-incorrect-enum-type.patch b/queue-5.10/drm-amdgpu-fix-incorrect-enum-type.patch
new file mode 100644
index 00000000000..1d445b08575
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-fix-incorrect-enum-type.patch
@@ -0,0 +1,50 @@
+From e3508ab4bdf2106b868c66cdf63894602ebe2047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 22:00:30 +0100
+Subject: drm/amdgpu: fix incorrect enum type
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a110f3750bf8b93764f13bd1402c7cba03d15d61 ]
+
+core_link_write_dpcd() returns enum dc_status, not ddc_result:
+
+display/dc/core/dc_link_dp.c: In function 'dp_set_panel_mode':
+display/dc/core/dc_link_dp.c:4237:11: warning: implicit conversion from 'enum dc_status' to 'enum ddc_result'
+[-Wenum-conversion]
+
+Avoid the warning by using the correct enum in the caller.
+
+Fixes: 0b226322434c ("drm/amd/display: Synchronous DisplayPort Link Training")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index ff1e9963ec7a2..98464886341f6 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -4230,7 +4230,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
+ 
+ 		if (edp_config_set.bits.PANEL_MODE_EDP
+ 			!= panel_mode_edp) {
+-			enum ddc_result result = DDC_RESULT_UNKNOWN;
++			enum dc_status result = DC_ERROR_UNEXPECTED;
+ 
+ 			edp_config_set.bits.PANEL_MODE_EDP =
+ 			panel_mode_edp;
+@@ -4240,7 +4240,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
+ 				&edp_config_set.raw,
+ 				sizeof(edp_config_set.raw));
+ 
+-			ASSERT(result == DDC_RESULT_SUCESSFULL);
++			ASSERT(result == DC_OK);
+ 		}
+ 	}
+ 	DC_LOG_DETECTION_DP_CAPS("Link: %d eDP panel mode supported: %d "
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-amdgpu-fix-regression-in-vbios-reservation-handl.patch b/queue-5.10/drm-amdgpu-fix-regression-in-vbios-reservation-handl.patch
new file mode 100644
index 00000000000..6b6438c56a2
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-fix-regression-in-vbios-reservation-handl.patch
@@ -0,0 +1,46 @@
+From c0cb2dc1e1dde54775d5b84f3b34ce5654b44ca3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 11:00:47 -0500
+Subject: drm/amdgpu: fix regression in vbios reservation handling on headless
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 7eded018bfeccb365963bb51be731a9f99aeea59 ]
+
+We need to move the check under the non-headless case, otherwise
+we always reserve the VGA save size.
+
+Fixes: 157fe68d74c2ad ("drm/amdgpu: fix size calculation with stolen vga memory")
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+index 3e4892b7b7d3c..ff4e226739308 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+@@ -494,13 +494,14 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)
+ 		break;
+ 	}
+ 
+-	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE))
++	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE)) {
+ 		size = 0;
+-	else
++	} else {
+ 		size = amdgpu_gmc_get_vbios_fb_size(adev);
+ 
+-	if (adev->mman.keep_stolen_vga_memory)
+-		size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
++		if (adev->mman.keep_stolen_vga_memory)
++			size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
++	}
+ 
+ 	/* set to 0 if the pre-OS buffer uses up most of vram */
+ 	if ((adev->gmc.real_vram_size - size) < (8 * 1024 * 1024))
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-amdkfd-put-acpi-table-after-using-it.patch b/queue-5.10/drm-amdkfd-put-acpi-table-after-using-it.patch
new file mode 100644
index 00000000000..113211e1c00
--- /dev/null
+++ b/queue-5.10/drm-amdkfd-put-acpi-table-after-using-it.patch
@@ -0,0 +1,74 @@
+From fd65e1b63dd86f62b29908e8feb7b9691eddd038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 11:11:14 +0800
+Subject: drm/amdkfd: Put ACPI table after using it
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit c4cb773c702be5519442c8375a6476d08fe2cb46 ]
+
+The acpi_get_table() should be coupled with acpi_put_table() if
+the mapped table is not used at runtime to release the table
+mapping which can prevent the memory leak.
+
+In kfd_create_crat_image_acpi(), crat_table is copied to pcrat_image,
+and in kfd_create_vcrat_image_cpu(), the acpi_table is only used to
+get the OEM information, so those two table mappings need to be released
+after using it.
+
+Fixes: 174de876d6d0 ("drm/amdkfd: Group up CRAT related functions")
+Fixes: 520b8fb755cc ("drm/amdkfd: Add topology support for CPUs")
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+index 3de5e14c5ae31..d7f67620f57ba 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+@@ -774,6 +774,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size)
+ 	struct acpi_table_header *crat_table;
+ 	acpi_status status;
+ 	void *pcrat_image;
++	int rc = 0;
+ 
+ 	if (!crat_image)
+ 		return -EINVAL;
+@@ -798,14 +799,17 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size)
+ 	}
+ 
+ 	pcrat_image = kvmalloc(crat_table->length, GFP_KERNEL);
+-	if (!pcrat_image)
+-		return -ENOMEM;
++	if (!pcrat_image) {
++		rc = -ENOMEM;
++		goto out;
++	}
+ 
+ 	memcpy(pcrat_image, crat_table, crat_table->length);
+ 	*crat_image = pcrat_image;
+ 	*size = crat_table->length;
+-
+-	return 0;
++out:
++	acpi_put_table(crat_table);
++	return rc;
+ }
+ 
+ /* Memory required to create Virtual CRAT.
+@@ -988,6 +992,7 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
+ 				CRAT_OEMID_LENGTH);
+ 		memcpy(crat_table->oem_table_id, acpi_table->oem_table_id,
+ 				CRAT_OEMTABLEID_LENGTH);
++		acpi_put_table(acpi_table);
+ 	}
+ 	crat_table->total_entries = 0;
+ 	crat_table->num_domains = 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch b/queue-5.10/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch
new file mode 100644
index 00000000000..63d04af9da0
--- /dev/null
+++ b/queue-5.10/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch
@@ -0,0 +1,63 @@
+From 9e8b3809654c271a4bb5f11ac6dcc776a6742eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Oct 2020 16:01:31 -0700
+Subject: drm/aspeed: Fix Kconfig warning & subsequent build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]
+
+Kernel test robot reported build errors (undefined references)
+that didn't make much sense. After reproducing them, there is also
+a Kconfig warning that is the root cause of the build errors, so
+fix that Kconfig problem.
+
+Fixes this Kconfig warning:
+WARNING: unmet direct dependencies detected for CMA
+  Depends on [n]: MMU [=n]
+  Selected by [m]:
+  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]
+
+and these dependent build errors:
+(.text+0x10c8c): undefined reference to `start_isolate_page_range'
+microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
+microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'
+
+Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Cc: Joel Stanley <joel@jms.id.au>
+Cc: Andrew Jeffery <andrew@aj.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Michal Simek <monstr@monstr.eu>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: linux-mm@kvack.org
+Cc: linux-aspeed@lists.ozlabs.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: David Airlie <airlied@linux.ie>
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/aspeed/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
+index 018383cfcfa79..5e95bcea43e92 100644
+--- a/drivers/gpu/drm/aspeed/Kconfig
++++ b/drivers/gpu/drm/aspeed/Kconfig
+@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
+ 	tristate "ASPEED BMC Display Controller"
+ 	depends on DRM && OF
+ 	depends on (COMPILE_TEST || ARCH_ASPEED)
++	depends on MMU
+ 	select DRM_KMS_HELPER
+ 	select DRM_KMS_CMA_HELPER
+ 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-bridge-tpd12s015-fix-irq-registering-in-tpd12s01.patch b/queue-5.10/drm-bridge-tpd12s015-fix-irq-registering-in-tpd12s01.patch
new file mode 100644
index 00000000000..f0db7743b3b
--- /dev/null
+++ b/queue-5.10/drm-bridge-tpd12s015-fix-irq-registering-in-tpd12s01.patch
@@ -0,0 +1,41 @@
+From 230653d947d9fdfa99de1f5c7d1de9b1f0436f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:30:24 +0800
+Subject: drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c2530cc9610d84a5a0118ba40d0f09309605047f ]
+
+gpiod_to_irq() return negative value in case of error,
+the existing code doesn't handle negative error codes.
+If the HPD gpio supports IRQs (gpiod_to_irq returns a
+valid number), we use the IRQ. If it doesn't (gpiod_to_irq
+returns an error), it gets polled via detect().
+
+Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201102143024.26216-1-yuehaibing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-tpd12s015.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+index 514cbf0eac75a..e0e015243a602 100644
+--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c
++++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+@@ -160,7 +160,7 @@ static int tpd12s015_probe(struct platform_device *pdev)
+ 
+ 	/* Register the IRQ if the HPD GPIO is IRQ-capable. */
+ 	tpd->hpd_irq = gpiod_to_irq(tpd->hpd_gpio);
+-	if (tpd->hpd_irq) {
++	if (tpd->hpd_irq >= 0) {
+ 		ret = devm_request_threaded_irq(&pdev->dev, tpd->hpd_irq, NULL,
+ 						tpd12s015_hpd_isr,
+ 						IRQF_TRIGGER_RISING |
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-edid-fix-uninitialized-variable-in-drm_cvt_modes.patch b/queue-5.10/drm-edid-fix-uninitialized-variable-in-drm_cvt_modes.patch
new file mode 100644
index 00000000000..571561932e4
--- /dev/null
+++ b/queue-5.10/drm-edid-fix-uninitialized-variable-in-drm_cvt_modes.patch
@@ -0,0 +1,44 @@
+From dd644bf9a08257ce080926bc0816d7f88bdcfc83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:57:02 -0500
+Subject: drm/edid: Fix uninitialized variable in drm_cvt_modes()
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit 991fcb77f490390bcad89fa67d95763c58cdc04c ]
+
+Noticed this when trying to compile with -Wall on a kernel fork. We
+potentially don't set width here, which causes the compiler to complain
+about width potentially being uninitialized in drm_cvt_modes(). So, let's
+fix that.
+
+Changes since v1:
+* Don't emit an error as this code isn't reachable, just mark it as such
+Changes since v2:
+* Remove now unused variable
+
+Fixes: 3f649ab728cd ("treewide: Remove uninitialized_var() usage")
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201105235703.1328115-1-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 631125b46e04c..b84efd538a702 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -3114,6 +3114,8 @@ static int drm_cvt_modes(struct drm_connector *connector,
+ 		case 0x0c:
+ 			width = height * 15 / 9;
+ 			break;
++		default:
++			unreachable();
+ 		}
+ 
+ 		for (j = 1; j < 5; j++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-gma500-fix-double-free-of-gma_connector.patch b/queue-5.10/drm-gma500-fix-double-free-of-gma_connector.patch
new file mode 100644
index 00000000000..a445466743c
--- /dev/null
+++ b/queue-5.10/drm-gma500-fix-double-free-of-gma_connector.patch
@@ -0,0 +1,45 @@
+From 5407e29bc72226011bac708800718fc98e1beb20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Oct 2020 12:39:28 -0700
+Subject: drm/gma500: fix double free of gma_connector
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]
+
+clang static analysis reports this problem:
+
+cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
+        kfree(gma_connector);
+        ^~~~~~~~~~~~~~~~~~~~
+
+In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
+fails, the handler calls cdv_intel_dp_destroy(connector) which does
+the first free of gma_connector. So adjust the goto label and skip
+the second free.
+
+Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+index 720a767118c9c..deb4fd13591d2 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+@@ -2083,7 +2083,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
+ 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
+ 			drm_encoder_cleanup(encoder);
+ 			cdv_intel_dp_destroy(connector);
+-			goto err_priv;
++			goto err_connector;
+ 		} else {
+         		DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
+ 				intel_dp->dpcd[0], intel_dp->dpcd[1], 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-imx-dcss-fix-rotations-for-vivante-tiled-formats.patch b/queue-5.10/drm-imx-dcss-fix-rotations-for-vivante-tiled-formats.patch
new file mode 100644
index 00000000000..7f358fa16e0
--- /dev/null
+++ b/queue-5.10/drm-imx-dcss-fix-rotations-for-vivante-tiled-formats.patch
@@ -0,0 +1,69 @@
+From b8a7bb976c4a0f08d6927c85d8d25281c9b3d729 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 16:01:25 +0200
+Subject: drm/imx/dcss: fix rotations for Vivante tiled formats
+
+From: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+
+[ Upstream commit 59cb403f38099506ddbe05fd09126f3f0890860b ]
+
+DCSS supports 90/180/270 degree rotations for Vivante tiled and super-tiled
+formats. Unfortunately, with the current code, they didn't work properly.
+
+This simple patch makes the rotations work by fixing the way the scaler is set
+up for 90/270 degree rotations. In this particular case, the source width and
+height need to be swapped since DPR is sending the buffer to scaler already
+rotated.
+
+Also, make sure to allow full rotations for DRM_FORMAT_MOD_VIVANTE_SUPER_TILED.
+
+Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ")
+Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201105140127.25249-2-laurentiu.palcu@oss.nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/dcss/dcss-plane.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/dcss/dcss-plane.c b/drivers/gpu/drm/imx/dcss/dcss-plane.c
+index 961d671f171b4..f54087ac44d35 100644
+--- a/drivers/gpu/drm/imx/dcss/dcss-plane.c
++++ b/drivers/gpu/drm/imx/dcss/dcss-plane.c
+@@ -111,7 +111,8 @@ static bool dcss_plane_can_rotate(const struct drm_format_info *format,
+ 		supported_rotation = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_180 |
+ 				     DRM_MODE_REFLECT_MASK;
+ 	else if (!format->is_yuv &&
+-		 modifier == DRM_FORMAT_MOD_VIVANTE_TILED)
++		 (modifier == DRM_FORMAT_MOD_VIVANTE_TILED ||
++		  modifier == DRM_FORMAT_MOD_VIVANTE_SUPER_TILED))
+ 		supported_rotation = DRM_MODE_ROTATE_MASK |
+ 				     DRM_MODE_REFLECT_MASK;
+ 	else if (format->is_yuv && linear_format &&
+@@ -273,6 +274,7 @@ static void dcss_plane_atomic_update(struct drm_plane *plane,
+ 	u32 src_w, src_h, dst_w, dst_h;
+ 	struct drm_rect src, dst;
+ 	bool enable = true;
++	bool is_rotation_90_or_270;
+ 
+ 	if (!fb || !state->crtc || !state->visible)
+ 		return;
+@@ -311,8 +313,13 @@ static void dcss_plane_atomic_update(struct drm_plane *plane,
+ 
+ 	dcss_plane_atomic_set_base(dcss_plane);
+ 
++	is_rotation_90_or_270 = state->rotation & (DRM_MODE_ROTATE_90 |
++						   DRM_MODE_ROTATE_270);
++
+ 	dcss_scaler_setup(dcss->scaler, dcss_plane->ch_num,
+-			  state->fb->format, src_w, src_h,
++			  state->fb->format,
++			  is_rotation_90_or_270 ? src_h : src_w,
++			  is_rotation_90_or_270 ? src_w : src_h,
+ 			  dst_w, dst_h,
+ 			  drm_mode_vrefresh(&crtc_state->mode));
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-mcde-fix-handling-of-platform_get_irq-error.patch b/queue-5.10/drm-mcde-fix-handling-of-platform_get_irq-error.patch
new file mode 100644
index 00000000000..3ac9fd3014a
--- /dev/null
+++ b/queue-5.10/drm-mcde-fix-handling-of-platform_get_irq-error.patch
@@ -0,0 +1,40 @@
+From 1875c05f3760a7c0a4d7a786f0b3ae8044eb7da2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 09:11:06 +0200
+Subject: drm/mcde: Fix handling of platform_get_irq() error
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e2dae672a9d5e11856fe30ede63467c65f999a81 ]
+
+platform_get_irq() returns -ERRNO on error.  In such case comparison
+to 0 would pass the check.
+
+Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-1-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mcde/mcde_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c
+index 92f8bd907193f..210f5e1630081 100644
+--- a/drivers/gpu/drm/mcde/mcde_drv.c
++++ b/drivers/gpu/drm/mcde/mcde_drv.c
+@@ -331,8 +331,8 @@ static int mcde_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
+-		ret = -EINVAL;
++	if (irq < 0) {
++		ret = irq;
+ 		goto clk_disable;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch b/queue-5.10/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch
new file mode 100644
index 00000000000..07695ca4b40
--- /dev/null
+++ b/queue-5.10/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch
@@ -0,0 +1,47 @@
+From c4132dc00e2b6400951c136b65f0221555268a9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:09:37 +0000
+Subject: drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b097efba9580d1f7cbc80cda84e768983e3de541 ]
+
+Currently there is a null pointer check for hdmi_phy that implies it
+may be null, however a dev_err messages dereferences this potential null
+pointer.  Avoid a null pointer dereference by only emitting the dev_err
+message if hdmi_phy is non-null.  It is a moot point if the error message
+needs to be printed at all, but since this is a relatively new piece of
+code it may be useful to keep the message in for the moment in case there
+are unforseen errors that need to be reported.
+
+Fixes: be28b6507c46 ("drm/mediatek: separate hdmi phy to different file")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Addresses-Coverity: ("Dereference after null check")
+Link: https://lore.kernel.org/r/20201207150937.170435-1-colin.king@canonical.com
+[vkoul: fix indent of return call]
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/mediatek/phy-mtk-hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/mediatek/phy-mtk-hdmi.c b/drivers/phy/mediatek/phy-mtk-hdmi.c
+index 47c029d4b270b..206cc34687223 100644
+--- a/drivers/phy/mediatek/phy-mtk-hdmi.c
++++ b/drivers/phy/mediatek/phy-mtk-hdmi.c
+@@ -84,8 +84,9 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy)
+ 	    hdmi_phy->conf->hdmi_phy_disable_tmds)
+ 		return &mtk_hdmi_phy_dev_ops;
+ 
+-	dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
+-		return NULL;
++	if (hdmi_phy)
++		dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
++	return NULL;
+ }
+ 
+ static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy,
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-mediatek-use-correct-aliases-name-for-ovl.patch b/queue-5.10/drm-mediatek-use-correct-aliases-name-for-ovl.patch
new file mode 100644
index 00000000000..0e1316ffc5b
--- /dev/null
+++ b/queue-5.10/drm-mediatek-use-correct-aliases-name-for-ovl.patch
@@ -0,0 +1,37 @@
+From 14b7156638036e1ffb9dc7e7454b5a544dc44f98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 12:02:04 +0100
+Subject: drm/mediatek: Use correct aliases name for ovl
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 414562b0ef36ce658f0ffec00e7039c7911e4cdc ]
+
+Aliases property name must include only lowercase and '-', so fix this
+in the driver, so we're not tempted to do "ovl_2l0 = &ovl_2l0" in the
+device-tree instead of the right one which is "ovl-2l0 = &ovl_2l0".
+
+Fixes: b17bdd0d7a73 ("drm/mediatek: add component OVL_2L0")
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+index 8eba44be3a8ae..3064eac1a7507 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -359,7 +359,7 @@ static const struct mtk_ddp_comp_funcs ddp_ufoe = {
+ 
+ static const char * const mtk_ddp_comp_stem[MTK_DDP_COMP_TYPE_MAX] = {
+ 	[MTK_DISP_OVL] = "ovl",
+-	[MTK_DISP_OVL_2L] = "ovl_2l",
++	[MTK_DISP_OVL_2L] = "ovl-2l",
+ 	[MTK_DISP_RDMA] = "rdma",
+ 	[MTK_DISP_WDMA] = "wdma",
+ 	[MTK_DISP_COLOR] = "color",
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-dw-hdmi-disable-clocks-on-driver-teardown.patch b/queue-5.10/drm-meson-dw-hdmi-disable-clocks-on-driver-teardown.patch
new file mode 100644
index 00000000000..05298855012
--- /dev/null
+++ b/queue-5.10/drm-meson-dw-hdmi-disable-clocks-on-driver-teardown.patch
@@ -0,0 +1,96 @@
+From fa034924e2b8f5b31bb535099b8c3e02068c1ebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:42:04 +0000
+Subject: drm/meson: dw-hdmi: Disable clocks on driver teardown
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 1dfeea904550c11eccf3fd5f6256e4b0f0208dfe ]
+
+The HDMI driver request clocks early, but never disable them, leaving
+the clocks on even when the driver is removed.
+
+Fix it by slightly refactoring the clock code, and register a devm
+action that will eventually disable/unprepare the enabled clocks.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201120094205.525228-2-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 43 ++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 7f8eea4941472..29623b309cb11 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -145,8 +145,6 @@ struct meson_dw_hdmi {
+ 	struct reset_control *hdmitx_apb;
+ 	struct reset_control *hdmitx_ctrl;
+ 	struct reset_control *hdmitx_phy;
+-	struct clk *hdmi_pclk;
+-	struct clk *venci_clk;
+ 	struct regulator *hdmi_supply;
+ 	u32 irq_stat;
+ 	struct dw_hdmi *hdmi;
+@@ -946,6 +944,29 @@ static void meson_disable_regulator(void *data)
+ 	regulator_disable(data);
+ }
+ 
++static void meson_disable_clk(void *data)
++{
++	clk_disable_unprepare(data);
++}
++
++static int meson_enable_clk(struct device *dev, char *name)
++{
++	struct clk *clk;
++	int ret;
++
++	clk = devm_clk_get(dev, name);
++	if (IS_ERR(clk)) {
++		dev_err(dev, "Unable to get %s pclk\n", name);
++		return PTR_ERR(clk);
++	}
++
++	ret = clk_prepare_enable(clk);
++	if (!ret)
++		ret = devm_add_action_or_reset(dev, meson_disable_clk, clk);
++
++	return ret;
++}
++
+ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 				void *data)
+ {
+@@ -1026,19 +1047,13 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	if (IS_ERR(meson_dw_hdmi->hdmitx))
+ 		return PTR_ERR(meson_dw_hdmi->hdmitx);
+ 
+-	meson_dw_hdmi->hdmi_pclk = devm_clk_get(dev, "isfr");
+-	if (IS_ERR(meson_dw_hdmi->hdmi_pclk)) {
+-		dev_err(dev, "Unable to get HDMI pclk\n");
+-		return PTR_ERR(meson_dw_hdmi->hdmi_pclk);
+-	}
+-	clk_prepare_enable(meson_dw_hdmi->hdmi_pclk);
++	ret = meson_enable_clk(dev, "isfr");
++	if (ret)
++		return ret;
+ 
+-	meson_dw_hdmi->venci_clk = devm_clk_get(dev, "venci");
+-	if (IS_ERR(meson_dw_hdmi->venci_clk)) {
+-		dev_err(dev, "Unable to get venci clk\n");
+-		return PTR_ERR(meson_dw_hdmi->venci_clk);
+-	}
+-	clk_prepare_enable(meson_dw_hdmi->venci_clk);
++	ret = meson_enable_clk(dev, "venci");
++	if (ret)
++		return ret;
+ 
+ 	dw_plat_data->regm = devm_regmap_init(dev, NULL, meson_dw_hdmi,
+ 					      &meson_dw_hdmi_regmap_config);
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-dw-hdmi-enable-the-iahb-clock-early-enough.patch b/queue-5.10/drm-meson-dw-hdmi-enable-the-iahb-clock-early-enough.patch
new file mode 100644
index 00000000000..68a2820b582
--- /dev/null
+++ b/queue-5.10/drm-meson-dw-hdmi-enable-the-iahb-clock-early-enough.patch
@@ -0,0 +1,63 @@
+From f6fbda40900cf2f4fe3c9175dc7fdbf3608820c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:42:05 +0000
+Subject: drm/meson: dw-hdmi: Enable the iahb clock early enough
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 2b6cb81b95d1e8abfb6d32cf194a5bd2992c315c ]
+
+Instead of moving meson_dw_hdmi_init() around which breaks existing
+platform, let's enable the clock meson_dw_hdmi_init() depends on.
+This means we don't have to worry about this clock being enabled or
+not, depending on the boot-loader features.
+
+Fixes: b33340e33acd ("drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Guillaume Tucker <guillaume.tucker@collabora.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+[narmstrong: changed reported by to kernelci.org bot]
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201120094205.525228-3-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 29623b309cb11..aad75a22dc338 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -1051,6 +1051,10 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	if (ret)
+ 		return ret;
+ 
++	ret = meson_enable_clk(dev, "iahb");
++	if (ret)
++		return ret;
++
+ 	ret = meson_enable_clk(dev, "venci");
+ 	if (ret)
+ 		return ret;
+@@ -1086,6 +1090,8 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 
+ 	encoder->possible_crtcs = BIT(0);
+ 
++	meson_dw_hdmi_init(meson_dw_hdmi);
++
+ 	DRM_DEBUG_DRIVER("encoder initialized\n");
+ 
+ 	/* Bridge / Connector */
+@@ -1110,8 +1116,6 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	if (IS_ERR(meson_dw_hdmi->hdmi))
+ 		return PTR_ERR(meson_dw_hdmi->hdmi);
+ 
+-	meson_dw_hdmi_init(meson_dw_hdmi);
+-
+ 	next_bridge = of_drm_find_bridge(pdev->dev.of_node);
+ 	if (next_bridge)
+ 		drm_bridge_attach(encoder, next_bridge,
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-dw-hdmi-ensure-that-clocks-are-enabled-bef.patch b/queue-5.10/drm-meson-dw-hdmi-ensure-that-clocks-are-enabled-bef.patch
new file mode 100644
index 00000000000..7688a7ce534
--- /dev/null
+++ b/queue-5.10/drm-meson-dw-hdmi-ensure-that-clocks-are-enabled-bef.patch
@@ -0,0 +1,54 @@
+From 9422a4a28f56cc779087c45ec96b44eade163199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 20:07:44 +0000
+Subject: drm/meson: dw-hdmi: Ensure that clocks are enabled before touching
+ the TOP registers
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit b33340e33acdfe5ca6a5aa1244709575ae1e0432 ]
+
+Removing the meson-dw-hdmi module and re-inserting it results in a hang
+as the driver writes to HDMITX_TOP_SW_RESET. Similar effects can be seen
+when booting with mainline u-boot and using the u-boot provided DT (which
+is highly desirable).
+
+The reason for the hang seem to be that the clocks are not always
+enabled by the time we enter meson_dw_hdmi_init(). Moving this call
+*after* dw_hdmi_probe() ensures that the clocks are enabled.
+
+Fixes: 1374b8375c2e ("drm/meson: dw_hdmi: add resume/suspend hooks")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-5-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 68826cf9993fc..7f8eea4941472 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -1073,8 +1073,6 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 
+ 	DRM_DEBUG_DRIVER("encoder initialized\n");
+ 
+-	meson_dw_hdmi_init(meson_dw_hdmi);
+-
+ 	/* Bridge / Connector */
+ 
+ 	dw_plat_data->priv_data = meson_dw_hdmi;
+@@ -1097,6 +1095,8 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 	if (IS_ERR(meson_dw_hdmi->hdmi))
+ 		return PTR_ERR(meson_dw_hdmi->hdmi);
+ 
++	meson_dw_hdmi_init(meson_dw_hdmi);
++
+ 	next_bridge = of_drm_find_bridge(pdev->dev.of_node);
+ 	if (next_bridge)
+ 		drm_bridge_attach(encoder, next_bridge,
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-dw-hdmi-register-a-callback-to-disable-the.patch b/queue-5.10/drm-meson-dw-hdmi-register-a-callback-to-disable-the.patch
new file mode 100644
index 00000000000..95de62cebad
--- /dev/null
+++ b/queue-5.10/drm-meson-dw-hdmi-register-a-callback-to-disable-the.patch
@@ -0,0 +1,78 @@
+From de973bb8247026a898d334b04fbb93613ef8d682 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 20:07:43 +0000
+Subject: drm/meson: dw-hdmi: Register a callback to disable the regulator
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 0405f94a1ae0586ca237aec0e859f1b796d6325d ]
+
+Removing the meson-dw-hdmi module results in the following splat:
+
+i[   43.340509] WARNING: CPU: 0 PID: 572 at drivers/regulator/core.c:2125 _regulator_put.part.0+0x16c/0x174
+[...]
+[   43.454870] CPU: 0 PID: 572 Comm: modprobe Tainted: G        W   E     5.10.0-rc4-00049-gd274813a4de3-dirty #2147
+[   43.465042] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
+[   43.471945] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
+[   43.477896] pc : _regulator_put.part.0+0x16c/0x174
+[   43.482638] lr : regulator_put+0x44/0x60
+[...]
+[   43.568715] Call trace:
+[   43.571132]  _regulator_put.part.0+0x16c/0x174
+[   43.575529]  regulator_put+0x44/0x60
+[   43.579067]  devm_regulator_release+0x20/0x2c
+[   43.583380]  release_nodes+0x1c8/0x2b4
+[   43.587087]  devres_release_all+0x44/0x6c
+[   43.591056]  __device_release_driver+0x1a0/0x23c
+[   43.595626]  driver_detach+0xcc/0x160
+[   43.599249]  bus_remove_driver+0x68/0xe0
+[   43.603130]  driver_unregister+0x3c/0x6c
+[   43.607011]  platform_driver_unregister+0x20/0x2c
+[   43.611678]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
+[   43.618485]  __arm64_sys_delete_module+0x1bc/0x294
+
+as the HDMI regulator is still enabled on release.
+
+In order to address this, register a callback that will deal with
+the disabling when the driver is unbound, solving the problem.
+
+Fixes: 161a803fe32d ("drm/meson: dw_hdmi: Add support for an optional external 5V regulator")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-4-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 29a8ff41595d2..68826cf9993fc 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -941,6 +941,11 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
+ 
+ }
+ 
++static void meson_disable_regulator(void *data)
++{
++	regulator_disable(data);
++}
++
+ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 				void *data)
+ {
+@@ -989,6 +994,10 @@ static int meson_dw_hdmi_bind(struct device *dev, struct device *master,
+ 		ret = regulator_enable(meson_dw_hdmi->hdmi_supply);
+ 		if (ret)
+ 			return ret;
++		ret = devm_add_action_or_reset(dev, meson_disable_regulator,
++					       meson_dw_hdmi->hdmi_supply);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	meson_dw_hdmi->hdmitx_apb = devm_reset_control_get_exclusive(dev,
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-free-rdma-resources-after-tearing-down-drm.patch b/queue-5.10/drm-meson-free-rdma-resources-after-tearing-down-drm.patch
new file mode 100644
index 00000000000..744c9095d63
--- /dev/null
+++ b/queue-5.10/drm-meson-free-rdma-resources-after-tearing-down-drm.patch
@@ -0,0 +1,92 @@
+From b242634d05ff7cd27609342b98564dcefb13f4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 20:07:41 +0000
+Subject: drm/meson: Free RDMA resources after tearing down DRM
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit fa62ee25280ff6ae1f720f363263cb5e7743a8c8 ]
+
+Removing the meson DRM module results in the following splat:
+
+[ 2179.451346] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
+[ 2179.458316] Workqueue: events drm_mode_rmfb_work_fn [drm]
+[ 2179.463597] pstate: 80c00009 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
+[ 2179.469558] pc : meson_rdma_writel_sync+0x44/0xb0 [meson_drm]
+[ 2179.475243] lr : meson_g12a_afbcd_reset+0x34/0x60 [meson_drm]
+[ 2179.480930] sp : ffffffc01212bb70
+[ 2179.484207] x29: ffffffc01212bb70 x28: ffffff8044f66f00
+[ 2179.489469] x27: ffffff8045b13800 x26: 0000000000000001
+[ 2179.494730] x25: 0000000000000000 x24: 0000000000000001
+[ 2179.499991] x23: 0000000000000000 x22: 0000000000000000
+[ 2179.505252] x21: 0000000000280000 x20: 0000000000001a01
+[ 2179.510513] x19: ffffff8046029480 x18: 0000000000000000
+[ 2179.515775] x17: 0000000000000000 x16: 0000000000000000
+[ 2179.521036] x15: 0000000000000000 x14: 0000000000000000
+[ 2179.526297] x13: 0040000000000326 x12: 0309030303260300
+[ 2179.531558] x11: 03000000054004a0 x10: 0418054004000400
+[ 2179.536820] x9 : ffffffc008fe4914 x8 : ffffff8040a1adc0
+[ 2179.542081] x7 : 0000000000000000 x6 : ffffff8042aa0080
+[ 2179.547342] x5 : ffffff8044f66f00 x4 : ffffffc008fe5bc8
+[ 2179.552603] x3 : 0000000000010101 x2 : 0000000000000001
+[ 2179.557865] x1 : 0000000000000000 x0 : 0000000000000000
+[ 2179.563127] Call trace:
+[ 2179.565548]  meson_rdma_writel_sync+0x44/0xb0 [meson_drm]
+[ 2179.570894]  meson_g12a_afbcd_reset+0x34/0x60 [meson_drm]
+[ 2179.576241]  meson_plane_atomic_disable+0x38/0xb0 [meson_drm]
+[ 2179.581966]  drm_atomic_helper_commit_planes+0x1e0/0x21c [drm_kms_helper]
+[ 2179.588684]  drm_atomic_helper_commit_tail_rpm+0x68/0xb0 [drm_kms_helper]
+[ 2179.595410]  commit_tail+0xac/0x190 [drm_kms_helper]
+[ 2179.600326]  drm_atomic_helper_commit+0x16c/0x390 [drm_kms_helper]
+[ 2179.606484]  drm_atomic_commit+0x58/0x70 [drm]
+[ 2179.610880]  drm_framebuffer_remove+0x398/0x434 [drm]
+[ 2179.615881]  drm_mode_rmfb_work_fn+0x68/0x8c [drm]
+[ 2179.620575]  process_one_work+0x1cc/0x49c
+[ 2179.624538]  worker_thread+0x200/0x444
+[ 2179.628246]  kthread+0x14c/0x160
+[ 2179.631439]  ret_from_fork+0x10/0x38
+
+caused by the fact that the RDMA buffer has already been freed,
+resulting in meson_rdma_writel_sync() getting a NULL pointer.
+
+Move the afbcd reset and meson_rdma_free calls after the DRM
+unregistration is complete so that the teardown can safely complete.
+
+Fixes: d1b5e41e13a7 ("drm/meson: Add AFBCD module driver")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-2-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 8b9c8dd788c41..324fa489f1c46 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -389,15 +389,15 @@ static void meson_drv_unbind(struct device *dev)
+ 		meson_canvas_free(priv->canvas, priv->canvas_id_vd1_2);
+ 	}
+ 
+-	if (priv->afbcd.ops) {
+-		priv->afbcd.ops->reset(priv);
+-		meson_rdma_free(priv);
+-	}
+-
+ 	drm_dev_unregister(drm);
+ 	drm_irq_uninstall(drm);
+ 	drm_kms_helper_poll_fini(drm);
+ 	drm_dev_put(drm);
++
++	if (priv->afbcd.ops) {
++		priv->afbcd.ops->reset(priv);
++		meson_rdma_free(priv);
++	}
+ }
+ 
+ static const struct component_master_ops meson_drv_master_ops = {
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-meson-unbind-all-connectors-on-module-removal.patch b/queue-5.10/drm-meson-unbind-all-connectors-on-module-removal.patch
new file mode 100644
index 00000000000..2a720fcb2f4
--- /dev/null
+++ b/queue-5.10/drm-meson-unbind-all-connectors-on-module-removal.patch
@@ -0,0 +1,105 @@
+From 36b3820f9c05af1d103fd9ce8841be054f8689dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 20:07:42 +0000
+Subject: drm/meson: Unbind all connectors on module removal
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit e78ad18ba3658fbc8c63629e034b68d8e51acbf1 ]
+
+Removing the meson DRM module results in the following splats:
+
+[   42.689228] WARNING: CPU: 0 PID: 572 at drivers/gpu/drm/drm_irq.c:192 drm_irq_uninstall+0x130/0x160 [drm]
+[...]
+[   42.812820] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
+[   42.819723] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--)
+[   42.825737] pc : drm_irq_uninstall+0x130/0x160 [drm]
+[   42.830647] lr : drm_irq_uninstall+0xc4/0x160 [drm]
+[...]
+[   42.917614] Call trace:
+[   42.920086]  drm_irq_uninstall+0x130/0x160 [drm]
+[   42.924612]  meson_drv_unbind+0x68/0xa4 [meson_drm]
+[   42.929436]  component_del+0xc0/0x180
+[   42.933058]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]
+[   42.938576]  platform_drv_remove+0x38/0x60
+[   42.942628]  __device_release_driver+0x190/0x23c
+[   42.947198]  driver_detach+0xcc/0x160
+[   42.950822]  bus_remove_driver+0x68/0xe0
+[   42.954702]  driver_unregister+0x3c/0x6c
+[   42.958583]  platform_driver_unregister+0x20/0x2c
+[   42.963243]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
+[   42.970057]  __arm64_sys_delete_module+0x1bc/0x294
+[   42.974801]  el0_svc_common.constprop.0+0x80/0x240
+[   42.979542]  do_el0_svc+0x30/0xa0
+[   42.982821]  el0_svc+0x18/0x50
+[   42.985839]  el0_sync_handler+0x198/0x404
+[   42.989806]  el0_sync+0x158/0x180
+
+immediatelly followed by
+
+[   43.002296] WARNING: CPU: 0 PID: 572 at drivers/gpu/drm/drm_mode_config.c:504 drm_mode_config_cleanup+0x2a8/0x304 [drm]
+[...]
+[   43.128150] Hardware name:  , BIOS 2021.01-rc2-00012-gde865f7ee1 11/16/2020
+[   43.135052] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
+[   43.141062] pc : drm_mode_config_cleanup+0x2a8/0x304 [drm]
+[   43.146492] lr : drm_mode_config_cleanup+0xac/0x304 [drm]
+[...]
+[   43.233979] Call trace:
+[   43.236451]  drm_mode_config_cleanup+0x2a8/0x304 [drm]
+[   43.241538]  drm_mode_config_init_release+0x1c/0x2c [drm]
+[   43.246886]  drm_managed_release+0xa8/0x120 [drm]
+[   43.251543]  drm_dev_put+0x94/0xc0 [drm]
+[   43.255380]  meson_drv_unbind+0x78/0xa4 [meson_drm]
+[   43.260204]  component_del+0xc0/0x180
+[   43.263829]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]
+[   43.269344]  platform_drv_remove+0x38/0x60
+[   43.273398]  __device_release_driver+0x190/0x23c
+[   43.277967]  driver_detach+0xcc/0x160
+[   43.281590]  bus_remove_driver+0x68/0xe0
+[   43.285471]  driver_unregister+0x3c/0x6c
+[   43.289352]  platform_driver_unregister+0x20/0x2c
+[   43.294011]  meson_dw_hdmi_platform_driver_exit+0x18/0x4a8 [meson_dw_hdmi]
+[   43.300826]  __arm64_sys_delete_module+0x1bc/0x294
+[   43.305570]  el0_svc_common.constprop.0+0x80/0x240
+[   43.310312]  do_el0_svc+0x30/0xa0
+[   43.313590]  el0_svc+0x18/0x50
+[   43.316608]  el0_sync_handler+0x198/0x404
+[   43.320574]  el0_sync+0x158/0x180
+[   43.323852] ---[ end trace d796a3072dab01da ]---
+[   43.328561] [drm:drm_mode_config_cleanup [drm]] *ERROR* connector HDMI-A-1 leaked!
+
+both triggered by the fact that the HDMI subsystem is still active,
+and the DRM removal doesn't result in the connectors being torn down.
+
+Call drm_atomic_helper_shutdown() and component_unbind_all() to safely
+tear the module down.
+
+Fixes: 2d8f92897ad8 ("drm/meson: Uninstall IRQ handler")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201116200744.495826-3-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 324fa489f1c46..3d1de9cbb1c8d 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -390,8 +390,10 @@ static void meson_drv_unbind(struct device *dev)
+ 	}
+ 
+ 	drm_dev_unregister(drm);
+-	drm_irq_uninstall(drm);
+ 	drm_kms_helper_poll_fini(drm);
++	drm_atomic_helper_shutdown(drm);
++	component_unbind_all(dev, drm);
++	drm_irq_uninstall(drm);
+ 	drm_dev_put(drm);
+ 
+ 	if (priv->afbcd.ops) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-a5xx-clear-shadow-on-suspend.patch b/queue-5.10/drm-msm-a5xx-clear-shadow-on-suspend.patch
new file mode 100644
index 00000000000..8bac2a3b70b
--- /dev/null
+++ b/queue-5.10/drm-msm-a5xx-clear-shadow-on-suspend.patch
@@ -0,0 +1,53 @@
+From 65b42ca48d051db77531ca4505e69d148dfe855f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 10:39:46 -0800
+Subject: drm/msm/a5xx: Clear shadow on suspend
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 5771de5d5b3bfaf279e5c262a113d4b6fbe54355 ]
+
+Similar to the previous patch, clear shadow on suspend to avoid timeouts
+waiting for ringbuffer space.
+
+Fixes: 8907afb476ac ("drm/msm: Allow a5xx to mark the RPTR shadow as privileged")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index d6804a8023555..8aa08976aad17 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1207,7 +1207,9 @@ static int a5xx_pm_resume(struct msm_gpu *gpu)
+ static int a5xx_pm_suspend(struct msm_gpu *gpu)
+ {
+ 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
++	struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+ 	u32 mask = 0xf;
++	int i, ret;
+ 
+ 	/* A510 has 3 XIN ports in VBIF */
+ 	if (adreno_is_a510(adreno_gpu))
+@@ -1227,7 +1229,15 @@ static int a5xx_pm_suspend(struct msm_gpu *gpu)
+ 	gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x003C0000);
+ 	gpu_write(gpu, REG_A5XX_RBBM_BLOCK_SW_RESET_CMD, 0x00000000);
+ 
+-	return msm_gpu_pm_suspend(gpu);
++	ret = msm_gpu_pm_suspend(gpu);
++	if (ret)
++		return ret;
++
++	if (a5xx_gpu->has_whereami)
++		for (i = 0; i < gpu->nr_rings; i++)
++			a5xx_gpu->shadow[i] = 0;
++
++	return 0;
+ }
+ 
+ static int a5xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-a5xx-make-preemption-reset-case-reentrant.patch b/queue-5.10/drm-msm-a5xx-make-preemption-reset-case-reentrant.patch
new file mode 100644
index 00000000000..9f26bb606b2
--- /dev/null
+++ b/queue-5.10/drm-msm-a5xx-make-preemption-reset-case-reentrant.patch
@@ -0,0 +1,61 @@
+From 5120e4d42570960ae277efafaa555febd98484bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 21:02:25 +0100
+Subject: drm/msm: a5xx: Make preemption reset case reentrant
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 7cc29fcdfcc8784e97c5151c848e193800ec79ac ]
+
+nr_rings is reset to 1, but when this function is called for a second
+(and third!) time nr_rings > 1 is false, thus the else case is entered
+to set up a buffer for the RPTR shadow and consequently written to
+RB_RPTR_ADDR, hanging platforms without WHERE_AM_I firmware support.
+
+Restructure the condition in such a way that shadow buffer setup only
+ever happens when has_whereami is true; otherwise preemption is only
+finalized when the number of ring buffers has not been reset to 1 yet.
+
+Fixes: 8907afb476ac ("drm/msm: Allow a5xx to mark the RPTR shadow as privileged")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 8aa08976aad17..69ed2c6094665 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -755,12 +755,8 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
+ 	gpu_write(gpu, REG_A5XX_CP_RB_CNTL,
+ 		MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
+ 
+-	/* Disable preemption if WHERE_AM_I isn't available */
+-	if (!a5xx_gpu->has_whereami && gpu->nr_rings > 1) {
+-		a5xx_preempt_fini(gpu);
+-		gpu->nr_rings = 1;
+-	} else {
+-		/* Create a privileged buffer for the RPTR shadow */
++	/* Create a privileged buffer for the RPTR shadow */
++	if (a5xx_gpu->has_whereami) {
+ 		if (!a5xx_gpu->shadow_bo) {
+ 			a5xx_gpu->shadow = msm_gem_kernel_new(gpu->dev,
+ 				sizeof(u32) * gpu->nr_rings,
+@@ -774,6 +770,10 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
+ 
+ 		gpu_write64(gpu, REG_A5XX_CP_RB_RPTR_ADDR,
+ 			REG_A5XX_CP_RB_RPTR_ADDR_HI, shadowptr(a5xx_gpu, gpu->rb[0]));
++	} else if (gpu->nr_rings > 1) {
++		/* Disable preemption if WHERE_AM_I isn't available */
++		a5xx_preempt_fini(gpu);
++		gpu->nr_rings = 1;
+ 	}
+ 
+ 	a5xx_preempt_hw_init(gpu);
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-a6xx-clear-shadow-on-suspend.patch b/queue-5.10/drm-msm-a6xx-clear-shadow-on-suspend.patch
new file mode 100644
index 00000000000..ab00da3c70b
--- /dev/null
+++ b/queue-5.10/drm-msm-a6xx-clear-shadow-on-suspend.patch
@@ -0,0 +1,59 @@
+From 2494f251d8307829ab1ab7054f8fe3d357b5485a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 10:23:06 -0800
+Subject: drm/msm/a6xx: Clear shadow on suspend
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit e8b0b994c3a5881f0648d53f90435120089c56ad ]
+
+Clear the shadow rptr on suspend.  Otherwise, when we resume, we can
+have a stale value until CP_WHERE_AM_I executes.  If we suspend near
+the ringbuffer wraparound point, this can lead to a chicken/egg
+situation where we are waiting for ringbuffer space to write the
+CP_WHERE_AM_I (or CP_INIT) packet, because we mistakenly believe that
+the ringbuffer is full (due to stale rptr value in the shadow).
+
+Fixes errors like:
+
+  [drm:adreno_wait_ring [msm]] *ERROR* timeout waiting for space in ringbuffer 0
+
+in the resume path.
+
+Fixes: d3a569fccfa0 ("drm/msm: a6xx: Use WHERE_AM_I for eligible targets")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 948f3656c20ca..420ca4a0eb5f7 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1045,12 +1045,21 @@ static int a6xx_pm_suspend(struct msm_gpu *gpu)
+ {
+ 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+ 	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
++	int i, ret;
+ 
+ 	trace_msm_gpu_suspend(0);
+ 
+ 	devfreq_suspend_device(gpu->devfreq.devfreq);
+ 
+-	return a6xx_gmu_stop(a6xx_gpu);
++	ret = a6xx_gmu_stop(a6xx_gpu);
++	if (ret)
++		return ret;
++
++	if (adreno_gpu->base.hw_apriv || a6xx_gpu->has_whereami)
++		for (i = 0; i < gpu->nr_rings; i++)
++			a6xx_gpu->shadow[i] = 0;
++
++	return 0;
+ }
+ 
+ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-add-iommu_support-dependency.patch b/queue-5.10/drm-msm-add-iommu_support-dependency.patch
new file mode 100644
index 00000000000..2a498c921e6
--- /dev/null
+++ b/queue-5.10/drm-msm-add-iommu_support-dependency.patch
@@ -0,0 +1,45 @@
+From 7ef7372335aebd65ca3c1a6a90e16ab45d27083c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 00:13:38 +0100
+Subject: drm/msm: add IOMMU_SUPPORT dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e319a1b956f785f618611857cd946dca2bb68542 ]
+
+The iommu pgtable support is only available when IOMMU support
+is built into the kernel:
+
+WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE
+  Depends on [n]: IOMMU_SUPPORT [=n]
+  Selected by [y]:
+  - DRM_MSM [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARCH_QCOM [=y] || SOC_IMX5 || ARM && COMPILE_TEST [=y]) && OF [=y] && COMMON_CLK [=y] && MMU [=y] && (QCOM_OCMEM [=y] || QCOM_OCMEM [=y]=n)
+
+Fix the dependency accordingly. There is no need for depending on
+CONFIG_MMU any more, as that is implied by the iommu support.
+
+Fixes: b145c6e65eb0 ("drm/msm: Add support to create a local pagetable")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
+index e5816b4984942..dabb4a1ccdcf7 100644
+--- a/drivers/gpu/drm/msm/Kconfig
++++ b/drivers/gpu/drm/msm/Kconfig
+@@ -4,8 +4,8 @@ config DRM_MSM
+ 	tristate "MSM DRM"
+ 	depends on DRM
+ 	depends on ARCH_QCOM || SOC_IMX5 || (ARM && COMPILE_TEST)
++	depends on IOMMU_SUPPORT
+ 	depends on OF && COMMON_CLK
+-	depends on MMU
+ 	depends on QCOM_OCMEM || QCOM_OCMEM=n
+ 	select IOMMU_IO_PGTABLE
+ 	select QCOM_MDT_LOADER if ARCH_QCOM
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-add-missing-stub-definition.patch b/queue-5.10/drm-msm-add-missing-stub-definition.patch
new file mode 100644
index 00000000000..a0e06117891
--- /dev/null
+++ b/queue-5.10/drm-msm-add-missing-stub-definition.patch
@@ -0,0 +1,39 @@
+From 25fc92ecdb336651b458b00d9526bdf3d64142d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 12:48:37 +0000
+Subject: drm/msm: Add missing stub definition
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit a0b21e0ad29420b04911a98d360b9586168eeae5 ]
+
+DRM_MSM fails to build with DRM_MSM_DP=n; add the missing stub.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
+index b9dd8f8f48872..0b2686b060c73 100644
+--- a/drivers/gpu/drm/msm/msm_drv.h
++++ b/drivers/gpu/drm/msm/msm_drv.h
+@@ -423,6 +423,11 @@ static inline int msm_dp_display_disable(struct msm_dp *dp,
+ {
+ 	return -EINVAL;
+ }
++static inline int msm_dp_display_pre_disable(struct msm_dp *dp,
++					struct drm_encoder *encoder)
++{
++	return -EINVAL;
++}
+ static inline void msm_dp_display_mode_set(struct msm_dp *dp,
+ 				struct drm_encoder *encoder,
+ 				struct drm_display_mode *mode,
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dp-displayport-phy-compliance-tests-fixup.patch b/queue-5.10/drm-msm-dp-displayport-phy-compliance-tests-fixup.patch
new file mode 100644
index 00000000000..036390b8731
--- /dev/null
+++ b/queue-5.10/drm-msm-dp-displayport-phy-compliance-tests-fixup.patch
@@ -0,0 +1,105 @@
+From 664a32087391e9bcd1889522beea741291852bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Sep 2020 21:50:48 -0700
+Subject: drm/msm/dp: DisplayPort PHY compliance tests fixup
+
+From: Tanmay Shah <tanmay@codeaurora.org>
+
+[ Upstream commit 6625e2637d93d2f52ef0d17656f21bfa2cb4983a ]
+
+Bandwidth code was being used as test link rate. Fix this by converting
+bandwidth code to test link rate
+
+Do not reset voltage and pre-emphasis level during IRQ HPD attention
+interrupt. Also fix pre-emphasis parsing during test link status process
+
+Signed-off-by: Tanmay Shah <tanmay@codeaurora.org>
+Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c    |  3 ---
+ drivers/gpu/drm/msm/dp/dp_display.c |  1 +
+ drivers/gpu/drm/msm/dp/dp_link.c    | 12 +++++++++++-
+ drivers/gpu/drm/msm/dp/dp_link.h    |  1 +
+ 4 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 2e3e1917351f0..872b12689e317 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1643,9 +1643,6 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
+ 	if (rc)
+ 		return rc;
+ 
+-	ctrl->link->phy_params.p_level = 0;
+-	ctrl->link->phy_params.v_level = 0;
+-
+ 	while (--link_train_max_retries &&
+ 		!atomic_read(&ctrl->dp_ctrl.aborted)) {
+ 		rc = dp_ctrl_reinitialize_mainlink(ctrl);
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index e175aa3fd3a93..ae9989ece73f4 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -335,6 +335,7 @@ static int dp_display_process_hpd_high(struct dp_display_private *dp)
+ 	dp->dp_display.max_pclk_khz = DP_MAX_PIXEL_CLK_KHZ;
+ 	dp->dp_display.max_dp_lanes = dp->parser->max_dp_lanes;
+ 
++	dp_link_reset_phy_params_vx_px(dp->link);
+ 	rc = dp_ctrl_on_link(dp->ctrl);
+ 	if (rc) {
+ 		DRM_ERROR("failed to complete DP link training\n");
+diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c
+index c811da515fb3b..49d7fad36fc4e 100644
+--- a/drivers/gpu/drm/msm/dp/dp_link.c
++++ b/drivers/gpu/drm/msm/dp/dp_link.c
+@@ -869,6 +869,9 @@ static int dp_link_parse_vx_px(struct dp_link_private *link)
+ 		drm_dp_get_adjust_request_voltage(link->link_status, 0);
+ 	link->dp_link.phy_params.p_level =
+ 		drm_dp_get_adjust_request_pre_emphasis(link->link_status, 0);
++
++	link->dp_link.phy_params.p_level >>= DP_TRAIN_PRE_EMPHASIS_SHIFT;
++
+ 	DRM_DEBUG_DP("Requested: v_level = 0x%x, p_level = 0x%x\n",
+ 			link->dp_link.phy_params.v_level,
+ 			link->dp_link.phy_params.p_level);
+@@ -911,7 +914,8 @@ static int dp_link_process_phy_test_pattern_request(
+ 			link->request.test_lane_count);
+ 
+ 	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
+-	link->dp_link.link_params.rate = link->request.test_link_rate;
++	link->dp_link.link_params.rate =
++		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
+ 
+ 	ret = dp_link_parse_vx_px(link);
+ 
+@@ -1156,6 +1160,12 @@ int dp_link_adjust_levels(struct dp_link *dp_link, u8 *link_status)
+ 	return 0;
+ }
+ 
++void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link)
++{
++	dp_link->phy_params.v_level = 0;
++	dp_link->phy_params.p_level = 0;
++}
++
+ u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp)
+ {
+ 	u32 tbd;
+diff --git a/drivers/gpu/drm/msm/dp/dp_link.h b/drivers/gpu/drm/msm/dp/dp_link.h
+index 49811b6221e53..9dd4dd9265304 100644
+--- a/drivers/gpu/drm/msm/dp/dp_link.h
++++ b/drivers/gpu/drm/msm/dp/dp_link.h
+@@ -135,6 +135,7 @@ static inline u32 dp_link_bit_depth_to_bpc(u32 tbd)
+ 	}
+ }
+ 
++void dp_link_reset_phy_params_vx_px(struct dp_link *dp_link);
+ u32 dp_link_get_test_bits_depth(struct dp_link *dp_link, u32 bpp);
+ int dp_link_process_request(struct dp_link *dp_link);
+ int dp_link_get_colorimetry_config(struct dp_link *dp_link);
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dp-do-not-notify-audio-subsystem-if-sink-doe.patch b/queue-5.10/drm-msm-dp-do-not-notify-audio-subsystem-if-sink-doe.patch
new file mode 100644
index 00000000000..9ce896fb352
--- /dev/null
+++ b/queue-5.10/drm-msm-dp-do-not-notify-audio-subsystem-if-sink-doe.patch
@@ -0,0 +1,51 @@
+From c5f885b3fa2d715ee9f1944db60d98541c7bcb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 17:10:23 -0800
+Subject: drm/msm/dp: do not notify audio subsystem if sink doesn't support
+ audio
+
+From: Abhinav Kumar <abhinavk@codeaurora.org>
+
+[ Upstream commit e8c765811b1064c200829eacf237ac8c25e79cd0 ]
+
+For sinks that do not support audio, there is no need to notify
+audio subsystem of the connection event.
+
+This will make sure that audio routes only to the primary display
+when connected to such sinks.
+
+changes in v2:
+  - Added fixes tag
+  - Removed nested if condition and removed usage of global pointer
+
+Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM")
+Signed-off-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index 8703c63d85c87..fe0279542a1c2 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -563,7 +563,14 @@ static int dp_connect_pending_timeout(struct dp_display_private *dp, u32 data)
+ static void dp_display_handle_plugged_change(struct msm_dp *dp_display,
+ 		bool plugged)
+ {
+-	if (dp_display->plugged_cb && dp_display->codec_dev)
++	struct dp_display_private *dp;
++
++	dp = container_of(dp_display,
++			struct dp_display_private, dp_display);
++
++	/* notify audio subsystem only if sink supports audio */
++	if (dp_display->plugged_cb && dp_display->codec_dev &&
++			dp->audio_supported)
+ 		dp_display->plugged_cb(dp_display->codec_dev, plugged);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dp-return-correct-connection-status-after-su.patch b/queue-5.10/drm-msm-dp-return-correct-connection-status-after-su.patch
new file mode 100644
index 00000000000..4a5290ec0cc
--- /dev/null
+++ b/queue-5.10/drm-msm-dp-return-correct-connection-status-after-su.patch
@@ -0,0 +1,440 @@
+From a7a6f88bd587208f2eb68868a7768c17cd5305de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 14:53:35 -0800
+Subject: drm/msm/dp: return correct connection status after suspend
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 19e52bcb27c2ba140699d2230d722366d7d048a1 ]
+
+During suspend, dp host controller and hpd block are disabled due to
+both ahb and aux clock are disabled. Therefore hpd plug/unplug interrupts
+will not be generated. At dp_pm_resume(), reinitialize both dp host
+controller and hpd block so that hpd plug/unplug interrupts will be
+generated and handled by driver so that hpd connection state is updated
+correctly. This patch will fix link training flaky issues.
+
+Changes in v2:
+-- use container_of to cast correct dp_display_private pointer
+   at both dp_pm_suspend() and dp_pm_resume().
+
+Changes in v3:
+-- replace hpd_state atomic_t  with u32
+
+Changes in v4
+-- call dp_display_host_deinit() at dp_pm_suspend()
+-- call dp_display_host_init() at msm_dp_display_enable()
+-- fix phy->init_count unbalance which causes link training failed
+
+Changes in v5
+--  add Fixes tag
+
+Fixes:  8ede2ecc3e5e (drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets)
+Tested-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_catalog.c |  13 +++
+ drivers/gpu/drm/msm/dp/dp_catalog.h |   1 +
+ drivers/gpu/drm/msm/dp/dp_ctrl.c    |   5 +
+ drivers/gpu/drm/msm/dp/dp_display.c | 144 +++++++++++++++-------------
+ drivers/gpu/drm/msm/dp/dp_reg.h     |   2 +
+ 5 files changed, 97 insertions(+), 68 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c
+index b15b4ce4ba35a..4963bfe6a4726 100644
+--- a/drivers/gpu/drm/msm/dp/dp_catalog.c
++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c
+@@ -572,6 +572,19 @@ void dp_catalog_ctrl_hpd_config(struct dp_catalog *dp_catalog)
+ 	dp_write_aux(catalog, REG_DP_DP_HPD_CTRL, DP_DP_HPD_CTRL_HPD_EN);
+ }
+ 
++u32 dp_catalog_hpd_get_state_status(struct dp_catalog *dp_catalog)
++{
++	struct dp_catalog_private *catalog = container_of(dp_catalog,
++				struct dp_catalog_private, dp_catalog);
++	u32 status;
++
++	status = dp_read_aux(catalog, REG_DP_DP_HPD_INT_STATUS);
++	status >>= DP_DP_HPD_STATE_STATUS_BITS_SHIFT;
++	status &= DP_DP_HPD_STATE_STATUS_BITS_MASK;
++
++	return status;
++}
++
+ u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog)
+ {
+ 	struct dp_catalog_private *catalog = container_of(dp_catalog,
+diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.h b/drivers/gpu/drm/msm/dp/dp_catalog.h
+index 4b7666f1fe6fe..6d257dbebf294 100644
+--- a/drivers/gpu/drm/msm/dp/dp_catalog.h
++++ b/drivers/gpu/drm/msm/dp/dp_catalog.h
+@@ -97,6 +97,7 @@ void dp_catalog_ctrl_enable_irq(struct dp_catalog *dp_catalog, bool enable);
+ void dp_catalog_hpd_config_intr(struct dp_catalog *dp_catalog,
+ 			u32 intr_mask, bool en);
+ void dp_catalog_ctrl_hpd_config(struct dp_catalog *dp_catalog);
++u32 dp_catalog_hpd_get_state_status(struct dp_catalog *dp_catalog);
+ u32 dp_catalog_hpd_get_intr_status(struct dp_catalog *dp_catalog);
+ void dp_catalog_ctrl_phy_reset(struct dp_catalog *dp_catalog);
+ int dp_catalog_ctrl_update_vx_px(struct dp_catalog *dp_catalog, u8 v_level,
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 872b12689e317..cee161c8ecc67 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1400,6 +1400,8 @@ int dp_ctrl_host_init(struct dp_ctrl *dp_ctrl, bool flip)
+ void dp_ctrl_host_deinit(struct dp_ctrl *dp_ctrl)
+ {
+ 	struct dp_ctrl_private *ctrl;
++	struct dp_io *dp_io;
++	struct phy *phy;
+ 
+ 	if (!dp_ctrl) {
+ 		DRM_ERROR("Invalid input data\n");
+@@ -1407,8 +1409,11 @@ void dp_ctrl_host_deinit(struct dp_ctrl *dp_ctrl)
+ 	}
+ 
+ 	ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl);
++	dp_io = &ctrl->parser->io;
++	phy = dp_io->phy;
+ 
+ 	dp_catalog_ctrl_enable_irq(ctrl->catalog, false);
++	phy_exit(phy);
+ 
+ 	DRM_DEBUG_DP("Host deinitialized successfully\n");
+ }
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index ae9989ece73f4..8703c63d85c87 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -108,14 +108,12 @@ struct dp_display_private {
+ 	/* event related only access by event thread */
+ 	struct mutex event_mutex;
+ 	wait_queue_head_t event_q;
+-	atomic_t hpd_state;
++	u32 hpd_state;
+ 	u32 event_pndx;
+ 	u32 event_gndx;
+ 	struct dp_event event_list[DP_EVENT_Q_MAX];
+ 	spinlock_t event_lock;
+ 
+-	struct completion resume_comp;
+-
+ 	struct dp_audio *audio;
+ };
+ 
+@@ -367,6 +365,20 @@ static void dp_display_host_init(struct dp_display_private *dp)
+ 	dp->core_initialized = true;
+ }
+ 
++static void dp_display_host_deinit(struct dp_display_private *dp)
++{
++	if (!dp->core_initialized) {
++		DRM_DEBUG_DP("DP core not initialized\n");
++		return;
++	}
++
++	dp_ctrl_host_deinit(dp->ctrl);
++	dp_aux_deinit(dp->aux);
++	dp_power_deinit(dp->power);
++
++	dp->core_initialized = false;
++}
++
+ static int dp_display_usbpd_configure_cb(struct device *dev)
+ {
+ 	int rc = 0;
+@@ -491,7 +503,7 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data)
+ 
+ 	mutex_lock(&dp->event_mutex);
+ 
+-	state =  atomic_read(&dp->hpd_state);
++	state =  dp->hpd_state;
+ 	if (state == ST_SUSPEND_PENDING) {
+ 		mutex_unlock(&dp->event_mutex);
+ 		return 0;
+@@ -509,17 +521,14 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data)
+ 		return 0;
+ 	}
+ 
+-	if (state == ST_SUSPENDED)
+-		tout = DP_TIMEOUT_NONE;
+-
+-	atomic_set(&dp->hpd_state, ST_CONNECT_PENDING);
++	dp->hpd_state = ST_CONNECT_PENDING;
+ 
+ 	hpd->hpd_high = 1;
+ 
+ 	ret = dp_display_usbpd_configure_cb(&dp->pdev->dev);
+ 	if (ret) {	/* failed */
+ 		hpd->hpd_high = 0;
+-		atomic_set(&dp->hpd_state, ST_DISCONNECTED);
++		dp->hpd_state = ST_DISCONNECTED;
+ 	}
+ 
+ 	/* start sanity checking */
+@@ -540,10 +549,10 @@ static int dp_connect_pending_timeout(struct dp_display_private *dp, u32 data)
+ 
+ 	mutex_lock(&dp->event_mutex);
+ 
+-	state =  atomic_read(&dp->hpd_state);
++	state = dp->hpd_state;
+ 	if (state == ST_CONNECT_PENDING) {
+ 		dp_display_enable(dp, 0);
+-		atomic_set(&dp->hpd_state, ST_CONNECTED);
++		dp->hpd_state = ST_CONNECTED;
+ 	}
+ 
+ 	mutex_unlock(&dp->event_mutex);
+@@ -568,7 +577,7 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
+ 
+ 	mutex_lock(&dp->event_mutex);
+ 
+-	state = atomic_read(&dp->hpd_state);
++	state = dp->hpd_state;
+ 	if (state == ST_SUSPEND_PENDING) {
+ 		mutex_unlock(&dp->event_mutex);
+ 		return 0;
+@@ -586,7 +595,7 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
+ 		return 0;
+ 	}
+ 
+-	atomic_set(&dp->hpd_state, ST_DISCONNECT_PENDING);
++	dp->hpd_state = ST_DISCONNECT_PENDING;
+ 
+ 	/* disable HPD plug interrupt until disconnect is done */
+ 	dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK
+@@ -621,10 +630,10 @@ static int dp_disconnect_pending_timeout(struct dp_display_private *dp, u32 data
+ 
+ 	mutex_lock(&dp->event_mutex);
+ 
+-	state =  atomic_read(&dp->hpd_state);
++	state =  dp->hpd_state;
+ 	if (state == ST_DISCONNECT_PENDING) {
+ 		dp_display_disable(dp, 0);
+-		atomic_set(&dp->hpd_state, ST_DISCONNECTED);
++		dp->hpd_state = ST_DISCONNECTED;
+ 	}
+ 
+ 	mutex_unlock(&dp->event_mutex);
+@@ -639,7 +648,7 @@ static int dp_irq_hpd_handle(struct dp_display_private *dp, u32 data)
+ 	mutex_lock(&dp->event_mutex);
+ 
+ 	/* irq_hpd can happen at either connected or disconnected state */
+-	state =  atomic_read(&dp->hpd_state);
++	state =  dp->hpd_state;
+ 	if (state == ST_SUSPEND_PENDING) {
+ 		mutex_unlock(&dp->event_mutex);
+ 		return 0;
+@@ -790,17 +799,10 @@ static int dp_display_enable(struct dp_display_private *dp, u32 data)
+ 
+ 	dp_display = g_dp_display;
+ 
+-	if (dp_display->power_on) {
+-		DRM_DEBUG_DP("Link already setup, return\n");
+-		return 0;
+-	}
+-
+ 	rc = dp_ctrl_on_stream(dp->ctrl);
+ 	if (!rc)
+ 		dp_display->power_on = true;
+ 
+-	/* complete resume_comp regardless it is armed or not */
+-	complete(&dp->resume_comp);
+ 	return rc;
+ }
+ 
+@@ -829,9 +831,6 @@ static int dp_display_disable(struct dp_display_private *dp, u32 data)
+ 
+ 	dp_display = g_dp_display;
+ 
+-	if (!dp_display->power_on)
+-		return -EINVAL;
+-
+ 	/* wait only if audio was enabled */
+ 	if (dp_display->audio_enabled) {
+ 		if (!wait_for_completion_timeout(&dp->audio_comp,
+@@ -1152,9 +1151,6 @@ static int dp_display_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	mutex_init(&dp->event_mutex);
+-
+-	init_completion(&dp->resume_comp);
+-
+ 	g_dp_display = &dp->dp_display;
+ 
+ 	/* Store DP audio handle inside DP display */
+@@ -1190,20 +1186,54 @@ static int dp_display_remove(struct platform_device *pdev)
+ 
+ static int dp_pm_resume(struct device *dev)
+ {
++	struct platform_device *pdev = to_platform_device(dev);
++	struct msm_dp *dp_display = platform_get_drvdata(pdev);
++	struct dp_display_private *dp;
++	u32 status;
++
++	dp = container_of(dp_display, struct dp_display_private, dp_display);
++
++	mutex_lock(&dp->event_mutex);
++
++	/* start from disconnected state */
++	dp->hpd_state = ST_DISCONNECTED;
++
++	/* turn on dp ctrl/phy */
++	dp_display_host_init(dp);
++
++	dp_catalog_ctrl_hpd_config(dp->catalog);
++
++	status = dp_catalog_hpd_get_state_status(dp->catalog);
++
++	if (status) {
++		dp->dp_display.is_connected = true;
++	} else {
++		dp->dp_display.is_connected = false;
++		/* make sure next resume host_init be called */
++		dp->core_initialized = false;
++	}
++
++	mutex_unlock(&dp->event_mutex);
++
+ 	return 0;
+ }
+ 
+ static int dp_pm_suspend(struct device *dev)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+-	struct dp_display_private *dp = platform_get_drvdata(pdev);
++	struct msm_dp *dp_display = platform_get_drvdata(pdev);
++	struct dp_display_private *dp;
+ 
+-	if (!dp) {
+-		DRM_ERROR("DP driver bind failed. Invalid driver data\n");
+-		return -EINVAL;
+-	}
++	dp = container_of(dp_display, struct dp_display_private, dp_display);
+ 
+-	atomic_set(&dp->hpd_state, ST_SUSPENDED);
++	mutex_lock(&dp->event_mutex);
++
++	if (dp->core_initialized == true)
++		dp_display_host_deinit(dp);
++
++	dp->hpd_state = ST_SUSPENDED;
++
++	mutex_unlock(&dp->event_mutex);
+ 
+ 	return 0;
+ }
+@@ -1318,19 +1348,6 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev,
+ 	return 0;
+ }
+ 
+-static int dp_display_wait4resume_done(struct dp_display_private *dp)
+-{
+-	int ret = 0;
+-
+-	reinit_completion(&dp->resume_comp);
+-	if (!wait_for_completion_timeout(&dp->resume_comp,
+-				WAIT_FOR_RESUME_TIMEOUT_JIFFIES)) {
+-		DRM_ERROR("wait4resume_done timedout\n");
+-		ret = -ETIMEDOUT;
+-	}
+-	return ret;
+-}
+-
+ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
+ {
+ 	int rc = 0;
+@@ -1345,6 +1362,8 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
+ 
+ 	mutex_lock(&dp_display->event_mutex);
+ 
++	dp_del_event(dp_display, EV_CONNECT_PENDING_TIMEOUT);
++
+ 	rc = dp_display_set_mode(dp, &dp_display->dp_mode);
+ 	if (rc) {
+ 		DRM_ERROR("Failed to perform a mode set, rc=%d\n", rc);
+@@ -1359,15 +1378,10 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
+ 		return rc;
+ 	}
+ 
+-	state =  atomic_read(&dp_display->hpd_state);
+-	if (state == ST_SUSPENDED) {
+-		/* start link training */
+-		dp_add_event(dp_display, EV_HPD_PLUG_INT, 0, 0);
+-		mutex_unlock(&dp_display->event_mutex);
++	state =  dp_display->hpd_state;
+ 
+-		/* wait until dp interface is up */
+-		goto resume_done;
+-	}
++	if (state == ST_SUSPEND_PENDING)
++		dp_display_host_init(dp_display);
+ 
+ 	dp_display_enable(dp_display, 0);
+ 
+@@ -1378,21 +1392,15 @@ int msm_dp_display_enable(struct msm_dp *dp, struct drm_encoder *encoder)
+ 		dp_display_unprepare(dp);
+ 	}
+ 
+-	dp_del_event(dp_display, EV_CONNECT_PENDING_TIMEOUT);
+-
+ 	if (state == ST_SUSPEND_PENDING)
+ 		dp_add_event(dp_display, EV_IRQ_HPD_INT, 0, 0);
+ 
+ 	/* completed connection */
+-	atomic_set(&dp_display->hpd_state, ST_CONNECTED);
++	dp_display->hpd_state = ST_CONNECTED;
+ 
+ 	mutex_unlock(&dp_display->event_mutex);
+ 
+ 	return rc;
+-
+-resume_done:
+-	dp_display_wait4resume_done(dp_display);
+-	return rc;
+ }
+ 
+ int msm_dp_display_pre_disable(struct msm_dp *dp, struct drm_encoder *encoder)
+@@ -1416,20 +1424,20 @@ int msm_dp_display_disable(struct msm_dp *dp, struct drm_encoder *encoder)
+ 
+ 	mutex_lock(&dp_display->event_mutex);
+ 
++	dp_del_event(dp_display, EV_DISCONNECT_PENDING_TIMEOUT);
++
+ 	dp_display_disable(dp_display, 0);
+ 
+ 	rc = dp_display_unprepare(dp);
+ 	if (rc)
+ 		DRM_ERROR("DP display unprepare failed, rc=%d\n", rc);
+ 
+-	dp_del_event(dp_display, EV_DISCONNECT_PENDING_TIMEOUT);
+-
+-	state =  atomic_read(&dp_display->hpd_state);
++	state =  dp_display->hpd_state;
+ 	if (state == ST_DISCONNECT_PENDING) {
+ 		/* completed disconnection */
+-		atomic_set(&dp_display->hpd_state, ST_DISCONNECTED);
++		dp_display->hpd_state = ST_DISCONNECTED;
+ 	} else {
+-		atomic_set(&dp_display->hpd_state, ST_SUSPEND_PENDING);
++		dp_display->hpd_state = ST_SUSPEND_PENDING;
+ 	}
+ 
+ 	mutex_unlock(&dp_display->event_mutex);
+diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
+index 43042ff90a199..268602803d9a3 100644
+--- a/drivers/gpu/drm/msm/dp/dp_reg.h
++++ b/drivers/gpu/drm/msm/dp/dp_reg.h
+@@ -32,6 +32,8 @@
+ #define DP_DP_IRQ_HPD_INT_ACK			(0x00000002)
+ #define DP_DP_HPD_REPLUG_INT_ACK		(0x00000004)
+ #define DP_DP_HPD_UNPLUG_INT_ACK		(0x00000008)
++#define DP_DP_HPD_STATE_STATUS_BITS_MASK	(0x0000000F)
++#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT	(0x1C)
+ 
+ #define REG_DP_DP_HPD_INT_MASK			(0x0000000C)
+ #define DP_DP_HPD_PLUG_INT_MASK			(0x00000001)
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dp-skip-checking-link_status_updated-bit.patch b/queue-5.10/drm-msm-dp-skip-checking-link_status_updated-bit.patch
new file mode 100644
index 00000000000..7012c629acd
--- /dev/null
+++ b/queue-5.10/drm-msm-dp-skip-checking-link_status_updated-bit.patch
@@ -0,0 +1,114 @@
+From f76fd2dae94a31d8f0e6608f064806f797633f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 12:49:01 -0800
+Subject: drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit ea530388e64bd584645f2d89e40ca7dffade8eff ]
+
+Some dongle will not clear LINK_STATUS_UPDATED bit after
+DPCD read which cause link training failed. This patch
+just read 6 bytes of DPCD link status from sink and return
+without checking LINK_STATUS_UPDATED bit.
+Only 8 bits are used to represent link rate at sinker DPCD.
+The really link rate is 2.7Mb times the 8 bits value.
+For example, 0x0A at DPCD is equal to 2.7Gb (10 * 2.7Mb).
+This patch also convert 8 bits value of DPCD to really link
+rate to fix worng link rate error during phy compliance test.
+
+Fixes: 6625e2637d93 ("drm/msm/dp: DisplayPort PHY compliance tests fixup")
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 20 ++++++--------------
+ drivers/gpu/drm/msm/dp/dp_link.c | 29 ++++++++++++++---------------
+ 2 files changed, 20 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index cee161c8ecc67..c83a1650437da 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1061,23 +1061,15 @@ static bool dp_ctrl_train_pattern_set(struct dp_ctrl_private *ctrl,
+ static int dp_ctrl_read_link_status(struct dp_ctrl_private *ctrl,
+ 				    u8 *link_status)
+ {
+-	int len = 0;
+-	u32 const offset = DP_LANE_ALIGN_STATUS_UPDATED - DP_LANE0_1_STATUS;
+-	u32 link_status_read_max_retries = 100;
+-
+-	while (--link_status_read_max_retries) {
+-		len = drm_dp_dpcd_read_link_status(ctrl->aux,
+-			link_status);
+-		if (len != DP_LINK_STATUS_SIZE) {
+-			DRM_ERROR("DP link status read failed, err: %d\n", len);
+-			return len;
+-		}
++	int ret = 0, len;
+ 
+-		if (!(link_status[offset] & DP_LINK_STATUS_UPDATED))
+-			return 0;
++	len = drm_dp_dpcd_read_link_status(ctrl->aux, link_status);
++	if (len != DP_LINK_STATUS_SIZE) {
++		DRM_ERROR("DP link status read failed, err: %d\n", len);
++		ret = -EINVAL;
+ 	}
+ 
+-	return -ETIMEDOUT;
++	return ret;
+ }
+ 
+ static int dp_ctrl_link_train_1(struct dp_ctrl_private *ctrl,
+diff --git a/drivers/gpu/drm/msm/dp/dp_link.c b/drivers/gpu/drm/msm/dp/dp_link.c
+index 49d7fad36fc4e..be986da78c4a5 100644
+--- a/drivers/gpu/drm/msm/dp/dp_link.c
++++ b/drivers/gpu/drm/msm/dp/dp_link.c
+@@ -773,7 +773,8 @@ static int dp_link_process_link_training_request(struct dp_link_private *link)
+ 			link->request.test_lane_count);
+ 
+ 	link->dp_link.link_params.num_lanes = link->request.test_lane_count;
+-	link->dp_link.link_params.rate = link->request.test_link_rate;
++	link->dp_link.link_params.rate = 
++		drm_dp_bw_code_to_link_rate(link->request.test_link_rate);
+ 
+ 	return 0;
+ }
+@@ -943,22 +944,20 @@ static u8 get_link_status(const u8 link_status[DP_LINK_STATUS_SIZE], int r)
+  */
+ static int dp_link_process_link_status_update(struct dp_link_private *link)
+ {
+-	if (!(get_link_status(link->link_status,
+-				DP_LANE_ALIGN_STATUS_UPDATED) &
+-				DP_LINK_STATUS_UPDATED) ||
+-			(drm_dp_clock_recovery_ok(link->link_status,
+-					link->dp_link.link_params.num_lanes) &&
+-			drm_dp_channel_eq_ok(link->link_status,
+-					link->dp_link.link_params.num_lanes)))
+-		return -EINVAL;
++       bool channel_eq_done = drm_dp_channel_eq_ok(link->link_status,
++                       link->dp_link.link_params.num_lanes);
+ 
+-	DRM_DEBUG_DP("channel_eq_done = %d, clock_recovery_done = %d\n",
+-			drm_dp_clock_recovery_ok(link->link_status,
+-			link->dp_link.link_params.num_lanes),
+-			drm_dp_clock_recovery_ok(link->link_status,
+-			link->dp_link.link_params.num_lanes));
++       bool clock_recovery_done = drm_dp_clock_recovery_ok(link->link_status,
++                       link->dp_link.link_params.num_lanes);
+ 
+-	return 0;
++       DRM_DEBUG_DP("channel_eq_done = %d, clock_recovery_done = %d\n",
++                        channel_eq_done, clock_recovery_done);
++
++       if (channel_eq_done && clock_recovery_done)
++               return -EINVAL;
++
++
++       return 0;
+ }
+ 
+ /**
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dpu-fix-clock-scaling-on-non-sc7180-board.patch b/queue-5.10/drm-msm-dpu-fix-clock-scaling-on-non-sc7180-board.patch
new file mode 100644
index 00000000000..19d4ccd6975
--- /dev/null
+++ b/queue-5.10/drm-msm-dpu-fix-clock-scaling-on-non-sc7180-board.patch
@@ -0,0 +1,54 @@
+From 8f1beb3b6ccc2f24a93f43a8f05e74a16ca068bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 13:23:04 +0300
+Subject: drm/msm/dpu: fix clock scaling on non-sc7180 board
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit cccdeda362fafd0613b571affe7199eb7d8f3fba ]
+
+c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for
+display") has added support for handling bandwidth voting in kms path in
+addition to old mdss path. However this broke all other platforms since
+_dpu_core_perf_crtc_update_bus() will now error out instead of properly
+calculating bandwidth and core clocks. Fix
+_dpu_core_perf_crtc_update_bus() to just skip bandwidth setting instead
+of returning an error in case kms->num_paths == 0 (MDSS is used for
+bandwidth management).
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display")
+Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+index 393858ef8a832..37c8270681c23 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+@@ -219,9 +219,6 @@ static int _dpu_core_perf_crtc_update_bus(struct dpu_kms *kms,
+ 	int i, ret = 0;
+ 	u64 avg_bw;
+ 
+-	if (!kms->num_paths)
+-		return -EINVAL;
+-
+ 	drm_for_each_crtc(tmp_crtc, crtc->dev) {
+ 		if (tmp_crtc->enabled &&
+ 			curr_client_type ==
+@@ -239,6 +236,9 @@ static int _dpu_core_perf_crtc_update_bus(struct dpu_kms *kms,
+ 		}
+ 	}
+ 
++	if (!kms->num_paths)
++		return 0;
++
+ 	avg_bw = perf.bw_ctl;
+ 	do_div(avg_bw, (kms->num_paths * 1000)); /*Bps_to_icc*/
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch b/queue-5.10/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch
new file mode 100644
index 00000000000..ce9662184f7
--- /dev/null
+++ b/queue-5.10/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch
@@ -0,0 +1,50 @@
+From 9e0709cd7dbd946f0f148fdf45409f982d5679cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 22:03:30 +0300
+Subject: drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]
+
+PHY disable/enable resets PLL registers to default values. Thus in
+addition to restoring several registers we also need to restore VCO rate
+settings.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 6ac04fc303f56..e4e9bf04b7368 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -559,6 +559,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ 	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
+ 	void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
+ 	u32 val;
++	int ret;
+ 
+ 	val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
+ 	val &= ~0x3;
+@@ -573,6 +574,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ 	val |= cached->pll_mux;
+ 	pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
+ 
++	ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
++	if (ret) {
++		DRM_DEV_ERROR(&pll_10nm->pdev->dev,
++			"restore vco rate failed. ret=%d\n", ret);
++		return ret;
++	}
++
+ 	DBG("DSI PLL%d", pll_10nm->id);
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-msm-dsi_pll_7nm-restore-vco-rate-during-restore_.patch b/queue-5.10/drm-msm-dsi_pll_7nm-restore-vco-rate-during-restore_.patch
new file mode 100644
index 00000000000..6539d20d377
--- /dev/null
+++ b/queue-5.10/drm-msm-dsi_pll_7nm-restore-vco-rate-during-restore_.patch
@@ -0,0 +1,50 @@
+From 682ef86c20d0ee39aa195cfdb49ade56683b343b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 22:03:29 +0300
+Subject: drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5047ab95bb7db0e7b2ecfd5e9bcafc7fd822c652 ]
+
+PHY disable/enable resets PLL registers to default values. Thus in
+addition to restoring several registers we also need to restore VCO rate
+settings.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: 1ef7c99d145c ("drm/msm/dsi: add support for 7nm DSI PHY/PLL")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
+index de0dfb8151258..93bf142e4a4e6 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
+@@ -585,6 +585,7 @@ static int dsi_pll_7nm_restore_state(struct msm_dsi_pll *pll)
+ 	struct pll_7nm_cached_state *cached = &pll_7nm->cached_state;
+ 	void __iomem *phy_base = pll_7nm->phy_cmn_mmio;
+ 	u32 val;
++	int ret;
+ 
+ 	val = pll_read(pll_7nm->mmio + REG_DSI_7nm_PHY_PLL_PLL_OUTDIV_RATE);
+ 	val &= ~0x3;
+@@ -599,6 +600,13 @@ static int dsi_pll_7nm_restore_state(struct msm_dsi_pll *pll)
+ 	val |= cached->pll_mux;
+ 	pll_write(phy_base + REG_DSI_7nm_PHY_CMN_CLK_CFG1, val);
+ 
++	ret = dsi_pll_7nm_vco_set_rate(&pll->clk_hw, pll_7nm->vco_current_rate, pll_7nm->vco_ref_clk_rate);
++	if (ret) {
++		DRM_DEV_ERROR(&pll_7nm->pdev->dev,
++			"restore vco rate failed. ret=%d\n", ret);
++		return ret;
++	}
++
+ 	DBG("DSI PLL%d", pll_7nm->id);
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-mxsfb-silence-eprobe_defer-while-waiting-for-bri.patch b/queue-5.10/drm-mxsfb-silence-eprobe_defer-while-waiting-for-bri.patch
new file mode 100644
index 00000000000..a8b0230d722
--- /dev/null
+++ b/queue-5.10/drm-mxsfb-silence-eprobe_defer-while-waiting-for-bri.patch
@@ -0,0 +1,66 @@
+From ed98d60f47795a8f1a8d9875c809f275e9736861 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 09:23:38 +0100
+Subject: drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guido Günther <agx@sigxcpu.org>
+
+[ Upstream commit ee46d16d2e40bebc2aa790fd7b6a056466ff895c ]
+
+It can take multiple iterations until all components for an attached DSI
+bridge are up leading to several:
+
+[    3.796425] mxsfb 30320000.lcd-controller: Cannot connect bridge: -517
+[    3.816952] mxsfb 30320000.lcd-controller: [drm:mxsfb_probe [mxsfb]] *ERROR* failed to attach bridge: -517
+
+Silence this by checking for -EPROBE_DEFER and using dev_err_probe() so
+we set a deferred reason in case a dependency fails to probe (which
+quickly happens on small config/DT changes due to the rather long probe
+chain which can include bridges, phys, panels, backights, leds, etc.).
+
+This also removes the only DRM_DEV_ERROR() usage, the rest of the driver
+uses dev_err().
+
+Signed-off-by: Guido Günther <agx@sigxcpu.org>
+Fixes: c42001e357f7 ("drm: mxsfb: Use drm_panel_bridge")
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/d5761eb871adde5464ba112b89d966568bc2ff6c.1608020391.git.agx@sigxcpu.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/mxsfb_drv.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+index 35122aef037b4..17f26052e8450 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+@@ -134,11 +134,8 @@ static int mxsfb_attach_bridge(struct mxsfb_drm_private *mxsfb)
+ 		return -ENODEV;
+ 
+ 	ret = drm_bridge_attach(&mxsfb->encoder, bridge, NULL, 0);
+-	if (ret) {
+-		DRM_DEV_ERROR(drm->dev,
+-			      "failed to attach bridge: %d\n", ret);
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(drm->dev, ret, "Failed to attach bridge\n");
+ 
+ 	mxsfb->bridge = bridge;
+ 
+@@ -212,7 +209,8 @@ static int mxsfb_load(struct drm_device *drm,
+ 
+ 	ret = mxsfb_attach_bridge(mxsfb);
+ 	if (ret) {
+-		dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
++		if (ret != -EPROBE_DEFER)
++			dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
+ 		goto err_vblank;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch b/queue-5.10/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch
new file mode 100644
index 00000000000..b0048a16adf
--- /dev/null
+++ b/queue-5.10/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch
@@ -0,0 +1,36 @@
+From 4f26505cd7c750727ab497d4582b6b416dd44876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:10:45 +0800
+Subject: drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]
+
+Return -ENOMEM when allocating refill memory failed.
+
+Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+index 42ec51bb7b1b0..7f43172488123 100644
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -889,6 +889,7 @@ static int omap_dmm_probe(struct platform_device *dev)
+ 					   &omap_dmm->refill_pa, GFP_KERNEL);
+ 	if (!omap_dmm->refill_va) {
+ 		dev_err(&dev->dev, "could not allocate refill memory\n");
++		ret = -ENOMEM;
+ 		goto fail;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-panel-simple-add-flags-to-boe_nv133fhm_n61.patch b/queue-5.10/drm-panel-simple-add-flags-to-boe_nv133fhm_n61.patch
new file mode 100644
index 00000000000..f644cbd954a
--- /dev/null
+++ b/queue-5.10/drm-panel-simple-add-flags-to-boe_nv133fhm_n61.patch
@@ -0,0 +1,39 @@
+From fcd0cca5946abe273aed8a50158b9d26d3043d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 10:23:33 -0800
+Subject: drm/panel: simple: Add flags to boe_nv133fhm_n61
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit ab6fd5d44aa21ede9e566f89132f7bdda7f33093 ]
+
+Reading the EDID of this panel shows that these flags should be set. Set
+them so that we match what is in the EDID.
+
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: b0c664cc80e8 ("panel: simple: Add BOE NV133FHM-N61")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201106182333.3080124-1-swboyd@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 2be358fb46f7d..204674fccd646 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1327,6 +1327,7 @@ static const struct drm_display_mode boe_nv133fhm_n61_modes = {
+ 	.vsync_start = 1080 + 3,
+ 	.vsync_end = 1080 + 3 + 6,
+ 	.vtotal = 1080 + 3 + 6 + 31,
++	.flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC,
+ };
+ 
+ /* Also used for boe_nv133fhm_n62 */
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-tve200-fix-handling-of-platform_get_irq-error.patch b/queue-5.10/drm-tve200-fix-handling-of-platform_get_irq-error.patch
new file mode 100644
index 00000000000..63e77ef36d0
--- /dev/null
+++ b/queue-5.10/drm-tve200-fix-handling-of-platform_get_irq-error.patch
@@ -0,0 +1,40 @@
+From 017b98e345d5b8faca8c4b30a328739296d3762a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 09:11:07 +0200
+Subject: drm/tve200: Fix handling of platform_get_irq() error
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ]
+
+platform_get_irq() returns -ERRNO on error.  In such case comparison
+to 0 would pass the check.
+
+Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tve200/tve200_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
+index c3aa39bd38ecd..b5259cb1383fc 100644
+--- a/drivers/gpu/drm/tve200/tve200_drv.c
++++ b/drivers/gpu/drm/tve200/tve200_drv.c
+@@ -200,8 +200,8 @@ static int tve200_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
+-		ret = -EINVAL;
++	if (irq < 0) {
++		ret = irq;
+ 		goto clk_disable;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/drm-udl-fix-missing-error-code-in-udl_handle_damage.patch b/queue-5.10/drm-udl-fix-missing-error-code-in-udl_handle_damage.patch
new file mode 100644
index 00000000000..839ee65ba6c
--- /dev/null
+++ b/queue-5.10/drm-udl-fix-missing-error-code-in-udl_handle_damage.patch
@@ -0,0 +1,40 @@
+From 3a31714c3221d6421f02f3cb7799d208aa113a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 13:15:02 +0300
+Subject: drm/udl: Fix missing error code in udl_handle_damage()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a7319c8f50c5e93a12997e2d0821a2f7946fb734 ]
+
+If udl_get_urb() fails then this should return a negative error code
+but currently it returns success.
+
+Fixes: 798ce3fe1c3a ("drm/udl: Begin/end access to imported buffers in damage-handler")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201113101502.GD168908@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/udl/udl_modeset.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/udl/udl_modeset.c b/drivers/gpu/drm/udl/udl_modeset.c
+index fef43f4e3bac4..edcfd8c120c44 100644
+--- a/drivers/gpu/drm/udl/udl_modeset.c
++++ b/drivers/gpu/drm/udl/udl_modeset.c
+@@ -303,8 +303,10 @@ static int udl_handle_damage(struct drm_framebuffer *fb, int x, int y,
+ 	}
+ 
+ 	urb = udl_get_urb(dev);
+-	if (!urb)
++	if (!urb) {
++		ret = -ENOMEM;
+ 		goto out_drm_gem_shmem_vunmap;
++	}
+ 	cmd = urb->transfer_buffer;
+ 
+ 	for (i = clip.y1; i < clip.y2; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch b/queue-5.10/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch
new file mode 100644
index 00000000000..a0a74802e58
--- /dev/null
+++ b/queue-5.10/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch
@@ -0,0 +1,55 @@
+From 5e9952b027fe0f77903db4dc3a35b5591dd6e54b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 21:06:58 +0000
+Subject: EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ]
+
+The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and
+later systems. This function is used in amd64_edac_mod to do
+system-specific decoding for DRAM ECC errors. The function takes a
+"NodeId" as a parameter.
+
+In AMD documentation, NodeId is used to identify a physical die in a
+system. This can be used to identify a node in the AMD_NB code and also
+it is used with umc_normaddr_to_sysaddr().
+
+However, the input used for decode_dram_ecc() is currently the NUMA node
+of a logical CPU. In the default configuration, the NUMA node and
+physical die will be equivalent, so this doesn't have an impact.
+
+But the NUMA node configuration can be adjusted with optional memory
+interleaving modes. This will cause the NUMA node enumeration to not
+match the physical die enumeration. The mismatch will cause the address
+translation function to fail or report incorrect results.
+
+Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the
+physical ID is used.
+
+Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/mce_amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
+index 7f28edb070bd0..6c474fbef32af 100644
+--- a/drivers/edac/mce_amd.c
++++ b/drivers/edac/mce_amd.c
+@@ -1003,7 +1003,7 @@ static void decode_smca_error(struct mce *m)
+ 		pr_cont(", %s.\n", smca_mce_descs[bank_type].descs[xec]);
+ 
+ 	if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc)
+-		decode_dram_ecc(cpu_to_node(m->extcpu), m);
++		decode_dram_ecc(topology_die_id(m->extcpu), m);
+ }
+ 
+ static inline void amd_decode_err_code(u16 ec)
+-- 
+2.27.0
+
diff --git a/queue-5.10/epoll-check-for-events-when-removing-a-timed-out-thr.patch b/queue-5.10/epoll-check-for-events-when-removing-a-timed-out-thr.patch
new file mode 100644
index 00000000000..e944fd2e6a6
--- /dev/null
+++ b/queue-5.10/epoll-check-for-events-when-removing-a-timed-out-thr.patch
@@ -0,0 +1,128 @@
+From dae9b6302c8be8b463e7c61b506b5734d0ad169f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 14:01:44 -0800
+Subject: epoll: check for events when removing a timed out thread from the
+ wait queue
+
+From: Soheil Hassas Yeganeh <soheil@google.com>
+
+[ Upstream commit 289caf5d8f6c61c6d2b7fd752a7f483cd153f182 ]
+
+Patch series "simplify ep_poll".
+
+This patch series is a followup based on the suggestions and feedback by
+Linus:
+https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com
+
+The first patch in the series is a fix for the epoll race in presence of
+timeouts, so that it can be cleanly backported to all affected stable
+kernels.
+
+The rest of the patch series simplify the ep_poll() implementation.  Some
+of these simplifications result in minor performance enhancements as well.
+We have kept these changes under self tests and internal benchmarks for a
+few days, and there are minor (1-2%) performance enhancements as a result.
+
+This patch (of 8):
+
+After abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2)
+timeout"), we break out of the ep_poll loop upon timeout, without checking
+whether there is any new events available.  Prior to that patch-series we
+always called ep_events_available() after exiting the loop.
+
+This can cause races and missed wakeups.  For example, consider the
+following scenario reported by Guantao Liu:
+
+Suppose we have an eventfd added using EPOLLET to an epollfd.
+
+Thread 1: Sleeps for just below 5ms and then writes to an eventfd.
+Thread 2: Calls epoll_wait with a timeout of 5 ms. If it sees an
+          event of the eventfd, it will write back on that fd.
+Thread 3: Calls epoll_wait with a negative timeout.
+
+Prior to abc610e01c66, it is guaranteed that Thread 3 will wake up either
+by Thread 1 or Thread 2.  After abc610e01c66, Thread 3 can be blocked
+indefinitely if Thread 2 sees a timeout right before the write to the
+eventfd by Thread 1.  Thread 2 will be woken up from
+schedule_hrtimeout_range and, with evail 0, it will not call
+ep_send_events().
+
+To fix this issue:
+1) Simplify the timed_out case as suggested by Linus.
+2) while holding the lock, recheck whether the thread was woken up
+   after its time out has reached.
+
+Note that (2) is different from Linus' original suggestion: It do not set
+"eavail = ep_events_available(ep)" to avoid unnecessary contention (when
+there are too many timed-out threads and a small number of events), as
+well as races mentioned in the discussion thread.
+
+This is the first patch in the series so that the backport to stable
+releases is straightforward.
+
+Link: https://lkml.kernel.org/r/20201106231635.3528496-1-soheil.kdev@gmail.com
+Link: https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com
+Link: https://lkml.kernel.org/r/20201106231635.3528496-2-soheil.kdev@gmail.com
+Fixes: abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2) timeout")
+Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
+Tested-by: Guantao Liu <guantaol@google.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Reported-by: Guantao Liu <guantaol@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Khazhismel Kumykov <khazhy@google.com>
+Reviewed-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventpoll.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 4df61129566d4..117b1c395ae4a 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1902,23 +1902,30 @@ fetch_events:
+ 		}
+ 		write_unlock_irq(&ep->lock);
+ 
+-		if (eavail || res)
+-			break;
++		if (!eavail && !res)
++			timed_out = !schedule_hrtimeout_range(to, slack,
++							      HRTIMER_MODE_ABS);
+ 
+-		if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
+-			timed_out = 1;
+-			break;
+-		}
+-
+-		/* We were woken up, thus go and try to harvest some events */
++		/*
++		 * We were woken up, thus go and try to harvest some events.
++		 * If timed out and still on the wait queue, recheck eavail
++		 * carefully under lock, below.
++		 */
+ 		eavail = 1;
+-
+ 	} while (0);
+ 
+ 	__set_current_state(TASK_RUNNING);
+ 
+ 	if (!list_empty_careful(&wait.entry)) {
+ 		write_lock_irq(&ep->lock);
++		/*
++		 * If the thread timed out and is not on the wait queue, it
++		 * means that the thread was woken up after its timeout expired
++		 * before it could reacquire the lock. Thus, when wait.entry is
++		 * empty, it needs to harvest events.
++		 */
++		if (timed_out)
++			eavail = list_empty(&wait.entry);
+ 		__remove_wait_queue(&ep->wq, &wait);
+ 		write_unlock_irq(&ep->lock);
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/erofs-avoid-using-generic_block_bmap.patch b/queue-5.10/erofs-avoid-using-generic_block_bmap.patch
new file mode 100644
index 00000000000..4425fa394a3
--- /dev/null
+++ b/queue-5.10/erofs-avoid-using-generic_block_bmap.patch
@@ -0,0 +1,78 @@
+From 7a12e473131a39e03e2845744cd09cbd724d01fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 19:57:40 +0800
+Subject: erofs: avoid using generic_block_bmap
+
+From: Huang Jianan <huangjianan@oppo.com>
+
+[ Upstream commit d8b3df8b1048405e73558b88cba2adf29490d468 ]
+
+Surprisingly, `block' in sector_t indicates the number of
+i_blkbits-sized blocks rather than sectors for bmap.
+
+In addition, considering buffer_head limits mapped size to 32-bits,
+should avoid using generic_block_bmap.
+
+Link: https://lore.kernel.org/r/20201209115740.18802-1-huangjianan@oppo.com
+Fixes: 9da681e017a3 ("staging: erofs: support bmap")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Reviewed-by: Gao Xiang <hsiangkao@redhat.com>
+Signed-off-by: Huang Jianan <huangjianan@oppo.com>
+Signed-off-by: Guo Weichao <guoweichao@oppo.com>
+[ Gao Xiang: slightly update the commit message description. ]
+Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/data.c | 26 +++++++-------------------
+ 1 file changed, 7 insertions(+), 19 deletions(-)
+
+diff --git a/fs/erofs/data.c b/fs/erofs/data.c
+index 347be146884c3..ea4f693bee224 100644
+--- a/fs/erofs/data.c
++++ b/fs/erofs/data.c
+@@ -312,27 +312,12 @@ static void erofs_raw_access_readahead(struct readahead_control *rac)
+ 		submit_bio(bio);
+ }
+ 
+-static int erofs_get_block(struct inode *inode, sector_t iblock,
+-			   struct buffer_head *bh, int create)
+-{
+-	struct erofs_map_blocks map = {
+-		.m_la = iblock << 9,
+-	};
+-	int err;
+-
+-	err = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW);
+-	if (err)
+-		return err;
+-
+-	if (map.m_flags & EROFS_MAP_MAPPED)
+-		bh->b_blocknr = erofs_blknr(map.m_pa);
+-
+-	return err;
+-}
+-
+ static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
+ {
+ 	struct inode *inode = mapping->host;
++	struct erofs_map_blocks map = {
++		.m_la = blknr_to_addr(block),
++	};
+ 
+ 	if (EROFS_I(inode)->datalayout == EROFS_INODE_FLAT_INLINE) {
+ 		erofs_blk_t blks = i_size_read(inode) >> LOG_BLOCK_SIZE;
+@@ -341,7 +326,10 @@ static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
+ 			return 0;
+ 	}
+ 
+-	return generic_block_bmap(mapping, block, erofs_get_block);
++	if (!erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW))
++		return erofs_blknr(map.m_pa);
++
++	return 0;
+ }
+ 
+ /* for uncompressed (aligned) files and raw access for other files */
+-- 
+2.27.0
+
diff --git a/queue-5.10/extcon-max77693-fix-modalias-string.patch b/queue-5.10/extcon-max77693-fix-modalias-string.patch
new file mode 100644
index 00000000000..d05b8f404b5
--- /dev/null
+++ b/queue-5.10/extcon-max77693-fix-modalias-string.patch
@@ -0,0 +1,34 @@
+From 197031eed937bd917582cd9ab5820ea9947f4383 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 14:36:27 +0100
+Subject: extcon: max77693: Fix modalias string
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]
+
+The platform device driver name is "max77693-muic", so advertise it
+properly in the modalias string. This fixes automated module loading when
+this driver is compiled as a module.
+
+Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-max77693.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
+index 4a410fd2ea9ae..92af97e00828f 100644
+--- a/drivers/extcon/extcon-max77693.c
++++ b/drivers/extcon/extcon-max77693.c
+@@ -1277,4 +1277,4 @@ module_platform_driver(max77693_muic_driver);
+ MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
+ MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("platform:extcon-max77693");
++MODULE_ALIAS("platform:max77693-muic");
+-- 
+2.27.0
+
diff --git a/queue-5.10/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch b/queue-5.10/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch
new file mode 100644
index 00000000000..c971e7c7de1
--- /dev/null
+++ b/queue-5.10/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch
@@ -0,0 +1,36 @@
+From 1c999f066ed69b0d303d711f1b34419afbea5822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 07:35:47 -0700
+Subject: f2fs: call f2fs_get_meta_page_retry for nat page
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 3acc4522d89e0a326db69e9d0afaad8cf763a54c ]
+
+When running fault injection test, if we don't stop checkpoint, some stale
+NAT entries were flushed which breaks consistency.
+
+Fixes: 86f33603f8c5 ("f2fs: handle errors of f2fs_get_meta_page_nofail")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index d5d8ce077f295..42394de6c7eb1 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -109,7 +109,7 @@ static void clear_node_page_dirty(struct page *page)
+ 
+ static struct page *get_current_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
+ {
+-	return f2fs_get_meta_page(sbi, current_nat_addr(sbi, nid));
++	return f2fs_get_meta_page_retry(sbi, current_nat_addr(sbi, nid));
+ }
+ 
+ static struct page *get_next_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
+-- 
+2.27.0
+
diff --git a/queue-5.10/f2fs-fix-double-free-of-unicode-map.patch b/queue-5.10/f2fs-fix-double-free-of-unicode-map.patch
new file mode 100644
index 00000000000..87f34ceaa40
--- /dev/null
+++ b/queue-5.10/f2fs-fix-double-free-of-unicode-map.patch
@@ -0,0 +1,38 @@
+From d48855310b9c97b2048387a04adeb6a4e0f5a1d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 18:14:54 +0900
+Subject: f2fs: fix double free of unicode map
+
+From: Hyeongseok Kim <hyeongseok@gmail.com>
+
+[ Upstream commit 89ff6005039a878afac87889fee748fa3f957c3a ]
+
+In case of retrying fill_super with skip_recovery,
+s_encoding for casefold would not be loaded again even though it's
+already been freed because it's not NULL.
+Set NULL after free to prevent double freeing when unmount.
+
+Fixes: eca4873ee1b6 ("f2fs: Use generic casefolding support")
+Signed-off-by: Hyeongseok Kim <hyeongseok@gmail.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 00eff2f518079..fef22e476c526 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3918,6 +3918,7 @@ free_bio_info:
+ 
+ #ifdef CONFIG_UNICODE
+ 	utf8_unload(sb->s_encoding);
++	sb->s_encoding = NULL;
+ #endif
+ free_options:
+ #ifdef CONFIG_QUOTA
+-- 
+2.27.0
+
diff --git a/queue-5.10/firmware-arm_scmi-fix-missing-destroy_workqueue.patch b/queue-5.10/firmware-arm_scmi-fix-missing-destroy_workqueue.patch
new file mode 100644
index 00000000000..02f1605ae05
--- /dev/null
+++ b/queue-5.10/firmware-arm_scmi-fix-missing-destroy_workqueue.patch
@@ -0,0 +1,54 @@
+From bc3eec47cbc0295ef252f70ad75aed9ace63dd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 15:42:21 +0800
+Subject: firmware: arm_scmi: Fix missing destroy_workqueue()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 6bbdb46c4b1bd57839c9c0a110bd81b0be0a4046 ]
+
+destroy_workqueue is required before the return from scmi_notification_init
+in case devm_kcalloc fails to allocate registered_protocols. Fix this by
+simply moving registered_protocols allocation before alloc_workqueue.
+
+Link: https://lore.kernel.org/r/20201110074221.41235-1-miaoqinglang@huawei.com
+Fixes: bd31b249692e ("firmware: arm_scmi: Add notification dispatch and delivery")
+Suggested-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/notify.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c
+index ce336899d6366..66196b293b6c2 100644
+--- a/drivers/firmware/arm_scmi/notify.c
++++ b/drivers/firmware/arm_scmi/notify.c
+@@ -1474,17 +1474,17 @@ int scmi_notification_init(struct scmi_handle *handle)
+ 	ni->gid = gid;
+ 	ni->handle = handle;
+ 
++	ni->registered_protocols = devm_kcalloc(handle->dev, SCMI_MAX_PROTO,
++						sizeof(char *), GFP_KERNEL);
++	if (!ni->registered_protocols)
++		goto err;
++
+ 	ni->notify_wq = alloc_workqueue(dev_name(handle->dev),
+ 					WQ_UNBOUND | WQ_FREEZABLE | WQ_SYSFS,
+ 					0);
+ 	if (!ni->notify_wq)
+ 		goto err;
+ 
+-	ni->registered_protocols = devm_kcalloc(handle->dev, SCMI_MAX_PROTO,
+-						sizeof(char *), GFP_KERNEL);
+-	if (!ni->registered_protocols)
+-		goto err;
+-
+ 	mutex_init(&ni->pending_mtx);
+ 	hash_init(ni->pending_events_handlers);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/firmware-tegra-fix-strncpy-strncat-confusion.patch b/queue-5.10/firmware-tegra-fix-strncpy-strncat-confusion.patch
new file mode 100644
index 00000000000..f474ba29578
--- /dev/null
+++ b/queue-5.10/firmware-tegra-fix-strncpy-strncat-confusion.patch
@@ -0,0 +1,66 @@
+From b332a60c7bb964764898ce6041e7893047b01381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:49:21 +0100
+Subject: firmware: tegra: fix strncpy()/strncat() confusion
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9294996f0be40e9da818ed891c82397ab63c00d0 ]
+
+The way that bpmp_populate_debugfs_inband() uses strncpy()
+and strncat() makes no sense since the size argument for
+the first is insufficient to contain the trailing '/'
+and the second passes the length of the input rather than
+the output, which triggers a warning:
+
+In function 'strncat',
+    inlined from 'bpmp_populate_debugfs_inband' at ../drivers/firmware/tegra/bpmp-debugfs.c:422:4:
+include/linux/string.h:289:30: warning: '__builtin_strncat' specified bound depends on the length of the source argument [-Wstringop-overflow=]
+  289 | #define __underlying_strncat __builtin_strncat
+      |                              ^
+include/linux/string.h:367:10: note: in expansion of macro '__underlying_strncat'
+  367 |   return __underlying_strncat(p, q, count);
+      |          ^~~~~~~~~~~~~~~~~~~~
+drivers/firmware/tegra/bpmp-debugfs.c: In function 'bpmp_populate_debugfs_inband':
+include/linux/string.h:288:29: note: length computed here
+  288 | #define __underlying_strlen __builtin_strlen
+      |                             ^
+include/linux/string.h:321:10: note: in expansion of macro '__underlying_strlen'
+  321 |   return __underlying_strlen(p);
+
+Simplify this to use an snprintf() instead.
+
+Fixes: 5e37b9c137ee ("firmware: tegra: Add support for in-band debug")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/tegra/bpmp-debugfs.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/tegra/bpmp-debugfs.c b/drivers/firmware/tegra/bpmp-debugfs.c
+index c1bbba9ee93a3..440d99c63638b 100644
+--- a/drivers/firmware/tegra/bpmp-debugfs.c
++++ b/drivers/firmware/tegra/bpmp-debugfs.c
+@@ -412,16 +412,12 @@ static int bpmp_populate_debugfs_inband(struct tegra_bpmp *bpmp,
+ 				goto out;
+ 			}
+ 
+-			len = strlen(ppath) + strlen(name) + 1;
++			len = snprintf(pathbuf, pathlen, "%s%s/", ppath, name);
+ 			if (len >= pathlen) {
+ 				err = -EINVAL;
+ 				goto out;
+ 			}
+ 
+-			strncpy(pathbuf, ppath, pathlen);
+-			strncat(pathbuf, name, strlen(name));
+-			strcat(pathbuf, "/");
+-
+ 			err = bpmp_populate_debugfs_inband(bpmp, dentry,
+ 							   pathbuf);
+ 			if (err < 0)
+-- 
+2.27.0
+
diff --git a/queue-5.10/fs-handle-i_dontcache-in-iput_final-instead-of-gener.patch b/queue-5.10/fs-handle-i_dontcache-in-iput_final-instead-of-gener.patch
new file mode 100644
index 00000000000..229d53aded3
--- /dev/null
+++ b/queue-5.10/fs-handle-i_dontcache-in-iput_final-instead-of-gener.patch
@@ -0,0 +1,66 @@
+From 79225beaf3c881d845ddb54468ec8f0d5762fbd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 10:08:43 +0800
+Subject: fs: Handle I_DONTCACHE in iput_final() instead of
+ generic_drop_inode()
+
+From: Hao Li <lihao2018.fnst@cn.fujitsu.com>
+
+[ Upstream commit 88149082bb8ef31b289673669e080ec6a00c2e59 ]
+
+If generic_drop_inode() returns true, it means iput_final() can evict
+this inode regardless of whether it is dirty or not. If we check
+I_DONTCACHE in generic_drop_inode(), any inode with this bit set will be
+evicted unconditionally. This is not the desired behavior because
+I_DONTCACHE only means the inode shouldn't be cached on the LRU list.
+As for whether we need to evict this inode, this is what
+generic_drop_inode() should do. This patch corrects the usage of
+I_DONTCACHE.
+
+This patch was proposed in [1].
+
+[1]: https://lore.kernel.org/linux-fsdevel/20200831003407.GE12096@dread.disaster.area/
+
+Fixes: dae2f8ed7992 ("fs: Lift XFS_IDONTCACHE to the VFS layer")
+Signed-off-by: Hao Li <lihao2018.fnst@cn.fujitsu.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/inode.c         | 4 +++-
+ include/linux/fs.h | 3 +--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/inode.c b/fs/inode.c
+index 9d78c37b00b81..5eea9912a0b9d 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -1627,7 +1627,9 @@ static void iput_final(struct inode *inode)
+ 	else
+ 		drop = generic_drop_inode(inode);
+ 
+-	if (!drop && (sb->s_flags & SB_ACTIVE)) {
++	if (!drop &&
++	    !(inode->i_state & I_DONTCACHE) &&
++	    (sb->s_flags & SB_ACTIVE)) {
+ 		inode_add_lru(inode);
+ 		spin_unlock(&inode->i_lock);
+ 		return;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 8667d0cdc71e7..8bde32cf97115 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2878,8 +2878,7 @@ extern int inode_needs_sync(struct inode *inode);
+ extern int generic_delete_inode(struct inode *inode);
+ static inline int generic_drop_inode(struct inode *inode)
+ {
+-	return !inode->i_nlink || inode_unhashed(inode) ||
+-		(inode->i_state & I_DONTCACHE);
++	return !inode->i_nlink || inode_unhashed(inode);
+ }
+ extern void d_mark_dontcache(struct inode *inode);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/fsi-aspeed-add-mutex-to-protect-hw-access.patch b/queue-5.10/fsi-aspeed-add-mutex-to-protect-hw-access.patch
new file mode 100644
index 00000000000..d0abe02a775
--- /dev/null
+++ b/queue-5.10/fsi-aspeed-add-mutex-to-protect-hw-access.patch
@@ -0,0 +1,153 @@
+From 1675077cde3a4a7ff4ce22e541cbeaeb74ce14fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 11:19:29 +1030
+Subject: fsi: Aspeed: Add mutex to protect HW access
+
+From: Eddie James <eajames@linux.ibm.com>
+
+[ Upstream commit dfd7f2c1c532efaeff6084970bb60ec2f2e44191 ]
+
+There is nothing to prevent multiple commands being executed
+simultaneously. Add a mutex to prevent this.
+
+Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Milton Miller <miltonm@us.ibm.com>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201120004929.185239-1-joel@jms.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-master-aspeed.c | 45 +++++++++++++++++++++------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
+index c006ec008a1aa..90dbe58ca1edc 100644
+--- a/drivers/fsi/fsi-master-aspeed.c
++++ b/drivers/fsi/fsi-master-aspeed.c
+@@ -8,6 +8,7 @@
+ #include <linux/io.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+@@ -19,6 +20,7 @@
+ 
+ struct fsi_master_aspeed {
+ 	struct fsi_master	master;
++	struct mutex		lock;	/* protect HW access */
+ 	struct device		*dev;
+ 	void __iomem		*base;
+ 	struct clk		*clk;
+@@ -254,6 +256,8 @@ static int aspeed_master_read(struct fsi_master *master, int link,
+ 	addr |= id << 21;
+ 	addr += link * FSI_HUB_LINK_SIZE;
+ 
++	mutex_lock(&aspeed->lock);
++
+ 	switch (size) {
+ 	case 1:
+ 		ret = opb_readb(aspeed, fsi_base + addr, val);
+@@ -265,14 +269,14 @@ static int aspeed_master_read(struct fsi_master *master, int link,
+ 		ret = opb_readl(aspeed, fsi_base + addr, val);
+ 		break;
+ 	default:
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto done;
+ 	}
+ 
+ 	ret = check_errors(aspeed, ret);
+-	if (ret)
+-		return ret;
+-
+-	return 0;
++done:
++	mutex_unlock(&aspeed->lock);
++	return ret;
+ }
+ 
+ static int aspeed_master_write(struct fsi_master *master, int link,
+@@ -287,6 +291,8 @@ static int aspeed_master_write(struct fsi_master *master, int link,
+ 	addr |= id << 21;
+ 	addr += link * FSI_HUB_LINK_SIZE;
+ 
++	mutex_lock(&aspeed->lock);
++
+ 	switch (size) {
+ 	case 1:
+ 		ret = opb_writeb(aspeed, fsi_base + addr, *(u8 *)val);
+@@ -298,14 +304,14 @@ static int aspeed_master_write(struct fsi_master *master, int link,
+ 		ret = opb_writel(aspeed, fsi_base + addr, *(__be32 *)val);
+ 		break;
+ 	default:
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto done;
+ 	}
+ 
+ 	ret = check_errors(aspeed, ret);
+-	if (ret)
+-		return ret;
+-
+-	return 0;
++done:
++	mutex_unlock(&aspeed->lock);
++	return ret;
+ }
+ 
+ static int aspeed_master_link_enable(struct fsi_master *master, int link,
+@@ -320,17 +326,21 @@ static int aspeed_master_link_enable(struct fsi_master *master, int link,
+ 
+ 	reg = cpu_to_be32(0x80000000 >> bit);
+ 
+-	if (!enable)
+-		return opb_writel(aspeed, ctrl_base + FSI_MCENP0 + (4 * idx),
+-				  reg);
++	mutex_lock(&aspeed->lock);
++
++	if (!enable) {
++		ret = opb_writel(aspeed, ctrl_base + FSI_MCENP0 + (4 * idx), reg);
++		goto done;
++	}
+ 
+ 	ret = opb_writel(aspeed, ctrl_base + FSI_MSENP0 + (4 * idx), reg);
+ 	if (ret)
+-		return ret;
++		goto done;
+ 
+ 	mdelay(FSI_LINK_ENABLE_SETUP_TIME);
+-
+-	return 0;
++done:
++	mutex_unlock(&aspeed->lock);
++	return ret;
+ }
+ 
+ static int aspeed_master_term(struct fsi_master *master, int link, uint8_t id)
+@@ -431,9 +441,11 @@ static ssize_t cfam_reset_store(struct device *dev, struct device_attribute *att
+ {
+ 	struct fsi_master_aspeed *aspeed = dev_get_drvdata(dev);
+ 
++	mutex_lock(&aspeed->lock);
+ 	gpiod_set_value(aspeed->cfam_reset_gpio, 1);
+ 	usleep_range(900, 1000);
+ 	gpiod_set_value(aspeed->cfam_reset_gpio, 0);
++	mutex_unlock(&aspeed->lock);
+ 
+ 	return count;
+ }
+@@ -597,6 +609,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
+ 
+ 	dev_set_drvdata(&pdev->dev, aspeed);
+ 
++	mutex_init(&aspeed->lock);
+ 	aspeed_master_init(aspeed);
+ 
+ 	rc = fsi_master_register(&aspeed->master);
+-- 
+2.27.0
+
diff --git a/queue-5.10/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch b/queue-5.10/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch
new file mode 100644
index 00000000000..e1f096e3acf
--- /dev/null
+++ b/queue-5.10/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch
@@ -0,0 +1,55 @@
+From 799c808875bdec27f846b5715f7402c83bba58d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 13:55:51 +0000
+Subject: genirq/irqdomain: Don't try to free an interrupt that has no mapping
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]
+
+When an interrupt allocation fails for N interrupts, it is pretty
+common for the error handling code to free the same number of interrupts,
+no matter how many interrupts have actually been allocated.
+
+This may result in the domain freeing code to be unexpectedly called
+for interrupts that have no mapping in that domain. Things end pretty
+badly.
+
+Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
+that thiss does not follow the hierarchy if no mapping exists for a given
+interrupt.
+
+Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index e4ca69608f3b8..c6b419db68efc 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -1373,8 +1373,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
+ 					   unsigned int irq_base,
+ 					   unsigned int nr_irqs)
+ {
+-	if (domain->ops->free)
+-		domain->ops->free(domain, irq_base, nr_irqs);
++	unsigned int i;
++
++	if (!domain->ops->free)
++		return;
++
++	for (i = 0; i < nr_irqs; i++) {
++		if (irq_domain_get_irq_data(domain, irq_base + i))
++			domain->ops->free(domain, irq_base + i, 1);
++	}
+ }
+ 
+ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
+-- 
+2.27.0
+
diff --git a/queue-5.10/gpiolib-irq-hooks-fix-recursion-in-gpiochip_irq_unma.patch b/queue-5.10/gpiolib-irq-hooks-fix-recursion-in-gpiochip_irq_unma.patch
new file mode 100644
index 00000000000..d643e3f450c
--- /dev/null
+++ b/queue-5.10/gpiolib-irq-hooks-fix-recursion-in-gpiochip_irq_unma.patch
@@ -0,0 +1,43 @@
+From 09339f0df3d9ec598a81072821c235abd17ae8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 10:05:14 +0300
+Subject: gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
+
+From: Nikita Shubin <nikita.shubin@maquefel.me>
+
+[ Upstream commit 9d5522199505c761575c8ea31dcfd9a2a8d73614 ]
+
+irqchip shared with multiple gpiochips, leads to recursive call of
+gpiochip_irq_mask/gpiochip_irq_unmask which was assigned to
+rqchip->irq_mask/irqchip->irq_unmask, these happens becouse of
+only irqchip->irq_enable == gpiochip_irq_enable is checked.
+
+Let's add an additional check to make sure shared irqchip is detected
+even if irqchip->irq_enable wasn't defined.
+
+Fixes: a8173820f441 ("gpio: gpiolib: Allow GPIO IRQs to lazy disable")
+Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
+Link: https://lore.kernel.org/r/20201210070514.13238-1-nikita.shubin@maquefel.me
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 6e3c4d7a7d146..4ad3c4b276dcf 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1477,7 +1477,8 @@ static void gpiochip_set_irq_hooks(struct gpio_chip *gc)
+ 	if (WARN_ON(gc->irq.irq_enable))
+ 		return;
+ 	/* Check if the irqchip already has this hook... */
+-	if (irqchip->irq_enable == gpiochip_irq_enable) {
++	if (irqchip->irq_enable == gpiochip_irq_enable ||
++		irqchip->irq_mask == gpiochip_irq_mask) {
+ 		/*
+ 		 * ...and if so, give a gentle warning that this is bad
+ 		 * practice.
+-- 
+2.27.0
+
diff --git a/queue-5.10/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch b/queue-5.10/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch
new file mode 100644
index 00000000000..275441dc0bd
--- /dev/null
+++ b/queue-5.10/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch
@@ -0,0 +1,36 @@
+From d25872e21f8540bc31211b2aea4b58de0fce8af7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 10:56:43 +0800
+Subject: HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]
+
+In current code, it jumps to ida_simple_remove() when ida_simple_get()
+failes to allocate an ID. Just return to fix it.
+
+Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/controllers/omap_ssi_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index fa69b94debd9b..7596dc1646484 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -355,7 +355,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
+ 
+ 	err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
+ 	if (err < 0)
+-		goto out_err;
++		return err;
+ 	ssi->id = err;
+ 
+ 	ssi->owner = THIS_MODULE;
+-- 
+2.27.0
+
diff --git a/queue-5.10/hugetlb-fix-an-error-code-in-hugetlb_reserve_pages.patch b/queue-5.10/hugetlb-fix-an-error-code-in-hugetlb_reserve_pages.patch
new file mode 100644
index 00000000000..9b0ea54cb1d
--- /dev/null
+++ b/queue-5.10/hugetlb-fix-an-error-code-in-hugetlb_reserve_pages.patch
@@ -0,0 +1,40 @@
+From 4ab01ee65f0db5566b1e76cb9d6a92f93fb048bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:12:11 -0800
+Subject: hugetlb: fix an error code in hugetlb_reserve_pages()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7fc2513aa237e2ce239ab54d7b04d1d79b317110 ]
+
+Preserve the error code from region_add() instead of returning success.
+
+Link: https://lkml.kernel.org/r/X9NGZWnZl5/Mt99R@mwanda
+Fixes: 0db9d74ed884 ("hugetlb: disable region_add file_region coalescing")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Cc: Mina Almasry <almasrymina@google.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/hugetlb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d029d938d26d6..3b38ea958e954 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -5115,6 +5115,7 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 
+ 		if (unlikely(add < 0)) {
+ 			hugetlb_acct_memory(h, -gbl_reserve);
++			ret = add;
+ 			goto out_put_pages;
+ 		} else if (unlikely(chg > add)) {
+ 			/*
+-- 
+2.27.0
+
diff --git a/queue-5.10/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch b/queue-5.10/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch
new file mode 100644
index 00000000000..3c2784f1383
--- /dev/null
+++ b/queue-5.10/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch
@@ -0,0 +1,42 @@
+From 838a20e6aa0badbbcf12a68b85baa85bdaa552c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 22:53:20 +0800
+Subject: hwmon: (ina3221) Fix PM usage counter unbalance in
+ ina3221_write_enable
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit bce776f10069c806290eaac712ba73432ae8ecd7 ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced. It depends on the mainline commit[PM: runtime:
+Add pm_runtime_resume_and_get to deal with usagecounter].
+
+Fixes: 323aeb0eb5d9a ("hwmon: (ina3221) Add PM runtime support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201202145320.1135614-1-zhangqilong3@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ina3221.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
+index 41fb17e0d6416..ad11cbddc3a7b 100644
+--- a/drivers/hwmon/ina3221.c
++++ b/drivers/hwmon/ina3221.c
+@@ -489,7 +489,7 @@ static int ina3221_write_enable(struct device *dev, int channel, bool enable)
+ 
+ 	/* For enabling routine, increase refcount and resume() at first */
+ 	if (enable) {
+-		ret = pm_runtime_get_sync(ina->pm_dev);
++		ret = pm_runtime_resume_and_get(ina->pm_dev);
+ 		if (ret < 0) {
+ 			dev_err(dev, "Failed to get PM runtime\n");
+ 			return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.10/i40e-xsk-clear-the-status-bits-for-the-next_to_use-d.patch b/queue-5.10/i40e-xsk-clear-the-status-bits-for-the-next_to_use-d.patch
new file mode 100644
index 00000000000..3c36029877c
--- /dev/null
+++ b/queue-5.10/i40e-xsk-clear-the-status-bits-for-the-next_to_use-d.patch
@@ -0,0 +1,58 @@
+From b3ca9107cb452b6ca26a25fdc3e11328dfe47c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 15:57:12 +0100
+Subject: i40e, xsk: clear the status bits for the next_to_use descriptor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 64050b5b8706d304ba647591b06e1eddc55e8bd9 ]
+
+On the Rx side, the next_to_use index points to the next item in the
+HW ring to be refilled/allocated, and next_to_clean points to the next
+item to potentially be processed.
+
+When the HW Rx ring is fully refilled, i.e. no packets has been
+processed, the next_to_use will be next_to_clean - 1. When the ring is
+fully processed next_to_clean will be equal to next_to_use. The latter
+case is where a bug is triggered.
+
+If the next_to_use bits are not cleared, and the "fully processed"
+state is entered, a stale descriptor can be processed.
+
+The skb-path correctly clear the status bit for the next_to_use
+descriptor, but the AF_XDP zero-copy path did not do that.
+
+This change adds the status bits clearing of the next_to_use
+descriptor.
+
+Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index 567fd67e900ef..e402c62eb3137 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -219,8 +219,11 @@ bool i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count)
+ 	} while (count);
+ 
+ no_buffers:
+-	if (rx_ring->next_to_use != ntu)
++	if (rx_ring->next_to_use != ntu) {
++		/* clear the status bits for the next_to_use descriptor */
++		rx_desc->wb.qword1.status_error_len = 0;
+ 		i40e_release_rx_desc(rx_ring, ntu);
++	}
+ 
+ 	return ok;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/ice-xsk-clear-the-status-bits-for-the-next_to_use-de.patch b/queue-5.10/ice-xsk-clear-the-status-bits-for-the-next_to_use-de.patch
new file mode 100644
index 00000000000..10341b1c2d2
--- /dev/null
+++ b/queue-5.10/ice-xsk-clear-the-status-bits-for-the-next_to_use-de.patch
@@ -0,0 +1,58 @@
+From f6381b4be9cf0154c761fe4380b68f193de8bc89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 15:57:11 +0100
+Subject: ice, xsk: clear the status bits for the next_to_use descriptor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 8d14768a7972b92c73259f0c9c45b969d85e3a60 ]
+
+On the Rx side, the next_to_use index points to the next item in the
+HW ring to be refilled/allocated, and next_to_clean points to the next
+item to potentially be processed.
+
+When the HW Rx ring is fully refilled, i.e. no packets has been
+processed, the next_to_use will be next_to_clean - 1. When the ring is
+fully processed next_to_clean will be equal to next_to_use. The latter
+case is where a bug is triggered.
+
+If the next_to_use bits are not cleared, and the "fully processed"
+state is entered, a stale descriptor can be processed.
+
+The skb-path correctly clear the status bit for the next_to_use
+descriptor, but the AF_XDP zero-copy path did not do that.
+
+This change adds the status bits clearing of the next_to_use
+descriptor.
+
+Fixes: 2d4238f55697 ("ice: Add support for AF_XDP")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_xsk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_xsk.c b/drivers/net/ethernet/intel/ice/ice_xsk.c
+index 797886524054c..98101a8e2952d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
+@@ -446,8 +446,11 @@ bool ice_alloc_rx_bufs_zc(struct ice_ring *rx_ring, u16 count)
+ 		}
+ 	} while (--count);
+ 
+-	if (rx_ring->next_to_use != ntu)
++	if (rx_ring->next_to_use != ntu) {
++		/* clear the status bits for the next_to_use descriptor */
++		rx_desc->wb.status_error0 = 0;
+ 		ice_release_rx_desc(rx_ring, ntu);
++	}
+ 
+ 	return ret;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/iio-adc-at91_adc-add-kconfig-dep-on-the-of-symbol-an.patch b/queue-5.10/iio-adc-at91_adc-add-kconfig-dep-on-the-of-symbol-an.patch
new file mode 100644
index 00000000000..3ce93b2c273
--- /dev/null
+++ b/queue-5.10/iio-adc-at91_adc-add-kconfig-dep-on-the-of-symbol-an.patch
@@ -0,0 +1,69 @@
+From a386696786fd13a7b1b17766b0ddee206431c936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 16:50:47 +0300
+Subject: iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove
+ of_match_ptr()
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit f091d7c5fe6cc39e916b50f90e3cac67a032d0be ]
+
+This tries to solve a warning reported by the lkp bot:
+
+>> drivers/iio/adc/at91_adc.c:1439:34: warning: unused variable
+>> 'at91_adc_dt_ids' [-Wunused-const-variable]
+   static const struct of_device_id at91_adc_dt_ids[] = {
+                                    ^
+   1 warning generated.
+
+This warning has appeared after the AT91_ADC driver compilation has been
+enabled via the COMPILE_TEST symbol dependency.
+
+The warning is caused by the 'of_match_ptr()' helper which returns NULL if
+OF is undefined. This driver should build only for device-tree context, so
+a dependency on the OF Kconfig symbol has been added.
+Also, the usage of of_match_ptr() helper has been removed since it
+shouldn't ever return NULL (because the driver should not be built for the
+non-OF context).
+
+Fixes: 4027860dcc4c ("iio: Kconfig: at91_adc: add COMPILE_TEST dependency to driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20200930135048.11530-4-alexandru.ardelean@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/Kconfig    | 2 +-
+ drivers/iio/adc/at91_adc.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+index 91ae90514aff4..17e9ceb9c6c48 100644
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -295,7 +295,7 @@ config ASPEED_ADC
+ config AT91_ADC
+ 	tristate "Atmel AT91 ADC"
+ 	depends on ARCH_AT91 || COMPILE_TEST
+-	depends on INPUT && SYSFS
++	depends on INPUT && SYSFS && OF
+ 	select IIO_BUFFER
+ 	select IIO_TRIGGERED_BUFFER
+ 	help
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 9b2c548fae957..0a793e7cd53ee 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -1469,7 +1469,7 @@ static struct platform_driver at91_adc_driver = {
+ 	.id_table = at91_adc_ids,
+ 	.driver = {
+ 		   .name = DRIVER_NAME,
+-		   .of_match_table = of_match_ptr(at91_adc_dt_ids),
++		   .of_match_table = at91_adc_dt_ids,
+ 		   .pm = &at91_adc_pm_ops,
+ 	},
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch b/queue-5.10/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch
new file mode 100644
index 00000000000..2a5750e7fb8
--- /dev/null
+++ b/queue-5.10/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch
@@ -0,0 +1,56 @@
+From 7cf6e0748e26be0f2c6f0ee256eed700f3c53805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 11:37:50 +0100
+Subject: iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt
+ context
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit 0178297c1e6898e2197fe169ef3be723e019b971 ]
+
+On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft
+interrupt expiry mode by default.
+
+The IIO hrtimer-trigger needs to run in hard interrupt context since it
+will end up calling generic_handle_irq() which has the requirement to run
+in hard interrupt context.
+
+Explicitly specify that the timer needs to run in hard interrupt context by
+using the HRTIMER_MODE_REL_HARD flag.
+
+Fixes: f5c2f0215e36 ("hrtimer: Move unmarked hrtimers to soft interrupt expiry on RT")
+Reported-by: Christian Eggers <ceggers@arri.de>
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20201117103751.16131-1-lars@metafoo.de
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/trigger/iio-trig-hrtimer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/trigger/iio-trig-hrtimer.c b/drivers/iio/trigger/iio-trig-hrtimer.c
+index f59bf8d585866..410de837d0417 100644
+--- a/drivers/iio/trigger/iio-trig-hrtimer.c
++++ b/drivers/iio/trigger/iio-trig-hrtimer.c
+@@ -102,7 +102,7 @@ static int iio_trig_hrtimer_set_state(struct iio_trigger *trig, bool state)
+ 
+ 	if (state)
+ 		hrtimer_start(&trig_info->timer, trig_info->period,
+-			      HRTIMER_MODE_REL);
++			      HRTIMER_MODE_REL_HARD);
+ 	else
+ 		hrtimer_cancel(&trig_info->timer);
+ 
+@@ -132,7 +132,7 @@ static struct iio_sw_trigger *iio_trig_hrtimer_probe(const char *name)
+ 	trig_info->swt.trigger->ops = &iio_hrtimer_trigger_ops;
+ 	trig_info->swt.trigger->dev.groups = iio_hrtimer_attr_groups;
+ 
+-	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
+ 	trig_info->timer.function = iio_hrtimer_trig_handler;
+ 
+ 	trig_info->sampling_frequency = HRTIMER_DEFAULT_SAMPLING_FREQUENCY;
+-- 
+2.27.0
+
diff --git a/queue-5.10/input-ads7846-fix-integer-overflow-on-rt-calculation.patch b/queue-5.10/input-ads7846-fix-integer-overflow-on-rt-calculation.patch
new file mode 100644
index 00000000000..71e7034d82b
--- /dev/null
+++ b/queue-5.10/input-ads7846-fix-integer-overflow-on-rt-calculation.patch
@@ -0,0 +1,52 @@
+From 33630d6ab18293aff62bb0d042e203ede2e0adbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 15:33:24 -0800
+Subject: Input: ads7846 - fix integer overflow on Rt calculation
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]
+
+In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
+z1 is minimal value and x_plate_ohms is relatively high (for example 800
+ohm). This would happen on some screen age with low pressure.
+
+There are two possible fixes:
+- make Rt 64bit
+- reorder calculation to avoid overflow
+
+The second variant seems to be preferable, since 64 bit calculation on
+32 bit system is a bit more expensive.
+
+Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
+Co-developed-by: David Jander <david@protonic.nl>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 69992d5e53118..78ed285c27ae3 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -802,10 +802,11 @@ static void ads7846_report_state(struct ads7846 *ts)
+ 		/* compute touch pressure resistance using equation #2 */
+ 		Rt = z2;
+ 		Rt -= z1;
+-		Rt *= x;
+ 		Rt *= ts->x_plate_ohms;
++		Rt = DIV_ROUND_CLOSEST(Rt, 16);
++		Rt *= x;
+ 		Rt /= z1;
+-		Rt = (Rt + 2047) >> 12;
++		Rt = DIV_ROUND_CLOSEST(Rt, 256);
+ 	} else {
+ 		Rt = 0;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/input-ads7846-fix-race-that-causes-missing-releases.patch b/queue-5.10/input-ads7846-fix-race-that-causes-missing-releases.patch
new file mode 100644
index 00000000000..669b3d070d0
--- /dev/null
+++ b/queue-5.10/input-ads7846-fix-race-that-causes-missing-releases.patch
@@ -0,0 +1,103 @@
+From b8e461c134fc326a530e9cf28055de4a44af4b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 11:00:59 -0800
+Subject: Input: ads7846 - fix race that causes missing releases
+
+From: David Jander <david@protonic.nl>
+
+[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]
+
+If touchscreen is released while busy reading HWMON device, the release
+can be missed. The IRQ thread is not started because no touch is active
+and BTN_TOUCH release event is never sent.
+
+Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 8fd7fc39c4fd7..69992d5e53118 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -199,6 +199,26 @@ struct ads7846 {
+ #define	REF_ON	(READ_12BIT_DFR(x, 1, 1))
+ #define	REF_OFF	(READ_12BIT_DFR(y, 0, 0))
+ 
++static int get_pendown_state(struct ads7846 *ts)
++{
++	if (ts->get_pendown_state)
++		return ts->get_pendown_state();
++
++	return !gpio_get_value(ts->gpio_pendown);
++}
++
++static void ads7846_report_pen_up(struct ads7846 *ts)
++{
++	struct input_dev *input = ts->input;
++
++	input_report_key(input, BTN_TOUCH, 0);
++	input_report_abs(input, ABS_PRESSURE, 0);
++	input_sync(input);
++
++	ts->pendown = false;
++	dev_vdbg(&ts->spi->dev, "UP\n");
++}
++
+ /* Must be called with ts->lock held */
+ static void ads7846_stop(struct ads7846 *ts)
+ {
+@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
+ static void ads7846_restart(struct ads7846 *ts)
+ {
+ 	if (!ts->disabled && !ts->suspended) {
++		/* Check if pen was released since last stop */
++		if (ts->pendown && !get_pendown_state(ts))
++			ads7846_report_pen_up(ts);
++
+ 		/* Tell IRQ thread that it may poll the device. */
+ 		ts->stopped = false;
+ 		mb();
+@@ -606,14 +630,6 @@ static const struct attribute_group ads784x_attr_group = {
+ 
+ /*--------------------------------------------------------------------------*/
+ 
+-static int get_pendown_state(struct ads7846 *ts)
+-{
+-	if (ts->get_pendown_state)
+-		return ts->get_pendown_state();
+-
+-	return !gpio_get_value(ts->gpio_pendown);
+-}
+-
+ static void null_wait_for_sync(void)
+ {
+ }
+@@ -868,16 +884,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
+ 				   msecs_to_jiffies(TS_POLL_PERIOD));
+ 	}
+ 
+-	if (ts->pendown && !ts->stopped) {
+-		struct input_dev *input = ts->input;
+-
+-		input_report_key(input, BTN_TOUCH, 0);
+-		input_report_abs(input, ABS_PRESSURE, 0);
+-		input_sync(input);
+-
+-		ts->pendown = false;
+-		dev_vdbg(&ts->spi->dev, "UP\n");
+-	}
++	if (ts->pendown && !ts->stopped)
++		ads7846_report_pen_up(ts);
+ 
+ 	return IRQ_HANDLED;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/input-ads7846-fix-unaligned-access-on-7845.patch b/queue-5.10/input-ads7846-fix-unaligned-access-on-7845.patch
new file mode 100644
index 00000000000..9df769cedb6
--- /dev/null
+++ b/queue-5.10/input-ads7846-fix-unaligned-access-on-7845.patch
@@ -0,0 +1,43 @@
+From a05e8e85678d654d2d52838173c54b721417c9b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 17:17:11 -0800
+Subject: Input: ads7846 - fix unaligned access on 7845
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]
+
+req->sample[1] is not naturally aligned at word boundary, and therefore we
+should use get_unaligned_be16() when accessing it.
+
+Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 78ed285c27ae3..ff97897feaf2a 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -33,6 +33,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/module.h>
+ #include <asm/irq.h>
++#include <asm/unaligned.h>
+ 
+ /*
+  * This code has been heavily tested on a Nokia 770, and lightly
+@@ -435,7 +436,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
+ 
+ 	if (status == 0) {
+ 		/* BE12 value, then padding */
+-		status = be16_to_cpu(*((u16 *)&req->sample[1]));
++		status = get_unaligned_be16(&req->sample[1]);
+ 		status = status >> 3;
+ 		status &= 0x0fff;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/input-omap4-keypad-fix-runtime-pm-error-handling.patch b/queue-5.10/input-omap4-keypad-fix-runtime-pm-error-handling.patch
new file mode 100644
index 00000000000..f400d5d2244
--- /dev/null
+++ b/queue-5.10/input-omap4-keypad-fix-runtime-pm-error-handling.patch
@@ -0,0 +1,202 @@
+From 186783f67c2ab42c3a696bbe932be4f8d5ae910c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:36:49 -0800
+Subject: Input: omap4-keypad - fix runtime PM error handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]
+
+In omap4_keypad_probe, the patch fix several bugs.
+
+  1) pm_runtime_get_sync will increment pm usage counter even it
+     failed. Forgetting to pm_runtime_put_noidle will result in
+     reference leak.
+
+  2) In err_unmap, forget to disable runtime of device,
+     pm_runtime_enable will increase power disable depth. Thus a
+     pairing decrement is needed on the error handling path to keep
+     it balanced.
+
+  3) In err_pm_disable, it will call pm_runtime_put_sync twice not
+     one time.
+
+To fix this we factor out code reading revision and disabling touchpad, and
+drop PM reference once we are done talking to the device.
+
+Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
+Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
+ 1 file changed, 53 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index d6c924032aaa8..dd16f7b3c7ef6 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -186,12 +186,8 @@ static int omap4_keypad_open(struct input_dev *input)
+ 	return 0;
+ }
+ 
+-static void omap4_keypad_close(struct input_dev *input)
++static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
+ {
+-	struct omap4_keypad *keypad_data = input_get_drvdata(input);
+-
+-	disable_irq(keypad_data->irq);
+-
+ 	/* Disable interrupts and wake-up events */
+ 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ 			 OMAP4_VAL_IRQDISABLE);
+@@ -200,7 +196,15 @@ static void omap4_keypad_close(struct input_dev *input)
+ 	/* clear pending interrupts */
+ 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ 			 kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
++}
++
++static void omap4_keypad_close(struct input_dev *input)
++{
++	struct omap4_keypad *keypad_data;
+ 
++	keypad_data = input_get_drvdata(input);
++	disable_irq(keypad_data->irq);
++	omap4_keypad_stop(keypad_data);
+ 	enable_irq(keypad_data->irq);
+ 
+ 	pm_runtime_put_sync(input->dev.parent);
+@@ -223,13 +227,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
+ 	return 0;
+ }
+ 
++static int omap4_keypad_check_revision(struct device *dev,
++				       struct omap4_keypad *keypad_data)
++{
++	unsigned int rev;
++
++	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
++	rev &= 0x03 << 30;
++	rev >>= 30;
++	switch (rev) {
++	case KBD_REVISION_OMAP4:
++		keypad_data->reg_offset = 0x00;
++		keypad_data->irqreg_offset = 0x00;
++		break;
++	case KBD_REVISION_OMAP5:
++		keypad_data->reg_offset = 0x10;
++		keypad_data->irqreg_offset = 0x0c;
++		break;
++	default:
++		dev_err(dev, "Keypad reports unsupported revision %d", rev);
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ static int omap4_keypad_probe(struct platform_device *pdev)
+ {
+ 	struct omap4_keypad *keypad_data;
+ 	struct input_dev *input_dev;
+ 	struct resource *res;
+ 	unsigned int max_keys;
+-	int rev;
+ 	int irq;
+ 	int error;
+ 
+@@ -269,41 +297,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ 		goto err_release_mem;
+ 	}
+ 
++	pm_runtime_enable(&pdev->dev);
+ 
+ 	/*
+ 	 * Enable clocks for the keypad module so that we can read
+ 	 * revision register.
+ 	 */
+-	pm_runtime_enable(&pdev->dev);
+ 	error = pm_runtime_get_sync(&pdev->dev);
+ 	if (error) {
+ 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+-		goto err_unmap;
+-	}
+-	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+-	rev &= 0x03 << 30;
+-	rev >>= 30;
+-	switch (rev) {
+-	case KBD_REVISION_OMAP4:
+-		keypad_data->reg_offset = 0x00;
+-		keypad_data->irqreg_offset = 0x00;
+-		break;
+-	case KBD_REVISION_OMAP5:
+-		keypad_data->reg_offset = 0x10;
+-		keypad_data->irqreg_offset = 0x0c;
+-		break;
+-	default:
+-		dev_err(&pdev->dev,
+-			"Keypad reports unsupported revision %d", rev);
+-		error = -EINVAL;
+-		goto err_pm_put_sync;
++		pm_runtime_put_noidle(&pdev->dev);
++	} else {
++		error = omap4_keypad_check_revision(&pdev->dev,
++						    keypad_data);
++		if (!error) {
++			/* Ensure device does not raise interrupts */
++			omap4_keypad_stop(keypad_data);
++		}
++		pm_runtime_put_sync(&pdev->dev);
+ 	}
++	if (error)
++		goto err_pm_disable;
+ 
+ 	/* input device allocation */
+ 	keypad_data->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+ 		error = -ENOMEM;
+-		goto err_pm_put_sync;
++		goto err_pm_disable;
+ 	}
+ 
+ 	input_dev->name = pdev->name;
+@@ -349,28 +369,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ 		goto err_free_keymap;
+ 	}
+ 
+-	device_init_wakeup(&pdev->dev, true);
+-	pm_runtime_put_sync(&pdev->dev);
+-
+ 	error = input_register_device(keypad_data->input);
+ 	if (error < 0) {
+ 		dev_err(&pdev->dev, "failed to register input device\n");
+-		goto err_pm_disable;
++		goto err_free_irq;
+ 	}
+ 
++	device_init_wakeup(&pdev->dev, true);
+ 	platform_set_drvdata(pdev, keypad_data);
++
+ 	return 0;
+ 
+-err_pm_disable:
+-	pm_runtime_disable(&pdev->dev);
++err_free_irq:
+ 	free_irq(keypad_data->irq, keypad_data);
+ err_free_keymap:
+ 	kfree(keypad_data->keymap);
+ err_free_input:
+ 	input_free_device(input_dev);
+-err_pm_put_sync:
+-	pm_runtime_put_sync(&pdev->dev);
+-err_unmap:
++err_pm_disable:
++	pm_runtime_disable(&pdev->dev);
+ 	iounmap(keypad_data->base);
+ err_release_mem:
+ 	release_mem_region(res->start, resource_size(res));
+-- 
+2.27.0
+
diff --git a/queue-5.10/io_uring-cancel-only-requests-of-current-task.patch b/queue-5.10/io_uring-cancel-only-requests-of-current-task.patch
new file mode 100644
index 00000000000..35023cd8952
--- /dev/null
+++ b/queue-5.10/io_uring-cancel-only-requests-of-current-task.patch
@@ -0,0 +1,90 @@
+From be5b4ae8cdc841a5ba7dec0f0dca63f49cdcc35e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 13:00:23 +0000
+Subject: io_uring: cancel only requests of current task
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit df9923f96717d0aebb0a73adbcf6285fa79e38cb ]
+
+io_uring_cancel_files() cancels all request that match files regardless
+of task. There is no real need in that, cancel only requests of the
+specified task. That also handles SQPOLL case as it already changes task
+to it.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 86dac2b2e2763..0621f581943cd 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8421,14 +8421,6 @@ static int io_uring_release(struct inode *inode, struct file *file)
+ 	return 0;
+ }
+ 
+-static bool io_wq_files_match(struct io_wq_work *work, void *data)
+-{
+-	struct files_struct *files = data;
+-
+-	return !files || ((work->flags & IO_WQ_WORK_FILES) &&
+-				work->identity->files == files);
+-}
+-
+ /*
+  * Returns true if 'preq' is the link parent of 'req'
+  */
+@@ -8566,21 +8558,20 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx,
+  * Returns true if we found and killed one or more files pinning requests
+  */
+ static bool io_uring_cancel_files(struct io_ring_ctx *ctx,
++				  struct task_struct *task,
+ 				  struct files_struct *files)
+ {
+ 	if (list_empty_careful(&ctx->inflight_list))
+ 		return false;
+ 
+-	/* cancel all at once, should be faster than doing it one by one*/
+-	io_wq_cancel_cb(ctx->io_wq, io_wq_files_match, files, true);
+-
+ 	while (!list_empty_careful(&ctx->inflight_list)) {
+ 		struct io_kiocb *cancel_req = NULL, *req;
+ 		DEFINE_WAIT(wait);
+ 
+ 		spin_lock_irq(&ctx->inflight_lock);
+ 		list_for_each_entry(req, &ctx->inflight_list, inflight_entry) {
+-			if (files && (req->work.flags & IO_WQ_WORK_FILES) &&
++			if (req->task == task &&
++			    (req->work.flags & IO_WQ_WORK_FILES) &&
+ 			    req->work.identity->files != files)
+ 				continue;
+ 			/* req is being completed, ignore */
+@@ -8623,7 +8614,7 @@ static bool __io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
+ {
+ 	bool ret;
+ 
+-	ret = io_uring_cancel_files(ctx, files);
++	ret = io_uring_cancel_files(ctx, task, files);
+ 	if (!files) {
+ 		enum io_wq_cancel cret;
+ 
+@@ -8662,11 +8653,7 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
+ 		io_sq_thread_park(ctx->sq_data);
+ 	}
+ 
+-	if (files)
+-		io_cancel_defer_files(ctx, NULL, files);
+-	else
+-		io_cancel_defer_files(ctx, task, NULL);
+-
++	io_cancel_defer_files(ctx, task, files);
+ 	io_cqring_overflow_flush(ctx, true, task, files);
+ 
+ 	while (__io_uring_cancel_task_requests(ctx, task, files)) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/io_uring-cancel-reqs-shouldn-t-kill-overflow-list.patch b/queue-5.10/io_uring-cancel-reqs-shouldn-t-kill-overflow-list.patch
new file mode 100644
index 00000000000..dcb9c3768c6
--- /dev/null
+++ b/queue-5.10/io_uring-cancel-reqs-shouldn-t-kill-overflow-list.patch
@@ -0,0 +1,57 @@
+From 7a16fe3c63c7cac9bc1a97958a197d89141d2502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 00:24:35 +0000
+Subject: io_uring: cancel reqs shouldn't kill overflow list
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit cda286f0715c82f8117e166afd42cca068876dde ]
+
+io_uring_cancel_task_requests() doesn't imply that the ring is going
+away, it may continue to work well after that. The problem is that it
+sets ->cq_overflow_flushed effectively disabling the CQ overflow feature
+
+Split setting cq_overflow_flushed from flush, and do the first one only
+on exit. It's ok in terms of cancellations because there is a
+io_uring->in_idle check in __io_cqring_fill_event().
+
+It also fixes a race with setting ->cq_overflow_flushed in
+io_uring_cancel_task_requests, whuch's is not atomic and a part of a
+bitmask with other flags. Though, the only other flag that's not set
+during init is drain_next, so it's not as bad for sane architectures.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Fixes: 0f2122045b946 ("io_uring: don't rely on weak ->files references")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index b9d3209a5f9de..e9219841923cc 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1641,10 +1641,6 @@ static bool io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force,
+ 
+ 	spin_lock_irqsave(&ctx->completion_lock, flags);
+ 
+-	/* if force is set, the ring is going away. always drop after that */
+-	if (force)
+-		ctx->cq_overflow_flushed = 1;
+-
+ 	cqe = NULL;
+ 	list_for_each_entry_safe(req, tmp, &ctx->cq_overflow_list, compl.list) {
+ 		if (tsk && req->task != tsk)
+@@ -8378,6 +8374,8 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
+ {
+ 	mutex_lock(&ctx->uring_lock);
+ 	percpu_ref_kill(&ctx->refs);
++	/* if force is set, the ring is going away. always drop after that */
++	ctx->cq_overflow_flushed = 1;
+ 	if (ctx->rings)
+ 		io_cqring_overflow_flush(ctx, true, NULL, NULL);
+ 	mutex_unlock(&ctx->uring_lock);
+-- 
+2.27.0
+
diff --git a/queue-5.10/io_uring-fix-racy-iopoll-flush-overflow.patch b/queue-5.10/io_uring-fix-racy-iopoll-flush-overflow.patch
new file mode 100644
index 00000000000..ed0af596276
--- /dev/null
+++ b/queue-5.10/io_uring-fix-racy-iopoll-flush-overflow.patch
@@ -0,0 +1,80 @@
+From 1a67e60cf40c320243db60362adf1c7b5856b491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 22:22:44 +0000
+Subject: io_uring: fix racy IOPOLL flush overflow
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 634578f800652035debba3098d8ab0d21af7c7a5 ]
+
+It's not safe to call io_cqring_overflow_flush() for IOPOLL mode without
+hodling uring_lock, because it does synchronisation differently. Make
+sure we have it.
+
+As for io_ring_exit_work(), we don't even need it there because
+io_ring_ctx_wait_and_kill() already set force flag making all overflowed
+requests to be dropped.
+
+Cc: <stable@vger.kernel.org> # 5.5+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 0621f581943cd..b9d3209a5f9de 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8369,8 +8369,6 @@ static void io_ring_exit_work(struct work_struct *work)
+ 	 * as nobody else will be looking for them.
+ 	 */
+ 	do {
+-		if (ctx->rings)
+-			io_cqring_overflow_flush(ctx, true, NULL, NULL);
+ 		io_iopoll_try_reap_events(ctx);
+ 	} while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20));
+ 	io_ring_ctx_free(ctx);
+@@ -8380,6 +8378,8 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
+ {
+ 	mutex_lock(&ctx->uring_lock);
+ 	percpu_ref_kill(&ctx->refs);
++	if (ctx->rings)
++		io_cqring_overflow_flush(ctx, true, NULL, NULL);
+ 	mutex_unlock(&ctx->uring_lock);
+ 
+ 	io_kill_timeouts(ctx, NULL);
+@@ -8389,8 +8389,6 @@ static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
+ 		io_wq_cancel_all(ctx->io_wq);
+ 
+ 	/* if we failed setting up the ctx, we might not have any rings */
+-	if (ctx->rings)
+-		io_cqring_overflow_flush(ctx, true, NULL, NULL);
+ 	io_iopoll_try_reap_events(ctx);
+ 	idr_for_each(&ctx->personality_idr, io_remove_personalities, ctx);
+ 
+@@ -8654,7 +8652,9 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
+ 	}
+ 
+ 	io_cancel_defer_files(ctx, task, files);
++	io_ring_submit_lock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
+ 	io_cqring_overflow_flush(ctx, true, task, files);
++	io_ring_submit_unlock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
+ 
+ 	while (__io_uring_cancel_task_requests(ctx, task, files)) {
+ 		io_run_task_work();
+@@ -8956,8 +8956,10 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
+ 	 */
+ 	ret = 0;
+ 	if (ctx->flags & IORING_SETUP_SQPOLL) {
++		io_ring_submit_lock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
+ 		if (!list_empty_careful(&ctx->cq_overflow_list))
+ 			io_cqring_overflow_flush(ctx, false, NULL, NULL);
++		io_ring_submit_unlock(ctx, (ctx->flags & IORING_SETUP_IOPOLL));
+ 		if (flags & IORING_ENTER_SQ_WAKEUP)
+ 			wake_up(&ctx->sq_data->wait);
+ 		if (flags & IORING_ENTER_SQ_WAIT)
+-- 
+2.27.0
+
diff --git a/queue-5.10/iommu-vt-d-include-conditionally-on-config_intel_iom.patch b/queue-5.10/iommu-vt-d-include-conditionally-on-config_intel_iom.patch
new file mode 100644
index 00000000000..ea2c612f62e
--- /dev/null
+++ b/queue-5.10/iommu-vt-d-include-conditionally-on-config_intel_iom.patch
@@ -0,0 +1,52 @@
+From 9770de0be8790ff7708400131dd064f4319c7769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 21:59:51 +0100
+Subject: iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit 68dd9d89eaf56dfab8d46bf25610aa4650247617 ]
+
+Commit 6ee1b77ba3ac ("iommu/vt-d: Add svm/sva invalidate function")
+introduced intel_iommu_sva_invalidate() when CONFIG_INTEL_IOMMU_SVM.
+This function uses the dedicated static variable inv_type_granu_table
+and functions to_vtd_granularity() and to_vtd_size().
+
+These parts are unused when !CONFIG_INTEL_IOMMU_SVM, and hence,
+make CC=clang W=1 warns with an -Wunused-function warning.
+
+Include these parts conditionally on CONFIG_INTEL_IOMMU_SVM.
+
+Fixes: 6ee1b77ba3ac ("iommu/vt-d: Add svm/sva invalidate function")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20201115205951.20698-1-lukas.bulwahn@gmail.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index a49afa11673cc..c9da9e93f545c 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -5387,6 +5387,7 @@ static void intel_iommu_aux_detach_device(struct iommu_domain *domain,
+ 	aux_domain_remove_dev(to_dmar_domain(domain), dev);
+ }
+ 
++#ifdef CONFIG_INTEL_IOMMU_SVM
+ /*
+  * 2D array for converting and sanitizing IOMMU generic TLB granularity to
+  * VT-d granularity. Invalidation is typically included in the unmap operation
+@@ -5433,7 +5434,6 @@ static inline u64 to_vtd_size(u64 granu_size, u64 nr_granules)
+ 	return order_base_2(nr_pages);
+ }
+ 
+-#ifdef CONFIG_INTEL_IOMMU_SVM
+ static int
+ intel_iommu_sva_invalidate(struct iommu_domain *domain, struct device *dev,
+ 			   struct iommu_cache_invalidate_info *inv_info)
+-- 
+2.27.0
+
diff --git a/queue-5.10/ionic-change-set_rx_mode-from_ndo-to-can_sleep.patch b/queue-5.10/ionic-change-set_rx_mode-from_ndo-to-can_sleep.patch
new file mode 100644
index 00000000000..96b9a1dee22
--- /dev/null
+++ b/queue-5.10/ionic-change-set_rx_mode-from_ndo-to-can_sleep.patch
@@ -0,0 +1,93 @@
+From 7f0ada2ab52681656c6a60a2ab2ada2140dafb1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 10:22:07 -0800
+Subject: ionic: change set_rx_mode from_ndo to can_sleep
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 81dbc24147f9250c186ae5875b3ed3136e9e293b ]
+
+Instead of having two different ways of expressing the same
+sleepability concept, using opposite logic, we can rework the
+from_ndo to can_sleep for a more consistent usage.
+
+Fixes: 1800eee16676 ("net: ionic: Replace in_interrupt() usage.")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_lif.c   | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 7ad9f0cc1af66..c968c5c5a60a0 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -1129,7 +1129,7 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
+ 		lif->rx_mode = rx_mode;
+ }
+ 
+-static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
++static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep)
+ {
+ 	struct ionic_lif *lif = netdev_priv(netdev);
+ 	struct ionic_deferred_work *work;
+@@ -1149,10 +1149,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 	 *       we remove our overflow flag and check the netdev flags
+ 	 *       to see if we can disable NIC PROMISC
+ 	 */
+-	if (from_ndo)
+-		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+-	else
++	if (can_sleep)
+ 		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
++	else
++		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+ 	nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters);
+ 	if (netdev_uc_count(netdev) + 1 > nfilters) {
+ 		rx_mode |= IONIC_RX_MODE_F_PROMISC;
+@@ -1164,10 +1164,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 	}
+ 
+ 	/* same for multicast */
+-	if (from_ndo)
+-		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+-	else
++	if (can_sleep)
+ 		__dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
++	else
++		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+ 	nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters);
+ 	if (netdev_mc_count(netdev) > nfilters) {
+ 		rx_mode |= IONIC_RX_MODE_F_ALLMULTI;
+@@ -1179,7 +1179,7 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 	}
+ 
+ 	if (lif->rx_mode != rx_mode) {
+-		if (from_ndo) {
++		if (!can_sleep) {
+ 			work = kzalloc(sizeof(*work), GFP_ATOMIC);
+ 			if (!work) {
+ 				netdev_err(lif->netdev, "%s OOM\n", __func__);
+@@ -1197,7 +1197,7 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 
+ static void ionic_ndo_set_rx_mode(struct net_device *netdev)
+ {
+-	ionic_set_rx_mode(netdev, true);
++	ionic_set_rx_mode(netdev, false);
+ }
+ 
+ static __le64 ionic_netdev_features_to_nic(netdev_features_t features)
+@@ -1764,7 +1764,7 @@ static int ionic_txrx_init(struct ionic_lif *lif)
+ 	if (lif->netdev->features & NETIF_F_RXHASH)
+ 		ionic_lif_rss_init(lif);
+ 
+-	ionic_set_rx_mode(lif->netdev, false);
++	ionic_set_rx_mode(lif->netdev, true);
+ 
+ 	return 0;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/ionic-flatten-calls-to-ionic_lif_rx_mode.patch b/queue-5.10/ionic-flatten-calls-to-ionic_lif_rx_mode.patch
new file mode 100644
index 00000000000..0b10147e040
--- /dev/null
+++ b/queue-5.10/ionic-flatten-calls-to-ionic_lif_rx_mode.patch
@@ -0,0 +1,82 @@
+From 4ea28f07e520b960d79cf8b14ee0363648685844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 10:22:06 -0800
+Subject: ionic: flatten calls to ionic_lif_rx_mode
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit e94f76bb206333efcd0c02da5dbb142518c941a2 ]
+
+The _ionic_lif_rx_mode() is only used once and really doesn't
+need to be broken out.
+
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_lif.c   | 38 ++++++++-----------
+ 1 file changed, 16 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 724df18400165..7ad9f0cc1af66 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -1129,29 +1129,10 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
+ 		lif->rx_mode = rx_mode;
+ }
+ 
+-static void _ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode,
+-			       bool from_ndo)
+-{
+-	struct ionic_deferred_work *work;
+-
+-	if (from_ndo) {
+-		work = kzalloc(sizeof(*work), GFP_ATOMIC);
+-		if (!work) {
+-			netdev_err(lif->netdev, "%s OOM\n", __func__);
+-			return;
+-		}
+-		work->type = IONIC_DW_TYPE_RX_MODE;
+-		work->rx_mode = rx_mode;
+-		netdev_dbg(lif->netdev, "deferred: rx_mode\n");
+-		ionic_lif_deferred_enqueue(&lif->deferred, work);
+-	} else {
+-		ionic_lif_rx_mode(lif, rx_mode);
+-	}
+-}
+-
+ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ {
+ 	struct ionic_lif *lif = netdev_priv(netdev);
++	struct ionic_deferred_work *work;
+ 	unsigned int nfilters;
+ 	unsigned int rx_mode;
+ 
+@@ -1197,8 +1178,21 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 			rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI;
+ 	}
+ 
+-	if (lif->rx_mode != rx_mode)
+-		_ionic_lif_rx_mode(lif, rx_mode, from_ndo);
++	if (lif->rx_mode != rx_mode) {
++		if (from_ndo) {
++			work = kzalloc(sizeof(*work), GFP_ATOMIC);
++			if (!work) {
++				netdev_err(lif->netdev, "%s OOM\n", __func__);
++				return;
++			}
++			work->type = IONIC_DW_TYPE_RX_MODE;
++			work->rx_mode = rx_mode;
++			netdev_dbg(lif->netdev, "deferred: rx_mode\n");
++			ionic_lif_deferred_enqueue(&lif->deferred, work);
++		} else {
++			ionic_lif_rx_mode(lif, rx_mode);
++		}
++	}
+ }
+ 
+ static void ionic_ndo_set_rx_mode(struct net_device *netdev)
+-- 
+2.27.0
+
diff --git a/queue-5.10/ionic-use-mc-sync-for-multicast-filters.patch b/queue-5.10/ionic-use-mc-sync-for-multicast-filters.patch
new file mode 100644
index 00000000000..01febb87513
--- /dev/null
+++ b/queue-5.10/ionic-use-mc-sync-for-multicast-filters.patch
@@ -0,0 +1,69 @@
+From 4816c4f3ae7318f2d93a61239b0442ba5a0c1202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 10:22:05 -0800
+Subject: ionic: use mc sync for multicast filters
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit e0243e1966592859da4c6ffe6d43e1576ec3c457 ]
+
+We should be using the multicast sync routines for the multicast
+filters.  Also, let's just flatten the logic a bit and pull
+the small unicast routine back into ionic_set_rx_mode().
+
+Fixes: 1800eee16676 ("net: ionic: Replace in_interrupt() usage.")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_lif.c   | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index a12df3946a07c..724df18400165 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -1149,15 +1149,6 @@ static void _ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode,
+ 	}
+ }
+ 
+-static void ionic_dev_uc_sync(struct net_device *netdev, bool from_ndo)
+-{
+-	if (from_ndo)
+-		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
+-	else
+-		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
+-
+-}
+-
+ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ {
+ 	struct ionic_lif *lif = netdev_priv(netdev);
+@@ -1177,7 +1168,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 	 *       we remove our overflow flag and check the netdev flags
+ 	 *       to see if we can disable NIC PROMISC
+ 	 */
+-	ionic_dev_uc_sync(netdev, from_ndo);
++	if (from_ndo)
++		__dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
++	else
++		__dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
+ 	nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters);
+ 	if (netdev_uc_count(netdev) + 1 > nfilters) {
+ 		rx_mode |= IONIC_RX_MODE_F_PROMISC;
+@@ -1189,7 +1183,10 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool from_ndo)
+ 	}
+ 
+ 	/* same for multicast */
+-	ionic_dev_uc_sync(netdev, from_ndo);
++	if (from_ndo)
++		__dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
++	else
++		__dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
+ 	nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters);
+ 	if (netdev_mc_count(netdev) > nfilters) {
+ 		rx_mode |= IONIC_RX_MODE_F_ALLMULTI;
+-- 
+2.27.0
+
diff --git a/queue-5.10/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch b/queue-5.10/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch
new file mode 100644
index 00000000000..930eda60f03
--- /dev/null
+++ b/queue-5.10/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch
@@ -0,0 +1,43 @@
+From 6b71055b330a5726a69d6f65b6918ccb2edfb396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 13:55:25 +0000
+Subject: irqchip/alpine-msi: Fix freeing of interrupts on allocation error
+ path
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]
+
+The alpine-msi driver has an interesting allocation error handling,
+where it frees the same interrupts repeatedly. Hilarity follows.
+
+This code is probably never executed, but let's fix it nonetheless.
+
+Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Antoine Tenart <atenart@kernel.org>
+Cc: Tsahee Zidenberg <tsahee@annapurnalabs.com>
+Cc: Antoine Tenart <atenart@kernel.org>
+Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-alpine-msi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
+index 23a3b877f7f1d..ede02dc2bcd0b 100644
+--- a/drivers/irqchip/irq-alpine-msi.c
++++ b/drivers/irqchip/irq-alpine-msi.c
+@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
+ 	return 0;
+ 
+ err_sgi:
+-	while (--i >= 0)
+-		irq_domain_free_irqs_parent(domain, virq, i);
++	irq_domain_free_irqs_parent(domain, virq, i - 1);
+ 	alpine_msix_free_sgi(priv, sgi, nr_irqs);
+ 	return err;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/irqchip-qcom-pdc-fix-phantom-irq-when-changing-betwe.patch b/queue-5.10/irqchip-qcom-pdc-fix-phantom-irq-when-changing-betwe.patch
new file mode 100644
index 00000000000..1a14e5121ca
--- /dev/null
+++ b/queue-5.10/irqchip-qcom-pdc-fix-phantom-irq-when-changing-betwe.patch
@@ -0,0 +1,100 @@
+From b16a1305ac028bd3ada96a43145973ce2299f467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 14:15:35 -0800
+Subject: irqchip/qcom-pdc: Fix phantom irq when changing between
+ rising/falling
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 2f5fbc4305d07725bfebaedb09e57271315691ef ]
+
+We have a problem if we use gpio-keys and configure wakeups such that
+we only want one edge to wake us up.  AKA:
+  wakeup-event-action = <EV_ACT_DEASSERTED>;
+  wakeup-source;
+
+Specifically we end up with a phantom interrupt that blocks suspend if
+the line was already high and we want wakeups on rising edges (AKA we
+want the GPIO to go low and then high again before we wake up).  The
+opposite is also problematic.
+
+Specifically, here's what's happening today:
+1. Normally, gpio-keys configures to look for both edges.  Due to the
+   current workaround introduced in commit c3c0c2e18d94 ("pinctrl:
+   qcom: Handle broken/missing PDC dual edge IRQs on sc7180"), if the
+   line was high we'd configure for falling edges.
+2. At suspend time, we change to look for rising edges.
+3. After qcom_pdc_gic_set_type() runs, we get a phantom interrupt.
+
+We can solve this by just clearing the phantom interrupt.
+
+NOTE: it is possible that this could cause problems for a client with
+very specific needs, but there's not much we can do with this
+hardware.  As an example, let's say the interrupt signal is currently
+high and the client is looking for falling edges.  The client now
+changes to look for rising edges.  The client could possibly expect
+that if the line has a short pulse low (and back high) that it would
+always be detected.  Specifically no matter when the pulse happened,
+it should either have tripped the (old) falling edge trigger or the
+(new) rising edge trigger.  We will simply not trip it.  We could
+narrow down the race a bit by polling our parent before changing
+types, but no matter what we do there will still be a period of time
+where we can't tell the difference between a real transition (or more
+than one transition) and the phantom.
+
+Fixes: f55c73aef890 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Maulik Shah <mkshah@codeaurora.org>
+Reviewed-by: Maulik Shah <mkshah@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20201211141514.v4.1.I2702919afc253e2a451bebc3b701b462b2d22344@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/qcom-pdc.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index bd39e9de6ecf7..5dc63c20b67ea 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -159,6 +159,8 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
+ {
+ 	int pin_out = d->hwirq;
+ 	enum pdc_irq_config_bits pdc_type;
++	enum pdc_irq_config_bits old_pdc_type;
++	int ret;
+ 
+ 	if (pin_out == GPIO_NO_WAKE_IRQ)
+ 		return 0;
+@@ -187,9 +189,26 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
+ 		return -EINVAL;
+ 	}
+ 
++	old_pdc_type = pdc_reg_read(IRQ_i_CFG, pin_out);
+ 	pdc_reg_write(IRQ_i_CFG, pin_out, pdc_type);
+ 
+-	return irq_chip_set_type_parent(d, type);
++	ret = irq_chip_set_type_parent(d, type);
++	if (ret)
++		return ret;
++
++	/*
++	 * When we change types the PDC can give a phantom interrupt.
++	 * Clear it.  Specifically the phantom shows up when reconfiguring
++	 * polarity of interrupt without changing the state of the signal
++	 * but let's be consistent and clear it always.
++	 *
++	 * Doing this works because we have IRQCHIP_SET_TYPE_MASKED so the
++	 * interrupt will be cleared before the rest of the system sees it.
++	 */
++	if (old_pdc_type != pdc_type)
++		irq_chip_set_parent_state(d, IRQCHIP_STATE_PENDING, false);
++
++	return 0;
+ }
+ 
+ static struct irq_chip qcom_pdc_gic_chip = {
+-- 
+2.27.0
+
diff --git a/queue-5.10/irqchip-ti-sci-inta-fix-printing-of-inta-id-on-probe.patch b/queue-5.10/irqchip-ti-sci-inta-fix-printing-of-inta-id-on-probe.patch
new file mode 100644
index 00000000000..d65b7316ae4
--- /dev/null
+++ b/queue-5.10/irqchip-ti-sci-inta-fix-printing-of-inta-id-on-probe.patch
@@ -0,0 +1,38 @@
+From 59a5983308c9f17762f0d2aa37b7298b2abec365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 17:36:14 +0530
+Subject: irqchip/ti-sci-inta: Fix printing of inta id on probe success
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit b10d5fd489b0c67f59cbdd28d95f4bd9f76a62f2 ]
+
+On a successful probe, the driver tries to print a success message with
+INTA device id. It uses pdev->id for printing the id but id is stored in
+inta->ti_sci_id. Fix it by correcting the dev_info parameter.
+
+Fixes: 5c4b585d2910 ("irqchip/ti-sci-inta: Add support for INTA directly connecting to GIC")
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20201102120614.11109-1-lokeshvutla@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ti-sci-inta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c
+index b2ab8db439d92..532d0ae172d9f 100644
+--- a/drivers/irqchip/irq-ti-sci-inta.c
++++ b/drivers/irqchip/irq-ti-sci-inta.c
+@@ -726,7 +726,7 @@ static int ti_sci_inta_irq_domain_probe(struct platform_device *pdev)
+ 	INIT_LIST_HEAD(&inta->vint_list);
+ 	mutex_init(&inta->vint_mutex);
+ 
+-	dev_info(dev, "Interrupt Aggregator domain %d created\n", pdev->id);
++	dev_info(dev, "Interrupt Aggregator domain %d created\n", inta->ti_sci_id);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/irqchip-ti-sci-intr-fix-freeing-of-irqs.patch b/queue-5.10/irqchip-ti-sci-intr-fix-freeing-of-irqs.patch
new file mode 100644
index 00000000000..f5751bc626f
--- /dev/null
+++ b/queue-5.10/irqchip-ti-sci-intr-fix-freeing-of-irqs.patch
@@ -0,0 +1,76 @@
+From 3027e09602800b3ead465eddd6537f510e700e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 17:36:31 +0530
+Subject: irqchip/ti-sci-intr: Fix freeing of irqs
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit fc6c7cd3878641fd43189f15697e7ad0871f5c1a ]
+
+ti_sci_intr_irq_domain_free() assumes that out_irq of intr is stored in
+data->chip_data and uses it for calling ti_sci irq_free() and then
+mark the out_irq as available resource. But ti_sci_intr_irq_domain_alloc()
+is storing p_hwirq(parent's hardware irq) which is translated from out_irq.
+This is causing resource leakage and eventually out_irq resources might
+be exhausted. Fix ti_sci_intr_irq_domain_alloc() by storing the out_irq
+in data->chip_data.
+
+Fixes: a5b659bd4bc7 ("irqchip/ti-sci-intr: Add support for INTR being a parent to INTR")
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20201102120631.11165-1-lokeshvutla@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ti-sci-intr.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c
+index ac9d6d658e65c..fe8fad22bcf96 100644
+--- a/drivers/irqchip/irq-ti-sci-intr.c
++++ b/drivers/irqchip/irq-ti-sci-intr.c
+@@ -129,7 +129,7 @@ static void ti_sci_intr_irq_domain_free(struct irq_domain *domain,
+  * @virq:	Corresponding Linux virtual IRQ number
+  * @hwirq:	Corresponding hwirq for the IRQ within this IRQ domain
+  *
+- * Returns parent irq if all went well else appropriate error pointer.
++ * Returns intr output irq if all went well else appropriate error pointer.
+  */
+ static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
+ 					unsigned int virq, u32 hwirq)
+@@ -173,7 +173,7 @@ static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
+ 	if (err)
+ 		goto err_msg;
+ 
+-	return p_hwirq;
++	return out_irq;
+ 
+ err_msg:
+ 	irq_domain_free_irqs_parent(domain, virq, 1);
+@@ -198,19 +198,19 @@ static int ti_sci_intr_irq_domain_alloc(struct irq_domain *domain,
+ 	struct irq_fwspec *fwspec = data;
+ 	unsigned long hwirq;
+ 	unsigned int flags;
+-	int err, p_hwirq;
++	int err, out_irq;
+ 
+ 	err = ti_sci_intr_irq_domain_translate(domain, fwspec, &hwirq, &flags);
+ 	if (err)
+ 		return err;
+ 
+-	p_hwirq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
+-	if (p_hwirq < 0)
+-		return p_hwirq;
++	out_irq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
++	if (out_irq < 0)
++		return out_irq;
+ 
+ 	irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
+ 				      &ti_sci_intr_irq_chip,
+-				      (void *)(uintptr_t)p_hwirq);
++				      (void *)(uintptr_t)out_irq);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/iwlwifi-dbg-tlv-fix-old-length-in-is_trig_data_conta.patch b/queue-5.10/iwlwifi-dbg-tlv-fix-old-length-in-is_trig_data_conta.patch
new file mode 100644
index 00000000000..27d7dfdcf56
--- /dev/null
+++ b/queue-5.10/iwlwifi-dbg-tlv-fix-old-length-in-is_trig_data_conta.patch
@@ -0,0 +1,40 @@
+From d19ae252a5955e9c049381a5dcbb22cf1a8fb356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 23:16:37 +0200
+Subject: iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 58a1c9f9a9b6b9092ae10b84f6b571a06596e296 ]
+
+There's a bug in the lengths - the 'old length' needs to be calculated
+using the 'old' pointer, of course, likely a copy/paste mistake. Fix
+this.
+
+Reported-by: Daniel Gabay <daniel.gabay@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20201209231352.c0105ddffa74.I1ddb243053ff763c91b663748b6a593ecc3b5634@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 51ce93d21ffe5..8fa1c22fd96db 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -808,7 +808,7 @@ static bool is_trig_data_contained(struct iwl_ucode_tlv *new,
+ 	struct iwl_fw_ini_trigger_tlv *old_trig = (void *)old->data;
+ 	__le32 *new_data = new_trig->data, *old_data = old_trig->data;
+ 	u32 new_dwords_num = iwl_tlv_array_len(new, new_trig, data);
+-	u32 old_dwords_num = iwl_tlv_array_len(new, new_trig, data);
++	u32 old_dwords_num = iwl_tlv_array_len(old, old_trig, data);
+ 	int i, j;
+ 
+ 	for (i = 0; i < new_dwords_num; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/iwlwifi-mvm-hook-up-missing-rx-handlers.patch b/queue-5.10/iwlwifi-mvm-hook-up-missing-rx-handlers.patch
new file mode 100644
index 00000000000..3edc7cf8005
--- /dev/null
+++ b/queue-5.10/iwlwifi-mvm-hook-up-missing-rx-handlers.patch
@@ -0,0 +1,43 @@
+From f3dd85c336d13c57d24490124e1a3de6adec24c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 23:16:47 +0200
+Subject: iwlwifi: mvm: hook up missing RX handlers
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 8a59d39033c35bb484f6bd91891db86ebe07fdc2 ]
+
+The RX handlers for probe response data and channel switch weren't
+hooked up properly, fix that.
+
+Fixes: 86e177d80ff7 ("iwlwifi: mvm: add NOA and CSA to a probe response")
+Fixes: d3a108a48dc6 ("iwlwifi: mvm: Support CSA countdown offloading")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20201209231352.2d07dcee0d35.I07a61b5d734478db57d9434ff303e4c90bf6c32b@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index f1c5b3a9c26f7..0d1118f66f0d5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -315,6 +315,12 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
+ 		       iwl_mvm_mu_mimo_grp_notif, RX_HANDLER_SYNC),
+ 	RX_HANDLER_GRP(DATA_PATH_GROUP, STA_PM_NOTIF,
+ 		       iwl_mvm_sta_pm_notif, RX_HANDLER_SYNC),
++	RX_HANDLER_GRP(MAC_CONF_GROUP, PROBE_RESPONSE_DATA_NOTIF,
++		       iwl_mvm_probe_resp_data_notif,
++		       RX_HANDLER_ASYNC_LOCKED),
++	RX_HANDLER_GRP(MAC_CONF_GROUP, CHANNEL_SWITCH_NOA_NOTIF,
++		       iwl_mvm_channel_switch_noa_notif,
++		       RX_HANDLER_SYNC),
+ };
+ #undef RX_HANDLER
+ #undef RX_HANDLER_GRP
+-- 
+2.27.0
+
diff --git a/queue-5.10/kconfig-fix-return-value-of-do_error_if.patch b/queue-5.10/kconfig-fix-return-value-of-do_error_if.patch
new file mode 100644
index 00000000000..1325cbb258d
--- /dev/null
+++ b/queue-5.10/kconfig-fix-return-value-of-do_error_if.patch
@@ -0,0 +1,36 @@
+From a6025c56344a8457429ce319590ba298b85ebb06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Dec 2020 03:18:42 +0900
+Subject: kconfig: fix return value of do_error_if()
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]
+
+$(error-if,...) is expanded to an empty string. Currently, it relies on
+eval_clause() returning xstrdup("") when all attempts for expansion fail,
+but the correct implementation is to make do_error_if() return xstrdup("").
+
+Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/preprocess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
+index 0243086fb1685..0590f86df6e40 100644
+--- a/scripts/kconfig/preprocess.c
++++ b/scripts/kconfig/preprocess.c
+@@ -114,7 +114,7 @@ static char *do_error_if(int argc, char *argv[])
+ 	if (!strcmp(argv[0], "y"))
+ 		pperror("%s", argv[1]);
+ 
+-	return NULL;
++	return xstrdup("");
+ }
+ 
+ static char *do_filename(int argc, char *argv[])
+-- 
+2.27.0
+
diff --git a/queue-5.10/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch b/queue-5.10/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch
new file mode 100644
index 00000000000..b8e70f2b1d7
--- /dev/null
+++ b/queue-5.10/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch
@@ -0,0 +1,148 @@
+From d613ba53922b2437879a1e01d6134d277dfc2ed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 11:19:54 -0500
+Subject: lan743x: fix rx_napi_poll/interrupt ping-pong
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 57030a0b620f735bf557696e5ceb9f32c2b3bb8f ]
+
+Even if there is more rx data waiting on the chip, the rx napi poll fn
+will never run more than once - it will always read a few buffers, then
+bail out and re-arm interrupts. Which results in ping-pong between napi
+and interrupt.
+
+This defeats the purpose of napi, and is bad for performance.
+
+Fix by making the rx napi poll behave identically to other ethernet
+drivers:
+1. initialize rx napi polling with an arbitrary budget (64).
+2. in the polling fn, return full weight if rx queue is not depleted,
+   this tells the napi core to "keep polling".
+3. update the rx tail ("ring the doorbell") once for every 8 processed
+   rx ring buffers.
+
+Thanks to Jakub Kicinski, Eric Dumazet and Andrew Lunn for their expert
+opinions and suggestions.
+
+Tested with 20 seconds of full bandwidth receive (iperf3):
+        rx irqs      softirqs(NET_RX)
+        -----------------------------
+before  23827        33620
+after   129          4081
+
+Tested-by: Sven Van Asbroeck <thesven73@gmail.com> # lan7430
+Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver")
+Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
+Link: https://lore.kernel.org/r/20201215161954.5950-1-TheSven73@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 43 ++++++++++---------
+ 1 file changed, 23 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index b319c22c211cd..8947c3a628109 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -1962,6 +1962,14 @@ static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
+ 				  length, GFP_ATOMIC | GFP_DMA);
+ }
+ 
++static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index)
++{
++	/* update the tail once per 8 descriptors */
++	if ((index & 7) == 7)
++		lan743x_csr_write(rx->adapter, RX_TAIL(rx->channel_number),
++				  index);
++}
++
+ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
+ 					struct sk_buff *skb)
+ {
+@@ -1992,6 +2000,7 @@ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
+ 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
+ 			    (length & RX_DESC_DATA0_BUF_LENGTH_MASK_));
+ 	skb_reserve(buffer_info->skb, RX_HEAD_PADDING);
++	lan743x_rx_update_tail(rx, index);
+ 
+ 	return 0;
+ }
+@@ -2010,6 +2019,7 @@ static void lan743x_rx_reuse_ring_element(struct lan743x_rx *rx, int index)
+ 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
+ 			    ((buffer_info->buffer_length) &
+ 			    RX_DESC_DATA0_BUF_LENGTH_MASK_));
++	lan743x_rx_update_tail(rx, index);
+ }
+ 
+ static void lan743x_rx_release_ring_element(struct lan743x_rx *rx, int index)
+@@ -2220,6 +2230,7 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
+ {
+ 	struct lan743x_rx *rx = container_of(napi, struct lan743x_rx, napi);
+ 	struct lan743x_adapter *adapter = rx->adapter;
++	int result = RX_PROCESS_RESULT_NOTHING_TO_DO;
+ 	u32 rx_tail_flags = 0;
+ 	int count;
+ 
+@@ -2228,27 +2239,19 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
+ 		lan743x_csr_write(adapter, DMAC_INT_STS,
+ 				  DMAC_INT_BIT_RXFRM_(rx->channel_number));
+ 	}
+-	count = 0;
+-	while (count < weight) {
+-		int rx_process_result = lan743x_rx_process_packet(rx);
+-
+-		if (rx_process_result == RX_PROCESS_RESULT_PACKET_RECEIVED) {
+-			count++;
+-		} else if (rx_process_result ==
+-			RX_PROCESS_RESULT_NOTHING_TO_DO) {
++	for (count = 0; count < weight; count++) {
++		result = lan743x_rx_process_packet(rx);
++		if (result == RX_PROCESS_RESULT_NOTHING_TO_DO)
+ 			break;
+-		} else if (rx_process_result ==
+-			RX_PROCESS_RESULT_PACKET_DROPPED) {
+-			continue;
+-		}
+ 	}
+ 	rx->frame_count += count;
+-	if (count == weight)
+-		goto done;
++	if (count == weight || result == RX_PROCESS_RESULT_PACKET_RECEIVED)
++		return weight;
+ 
+ 	if (!napi_complete_done(napi, count))
+-		goto done;
++		return count;
+ 
++	/* re-arm interrupts, must write to rx tail on some chip variants */
+ 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET)
+ 		rx_tail_flags |= RX_TAIL_SET_TOP_INT_VEC_EN_;
+ 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET) {
+@@ -2258,10 +2261,10 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
+ 				  INT_BIT_DMA_RX_(rx->channel_number));
+ 	}
+ 
+-	/* update RX_TAIL */
+-	lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
+-			  rx_tail_flags | rx->last_tail);
+-done:
++	if (rx_tail_flags)
++		lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
++				  rx_tail_flags | rx->last_tail);
++
+ 	return count;
+ }
+ 
+@@ -2405,7 +2408,7 @@ static int lan743x_rx_open(struct lan743x_rx *rx)
+ 
+ 	netif_napi_add(adapter->netdev,
+ 		       &rx->napi, lan743x_rx_napi_poll,
+-		       rx->ring_size - 1);
++		       NAPI_POLL_WEIGHT);
+ 
+ 	lan743x_csr_write(adapter, DMAC_CMD,
+ 			  DMAC_CMD_RX_SWR_(rx->channel_number));
+-- 
+2.27.0
+
diff --git a/queue-5.10/leds-lp50xx-fix-an-error-handling-path-in-lp50xx_pro.patch b/queue-5.10/leds-lp50xx-fix-an-error-handling-path-in-lp50xx_pro.patch
new file mode 100644
index 00000000000..a9317cc90c2
--- /dev/null
+++ b/queue-5.10/leds-lp50xx-fix-an-error-handling-path-in-lp50xx_pro.patch
@@ -0,0 +1,44 @@
+From f81aab7a3a5bf3a440a1d130340a48446c563e30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 23:05:15 +0200
+Subject: leds: lp50xx: Fix an error handling path in 'lp50xx_probe_dt()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6d8d014c7dcf85a79da71ef586d06d03d2cae558 ]
+
+In case of memory allocation failure, we must release some resources as
+done in all other error handling paths of the function.
+
+'goto child_out' instead of a direct return so that 'fwnode_handle_put()'
+is called when we break out of a 'device_for_each_child_node' loop.
+
+Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp50xx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c
+index 5fb4f24aeb2e8..f13117eed976d 100644
+--- a/drivers/leds/leds-lp50xx.c
++++ b/drivers/leds/leds-lp50xx.c
+@@ -487,8 +487,10 @@ static int lp50xx_probe_dt(struct lp50xx *priv)
+ 		 */
+ 		mc_led_info = devm_kcalloc(priv->dev, LP50XX_LEDS_PER_MODULE,
+ 					   sizeof(*mc_led_info), GFP_KERNEL);
+-		if (!mc_led_info)
+-			return -ENOMEM;
++		if (!mc_led_info) {
++			ret = -ENOMEM;
++			goto child_out;
++		}
+ 
+ 		fwnode_for_each_child_node(child, led_node) {
+ 			ret = fwnode_property_read_u32(led_node, "color",
+-- 
+2.27.0
+
diff --git a/queue-5.10/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch b/queue-5.10/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch
new file mode 100644
index 00000000000..f11e5bd0b43
--- /dev/null
+++ b/queue-5.10/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch
@@ -0,0 +1,105 @@
+From c8d61a4e687c3b13024cf8042703e79da1473a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 17:23:05 +0800
+Subject: leds: netxbig: add missing put_device() call in
+ netxbig_leds_get_of_pdata()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 311066aa9ebcd6f1789c829da5039ca02f2dfe46 ]
+
+if of_find_device_by_node() succeed, netxbig_leds_get_of_pdata() doesn't
+have a corresponding put_device(). Thus add jump target to fix the
+exception handling for this function implementation.
+
+Fixes: 2976b1798909 ("leds: netxbig: add device tree binding")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-netxbig.c | 35 ++++++++++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
+index e6fd47365b588..68fbf0b66fadd 100644
+--- a/drivers/leds/leds-netxbig.c
++++ b/drivers/leds/leds-netxbig.c
+@@ -448,31 +448,39 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
+ 	gpio_ext = devm_kzalloc(dev, sizeof(*gpio_ext), GFP_KERNEL);
+ 	if (!gpio_ext) {
+ 		of_node_put(gpio_ext_np);
+-		return -ENOMEM;
++		ret = -ENOMEM;
++		goto put_device;
+ 	}
+ 	ret = netxbig_gpio_ext_get(dev, gpio_ext_dev, gpio_ext);
+ 	of_node_put(gpio_ext_np);
+ 	if (ret)
+-		return ret;
++		goto put_device;
+ 	pdata->gpio_ext = gpio_ext;
+ 
+ 	/* Timers (optional) */
+ 	ret = of_property_count_u32_elems(np, "timers");
+ 	if (ret > 0) {
+-		if (ret % 3)
+-			return -EINVAL;
++		if (ret % 3) {
++			ret = -EINVAL;
++			goto put_device;
++		}
++
+ 		num_timers = ret / 3;
+ 		timers = devm_kcalloc(dev, num_timers, sizeof(*timers),
+ 				      GFP_KERNEL);
+-		if (!timers)
+-			return -ENOMEM;
++		if (!timers) {
++			ret = -ENOMEM;
++			goto put_device;
++		}
+ 		for (i = 0; i < num_timers; i++) {
+ 			u32 tmp;
+ 
+ 			of_property_read_u32_index(np, "timers", 3 * i,
+ 						   &timers[i].mode);
+-			if (timers[i].mode >= NETXBIG_LED_MODE_NUM)
+-				return -EINVAL;
++			if (timers[i].mode >= NETXBIG_LED_MODE_NUM) {
++				ret = -EINVAL;
++				goto put_device;
++			}
+ 			of_property_read_u32_index(np, "timers",
+ 						   3 * i + 1, &tmp);
+ 			timers[i].delay_on = tmp;
+@@ -488,12 +496,15 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
+ 	num_leds = of_get_available_child_count(np);
+ 	if (!num_leds) {
+ 		dev_err(dev, "No LED subnodes found in DT\n");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto put_device;
+ 	}
+ 
+ 	leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL);
+-	if (!leds)
+-		return -ENOMEM;
++	if (!leds) {
++		ret = -ENOMEM;
++		goto put_device;
++	}
+ 
+ 	led = leds;
+ 	for_each_available_child_of_node(np, child) {
+@@ -574,6 +585,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
+ 
+ err_node_put:
+ 	of_node_put(child);
++put_device:
++	put_device(gpio_ext_dev);
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/leds-turris-omnia-check-for-led_color_id_rgb-instead.patch b/queue-5.10/leds-turris-omnia-check-for-led_color_id_rgb-instead.patch
new file mode 100644
index 00000000000..516498e9ad6
--- /dev/null
+++ b/queue-5.10/leds-turris-omnia-check-for-led_color_id_rgb-instead.patch
@@ -0,0 +1,43 @@
+From 4a1f2df7218905283205500785d2e4a62b1fba68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 03:39:06 +0100
+Subject: leds: turris-omnia: check for LED_COLOR_ID_RGB instead
+ LED_COLOR_ID_MULTI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 98650b0874171cc443251f7b369d3b1544db9d4e ]
+
+LED core does not allow LED_COLOR_ID_MULTI for now and instead for RGB
+LEDs prefers LED_COLOR_ID_RGB.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 77dce3a22e89 ("leds: disallow /sys/class/leds/*:multi:* for now")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-turris-omnia.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/leds-turris-omnia.c b/drivers/leds/leds-turris-omnia.c
+index 8c5bdc3847ee7..880fc8def5309 100644
+--- a/drivers/leds/leds-turris-omnia.c
++++ b/drivers/leds/leds-turris-omnia.c
+@@ -98,9 +98,9 @@ static int omnia_led_register(struct i2c_client *client, struct omnia_led *led,
+ 	}
+ 
+ 	ret = of_property_read_u32(np, "color", &color);
+-	if (ret || color != LED_COLOR_ID_MULTI) {
++	if (ret || color != LED_COLOR_ID_RGB) {
+ 		dev_warn(dev,
+-			 "Node %pOF: must contain 'color' property with value LED_COLOR_ID_MULTI\n",
++			 "Node %pOF: must contain 'color' property with value LED_COLOR_ID_RGB\n",
+ 			 np);
+ 		return 0;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch b/queue-5.10/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch
new file mode 100644
index 00000000000..6404eae53a7
--- /dev/null
+++ b/queue-5.10/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch
@@ -0,0 +1,64 @@
+From c306b1e136cdfcb7be83c3299c244f3781c276d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 20:33:57 -0800
+Subject: libbpf: Fix BTF data layout checks and allow empty BTF
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]
+
+Make data section layout checks stricter, disallowing overlap of types and
+strings data.
+
+Additionally, allow BTFs with no type data. There is nothing inherently wrong
+with having BTF with no types (put potentially with some strings). This could
+be a situation with kernel module BTFs, if module doesn't introduce any new
+type information.
+
+Also fix invalid offset alignment check for btf->hdr->type_off.
+
+Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index 231b07203e3d2..987c1515b828b 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -215,22 +215,18 @@ static int btf_parse_hdr(struct btf *btf)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (meta_left < hdr->type_off) {
+-		pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
++	if (meta_left < hdr->str_off + hdr->str_len) {
++		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
+ 		return -EINVAL;
+ 	}
+ 
+-	if (meta_left < hdr->str_off) {
+-		pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off);
++	if (hdr->type_off + hdr->type_len > hdr->str_off) {
++		pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
++			 hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
+ 		return -EINVAL;
+ 	}
+ 
+-	if (hdr->type_off >= hdr->str_off) {
+-		pr_debug("BTF type section offset >= string section offset. No type?\n");
+-		return -EINVAL;
+-	}
+-
+-	if (hdr->type_off & 0x02) {
++	if (hdr->type_off % 4) {
+ 		pr_debug("BTF type section is not aligned to 4 bytes\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/libbpf-sanitise-map-names-before-pinning.patch b/queue-5.10/libbpf-sanitise-map-names-before-pinning.patch
new file mode 100644
index 00000000000..d534f327132
--- /dev/null
+++ b/queue-5.10/libbpf-sanitise-map-names-before-pinning.patch
@@ -0,0 +1,73 @@
+From 1a2b78de7051c9c56e9a47ca94d01ef5b4756abc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 10:33:06 +0100
+Subject: libbpf: Sanitise map names before pinning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 9cf309c56f7910a81fbe053b6f11c3b1f0987b12 ]
+
+When we added sanitising of map names before loading programs to libbpf, we
+still allowed periods in the name. While the kernel will accept these for
+the map names themselves, they are not allowed in file names when pinning
+maps. This means that bpf_object__pin_maps() will fail if called on an
+object that contains internal maps (such as sections .rodata).
+
+Fix this by replacing periods with underscores when constructing map pin
+paths. This only affects the paths generated by libbpf when
+bpf_object__pin_maps() is called with a path argument. Any pin paths set
+by bpf_map__set_pin_path() are unaffected, and it will still be up to the
+caller to avoid invalid characters in those.
+
+Fixes: 113e6b7e15e2 ("libbpf: Sanitise internal map names so they are not rejected by the kernel")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20201203093306.107676-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 28baee7ba1ca8..ad165e6e74bc0 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -7649,6 +7649,16 @@ bool bpf_map__is_pinned(const struct bpf_map *map)
+ 	return map->pinned;
+ }
+ 
++static void sanitize_pin_path(char *s)
++{
++	/* bpffs disallows periods in path names */
++	while (*s) {
++		if (*s == '.')
++			*s = '_';
++		s++;
++	}
++}
++
+ int bpf_object__pin_maps(struct bpf_object *obj, const char *path)
+ {
+ 	struct bpf_map *map;
+@@ -7678,6 +7688,7 @@ int bpf_object__pin_maps(struct bpf_object *obj, const char *path)
+ 				err = -ENAMETOOLONG;
+ 				goto err_unpin_maps;
+ 			}
++			sanitize_pin_path(buf);
+ 			pin_path = buf;
+ 		} else if (!map->pin_path) {
+ 			continue;
+@@ -7722,6 +7733,7 @@ int bpf_object__unpin_maps(struct bpf_object *obj, const char *path)
+ 				return -EINVAL;
+ 			else if (len >= PATH_MAX)
+ 				return -ENAMETOOLONG;
++			sanitize_pin_path(buf);
+ 			pin_path = buf;
+ 		} else if (!map->pin_path) {
+ 			continue;
+-- 
+2.27.0
+
diff --git a/queue-5.10/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch b/queue-5.10/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch
new file mode 100644
index 00000000000..4fce2ee85ba
--- /dev/null
+++ b/queue-5.10/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch
@@ -0,0 +1,40 @@
+From 1b7fe462ff42dc29a49a1d15a28f71dc613740e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 19:50:56 +0800
+Subject: libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ]
+
+Forget to set error code when nd_label_alloc_slot failed, and we
+add it to avoid overwritten error code.
+
+Fixes: 0ba1c634892b ("libnvdimm: write blk label set")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201205115056.2076523-1-zhangqilong3@huawei.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/label.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 47a4828b8b310..05c1f186a6be8 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -999,8 +999,10 @@ static int __blk_label_update(struct nd_region *nd_region,
+ 		if (is_old_resource(res, old_res_list, old_num_resources))
+ 			continue; /* carry-over */
+ 		slot = nd_label_alloc_slot(ndd);
+-		if (slot == UINT_MAX)
++		if (slot == UINT_MAX) {
++			rc = -ENXIO;
+ 			goto abort;
++		}
+ 		dev_dbg(ndd->dev, "allocated: %d\n", slot);
+ 
+ 		nd_label = to_label(ndd, slot);
+-- 
+2.27.0
+
diff --git a/queue-5.10/lockd-don-t-use-interval-based-rebinding-over-tcp.patch b/queue-5.10/lockd-don-t-use-interval-based-rebinding-over-tcp.patch
new file mode 100644
index 00000000000..a25863118e3
--- /dev/null
+++ b/queue-5.10/lockd-don-t-use-interval-based-rebinding-over-tcp.patch
@@ -0,0 +1,99 @@
+From 65fea83a0a6151f03231726db62d8cec543040be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 20:16:27 +0000
+Subject: lockd: don't use interval-based rebinding over TCP
+
+From: Calum Mackay <calum.mackay@oracle.com>
+
+[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]
+
+NLM uses an interval-based rebinding, i.e. it clears the transport's
+binding under certain conditions if more than 60 seconds have elapsed
+since the connection was last bound.
+
+This rebinding is not necessary for an autobind RPC client over a
+connection-oriented protocol like TCP.
+
+It can also cause problems: it is possible for nlm_bind_host() to clear
+XPRT_BOUND whilst a connection worker is in the middle of trying to
+reconnect, after it had already been checked in xprt_connect().
+
+When the connection worker notices that XPRT_BOUND has been cleared
+under it, in xs_tcp_finish_connecting(), that results in:
+
+	xs_tcp_setup_socket: connect returned unhandled error -107
+
+Worse, it's possible that the two can get into lockstep, resulting in
+the same behaviour repeated indefinitely, with the above error every
+300 seconds, without ever recovering, and the connection never being
+established. This has been seen in practice, with a large number of NLM
+client tasks, following a server restart.
+
+The existing callers of nlm_bind_host & nlm_rebind_host should not need
+to force the rebind, for TCP, so restrict the interval-based rebinding
+to UDP only.
+
+For TCP, we will still rebind when needed, e.g. on timeout, and connection
+error (including closure), since connection-related errors on an existing
+connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
+already unconditionally clear XPRT_BOUND.
+
+To avoid having to add the fix, and explanation, to both nlm_bind_host()
+and nlm_rebind_host(), remove the duplicate code from the former, and
+have it call the latter.
+
+Drop the dprintk, which adds no value over a trace.
+
+Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
+Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/host.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index 0afb6d59bad03..771c289f6df7f 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -439,12 +439,7 @@ nlm_bind_host(struct nlm_host *host)
+ 	 * RPC rebind is required
+ 	 */
+ 	if ((clnt = host->h_rpcclnt) != NULL) {
+-		if (time_after_eq(jiffies, host->h_nextrebind)) {
+-			rpc_force_rebind(clnt);
+-			host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+-			dprintk("lockd: next rebind in %lu jiffies\n",
+-					host->h_nextrebind - jiffies);
+-		}
++		nlm_rebind_host(host);
+ 	} else {
+ 		unsigned long increment = nlmsvc_timeout;
+ 		struct rpc_timeout timeparms = {
+@@ -494,13 +489,20 @@ nlm_bind_host(struct nlm_host *host)
+ 	return clnt;
+ }
+ 
+-/*
+- * Force a portmap lookup of the remote lockd port
++/**
++ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
++ * @host: NLM host handle for peer
++ *
++ * This is not needed when using a connection-oriented protocol, such as TCP.
++ * The existing autobind mechanism is sufficient to force a rebind when
++ * required, e.g. on connection state transitions.
+  */
+ void
+ nlm_rebind_host(struct nlm_host *host)
+ {
+-	dprintk("lockd: rebind host %s\n", host->h_name);
++	if (host->h_proto != IPPROTO_UDP)
++		return;
++
+ 	if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
+ 		rpc_force_rebind(host->h_rpcclnt);
+ 		host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+-- 
+2.27.0
+
diff --git a/queue-5.10/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch b/queue-5.10/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch
new file mode 100644
index 00000000000..d344c42a849
--- /dev/null
+++ b/queue-5.10/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch
@@ -0,0 +1,71 @@
+From 410920ecb99964365fc656086df5bb0af3f7f555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 14:54:44 +0200
+Subject: mac80211: don't set set TDLS STA bandwidth wider than possible
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ]
+
+When we set up a TDLS station, we set sta->sta.bandwidth solely based
+on the capabilities, because the "what's the current bandwidth" check
+is bypassed and only applied for other types of stations.
+
+This leads to the unfortunate scenario that the sta->sta.bandwidth is
+160 MHz if both stations support it, but we never actually configure
+this bandwidth unless the AP is already using 160 MHz; even for wider
+bandwidth support we only go up to 80 MHz (at least right now.)
+
+For iwlwifi, this can also lead to firmware asserts, telling us that
+we've configured the TX rates for a higher bandwidth than is actually
+available due to the PHY configuration.
+
+For non-TDLS, we check against the interface's requested bandwidth,
+but we explicitly skip this check for TDLS to cope with the wider BW
+case. Change this to
+ (a) still limit to the TDLS peer's own chandef, which gets factored
+     into the overall PHY configuration we request from the driver,
+     and
+ (b) limit it to when the TDLS peer is authorized, because it's only
+     factored into the channel context in this case.
+
+Fixes: 504871e602d9 ("mac80211: fix bandwidth computation for TDLS peers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20201206145305.fcc7d29c4590.I11f77e9e25ddf871a3c8d5604650c763e2c5887a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/vht.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
+index fb0e3a657d2d3..c3ca973737742 100644
+--- a/net/mac80211/vht.c
++++ b/net/mac80211/vht.c
+@@ -465,12 +465,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+ 	 * IEEE80211-2016 specification makes higher bandwidth operation
+ 	 * possible on the TDLS link if the peers have wider bandwidth
+ 	 * capability.
++	 *
++	 * However, in this case, and only if the TDLS peer is authorized,
++	 * limit to the tdls_chandef so that the configuration here isn't
++	 * wider than what's actually requested on the channel context.
+ 	 */
+ 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+-	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
+-		return bw;
+-
+-	bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
++	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) &&
++	    test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
++	    sta->tdls_chandef.chan)
++		bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width));
++	else
++		bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+ 
+ 	return bw;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/mac80211-fix-a-mistake-check-for-rx_stats-update.patch b/queue-5.10/mac80211-fix-a-mistake-check-for-rx_stats-update.patch
new file mode 100644
index 00000000000..35e78593dfd
--- /dev/null
+++ b/queue-5.10/mac80211-fix-a-mistake-check-for-rx_stats-update.patch
@@ -0,0 +1,41 @@
+From f1155a53f5c3bb8274956072484703678d31fbe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 11:06:29 +0800
+Subject: mac80211: fix a mistake check for rx_stats update
+
+From: Wen Gong <wgong@codeaurora.org>
+
+[ Upstream commit f879ac8ed6c83ce05fcb53815a8ea83c5b6099a1 ]
+
+It should be !is_multicast_ether_addr() in ieee80211_rx_h_sta_process()
+for the rx_stats update, below commit remove the !, this patch is to
+change it back.
+
+It lead the rx rate "iw wlan0 station dump" become invalid for some
+scenario when IEEE80211_HW_USES_RSS is set.
+
+Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons")
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Link: https://lore.kernel.org/r/1607483189-3891-1-git-send-email-wgong@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 1e2e5a406d587..2a5a11f92b03e 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1758,7 +1758,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
+ 	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
+ 		sta->rx_stats.last_rx = jiffies;
+ 	} else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
+-		   is_multicast_ether_addr(hdr->addr1)) {
++		   !is_multicast_ether_addr(hdr->addr1)) {
+ 		/*
+ 		 * Mesh beacons will update last_rx when if they are found to
+ 		 * match the current local configuration when processed.
+-- 
+2.27.0
+
diff --git a/queue-5.10/macintosh-adb-iop-always-wait-for-reply-message-from.patch b/queue-5.10/macintosh-adb-iop-always-wait-for-reply-message-from.patch
new file mode 100644
index 00000000000..24ba3a0156a
--- /dev/null
+++ b/queue-5.10/macintosh-adb-iop-always-wait-for-reply-message-from.patch
@@ -0,0 +1,95 @@
+From 3f01f53bf7e3f00f35cf9edc6ae7ca6d1194ca67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:39:56 +1100
+Subject: macintosh/adb-iop: Always wait for reply message from IOP
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 2c9cfbadfa234b03473f1ef54e6f4772cc07a371 ]
+
+A recent patch incorrectly altered the adb-iop state machine behaviour
+and introduced a regression that can appear intermittently as a
+malfunctioning ADB input device. This seems to be caused when reply
+packets from different ADB commands become mixed up, especially during
+the adb bus scan. Fix this by unconditionally entering the awaiting_reply
+state after sending an explicit command, even when the ADB command won't
+generate a reply from the ADB device.
+
+It turns out that the IOP always generates reply messages, even when the
+ADB command does not produce a reply packet (e.g. ADB Listen command).
+So it's not really the ADB reply packets that are being mixed up, it's the
+IOP messages that enclose them. The bug goes like this:
+
+  1. CPU sends a message to the IOP, expecting no response because this
+     message contains an ADB Listen command. The ADB command is now
+     considered complete.
+
+  2. CPU sends a second message to the IOP, this time expecting a
+     response because this message contains an ADB Talk command. This
+     ADB command needs a reply before it can be completed.
+
+  3. adb-iop driver receives an IOP message and assumes that it relates
+     to the Talk command. It's actually an empty one (with flags ==
+     ADB_IOP_EXPLICIT|ADB_IOP_TIMEOUT) for the previous command. The
+     Talk command is now considered complete but it gets the wrong reply
+     data.
+
+  4. adb-iop driver gets another IOP response message, which contains
+     the actual reply data for the Talk command, but this is dropped
+     (the driver is no longer in awaiting_reply state).
+
+Cc: Joshua Thompson <funaho@jurai.org>
+Fixes: e2954e5f727f ("macintosh/adb-iop: Implement sending -> idle state transition")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Link: https://lore.kernel.org/r/0f0a25855391e7eaa53a50f651aea0124e8525dd.1605847196.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/adb-iop.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
+index f3d1a460fbce1..422abd1d48e18 100644
+--- a/drivers/macintosh/adb-iop.c
++++ b/drivers/macintosh/adb-iop.c
+@@ -78,10 +78,7 @@ static void adb_iop_complete(struct iop_msg *msg)
+ 
+ 	local_irq_save(flags);
+ 
+-	if (current_req->reply_expected)
+-		adb_iop_state = awaiting_reply;
+-	else
+-		adb_iop_done();
++	adb_iop_state = awaiting_reply;
+ 
+ 	local_irq_restore(flags);
+ }
+@@ -89,8 +86,9 @@ static void adb_iop_complete(struct iop_msg *msg)
+ /*
+  * Listen for ADB messages from the IOP.
+  *
+- * This will be called when unsolicited messages (usually replies to TALK
+- * commands or autopoll packets) are received.
++ * This will be called when unsolicited IOP messages are received.
++ * These IOP messages can carry ADB autopoll responses and also occur
++ * after explicit ADB commands.
+  */
+ 
+ static void adb_iop_listen(struct iop_msg *msg)
+@@ -110,8 +108,10 @@ static void adb_iop_listen(struct iop_msg *msg)
+ 		if (adb_iop_state == awaiting_reply) {
+ 			struct adb_request *req = current_req;
+ 
+-			req->reply_len = amsg->count + 1;
+-			memcpy(req->reply, &amsg->cmd, req->reply_len);
++			if (req->reply_expected) {
++				req->reply_len = amsg->count + 1;
++				memcpy(req->reply, &amsg->cmd, req->reply_len);
++			}
+ 
+ 			req_done = true;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/macintosh-adb-iop-send-correct-poll-command.patch b/queue-5.10/macintosh-adb-iop-send-correct-poll-command.patch
new file mode 100644
index 00000000000..564c2d47402
--- /dev/null
+++ b/queue-5.10/macintosh-adb-iop-send-correct-poll-command.patch
@@ -0,0 +1,116 @@
+From 88440c468b4bec1175479a3bca9e5f7a21a760df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:39:56 +1100
+Subject: macintosh/adb-iop: Send correct poll command
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 10199e90ee20e68859f8128331ec8d85b036d349 ]
+
+The behaviour of the IOP firmware is not well documented but we do know
+that IOP message reply data can be used to issue new ADB commands.
+Use the message reply to better control autopoll behaviour by sending
+a Talk Register 0 command after every ADB response, not unlike the
+algorithm in the via-macii driver. This poll command is addressed to
+that device which last received a Talk command (explicit or otherwise).
+
+Cc: Joshua Thompson <funaho@jurai.org>
+Fixes: 32226e817043 ("macintosh/adb-iop: Implement idle -> sending state transition")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Link: https://lore.kernel.org/r/58bba4310da4c29b068345a4b36af8a531397ff7.1605847196.git.fthain@telegraphics.com.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/adb-iop.c | 40 +++++++++++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
+index 422abd1d48e18..0ee3272491501 100644
+--- a/drivers/macintosh/adb-iop.c
++++ b/drivers/macintosh/adb-iop.c
+@@ -25,6 +25,7 @@
+ static struct adb_request *current_req;
+ static struct adb_request *last_req;
+ static unsigned int autopoll_devs;
++static u8 autopoll_addr;
+ 
+ static enum adb_iop_state {
+ 	idle,
+@@ -41,6 +42,11 @@ static int adb_iop_autopoll(int);
+ static void adb_iop_poll(void);
+ static int adb_iop_reset_bus(void);
+ 
++/* ADB command byte structure */
++#define ADDR_MASK       0xF0
++#define OP_MASK         0x0C
++#define TALK            0x0C
++
+ struct adb_driver adb_iop_driver = {
+ 	.name         = "ISM IOP",
+ 	.probe        = adb_iop_probe,
+@@ -94,17 +100,24 @@ static void adb_iop_complete(struct iop_msg *msg)
+ static void adb_iop_listen(struct iop_msg *msg)
+ {
+ 	struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
++	u8 addr = (amsg->cmd & ADDR_MASK) >> 4;
++	u8 op = amsg->cmd & OP_MASK;
+ 	unsigned long flags;
+ 	bool req_done = false;
+ 
+ 	local_irq_save(flags);
+ 
+-	/* Handle a timeout. Timeout packets seem to occur even after
+-	 * we've gotten a valid reply to a TALK, presumably because of
+-	 * autopolling.
++	/* Responses to Talk commands may be unsolicited as they are
++	 * produced when the IOP polls devices. They are mostly timeouts.
+ 	 */
+-
+-	if (amsg->flags & ADB_IOP_EXPLICIT) {
++	if (op == TALK && ((1 << addr) & autopoll_devs))
++		autopoll_addr = addr;
++
++	switch (amsg->flags & (ADB_IOP_EXPLICIT |
++			       ADB_IOP_AUTOPOLL |
++			       ADB_IOP_TIMEOUT)) {
++	case ADB_IOP_EXPLICIT:
++	case ADB_IOP_EXPLICIT | ADB_IOP_TIMEOUT:
+ 		if (adb_iop_state == awaiting_reply) {
+ 			struct adb_request *req = current_req;
+ 
+@@ -115,12 +128,16 @@ static void adb_iop_listen(struct iop_msg *msg)
+ 
+ 			req_done = true;
+ 		}
+-	} else if (!(amsg->flags & ADB_IOP_TIMEOUT)) {
+-		adb_input(&amsg->cmd, amsg->count + 1,
+-			  amsg->flags & ADB_IOP_AUTOPOLL);
++		break;
++	case ADB_IOP_AUTOPOLL:
++		if (((1 << addr) & autopoll_devs) &&
++		    amsg->cmd == ADB_READREG(addr, 0))
++			adb_input(&amsg->cmd, amsg->count + 1, 1);
++		break;
+ 	}
+-
+-	msg->reply[0] = autopoll_devs ? ADB_IOP_AUTOPOLL : 0;
++	msg->reply[0] = autopoll_addr ? ADB_IOP_AUTOPOLL : 0;
++	msg->reply[1] = 0;
++	msg->reply[2] = autopoll_addr ? ADB_READREG(autopoll_addr, 0) : 0;
+ 	iop_complete_message(msg);
+ 
+ 	if (req_done)
+@@ -233,6 +250,9 @@ static void adb_iop_set_ap_complete(struct iop_msg *msg)
+ 	struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
+ 
+ 	autopoll_devs = (amsg->data[1] << 8) | amsg->data[0];
++	if (autopoll_devs & (1 << autopoll_addr))
++		return;
++	autopoll_addr = autopoll_devs ? (ffs(autopoll_devs) - 1) : 0;
+ }
+ 
+ static int adb_iop_autopoll(int devs)
+-- 
+2.27.0
+
diff --git a/queue-5.10/mailbox-arm_mhu_db-fix-mhu_db_shutdown-by-replacing-.patch b/queue-5.10/mailbox-arm_mhu_db-fix-mhu_db_shutdown-by-replacing-.patch
new file mode 100644
index 00000000000..2793f205bdd
--- /dev/null
+++ b/queue-5.10/mailbox-arm_mhu_db-fix-mhu_db_shutdown-by-replacing-.patch
@@ -0,0 +1,73 @@
+From 31f8dc0e7b9f1343e6bbc77dacec74175eb90e30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 10:28:04 +0000
+Subject: mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with
+ devm_kfree
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 9905f728b0bda737fe2c2afd7c24f3365a45cc7b ]
+
+The mhu_db_channel info is allocated per channel using devm_kzalloc from
+mhu_db_mbox_xlate which gets called from mbox_request_channel. However
+we are releasing the allocated mhu_db_channel info using plain kfree from
+mhu_db_shutdown which is called from mbox_free_channel.
+
+This leads to random crashes when the channel is freed like below one:
+
+  Unable to handle kernel paging request at virtual address 0080000400000008
+  [0080000400000008] address between user and kernel address ranges
+  Internal error: Oops: 96000044 [#1] PREEMPT SMP
+  Modules linked in: scmi_module(-)
+  CPU: 1 PID: 2212 Comm: rmmod Not tainted 5.10.0-rc5 #31
+  Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno
+  	Development Platform, BIOS EDK II Nov 19 2020
+  pstate: 20000085 (nzCv daIf -PAN -UAO -TCO BTYPE=--)
+  pc : release_nodes+0x74/0x230
+  lr : devres_release_all+0x40/0x68
+  Call trace:
+   release_nodes+0x74/0x230
+   devres_release_all+0x40/0x68
+   device_release_driver_internal+0x12c/0x1f8
+   driver_detach+0x58/0xe8
+   bus_remove_driver+0x64/0xe0
+   driver_unregister+0x38/0x68
+   platform_driver_unregister+0x1c/0x28
+   scmi_driver_exit+0x38/0x44 [scmi_module]
+   __arm64_sys_delete_module+0x188/0x260
+   el0_svc_common.constprop.0+0x80/0x1a8
+   do_el0_svc+0x2c/0x98
+   el0_sync_handler+0x160/0x168
+   el0_sync+0x174/0x180
+  Code: 1400000d eb07009f 54000460 f9400486 (f90004a6)
+  ---[ end trace c55ffd306c140233 ]---
+
+Fix it by replacing kfree with devm_kfree as required.
+
+Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
+Reported-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/arm_mhu_db.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/arm_mhu_db.c b/drivers/mailbox/arm_mhu_db.c
+index 275efe4cca0c2..8eb66c4ecf5bf 100644
+--- a/drivers/mailbox/arm_mhu_db.c
++++ b/drivers/mailbox/arm_mhu_db.c
+@@ -180,7 +180,7 @@ static void mhu_db_shutdown(struct mbox_chan *chan)
+ 
+ 	/* Reset channel */
+ 	mhu_db_mbox_clear_irq(chan);
+-	kfree(chan->con_priv);
++	devm_kfree(mbox->dev, chan->con_priv);
+ 	chan->con_priv = NULL;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-cedrus-fix-reference-leak-in-cedrus_start_stre.patch b/queue-5.10/media-cedrus-fix-reference-leak-in-cedrus_start_stre.patch
new file mode 100644
index 00000000000..69fd977b909
--- /dev/null
+++ b/queue-5.10/media-cedrus-fix-reference-leak-in-cedrus_start_stre.patch
@@ -0,0 +1,41 @@
+From 67fd5ef5d2e7a101ed4dd0382ae8fa97b26a53ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 15:26:22 +0100
+Subject: media: cedrus: fix reference leak in cedrus_start_streaming
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 940727bf22f74cbdef8de327de34c4ae565c89ea ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in cedrus_start_streaming. We should fix it.
+
+Fixes: d5aecd289babf ("media: cedrus: Implement runtime PM")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+index 667b86dde1ee8..911f607d9b092 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c
+@@ -479,8 +479,10 @@ static int cedrus_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 
+ 	if (V4L2_TYPE_IS_OUTPUT(vq->type)) {
+ 		ret = pm_runtime_get_sync(dev->dev);
+-		if (ret < 0)
++		if (ret < 0) {
++			pm_runtime_put_noidle(dev->dev);
+ 			goto err_cleanup;
++		}
+ 
+ 		if (dev->dec_ops[ctx->current_codec]->start) {
+ 			ret = dev->dec_ops[ctx->current_codec]->start(ctx);
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-i2c-imx219-selection-compliance-fixes.patch b/queue-5.10/media-i2c-imx219-selection-compliance-fixes.patch
new file mode 100644
index 00000000000..9335c2fe178
--- /dev/null
+++ b/queue-5.10/media-i2c-imx219-selection-compliance-fixes.patch
@@ -0,0 +1,93 @@
+From 726ef415c53a94cd1b962719359464d24d470f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 12:57:21 +0200
+Subject: media: i2c: imx219: Selection compliance fixes
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 1ed36ecd1459b653cced8929bfb37dba94b64c5d ]
+
+To comply with the intended usage of the V4L2 selection target when
+used to retrieve a sensor image properties, adjust the rectangles
+returned by the imx219 driver.
+
+The top/left crop coordinates of the TGT_CROP rectangle were set to
+(0, 0) instead of (8, 8) which is the offset from the larger physical
+pixel array rectangle. This was also a mismatch with the default values
+crop rectangle value, so this is corrected. Found with v4l2-compliance.
+
+While at it, add V4L2_SEL_TGT_CROP_BOUNDS support: CROP_DEFAULT and
+CROP_BOUNDS have the same size as the non-active pixels are not readable
+using the selection API. Found with v4l2-compliance.
+
+[reword commit message, use macros for pixel offsets]
+
+Fixes: e6d4ef7d58aa7 ("media: i2c: imx219: Implement get_selection")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx219.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
+index 1cee45e353554..0ae66091a6962 100644
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -473,8 +473,8 @@ static const struct imx219_mode supported_modes[] = {
+ 		.width = 3280,
+ 		.height = 2464,
+ 		.crop = {
+-			.left = 0,
+-			.top = 0,
++			.left = IMX219_PIXEL_ARRAY_LEFT,
++			.top = IMX219_PIXEL_ARRAY_TOP,
+ 			.width = 3280,
+ 			.height = 2464
+ 		},
+@@ -489,8 +489,8 @@ static const struct imx219_mode supported_modes[] = {
+ 		.width = 1920,
+ 		.height = 1080,
+ 		.crop = {
+-			.left = 680,
+-			.top = 692,
++			.left = 688,
++			.top = 700,
+ 			.width = 1920,
+ 			.height = 1080
+ 		},
+@@ -505,8 +505,8 @@ static const struct imx219_mode supported_modes[] = {
+ 		.width = 1640,
+ 		.height = 1232,
+ 		.crop = {
+-			.left = 0,
+-			.top = 0,
++			.left = IMX219_PIXEL_ARRAY_LEFT,
++			.top = IMX219_PIXEL_ARRAY_TOP,
+ 			.width = 3280,
+ 			.height = 2464
+ 		},
+@@ -521,8 +521,8 @@ static const struct imx219_mode supported_modes[] = {
+ 		.width = 640,
+ 		.height = 480,
+ 		.crop = {
+-			.left = 1000,
+-			.top = 752,
++			.left = 1008,
++			.top = 760,
+ 			.width = 1280,
+ 			.height = 960
+ 		},
+@@ -1008,6 +1008,7 @@ static int imx219_get_selection(struct v4l2_subdev *sd,
+ 		return 0;
+ 
+ 	case V4L2_SEL_TGT_CROP_DEFAULT:
++	case V4L2_SEL_TGT_CROP_BOUNDS:
+ 		sel->r.top = IMX219_PIXEL_ARRAY_TOP;
+ 		sel->r.left = IMX219_PIXEL_ARRAY_LEFT;
+ 		sel->r.width = IMX219_PIXEL_ARRAY_WIDTH;
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-imx214-fix-stop-streaming.patch b/queue-5.10/media-imx214-fix-stop-streaming.patch
new file mode 100644
index 00000000000..76eae4b595e
--- /dev/null
+++ b/queue-5.10/media-imx214-fix-stop-streaming.patch
@@ -0,0 +1,39 @@
+From 9e1435141c13eccd7701c8edce4bffbe61e42ecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 16:46:24 +0200
+Subject: media: imx214: Fix stop streaming
+
+From: Daniel Gomez <daniel@qtec.com>
+
+[ Upstream commit eeb76afbe8d91e112396c6281cd020725160f006 ]
+
+Stop video streaming when requested.
+
+When s_stream is called to stop the video streaming, if/else condition calls
+start_streaming function instead of the one for stopping it.
+
+Fixes: 436190596241 ("media: imx214: Add imx214 camera sensor driver")
+Signed-off-by: Daniel Gomez <daniel@qtec.com>
+Signed-off-by: Ricardo Ribalda <ribalda@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx214.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/imx214.c b/drivers/media/i2c/imx214.c
+index 1ef5af9a8c8bc..cee1a4817af99 100644
+--- a/drivers/media/i2c/imx214.c
++++ b/drivers/media/i2c/imx214.c
+@@ -786,7 +786,7 @@ static int imx214_s_stream(struct v4l2_subdev *subdev, int enable)
+ 		if (ret < 0)
+ 			goto err_rpm_put;
+ 	} else {
+-		ret = imx214_start_streaming(imx214);
++		ret = imx214_stop_streaming(imx214);
+ 		if (ret < 0)
+ 			goto err_rpm_put;
+ 		pm_runtime_put(imx214->dev);
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-max2175-fix-max2175_set_csm_mode-error-code.patch b/queue-5.10/media-max2175-fix-max2175_set_csm_mode-error-code.patch
new file mode 100644
index 00000000000..41119753954
--- /dev/null
+++ b/queue-5.10/media-max2175-fix-max2175_set_csm_mode-error-code.patch
@@ -0,0 +1,36 @@
+From add5958ae1069aaa973d4be4c9065732593cb524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Mar 2020 15:23:12 +0100
+Subject: media: max2175: fix max2175_set_csm_mode() error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]
+
+This is supposed to return negative error codes but the type is bool so
+it returns true instead.
+
+Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max2175.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
+index 03b4ed3a61b83..661208c9bfc5d 100644
+--- a/drivers/media/i2c/max2175.c
++++ b/drivers/media/i2c/max2175.c
+@@ -503,7 +503,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
+ 	}
+ }
+ 
+-static bool max2175_set_csm_mode(struct max2175 *ctx,
++static int max2175_set_csm_mode(struct max2175 *ctx,
+ 			  enum max2175_csm_mode new_mode)
+ {
+ 	int ret = max2175_poll_csm_ready(ctx);
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-max9271-fix-gpio-enable-disable.patch b/queue-5.10/media-max9271-fix-gpio-enable-disable.patch
new file mode 100644
index 00000000000..d69ed41130f
--- /dev/null
+++ b/queue-5.10/media-max9271-fix-gpio-enable-disable.patch
@@ -0,0 +1,63 @@
+From 6951e8dd41e2abb0f4c3863a03bfb47237239771 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 17:15:28 +0100
+Subject: media: max9271: Fix GPIO enable/disable
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 909a0a189c677307edd461e21fd962784370d27f ]
+
+Fix GPIO enable/disable operations which wrongly read the 0x0f register
+to obtain the current mask of the enabled lines instead of using
+the correct 0x0e register.
+
+Also fix access to bit 0 of the register which is marked as reserved.
+
+Fixes: 34009bffc1c6 ("media: i2c: Add RDACM20 driver")
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max9271.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/max9271.c b/drivers/media/i2c/max9271.c
+index 0f6f7a092a463..c247db569bab0 100644
+--- a/drivers/media/i2c/max9271.c
++++ b/drivers/media/i2c/max9271.c
+@@ -223,12 +223,12 @@ int max9271_enable_gpios(struct max9271_device *dev, u8 gpio_mask)
+ {
+ 	int ret;
+ 
+-	ret = max9271_read(dev, 0x0f);
++	ret = max9271_read(dev, 0x0e);
+ 	if (ret < 0)
+ 		return 0;
+ 
+ 	/* BIT(0) reserved: GPO is always enabled. */
+-	ret |= gpio_mask | BIT(0);
++	ret |= (gpio_mask & ~BIT(0));
+ 	ret = max9271_write(dev, 0x0e, ret);
+ 	if (ret < 0) {
+ 		dev_err(&dev->client->dev, "Failed to enable gpio (%d)\n", ret);
+@@ -245,12 +245,12 @@ int max9271_disable_gpios(struct max9271_device *dev, u8 gpio_mask)
+ {
+ 	int ret;
+ 
+-	ret = max9271_read(dev, 0x0f);
++	ret = max9271_read(dev, 0x0e);
+ 	if (ret < 0)
+ 		return 0;
+ 
+ 	/* BIT(0) reserved: GPO cannot be disabled */
+-	ret &= (~gpio_mask | BIT(0));
++	ret &= ~(gpio_mask | BIT(0));
+ 	ret = max9271_write(dev, 0x0e, ret);
+ 	if (ret < 0) {
+ 		dev_err(&dev->client->dev, "Failed to disable gpio (%d)\n", ret);
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch
new file mode 100644
index 00000000000..3822baf8b30
--- /dev/null
+++ b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch
@@ -0,0 +1,74 @@
+From 8da62523c9b4ea537ecf9523802fc40c9e5f7473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:38:01 +0200
+Subject: media: mtk-vcodec: add missing put_device() call in
+ mtk_vcodec_init_dec_pm()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 5d4fa2c50125c9cda9e380d89268757cc5fa743d ]
+
+if of_find_device_by_node() succeed, mtk_vcodec_init_dec_pm() doesn't have
+a corresponding put_device(). Thus add jump target to fix the exception
+handling for this function implementation.
+
+Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mtk-vcodec/mtk_vcodec_dec_pm.c    | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+index 36dfe3fc056a4..f6a6b42865fbd 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+@@ -47,11 +47,14 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
+ 		dec_clk->clk_info = devm_kcalloc(&pdev->dev,
+ 			dec_clk->clk_num, sizeof(*clk_info),
+ 			GFP_KERNEL);
+-		if (!dec_clk->clk_info)
+-			return -ENOMEM;
++		if (!dec_clk->clk_info) {
++			ret = -ENOMEM;
++			goto put_device;
++		}
+ 	} else {
+ 		mtk_v4l2_err("Failed to get vdec clock count");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto put_device;
+ 	}
+ 
+ 	for (i = 0; i < dec_clk->clk_num; i++) {
+@@ -60,19 +63,22 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
+ 			"clock-names", i, &clk_info->clk_name);
+ 		if (ret) {
+ 			mtk_v4l2_err("Failed to get clock name id = %d", i);
+-			return ret;
++			goto put_device;
+ 		}
+ 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
+ 			clk_info->clk_name);
+ 		if (IS_ERR(clk_info->vcodec_clk)) {
+ 			mtk_v4l2_err("devm_clk_get (%d)%s fail", i,
+ 				clk_info->clk_name);
+-			return PTR_ERR(clk_info->vcodec_clk);
++			ret = PTR_ERR(clk_info->vcodec_clk);
++			goto put_device;
+ 		}
+ 	}
+ 
+ 	pm_runtime_enable(&pdev->dev);
+-
++	return 0;
++put_device:
++	put_device(pm->larbvdec);
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-4640 b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-4640
new file mode 100644
index 00000000000..ef3cb2c3d90
--- /dev/null
+++ b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-4640
@@ -0,0 +1,44 @@
+From c29fa2c7781068c0965877d57621147ce5df7507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:38:02 +0200
+Subject: media: mtk-vcodec: add missing put_device() call in
+ mtk_vcodec_release_dec_pm()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]
+
+mtk_vcodec_release_dec_pm() will be called in two places:
+
+a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
+b. mtk_vcodec_dec_remove().
+
+In both cases put_device() call is needed, since of_find_device_by_node()
+was called in mtk_vcodec_init_dec_pm() previously.
+
+Thus add put_devices() call in mtk_vcodec_release_dec_pm()
+
+Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+index f6a6b42865fbd..ddee7046ce422 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+@@ -85,6 +85,7 @@ put_device:
+ void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
+ {
+ 	pm_runtime_disable(dev->pm.dev);
++	put_device(dev->pm.larbvdec);
+ }
+ 
+ void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-7942 b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-7942
new file mode 100644
index 00000000000..cd8ac0d5aa3
--- /dev/null
+++ b/queue-5.10/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-7942
@@ -0,0 +1,94 @@
+From a04a6170f10a8fcb0bc408a2da40a5c57767bfdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:38:03 +0200
+Subject: media: mtk-vcodec: add missing put_device() call in
+ mtk_vcodec_init_enc_pm()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 4affafd7bec7c65da31777f18bd20420f1aeb5f8 ]
+
+if of_find_device_by_node() succeed, mtk_vcodec_init_enc_pm() doesn't have
+a corresponding put_device(). Thus add jump target to fix the exception
+handling for this function implementation.
+
+Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mtk-vcodec/mtk_vcodec_enc_pm.c   | 26 ++++++++++++++-----
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+index ee22902aaa71c..1a047c25679fa 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+@@ -47,14 +47,16 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
+ 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
+ 	if (!node) {
+ 		mtk_v4l2_err("no mediatek,larb found");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto put_larbvenc;
+ 	}
+ 
+ 	pdev = of_find_device_by_node(node);
+ 	of_node_put(node);
+ 	if (!pdev) {
+ 		mtk_v4l2_err("no mediatek,larb device found");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto put_larbvenc;
+ 	}
+ 
+ 	pm->larbvenclt = &pdev->dev;
+@@ -67,11 +69,14 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
+ 		enc_clk->clk_info = devm_kcalloc(&pdev->dev,
+ 			enc_clk->clk_num, sizeof(*clk_info),
+ 			GFP_KERNEL);
+-		if (!enc_clk->clk_info)
+-			return -ENOMEM;
++		if (!enc_clk->clk_info) {
++			ret = -ENOMEM;
++			goto put_larbvenclt;
++		}
+ 	} else {
+ 		mtk_v4l2_err("Failed to get venc clock count");
+-		return -EINVAL;
++		ret = -EINVAL;
++		goto put_larbvenclt;
+ 	}
+ 
+ 	for (i = 0; i < enc_clk->clk_num; i++) {
+@@ -80,17 +85,24 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
+ 			"clock-names", i, &clk_info->clk_name);
+ 		if (ret) {
+ 			mtk_v4l2_err("venc failed to get clk name %d", i);
+-			return ret;
++			goto put_larbvenclt;
+ 		}
+ 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
+ 			clk_info->clk_name);
+ 		if (IS_ERR(clk_info->vcodec_clk)) {
+ 			mtk_v4l2_err("venc devm_clk_get (%d)%s fail", i,
+ 				clk_info->clk_name);
+-			return PTR_ERR(clk_info->vcodec_clk);
++			ret = PTR_ERR(clk_info->vcodec_clk);
++			goto put_larbvenclt;
+ 		}
+ 	}
+ 
++	return 0;
++
++put_larbvenclt:
++	put_device(pm->larbvenclt);
++put_larbvenc:
++	put_device(pm->larbvenc);
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-ov5640-fix-support-of-bt656-bus-mode.patch b/queue-5.10/media-ov5640-fix-support-of-bt656-bus-mode.patch
new file mode 100644
index 00000000000..31a4199443c
--- /dev/null
+++ b/queue-5.10/media-ov5640-fix-support-of-bt656-bus-mode.patch
@@ -0,0 +1,168 @@
+From bf69bab0bbb962cc13dfe62143548c9bb0fe0649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 11:02:23 +0200
+Subject: media: ov5640: fix support of BT656 bus mode
+
+From: Hugues Fruchet <hugues.fruchet@st.com>
+
+[ Upstream commit 68579b32e786f9680e7c6b6c7d17e26943bb02b3 ]
+
+Fix PCLK polarity not being taken into account.
+Add comments about BT656 register control.
+Remove useless ov5640_set_stream_bt656() function.
+Refine comments about MIPI IO register control.
+
+Fixes: 4039b03720f7 ("media: i2c: ov5640: Add support for BT656 mode")
+Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com>
+Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
+Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 82 +++++++++++++++++++++-----------------
+ 1 file changed, 45 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 8d0254d0e5ea7..8f0812e859012 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -1216,20 +1216,6 @@ static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on)
+ 			      BIT(1), on ? 0 : BIT(1));
+ }
+ 
+-static int ov5640_set_stream_bt656(struct ov5640_dev *sensor, bool on)
+-{
+-	int ret;
+-
+-	ret = ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00,
+-			       on ? 0x1 : 0x00);
+-	if (ret)
+-		return ret;
+-
+-	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
+-				OV5640_REG_SYS_CTRL0_SW_PWUP :
+-				OV5640_REG_SYS_CTRL0_SW_PWDN);
+-}
+-
+ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
+ {
+ 	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
+@@ -1994,13 +1980,13 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on)
+ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
+ {
+ 	unsigned int flags = sensor->ep.bus.parallel.flags;
+-	u8 pclk_pol = 0;
+-	u8 hsync_pol = 0;
+-	u8 vsync_pol = 0;
++	bool bt656 = sensor->ep.bus_type == V4L2_MBUS_BT656;
++	u8 polarities = 0;
+ 	int ret;
+ 
+ 	if (!on) {
+ 		/* Reset settings to their default values. */
++		ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00, 0x00);
+ 		ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58);
+ 		ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, 0x20);
+ 		ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00);
+@@ -2024,7 +2010,35 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
+ 	 * - VSYNC:	active high
+ 	 * - HREF:	active low
+ 	 * - PCLK:	active low
++	 *
++	 * VSYNC & HREF are not configured if BT656 bus mode is selected
+ 	 */
++
++	/*
++	 * BT656 embedded synchronization configuration
++	 *
++	 * CCIR656 CTRL00
++	 * - [7]:	SYNC code selection (0: auto generate sync code,
++	 *		1: sync code from regs 0x4732-0x4735)
++	 * - [6]:	f value in CCIR656 SYNC code when fixed f value
++	 * - [5]:	Fixed f value
++	 * - [4:3]:	Blank toggle data options (00: data=1'h040/1'h200,
++	 *		01: data from regs 0x4736-0x4738, 10: always keep 0)
++	 * - [1]:	Clip data disable
++	 * - [0]:	CCIR656 mode enable
++	 *
++	 * Default CCIR656 SAV/EAV mode with default codes
++	 * SAV=0xff000080 & EAV=0xff00009d is enabled here with settings:
++	 * - CCIR656 mode enable
++	 * - auto generation of sync codes
++	 * - blank toggle data 1'h040/1'h200
++	 * - clip reserved data (0x00 & 0xff changed to 0x01 & 0xfe)
++	 */
++	ret = ov5640_write_reg(sensor, OV5640_REG_CCIR656_CTRL00,
++			       bt656 ? 0x01 : 0x00);
++	if (ret)
++		return ret;
++
+ 	/*
+ 	 * configure parallel port control lines polarity
+ 	 *
+@@ -2035,29 +2049,26 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
+ 	 *		datasheet and hardware, 0 is active high
+ 	 *		and 1 is active low...)
+ 	 */
+-	if (sensor->ep.bus_type == V4L2_MBUS_PARALLEL) {
+-		if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING)
+-			pclk_pol = 1;
++	if (!bt656) {
+ 		if (flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH)
+-			hsync_pol = 1;
++			polarities |= BIT(1);
+ 		if (flags & V4L2_MBUS_VSYNC_ACTIVE_LOW)
+-			vsync_pol = 1;
+-
+-		ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00,
+-				       (pclk_pol << 5) | (hsync_pol << 1) |
+-				       vsync_pol);
+-
+-		if (ret)
+-			return ret;
++			polarities |= BIT(0);
+ 	}
++	if (flags & V4L2_MBUS_PCLK_SAMPLE_RISING)
++		polarities |= BIT(5);
++
++	ret = ov5640_write_reg(sensor, OV5640_REG_POLARITY_CTRL00, polarities);
++	if (ret)
++		return ret;
+ 
+ 	/*
+-	 * powerdown MIPI TX/RX PHY & disable MIPI
++	 * powerdown MIPI TX/RX PHY & enable DVP
+ 	 *
+ 	 * MIPI CONTROL 00
+-	 * 4:	 PWDN PHY TX
+-	 * 3:	 PWDN PHY RX
+-	 * 2:	 MIPI enable
++	 * [4] = 1	: Power down MIPI HS Tx
++	 * [3] = 1	: Power down MIPI LS Rx
++	 * [2] = 0	: DVP enable (MIPI disable)
+ 	 */
+ 	ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x18);
+ 	if (ret)
+@@ -2074,8 +2085,7 @@ static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
+ 	 * - [3:0]:	D[9:6] output enable
+ 	 */
+ 	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01,
+-			       sensor->ep.bus_type == V4L2_MBUS_PARALLEL ?
+-			       0x7f : 0x1f);
++			       bt656 ? 0x1f : 0x7f);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -2925,8 +2935,6 @@ static int ov5640_s_stream(struct v4l2_subdev *sd, int enable)
+ 
+ 		if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY)
+ 			ret = ov5640_set_stream_mipi(sensor, enable);
+-		else if (sensor->ep.bus_type == V4L2_MBUS_BT656)
+-			ret = ov5640_set_stream_bt656(sensor, enable);
+ 		else
+ 			ret = ov5640_set_stream_dvp(sensor, enable);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch b/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch
new file mode 100644
index 00000000000..ef3b6daf1d6
--- /dev/null
+++ b/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch
@@ -0,0 +1,37 @@
+From b1c1110ed100d14c36c3a315be8eafd35aab8d77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:37:58 +0200
+Subject: media: platform: add missing put_device() call in mtk_jpeg_clk_init()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f28a81a3b64270da3588174feff4628c36e0ff4e ]
+
+if of_find_device_by_node() succeeds, mtk_jpeg_clk_init() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: 648372a87cee ("media: platform: Change the call functions of getting/enable/disable the jpeg's clock")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+index 227245ccaedc7..106543391c460 100644
+--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+@@ -1306,6 +1306,7 @@ static int mtk_jpeg_clk_init(struct mtk_jpeg_dev *jpeg)
+ 				jpeg->variant->clks);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to get jpeg clock:%d\n", ret);
++		put_device(&pdev->dev);
+ 		return ret;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch-21183 b/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch-21183
new file mode 100644
index 00000000000..03423d9dd4b
--- /dev/null
+++ b/queue-5.10/media-platform-add-missing-put_device-call-in-mtk_jp.patch-21183
@@ -0,0 +1,59 @@
+From c7e185c1dac22b81d9473eb16aca8a580926d3d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 13:41:36 +0100
+Subject: media: platform: add missing put_device() call in mtk_jpeg_probe()
+ and mtk_jpeg_remove()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 0d72f489995bb8565f6fe30539d4504c88356a9e ]
+
+if mtk_jpeg_clk_init() succeed, mtk_jpeg_probe() and mtk_jpeg_remove()
+doesn't have a corresponding put_device(). Thus add a new helper
+mtk_jpeg_clk_release() to fix it.
+
+Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+index 106543391c460..88a23bce569d9 100644
+--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+@@ -1332,6 +1332,12 @@ static void mtk_jpeg_job_timeout_work(struct work_struct *work)
+ 	v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
+ 	v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+ }
++
++static inline void mtk_jpeg_clk_release(struct mtk_jpeg_dev *jpeg)
++{
++	put_device(jpeg->larb);
++}
++
+ static int mtk_jpeg_probe(struct platform_device *pdev)
+ {
+ 	struct mtk_jpeg_dev *jpeg;
+@@ -1436,6 +1442,7 @@ err_m2m_init:
+ 	v4l2_device_unregister(&jpeg->v4l2_dev);
+ 
+ err_dev_register:
++	mtk_jpeg_clk_release(jpeg);
+ 
+ err_clk_init:
+ 
+@@ -1453,6 +1460,7 @@ static int mtk_jpeg_remove(struct platform_device *pdev)
+ 	video_device_release(jpeg->vdev);
+ 	v4l2_m2m_release(jpeg->m2m_dev);
+ 	v4l2_device_unregister(&jpeg->v4l2_dev);
++	mtk_jpeg_clk_release(jpeg);
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-rdacm20-enable-gpio1-explicitly.patch b/queue-5.10/media-rdacm20-enable-gpio1-explicitly.patch
new file mode 100644
index 00000000000..457c944d86c
--- /dev/null
+++ b/queue-5.10/media-rdacm20-enable-gpio1-explicitly.patch
@@ -0,0 +1,53 @@
+From ceecebfc66adb9b463d02fe8fe8c3865feb89fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 17:15:29 +0100
+Subject: media: rdacm20: Enable GPIO1 explicitly
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 7fe1d4453fb6bf103d668a19d957a7b2fc21887c ]
+
+The MAX9271 GPIO1 line that controls the sensor reset is by default
+enabled after a serializer chip reset.
+
+As rdacm20 does not go through an explicit serializer reset, make sure
+GPIO1 is enabled to make the camera module driver more robust.
+
+Fixes: 34009bffc1c6 ("media: i2c: Add RDACM20 driver")
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rdacm20.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/rdacm20.c b/drivers/media/i2c/rdacm20.c
+index 1ed928c4ca70f..16bcb764b0e0d 100644
+--- a/drivers/media/i2c/rdacm20.c
++++ b/drivers/media/i2c/rdacm20.c
+@@ -487,9 +487,18 @@ static int rdacm20_initialize(struct rdacm20_device *dev)
+ 	 * Reset the sensor by cycling the OV10635 reset signal connected to the
+ 	 * MAX9271 GPIO1 and verify communication with the OV10635.
+ 	 */
+-	max9271_clear_gpios(dev->serializer, MAX9271_GPIO1OUT);
++	ret = max9271_enable_gpios(dev->serializer, MAX9271_GPIO1OUT);
++	if (ret)
++		return ret;
++
++	ret = max9271_clear_gpios(dev->serializer, MAX9271_GPIO1OUT);
++	if (ret)
++		return ret;
+ 	usleep_range(10000, 15000);
+-	max9271_set_gpios(dev->serializer, MAX9271_GPIO1OUT);
++
++	ret = max9271_set_gpios(dev->serializer, MAX9271_GPIO1OUT);
++	if (ret)
++		return ret;
+ 	usleep_range(10000, 15000);
+ 
+ again:
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch b/queue-5.10/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch
new file mode 100644
index 00000000000..2006d412671
--- /dev/null
+++ b/queue-5.10/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch
@@ -0,0 +1,56 @@
+From 746cc4b1b21eb402c348c1139ae08e03e259909d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 08:23:40 +0100
+Subject: media: saa7146: fix array overflow in vidioc_s_audio()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]
+
+The "a->index" value comes from the user via the ioctl.  The problem is
+that the shift can wrap resulting in setting "mxb->cur_audinput" to an
+invalid value, which later results in an array overflow.
+
+Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
+index 129a1f8ebe1ad..73fc901ecf3db 100644
+--- a/drivers/media/pci/saa7146/mxb.c
++++ b/drivers/media/pci/saa7146/mxb.c
+@@ -641,16 +641,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
+ 	struct mxb *mxb = (struct mxb *)dev->ext_priv;
+ 
+ 	DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
+-	if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
+-		if (mxb->cur_audinput != a->index) {
+-			mxb->cur_audinput = a->index;
+-			tea6420_route(mxb, a->index);
+-			if (mxb->cur_audinput == 0)
+-				mxb_update_audmode(mxb);
+-		}
+-		return 0;
++	if (a->index >= 32 ||
++	    !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
++		return -EINVAL;
++
++	if (mxb->cur_audinput != a->index) {
++		mxb->cur_audinput = a->index;
++		tea6420_route(mxb, a->index);
++		if (mxb->cur_audinput == 0)
++			mxb_update_audmode(mxb);
+ 	}
+-	return -EINVAL;
++	return 0;
+ }
+ 
+ #ifdef CONFIG_VIDEO_ADV_DEBUG
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch b/queue-5.10/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch
new file mode 100644
index 00000000000..f38af1ad013
--- /dev/null
+++ b/queue-5.10/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch
@@ -0,0 +1,47 @@
+From 23c9c8264dd2f5c09204453b9082adeef20f0c51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 14:56:57 +0200
+Subject: media: siano: fix memory leak of debugfs members in smsdvb_hotplug
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]
+
+When dvb_create_media_graph fails, the debugfs kept inside client should
+be released. However, the current implementation does not release them.
+
+Fix this by adding a new goto label to call smsdvb_debugfs_release.
+
+Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/siano/smsdvb-main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 88f90dfd368b1..ae17407e477a4 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -1169,12 +1169,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
+ 	rc = dvb_create_media_graph(&client->adapter, true);
+ 	if (rc < 0) {
+ 		pr_err("dvb_create_media_graph failed %d\n", rc);
+-		goto client_error;
++		goto media_graph_error;
+ 	}
+ 
+ 	pr_info("DVB interface registered.\n");
+ 	return 0;
+ 
++media_graph_error:
++	smsdvb_debugfs_release(client);
++
+ client_error:
+ 	dvb_unregister_frontend(&client->frontend);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch b/queue-5.10/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch
new file mode 100644
index 00000000000..5c14797b5d5
--- /dev/null
+++ b/queue-5.10/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch
@@ -0,0 +1,38 @@
+From 5b8a031ef93affad04c4c208eccf819cff735215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 04:22:01 +0100
+Subject: media: solo6x10: fix missing snd_card_free in error handling case
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]
+
+Fix to goto snd_error in error handling case when fails
+to do snd_ctl_add, as done elsewhere in this function.
+
+Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
+index 906ce86437ae3..d137b94869d82 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
++++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
+@@ -385,7 +385,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
+ 
+ 	ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
+ 	if (ret < 0)
+-		return ret;
++		goto snd_error;
+ 
+ 	ret = solo_snd_pcm_init(solo_dev);
+ 	if (ret < 0)
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-staging-rkisp1-cap-fix-runtime-pm-imbalance-on.patch b/queue-5.10/media-staging-rkisp1-cap-fix-runtime-pm-imbalance-on.patch
new file mode 100644
index 00000000000..f26eb2b24d4
--- /dev/null
+++ b/queue-5.10/media-staging-rkisp1-cap-fix-runtime-pm-imbalance-on.patch
@@ -0,0 +1,38 @@
+From c9e01c37ad10b322b8acdffdcfcc8da701d33273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 15:28:52 +0100
+Subject: media: staging: rkisp1: cap: fix runtime PM imbalance on error
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 4cbbe2aaa0536b0e7b3dfbd7febc3bc2ec300559 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference imbalance in rkisp1_vb2_start_streaming, so we
+should fix it.
+
+Fixes: 56e3b29f9f6b2 ("media: staging: rkisp1: add streaming paths")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-capture.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-capture.c b/drivers/staging/media/rkisp1/rkisp1-capture.c
+index b6f497ce3e95c..0c934ca5adaa3 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-capture.c
++++ b/drivers/staging/media/rkisp1/rkisp1-capture.c
+@@ -992,6 +992,7 @@ rkisp1_vb2_start_streaming(struct vb2_queue *queue, unsigned int count)
+ 
+ 	ret = pm_runtime_get_sync(cap->rkisp1->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(cap->rkisp1->dev);
+ 		dev_err(cap->rkisp1->dev, "power up failed %d\n", ret);
+ 		goto err_destroy_dummy;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-tm6000-fix-sizeof-mismatches.patch b/queue-5.10/media-tm6000-fix-sizeof-mismatches.patch
new file mode 100644
index 00000000000..8fdd1676834
--- /dev/null
+++ b/queue-5.10/media-tm6000-fix-sizeof-mismatches.patch
@@ -0,0 +1,49 @@
+From d68318a91d7db0129ad89a058fa2901df8d11b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 23:12:23 +0200
+Subject: media: tm6000: Fix sizeof() mismatches
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ]
+
+The are two instances of sizeof() being used incorrectly. The
+sizeof(void *) is incorrect because urb_buffer is a char ** pointer,
+fix this by using sizeof(*dev->urb_buffer).  The sizeof(dma_addr_t *)
+is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t
+and not a dma_addr_t *.  This errors did not cause any issues because
+it just so happens the sizes are the same.
+
+Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
+
+Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/tm6000/tm6000-video.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
+index bfba06ea60e9d..2df736c029d6e 100644
+--- a/drivers/media/usb/tm6000/tm6000-video.c
++++ b/drivers/media/usb/tm6000/tm6000-video.c
+@@ -461,11 +461,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
+ 	if (dev->urb_buffer)
+ 		return 0;
+ 
+-	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
++	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
++					GFP_KERNEL);
+ 	if (!dev->urb_buffer)
+ 		return -ENOMEM;
+ 
+-	dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
++	dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
+ 				     GFP_KERNEL);
+ 	if (!dev->urb_dma)
+ 		return -ENOMEM;
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-tvp5150-fix-wrong-return-value-of-tvp5150_pars.patch b/queue-5.10/media-tvp5150-fix-wrong-return-value-of-tvp5150_pars.patch
new file mode 100644
index 00000000000..64af1c09287
--- /dev/null
+++ b/queue-5.10/media-tvp5150-fix-wrong-return-value-of-tvp5150_pars.patch
@@ -0,0 +1,38 @@
+From 7bd3e3bcd728cec8376a7c34aa0e8035f9a5b2d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 15:18:01 +0100
+Subject: media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit eb08c48132a1f594478ab9fa2b6ee646c3513a49 ]
+
+If of_graph_get_endpoint_by_regs() return NULL, it will return 0 rather
+than an errno, because we doesn't initialize the return value.
+
+Fixes: 0556f1d580d4 ("media: tvp5150: add input source selection of_graph support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tvp5150.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 7d9401219a3ac..3b3221fd3fe8f 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -2082,6 +2082,7 @@ static int tvp5150_parse_dt(struct tvp5150 *decoder, struct device_node *np)
+ 
+ 	ep_np = of_graph_get_endpoint_by_regs(np, TVP5150_PAD_VID_OUT, 0);
+ 	if (!ep_np) {
++		ret = -EINVAL;
+ 		dev_err(dev, "Error no output endpoint available\n");
+ 		goto err_free;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch b/queue-5.10/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch
new file mode 100644
index 00000000000..e443747399c
--- /dev/null
+++ b/queue-5.10/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch
@@ -0,0 +1,68 @@
+From 668a5f3b879e7a19d7a372012ea768d18152f680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Sep 2020 18:08:47 +0200
+Subject: media: v4l2-fwnode: Return -EINVAL for invalid bus-type
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 69baf338fc16a4d55c78da8874ce3f06feb38c78 ]
+
+Return -EINVAL if invalid bus-type is detected while parsing endpoints.
+
+Fixes: 26c1126c9b56 ("media: v4l: fwnode: Use media bus type for bus parser selection")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-fwnode.c | 6 +++++-
+ include/media/v4l2-mediabus.h         | 2 ++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index d7bbe33840cb4..dfc53d11053fc 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -93,7 +93,7 @@ v4l2_fwnode_bus_type_to_mbus(enum v4l2_fwnode_bus_type type)
+ 	const struct v4l2_fwnode_bus_conv *conv =
+ 		get_v4l2_fwnode_bus_conv_by_fwnode_bus(type);
+ 
+-	return conv ? conv->mbus_type : V4L2_MBUS_UNKNOWN;
++	return conv ? conv->mbus_type : V4L2_MBUS_INVALID;
+ }
+ 
+ static const char *
+@@ -436,6 +436,10 @@ static int __v4l2_fwnode_endpoint_parse(struct fwnode_handle *fwnode,
+ 		 v4l2_fwnode_mbus_type_to_string(vep->bus_type),
+ 		 vep->bus_type);
+ 	mbus_type = v4l2_fwnode_bus_type_to_mbus(bus_type);
++	if (mbus_type == V4L2_MBUS_INVALID) {
++		pr_debug("unsupported bus type %u\n", bus_type);
++		return -EINVAL;
++	}
+ 
+ 	if (vep->bus_type != V4L2_MBUS_UNKNOWN) {
+ 		if (mbus_type != V4L2_MBUS_UNKNOWN &&
+diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h
+index 59b1de1971142..c20e2dc6d4320 100644
+--- a/include/media/v4l2-mediabus.h
++++ b/include/media/v4l2-mediabus.h
+@@ -103,6 +103,7 @@
+  * @V4L2_MBUS_CCP2:	CCP2 (Compact Camera Port 2)
+  * @V4L2_MBUS_CSI2_DPHY: MIPI CSI-2 serial interface, with D-PHY
+  * @V4L2_MBUS_CSI2_CPHY: MIPI CSI-2 serial interface, with C-PHY
++ * @V4L2_MBUS_INVALID:	invalid bus type (keep as last)
+  */
+ enum v4l2_mbus_type {
+ 	V4L2_MBUS_UNKNOWN,
+@@ -112,6 +113,7 @@ enum v4l2_mbus_type {
+ 	V4L2_MBUS_CCP2,
+ 	V4L2_MBUS_CSI2_DPHY,
+ 	V4L2_MBUS_CSI2_CPHY,
++	V4L2_MBUS_INVALID,
+ };
+ 
+ /**
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-v4l2-fwnode-v4l2_fwnode_endpoint_parse-caller-.patch b/queue-5.10/media-v4l2-fwnode-v4l2_fwnode_endpoint_parse-caller-.patch
new file mode 100644
index 00000000000..b5d7a8698e1
--- /dev/null
+++ b/queue-5.10/media-v4l2-fwnode-v4l2_fwnode_endpoint_parse-caller-.patch
@@ -0,0 +1,57 @@
+From 0f03d6a3eea8c54ae4fbbd5eb12d6ecd2aa3f872 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 14:08:03 +0200
+Subject: media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep
+ argument
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit b3cc73d2bf14e7c6e0376fa9433e708349e9ddfc ]
+
+Document that the caller of v4l2_fwnode_endpoint_parse() must init the
+fields of struct v4l2_fwnode_endpoint (vep argument) fields.
+
+It used to be that the fields were zeroed by v4l2_fwnode_endpoint_parse
+when bus type was set to V4L2_MBUS_UNKNOWN but with recent changes (Fixes:
+line below) that no longer makes sense.
+
+Fixes: bb4bba9232fc ("media: v4l2-fwnode: Make bus configuration a struct")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/v4l2-fwnode.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/media/v4l2-fwnode.h b/include/media/v4l2-fwnode.h
+index c090742765431..ed0840f3d5dff 100644
+--- a/include/media/v4l2-fwnode.h
++++ b/include/media/v4l2-fwnode.h
+@@ -231,6 +231,9 @@ struct v4l2_fwnode_connector {
+  * guessing @vep.bus_type between CSI-2 D-PHY, parallel and BT.656 busses is
+  * supported. NEVER RELY ON GUESSING @vep.bus_type IN NEW DRIVERS!
+  *
++ * The caller is required to initialise all fields of @vep, either with
++ * explicitly values, or by zeroing them.
++ *
+  * The function does not change the V4L2 fwnode endpoint state if it fails.
+  *
+  * NOTE: This function does not parse properties the size of which is variable
+@@ -273,6 +276,9 @@ void v4l2_fwnode_endpoint_free(struct v4l2_fwnode_endpoint *vep);
+  * guessing @vep.bus_type between CSI-2 D-PHY, parallel and BT.656 busses is
+  * supported. NEVER RELY ON GUESSING @vep.bus_type IN NEW DRIVERS!
+  *
++ * The caller is required to initialise all fields of @vep, either with
++ * explicitly values, or by zeroing them.
++ *
+  * The function does not change the V4L2 fwnode endpoint state if it fails.
+  *
+  * v4l2_fwnode_endpoint_alloc_parse() has two important differences to
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-venus-core-change-clk-enable-and-disable-order.patch b/queue-5.10/media-venus-core-change-clk-enable-and-disable-order.patch
new file mode 100644
index 00000000000..056ac505661
--- /dev/null
+++ b/queue-5.10/media-venus-core-change-clk-enable-and-disable-order.patch
@@ -0,0 +1,76 @@
+From 52569402b729c78c86fea8950a92d0bd4d30d31a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:18:11 +0200
+Subject: media: venus: core: change clk enable and disable order in resume and
+ suspend
+
+From: Mansur Alisha Shaik <mansur@codeaurora.org>
+
+[ Upstream commit 21926d466e3a4f35c2536244d1d56512cc81a0a9 ]
+
+Currently video driver is voting after clk enable and un voting
+before clk disable. This is incorrect, video driver should vote
+before clk enable and unvote after clk disable.
+
+Corrected this by changing the order of clk enable and clk disable.
+
+suspend")
+
+Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
+Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index 6103aaf43987b..52a3886c496eb 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -355,13 +355,16 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	if (pm_ops->core_power) {
++		ret = pm_ops->core_power(dev, POWER_OFF);
++		if (ret)
++			return ret;
++	}
++
+ 	ret = icc_set_bw(core->cpucfg_path, 0, 0);
+ 	if (ret)
+ 		return ret;
+ 
+-	if (pm_ops->core_power)
+-		ret = pm_ops->core_power(dev, POWER_OFF);
+-
+ 	return ret;
+ }
+ 
+@@ -371,16 +374,16 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
+ 	const struct venus_pm_ops *pm_ops = core->pm_ops;
+ 	int ret;
+ 
++	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
++	if (ret)
++		return ret;
++
+ 	if (pm_ops->core_power) {
+ 		ret = pm_ops->core_power(dev, POWER_ON);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+-	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
+-	if (ret)
+-		return ret;
+-
+ 	return hfi_core_resume(core, false);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-venus-core-vote-for-video-mem-path.patch b/queue-5.10/media-venus-core-vote-for-video-mem-path.patch
new file mode 100644
index 00000000000..7cb56eb5aaf
--- /dev/null
+++ b/queue-5.10/media-venus-core-vote-for-video-mem-path.patch
@@ -0,0 +1,70 @@
+From b34e413e1ff95ff7238efc3d3ff587b36dbe225a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:18:12 +0200
+Subject: media: venus: core: vote for video-mem path
+
+From: Mansur Alisha Shaik <mansur@codeaurora.org>
+
+[ Upstream commit 9e8efdb5787986cc0d0134925cf5c4f001bb3f2e ]
+
+Currently video driver is voting for venus0-ebi path during buffer
+processing with an average bandwidth of all the instances and
+unvoting during session release.
+
+While video streaming when we try to do XO-SD using the command
+"echo mem > /sys/power/state command" , device is not entering
+to suspend state and from interconnect summary seeing votes for venus0-ebi
+
+Corrected this by voting for venus0-ebi path in venus_runtime_resume()
+and unvote during venus_runtime_suspend().
+
+suspend")
+
+Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
+Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index 52a3886c496eb..fa363b8ddc070 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -363,7 +363,18 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
+ 
+ 	ret = icc_set_bw(core->cpucfg_path, 0, 0);
+ 	if (ret)
+-		return ret;
++		goto err_cpucfg_path;
++
++	ret = icc_set_bw(core->video_path, 0, 0);
++	if (ret)
++		goto err_video_path;
++
++	return ret;
++
++err_video_path:
++	icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
++err_cpucfg_path:
++	pm_ops->core_power(dev, POWER_ON);
+ 
+ 	return ret;
+ }
+@@ -374,6 +385,10 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
+ 	const struct venus_pm_ops *pm_ops = core->pm_ops;
+ 	int ret;
+ 
++	ret = icc_set_bw(core->video_path, 0, kbps_to_icc(1000));
++	if (ret)
++		return ret;
++
+ 	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
+ 	if (ret)
+ 		return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-venus-core-vote-with-average-bandwidth-and-pea.patch b/queue-5.10/media-venus-core-vote-with-average-bandwidth-and-pea.patch
new file mode 100644
index 00000000000..3849e93dde5
--- /dev/null
+++ b/queue-5.10/media-venus-core-vote-with-average-bandwidth-and-pea.patch
@@ -0,0 +1,47 @@
+From a3ea91e7b1299c0848837455ec69dfe06aae5dc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:18:13 +0200
+Subject: media: venus: core: vote with average bandwidth and peak bandwidth as
+ zero
+
+From: Mansur Alisha Shaik <mansur@codeaurora.org>
+
+[ Upstream commit e44fb034b03231cd117d6db73fb8048deab6ea41 ]
+
+As per bandwidth table video driver is voting with average bandwidth
+for "video-mem" and "cpu-cfg" paths as peak bandwidth is zero
+in bandwidth table.
+
+suspend")
+
+Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
+Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index fa363b8ddc070..d5bfd6fff85b4 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -385,11 +385,11 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
+ 	const struct venus_pm_ops *pm_ops = core->pm_ops;
+ 	int ret;
+ 
+-	ret = icc_set_bw(core->video_path, 0, kbps_to_icc(1000));
++	ret = icc_set_bw(core->video_path, kbps_to_icc(20000), 0);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = icc_set_bw(core->cpucfg_path, 0, kbps_to_icc(1000));
++	ret = icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/media-venus-put-dummy-vote-on-video-mem-path-after-l.patch b/queue-5.10/media-venus-put-dummy-vote-on-video-mem-path-after-l.patch
new file mode 100644
index 00000000000..23982871b64
--- /dev/null
+++ b/queue-5.10/media-venus-put-dummy-vote-on-video-mem-path-after-l.patch
@@ -0,0 +1,54 @@
+From 6391c21c819ce52735b4e368dd7f507e3a00a32a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:18:14 +0200
+Subject: media: venus: put dummy vote on video-mem path after last session
+ release
+
+From: Mansur Alisha Shaik <mansur@codeaurora.org>
+
+[ Upstream commit eff5ce02e170125936c43ca96c7dc701a86681ed ]
+
+As per current implementation, video driver is unvoting "videom-mem" path
+for last video session during vdec_session_release().
+While video playback when we try to suspend device, we see video clock
+warnings since votes are already removed during vdec_session_release().
+
+corrected this by putting dummy vote on "video-mem" after last video
+session release and unvoting it during suspend.
+
+suspend")
+
+Fixes: 07f8f22a33a9e ("media: venus: core: remove CNOC voting while device
+Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/pm_helpers.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
+index a9538c2cc3c9d..2946547a0df4a 100644
+--- a/drivers/media/platform/qcom/venus/pm_helpers.c
++++ b/drivers/media/platform/qcom/venus/pm_helpers.c
+@@ -212,6 +212,16 @@ static int load_scale_bw(struct venus_core *core)
+ 	}
+ 	mutex_unlock(&core->lock);
+ 
++	/*
++	 * keep minimum bandwidth vote for "video-mem" path,
++	 * so that clks can be disabled during vdec_session_release().
++	 * Actual bandwidth drop will be done during device supend
++	 * so that device can power down without any warnings.
++	 */
++
++	if (!total_avg && !total_peak)
++		total_avg = kbps_to_icc(1000);
++
+ 	dev_dbg(core->dev, VDBGL "total: avg_bw: %u, peak_bw: %u\n",
+ 		total_avg, total_peak);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/memory-jz4780_nemc-fix-potential-null-dereference-in.patch b/queue-5.10/memory-jz4780_nemc-fix-potential-null-dereference-in.patch
new file mode 100644
index 00000000000..1b2f849befc
--- /dev/null
+++ b/queue-5.10/memory-jz4780_nemc-fix-potential-null-dereference-in.patch
@@ -0,0 +1,42 @@
+From 9b4c35866cdfba70c2001a7e5b5f74fa1ff80689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:31:57 +0800
+Subject: memory: jz4780_nemc: Fix potential NULL dereference in
+ jz4780_nemc_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 4bfa07300b9334b487ed4f3d4901c35ebb31b7ca ]
+
+platform_get_resource() may fail and return NULL, so we should
+better check it's return value to avoid a NULL pointer dereference
+a bit later in the code.
+
+This is detected by Coccinelle semantic patch.
+
+Fixes: 911a88829725 ("memory: jz4780-nemc: driver for the NEMC on JZ4780 SoCs")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://lore.kernel.org/r/1607070717-32880-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/jz4780-nemc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/memory/jz4780-nemc.c b/drivers/memory/jz4780-nemc.c
+index 3ec5cb0fce1ee..465ea92990d7e 100644
+--- a/drivers/memory/jz4780-nemc.c
++++ b/drivers/memory/jz4780-nemc.c
+@@ -291,6 +291,8 @@ static int jz4780_nemc_probe(struct platform_device *pdev)
+ 	nemc->dev = dev;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res)
++		return -EINVAL;
+ 
+ 	/*
+ 	 * The driver currently only uses the registers up to offset
+-- 
+2.27.0
+
diff --git a/queue-5.10/memory-ti-emif-sram-only-build-for-armv7.patch b/queue-5.10/memory-ti-emif-sram-only-build-for-armv7.patch
new file mode 100644
index 00000000000..37a5b801382
--- /dev/null
+++ b/queue-5.10/memory-ti-emif-sram-only-build-for-armv7.patch
@@ -0,0 +1,41 @@
+From 8755bb082d3cc379105d48c016bfa29e08cca749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 00:08:14 +0100
+Subject: memory: ti-emif-sram: only build for ARMv7
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d77d22d701b0471584abe1871570bb43deb6e3c4 ]
+
+The driver can be compile-tested on all ARM machines, but
+causes a failure when built for ARMv7-M:
+
+arm-linux-gnueabi-ld: error: drivers/memory/ti-emif-sram-pm.o: conflicting architecture profiles A/M
+
+Limit the target machines to configurations that have ARMv7 enabled.
+
+Fixes: ea0c0ad6b6eb ("memory: Enable compile testing for most of the drivers")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20201203230832.1481767-1-arnd@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/Kconfig b/drivers/memory/Kconfig
+index 00e013b14703e..cc2c83e1accfb 100644
+--- a/drivers/memory/Kconfig
++++ b/drivers/memory/Kconfig
+@@ -128,7 +128,7 @@ config OMAP_GPMC_DEBUG
+ 
+ config TI_EMIF_SRAM
+ 	tristate "Texas Instruments EMIF SRAM driver"
+-	depends on SOC_AM33XX || SOC_AM43XX || (ARM && COMPILE_TEST)
++	depends on SOC_AM33XX || SOC_AM43XX || (ARM && CPU_V7 && COMPILE_TEST)
+ 	depends on SRAM
+ 	help
+ 	  This driver is for the EMIF module available on Texas Instruments
+-- 
+2.27.0
+
diff --git a/queue-5.10/memstick-fix-a-double-free-bug-in-memstick_check.patch b/queue-5.10/memstick-fix-a-double-free-bug-in-memstick_check.patch
new file mode 100644
index 00000000000..447dd414446
--- /dev/null
+++ b/queue-5.10/memstick-fix-a-double-free-bug-in-memstick_check.patch
@@ -0,0 +1,37 @@
+From 477af69fd8331e072505cb4f19bd4fa589f15143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:48:46 +0800
+Subject: memstick: fix a double-free bug in memstick_check
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]
+
+kfree(host->card) has been called in put_device so that
+another kfree would raise cause a double-free bug.
+
+Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index ef03d6fafc5ce..12bc3f5a6cbbd 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
+ 			host->card = card;
+ 			if (device_register(&card->dev)) {
+ 				put_device(&card->dev);
+-				kfree(host->card);
+ 				host->card = NULL;
+ 			}
+ 		} else
+-- 
+2.27.0
+
diff --git a/queue-5.10/memstick-r592-fix-error-return-in-r592_probe.patch b/queue-5.10/memstick-r592-fix-error-return-in-r592_probe.patch
new file mode 100644
index 00000000000..0aa07a5fee2
--- /dev/null
+++ b/queue-5.10/memstick-r592-fix-error-return-in-r592_probe.patch
@@ -0,0 +1,57 @@
+From aa6e261205b62dd194b18d0de01256e0157c3cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 09:47:18 +0800
+Subject: memstick: r592: Fix error return in r592_probe()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]
+
+Fix to return a error code from the error handling case instead of 0.
+
+Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/host/r592.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index dd3a1f3dcc191..d2ef46337191c 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -759,8 +759,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 		goto error3;
+ 
+ 	dev->mmio = pci_ioremap_bar(pdev, 0);
+-	if (!dev->mmio)
++	if (!dev->mmio) {
++		error = -ENOMEM;
+ 		goto error4;
++	}
+ 
+ 	dev->irq = pdev->irq;
+ 	spin_lock_init(&dev->irq_lock);
+@@ -786,12 +788,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 		&dev->dummy_dma_page_physical_address, GFP_KERNEL);
+ 	r592_stop_dma(dev , 0);
+ 
+-	if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+-			  DRV_NAME, dev))
++	error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
++			  DRV_NAME, dev);
++	if (error)
+ 		goto error6;
+ 
+ 	r592_update_card_detect(dev);
+-	if (memstick_add_host(host))
++	error = memstick_add_host(host);
++	if (error)
+ 		goto error7;
+ 
+ 	message("driver successfully loaded");
+-- 
+2.27.0
+
diff --git a/queue-5.10/mfd-cpcap-fix-interrupt-regression-with-regmap-clear.patch b/queue-5.10/mfd-cpcap-fix-interrupt-regression-with-regmap-clear.patch
new file mode 100644
index 00000000000..aeaf6fee0e6
--- /dev/null
+++ b/queue-5.10/mfd-cpcap-fix-interrupt-regression-with-regmap-clear.patch
@@ -0,0 +1,82 @@
+From 6a869ea436a4304dc69f1d87b1a6bd8d23a102db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 19:06:13 +0200
+Subject: mfd: cpcap: Fix interrupt regression with regmap clear_ack
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 14639a22de657eabbb776f503a816594393cc935 ]
+
+With commit 3a6f0fb7b8eb ("regmap: irq: Add support to clear ack
+registers"), the cpcap interrupts are no longer getting acked properly
+leading to a very unresponsive device with CPUs fully loaded spinning
+in the threaded IRQ handlers.
+
+To me it looks like the clear_ack commit above actually fixed a long
+standing bug in regmap_irq_thread() where we unconditionally acked the
+interrupts earlier without considering ack_invert. And the issue with
+cpcap started happening as we now also consider ack_invert.
+
+Tim Harvey <tharvey@gateworks.com> tried to fix this issue earlier with
+"[PATCH v2] regmap: irq: fix ack-invert", but the reading of the ack
+register was considered unnecessary for just ack_invert, and we did not
+have clear_ack available yet. As the cpcap irqs worked both with and
+without ack_invert earlier because of the unconditional ack, the
+problem remained hidden until now.
+
+Also, looks like the earlier v3.0.8 based Motorola Android Linux kernel
+does clear_ack style read-clear-write with "ireg_val & ~mreg_val" instead
+of just ack_invert style write. So let's switch cpcap to use clear_ack
+to fix the issue.
+
+Fixes: 3a6f0fb7b8eb ("regmap: irq: Add support to clear ack registers")
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Laxminath Kasam <lkasam@codeaurora.org>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-By: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/motorola-cpcap.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c
+index 2283d88adcc25..30d82bfe5b02f 100644
+--- a/drivers/mfd/motorola-cpcap.c
++++ b/drivers/mfd/motorola-cpcap.c
+@@ -97,7 +97,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
+ 		.ack_base = CPCAP_REG_MI1,
+ 		.mask_base = CPCAP_REG_MIM1,
+ 		.use_ack = true,
+-		.ack_invert = true,
++		.clear_ack = true,
+ 	},
+ 	{
+ 		.name = "cpcap-m2",
+@@ -106,7 +106,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
+ 		.ack_base = CPCAP_REG_MI2,
+ 		.mask_base = CPCAP_REG_MIM2,
+ 		.use_ack = true,
+-		.ack_invert = true,
++		.clear_ack = true,
+ 	},
+ 	{
+ 		.name = "cpcap1-4",
+@@ -115,7 +115,7 @@ static struct regmap_irq_chip cpcap_irq_chip[CPCAP_NR_IRQ_CHIPS] = {
+ 		.ack_base = CPCAP_REG_INT1,
+ 		.mask_base = CPCAP_REG_INTM1,
+ 		.use_ack = true,
+-		.ack_invert = true,
++		.clear_ack = true,
+ 	},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mfd-htc-i2cpld-add-the-missed-i2c_put_adapter-in-htc.patch b/queue-5.10/mfd-htc-i2cpld-add-the-missed-i2c_put_adapter-in-htc.patch
new file mode 100644
index 00000000000..37a069ec5bb
--- /dev/null
+++ b/queue-5.10/mfd-htc-i2cpld-add-the-missed-i2c_put_adapter-in-htc.patch
@@ -0,0 +1,44 @@
+From c9d7a21471dcf360bbbfaf3de296fcaf91eea914 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 15:43:46 +0800
+Subject: mfd: htc-i2cpld: Add the missed i2c_put_adapter() in
+ htcpld_register_chip_i2c()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 9a463284706c5217872c3cadaca863d47129bd95 ]
+
+htcpld_register_chip_i2c() misses to call i2c_put_adapter() in an error
+path. Add the missed function call to fix it.
+
+Fixes: 6048a3dd2371 ("mfd: Add HTCPLD driver")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/htc-i2cpld.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/htc-i2cpld.c b/drivers/mfd/htc-i2cpld.c
+index 247f9849e54ae..417b0355d904d 100644
+--- a/drivers/mfd/htc-i2cpld.c
++++ b/drivers/mfd/htc-i2cpld.c
+@@ -346,6 +346,7 @@ static int htcpld_register_chip_i2c(
+ 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_READ_BYTE_DATA)) {
+ 		dev_warn(dev, "i2c adapter %d non-functional\n",
+ 			 pdata->i2c_adapter_id);
++		i2c_put_adapter(adapter);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -360,6 +361,7 @@ static int htcpld_register_chip_i2c(
+ 		/* I2C device registration failed, contineu with the next */
+ 		dev_warn(dev, "Unable to add I2C device for 0x%x\n",
+ 			 plat_chip_data->addr);
++		i2c_put_adapter(adapter);
+ 		return PTR_ERR(client);
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mfd-mfd_sl28cpld-should-depend-on-arch_layerscape.patch b/queue-5.10/mfd-mfd_sl28cpld-should-depend-on-arch_layerscape.patch
new file mode 100644
index 00000000000..cc374fa2569
--- /dev/null
+++ b/queue-5.10/mfd-mfd_sl28cpld-should-depend-on-arch_layerscape.patch
@@ -0,0 +1,38 @@
+From 7e741c0ba161988613910576e67a7919c6a795e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 16:57:27 +0100
+Subject: mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit de1292817cf736c04fab31903a6aa9d9ffe60b79 ]
+
+Currently the Kontron sl28cpld Board Management Controller is found only
+on Kontron boards equipped with a Freescale Layerscape SoC.  Hence add a
+dependency on ARCH_LAYERSCAPE, to prevent asking the user about a driver
+for this controller when configuring a kernel without Layerscape support.
+
+Fixes: a538ad229bbee4f8 ("mfd: simple-mfd-i2c: Add sl28cpld support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 8b99a13669bfc..4789507f325b8 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1189,6 +1189,7 @@ config MFD_SIMPLE_MFD_I2C
+ config MFD_SL28CPLD
+ 	tristate "Kontron sl28cpld Board Management Controller"
+ 	depends on I2C
++	depends on ARCH_LAYERSCAPE || COMPILE_TEST
+ 	select MFD_SIMPLE_MFD_I2C
+ 	help
+ 	  Say yes here to enable support for the Kontron sl28cpld board
+-- 
+2.27.0
+
diff --git a/queue-5.10/mfd-stmfx-fix-dev_err_probe-call-in-stmfx_chip_init.patch b/queue-5.10/mfd-stmfx-fix-dev_err_probe-call-in-stmfx_chip_init.patch
new file mode 100644
index 00000000000..9429a1f05a4
--- /dev/null
+++ b/queue-5.10/mfd-stmfx-fix-dev_err_probe-call-in-stmfx_chip_init.patch
@@ -0,0 +1,44 @@
+From 7b04ce0ac51e52fed4d4b775beb1240e3dac16cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 13:27:25 +0100
+Subject: mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()
+
+From: Amelie Delaunay <amelie.delaunay@st.com>
+
+[ Upstream commit d75846ed08e6f4135ec73778575c34d9c0ace993 ]
+
+'ret' may be 0 so, dev_err_probe() should be called only when 'ret' is
+an error code.
+
+Fixes: 41c9c06c491a ("mfd: stmfx: Simplify with dev_err_probe()")
+Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/stmfx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
+index 5e680bfdf5c90..988e2ba6dd0f3 100644
+--- a/drivers/mfd/stmfx.c
++++ b/drivers/mfd/stmfx.c
+@@ -329,11 +329,11 @@ static int stmfx_chip_init(struct i2c_client *client)
+ 
+ 	stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd");
+ 	ret = PTR_ERR_OR_ZERO(stmfx->vdd);
+-	if (ret == -ENODEV) {
+-		stmfx->vdd = NULL;
+-	} else {
+-		return dev_err_probe(&client->dev, ret,
+-				     "Failed to get VDD regulator\n");
++	if (ret) {
++		if (ret == -ENODEV)
++			stmfx->vdd = NULL;
++		else
++			return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n");
+ 	}
+ 
+ 	if (stmfx->vdd) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch b/queue-5.10/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch
new file mode 100644
index 00000000000..8e10c902831
--- /dev/null
+++ b/queue-5.10/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch
@@ -0,0 +1,48 @@
+From a590cf66ab5d125c0497855b62f6e27f38150ab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 00:34:01 +0300
+Subject: MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
+
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+
+[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]
+
+When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
+in the following Kbuild warning:
+
+WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
+  Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
+  Selected by [y]:
+  - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]
+
+The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
+depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
+depends on BCMA_DRIVER_PCI. This can also fail building the kernel.
+
+Honor the kconfig dependency to remove unmet direct dependency warnings
+and avoid any potential build failures.
+
+Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
+Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
+index 6889f74e06f54..490bb6da74b7e 100644
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -27,6 +27,7 @@ config BCM47XX_BCMA
+ 	select BCMA
+ 	select BCMA_HOST_SOC
+ 	select BCMA_DRIVER_MIPS
++	select BCMA_DRIVER_PCI if PCI
+ 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ 	select BCMA_DRIVER_GPIO
+ 	default y
+-- 
+2.27.0
+
diff --git a/queue-5.10/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch b/queue-5.10/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch
new file mode 100644
index 00000000000..200b6e5208c
--- /dev/null
+++ b/queue-5.10/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch
@@ -0,0 +1,41 @@
+From 9bb1f49d9cec3ba29fa5f2ea3765c138e17187de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:48:47 +0800
+Subject: mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]
+
+kfree(dev) has been called inside put_device so anther
+kfree would cause a use-after-free bug/
+
+Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mips_cdmm.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
+index 9f7ed1fcd4285..626dedd110cbc 100644
+--- a/drivers/bus/mips_cdmm.c
++++ b/drivers/bus/mips_cdmm.c
+@@ -559,10 +559,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
+ 		dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
+ 		++id;
+ 		ret = device_register(&dev->dev);
+-		if (ret) {
++		if (ret)
+ 			put_device(&dev->dev);
+-			kfree(dev);
+-		}
+ 	}
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mips-don-t-round-up-kernel-sections-size-for-membloc.patch b/queue-5.10/mips-don-t-round-up-kernel-sections-size-for-membloc.patch
new file mode 100644
index 00000000000..925df994823
--- /dev/null
+++ b/queue-5.10/mips-don-t-round-up-kernel-sections-size-for-membloc.patch
@@ -0,0 +1,44 @@
+From 90272d52dce5863da0cd4b7e4409c6effc39c29e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 13:36:48 +0100
+Subject: MIPS: Don't round up kernel sections size for memblock_add()
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+[ Upstream commit d121f125af22a16f0f679293756d28a9691fa46d ]
+
+Linux doesn't own the memory immediately after the kernel image. On Octeon
+bootloader places a shared structure right close after the kernel _end,
+refer to "struct cvmx_bootinfo *octeon_bootinfo" in cavium-octeon/setup.c.
+
+If check_kernel_sections_mem() rounds the PFNs up, first memblock_alloc()
+inside early_init_dt_alloc_memory_arch() <= device_tree_init() returns
+memory block overlapping with the above octeon_bootinfo structure, which
+is being overwritten afterwards.
+
+Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map")
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/setup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index ca579deef9391..9d11f68a9e8bb 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -498,8 +498,8 @@ static void __init request_crashkernel(struct resource *res)
+ 
+ static void __init check_kernel_sections_mem(void)
+ {
+-	phys_addr_t start = PFN_PHYS(PFN_DOWN(__pa_symbol(&_text)));
+-	phys_addr_t size = PFN_PHYS(PFN_UP(__pa_symbol(&_end))) - start;
++	phys_addr_t start = __pa_symbol(&_text);
++	phys_addr_t size = __pa_symbol(&_end) - start;
+ 
+ 	if (!memblock_is_region_memory(start, size)) {
+ 		pr_info("Kernel sections are not in the memory maps\n");
+-- 
+2.27.0
+
diff --git a/queue-5.10/misc-pci_endpoint_test-fix-return-value-of-error-bra.patch b/queue-5.10/misc-pci_endpoint_test-fix-return-value-of-error-bra.patch
new file mode 100644
index 00000000000..2825c01eca4
--- /dev/null
+++ b/queue-5.10/misc-pci_endpoint_test-fix-return-value-of-error-bra.patch
@@ -0,0 +1,54 @@
+From 35bf8ccfbee82e9cd1fa4770a1296c04ecbf8661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 20:49:18 +0800
+Subject: misc: pci_endpoint_test: fix return value of error branch
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 1749c90489f2afa6b59dbf3ab59d58a9014c84a1 ]
+
+We return 'err' in the error branch, but this variable may be set as
+zero before. Fix it by setting 'err' as a negative value before we
+goto the error label.
+
+Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Link: https://lore.kernel.org/r/1605790158-6780-1-git-send-email-wangxiongfeng2@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pci_endpoint_test.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index 146ca6fb3260f..d3844730eacaf 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -811,8 +811,10 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ 
+ 	pci_set_master(pdev);
+ 
+-	if (!pci_endpoint_test_alloc_irq_vectors(test, irq_type))
++	if (!pci_endpoint_test_alloc_irq_vectors(test, irq_type)) {
++		err = -EINVAL;
+ 		goto err_disable_irq;
++	}
+ 
+ 	for (bar = 0; bar < PCI_STD_NUM_BARS; bar++) {
+ 		if (pci_resource_flags(pdev, bar) & IORESOURCE_MEM) {
+@@ -849,8 +851,10 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ 		goto err_ida_remove;
+ 	}
+ 
+-	if (!pci_endpoint_test_request_irq(test))
++	if (!pci_endpoint_test_request_irq(test)) {
++		err = -EINVAL;
+ 		goto err_kfree_test_name;
++	}
+ 
+ 	misc_device = &test->miscdev;
+ 	misc_device->minor = MISC_DYNAMIC_MINOR;
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch b/queue-5.10/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch
new file mode 100644
index 00000000000..0b4a296cd96
--- /dev/null
+++ b/queue-5.10/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch
@@ -0,0 +1,94 @@
+From 1df7f6f94317f588aa42654e4a3b8b2141baea1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:12:15 -0800
+Subject: mm: don't wake kswapd prematurely when watermark boosting is disabled
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+[ Upstream commit 597c892038e08098b17ccfe65afd9677e6979800 ]
+
+On 2-node NUMA hosts we see bursts of kswapd reclaim and subsequent
+pressure spikes and stalls from cache refaults while there is plenty of
+free memory in the system.
+
+Usually, kswapd is woken up when all eligible nodes in an allocation are
+full.  But the code related to watermark boosting can wake kswapd on one
+full node while the other one is mostly empty.  This may be justified to
+fight fragmentation, but is currently unconditionally done whether
+watermark boosting is occurring or not.
+
+In our case, many of our workloads' throughput scales with available
+memory, and pure utilization is a more tangible concern than trends
+around longer-term fragmentation.  As a result we generally disable
+watermark boosting.
+
+Wake kswapd only woken when watermark boosting is requested.
+
+Link: https://lkml.kernel.org/r/20201020175833.397286-1-hannes@cmpxchg.org
+Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index eaa227a479e4a..32f783ddb5c3a 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2470,12 +2470,12 @@ static bool can_steal_fallback(unsigned int order, int start_mt)
+ 	return false;
+ }
+ 
+-static inline void boost_watermark(struct zone *zone)
++static inline bool boost_watermark(struct zone *zone)
+ {
+ 	unsigned long max_boost;
+ 
+ 	if (!watermark_boost_factor)
+-		return;
++		return false;
+ 	/*
+ 	 * Don't bother in zones that are unlikely to produce results.
+ 	 * On small machines, including kdump capture kernels running
+@@ -2483,7 +2483,7 @@ static inline void boost_watermark(struct zone *zone)
+ 	 * memory situation immediately.
+ 	 */
+ 	if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))
+-		return;
++		return false;
+ 
+ 	max_boost = mult_frac(zone->_watermark[WMARK_HIGH],
+ 			watermark_boost_factor, 10000);
+@@ -2497,12 +2497,14 @@ static inline void boost_watermark(struct zone *zone)
+ 	 * boosted watermark resulting in a hang.
+ 	 */
+ 	if (!max_boost)
+-		return;
++		return false;
+ 
+ 	max_boost = max(pageblock_nr_pages, max_boost);
+ 
+ 	zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages,
+ 		max_boost);
++
++	return true;
+ }
+ 
+ /*
+@@ -2540,8 +2542,7 @@ static void steal_suitable_fallback(struct zone *zone, struct page *page,
+ 	 * likelihood of future fallbacks. Wake kswapd now as the node
+ 	 * may be balanced overall and kswapd will not wake naturally.
+ 	 */
+-	boost_watermark(zone);
+-	if (alloc_flags & ALLOC_KSWAPD)
++	if (boost_watermark(zone) && (alloc_flags & ALLOC_KSWAPD))
+ 		set_bit(ZONE_BOOSTED_WATERMARK, &zone->flags);
+ 
+ 	/* We are not allowed to try stealing from the whole block */
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-gup-combine-put_compound_head-and-unpin_user_page.patch b/queue-5.10/mm-gup-combine-put_compound_head-and-unpin_user_page.patch
new file mode 100644
index 00000000000..61cebee64c1
--- /dev/null
+++ b/queue-5.10/mm-gup-combine-put_compound_head-and-unpin_user_page.patch
@@ -0,0 +1,190 @@
+From e45d54ec1c1a97630ddb72aa4565be23f62f80a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:05:51 -0800
+Subject: mm/gup: combine put_compound_head() and unpin_user_page()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 4509b42c38963f495b49aa50209c34337286ecbe ]
+
+These functions accomplish the same thing but have different
+implementations.
+
+unpin_user_page() has a bug where it calls mod_node_page_state() after
+calling put_page() which creates a risk that the page could have been
+hot-uplugged from the system.
+
+Fix this by using put_compound_head() as the only implementation.
+
+__unpin_devmap_managed_user_page() and related can be deleted as well in
+favour of the simpler, but slower, version in put_compound_head() that has
+an extra atomic page_ref_sub, but always calls put_page() which internally
+contains the special devmap code.
+
+Move put_compound_head() to be directly after try_grab_compound_head() so
+people can find it in future.
+
+Link: https://lkml.kernel.org/r/0-v1-6730d4ee0d32+40e6-gup_combine_put_jgg@nvidia.com
+Fixes: 1970dc6f5226 ("mm/gup: /proc/vmstat: pin_user_pages (FOLL_PIN) reporting")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+CC: Joao Martins <joao.m.martins@oracle.com>
+CC: Jonathan Corbet <corbet@lwn.net>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: Dave Chinner <david@fromorbit.com>
+CC: Christoph Hellwig <hch@infradead.org>
+CC: Jane Chu <jane.chu@oracle.com>
+CC: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+CC: Michal Hocko <mhocko@suse.com>
+CC: Mike Kravetz <mike.kravetz@oracle.com>
+CC: Shuah Khan <shuah@kernel.org>
+CC: Muchun Song <songmuchun@bytedance.com>
+CC: Vlastimil Babka <vbabka@suse.cz>
+CC: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/gup.c | 103 +++++++++++++------------------------------------------
+ 1 file changed, 23 insertions(+), 80 deletions(-)
+
+diff --git a/mm/gup.c b/mm/gup.c
+index 9c6a2f5001c5c..054ff923d3d92 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -123,6 +123,28 @@ static __maybe_unused struct page *try_grab_compound_head(struct page *page,
+ 	return NULL;
+ }
+ 
++static void put_compound_head(struct page *page, int refs, unsigned int flags)
++{
++	if (flags & FOLL_PIN) {
++		mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED,
++				    refs);
++
++		if (hpage_pincount_available(page))
++			hpage_pincount_sub(page, refs);
++		else
++			refs *= GUP_PIN_COUNTING_BIAS;
++	}
++
++	VM_BUG_ON_PAGE(page_ref_count(page) < refs, page);
++	/*
++	 * Calling put_page() for each ref is unnecessarily slow. Only the last
++	 * ref needs a put_page().
++	 */
++	if (refs > 1)
++		page_ref_sub(page, refs - 1);
++	put_page(page);
++}
++
+ /**
+  * try_grab_page() - elevate a page's refcount by a flag-dependent amount
+  *
+@@ -177,41 +199,6 @@ bool __must_check try_grab_page(struct page *page, unsigned int flags)
+ 	return true;
+ }
+ 
+-#ifdef CONFIG_DEV_PAGEMAP_OPS
+-static bool __unpin_devmap_managed_user_page(struct page *page)
+-{
+-	int count, refs = 1;
+-
+-	if (!page_is_devmap_managed(page))
+-		return false;
+-
+-	if (hpage_pincount_available(page))
+-		hpage_pincount_sub(page, 1);
+-	else
+-		refs = GUP_PIN_COUNTING_BIAS;
+-
+-	count = page_ref_sub_return(page, refs);
+-
+-	mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED, 1);
+-	/*
+-	 * devmap page refcounts are 1-based, rather than 0-based: if
+-	 * refcount is 1, then the page is free and the refcount is
+-	 * stable because nobody holds a reference on the page.
+-	 */
+-	if (count == 1)
+-		free_devmap_managed_page(page);
+-	else if (!count)
+-		__put_page(page);
+-
+-	return true;
+-}
+-#else
+-static bool __unpin_devmap_managed_user_page(struct page *page)
+-{
+-	return false;
+-}
+-#endif /* CONFIG_DEV_PAGEMAP_OPS */
+-
+ /**
+  * unpin_user_page() - release a dma-pinned page
+  * @page:            pointer to page to be released
+@@ -223,28 +210,7 @@ static bool __unpin_devmap_managed_user_page(struct page *page)
+  */
+ void unpin_user_page(struct page *page)
+ {
+-	int refs = 1;
+-
+-	page = compound_head(page);
+-
+-	/*
+-	 * For devmap managed pages we need to catch refcount transition from
+-	 * GUP_PIN_COUNTING_BIAS to 1, when refcount reach one it means the
+-	 * page is free and we need to inform the device driver through
+-	 * callback. See include/linux/memremap.h and HMM for details.
+-	 */
+-	if (__unpin_devmap_managed_user_page(page))
+-		return;
+-
+-	if (hpage_pincount_available(page))
+-		hpage_pincount_sub(page, 1);
+-	else
+-		refs = GUP_PIN_COUNTING_BIAS;
+-
+-	if (page_ref_sub_and_test(page, refs))
+-		__put_page(page);
+-
+-	mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED, 1);
++	put_compound_head(compound_head(page), 1, FOLL_PIN);
+ }
+ EXPORT_SYMBOL(unpin_user_page);
+ 
+@@ -2062,29 +2028,6 @@ EXPORT_SYMBOL(get_user_pages_unlocked);
+  * This code is based heavily on the PowerPC implementation by Nick Piggin.
+  */
+ #ifdef CONFIG_HAVE_FAST_GUP
+-
+-static void put_compound_head(struct page *page, int refs, unsigned int flags)
+-{
+-	if (flags & FOLL_PIN) {
+-		mod_node_page_state(page_pgdat(page), NR_FOLL_PIN_RELEASED,
+-				    refs);
+-
+-		if (hpage_pincount_available(page))
+-			hpage_pincount_sub(page, refs);
+-		else
+-			refs *= GUP_PIN_COUNTING_BIAS;
+-	}
+-
+-	VM_BUG_ON_PAGE(page_ref_count(page) < refs, page);
+-	/*
+-	 * Calling put_page() for each ref is unnecessarily slow. Only the last
+-	 * ref needs a put_page().
+-	 */
+-	if (refs > 1)
+-		page_ref_sub(page, refs - 1);
+-	put_page(page);
+-}
+-
+ #ifdef CONFIG_GUP_GET_PTE_LOW_HIGH
+ 
+ /*
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-gup-prevent-gup_fast-from-racing-with-cow-during-.patch b/queue-5.10/mm-gup-prevent-gup_fast-from-racing-with-cow-during-.patch
new file mode 100644
index 00000000000..2e67dd5a9b6
--- /dev/null
+++ b/queue-5.10/mm-gup-prevent-gup_fast-from-racing-with-cow-during-.patch
@@ -0,0 +1,234 @@
+From 052a409ee5bec72f1a56148d5479d6e63306dd81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:05:44 -0800
+Subject: mm/gup: prevent gup_fast from racing with COW during fork
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 57efa1fe5957694fa541c9062de0a127f0b9acb0 ]
+
+Since commit 70e806e4e645 ("mm: Do early cow for pinned pages during
+fork() for ptes") pages under a FOLL_PIN will not be write protected
+during COW for fork.  This means that pages returned from
+pin_user_pages(FOLL_WRITE) should not become write protected while the pin
+is active.
+
+However, there is a small race where get_user_pages_fast(FOLL_PIN) can
+establish a FOLL_PIN at the same time copy_present_page() is write
+protecting it:
+
+        CPU 0                             CPU 1
+   get_user_pages_fast()
+    internal_get_user_pages_fast()
+                                       copy_page_range()
+                                         pte_alloc_map_lock()
+                                           copy_present_page()
+                                             atomic_read(has_pinned) == 0
+					     page_maybe_dma_pinned() == false
+     atomic_set(has_pinned, 1);
+     gup_pgd_range()
+      gup_pte_range()
+       pte_t pte = gup_get_pte(ptep)
+       pte_access_permitted(pte)
+       try_grab_compound_head()
+                                             pte = pte_wrprotect(pte)
+	                                     set_pte_at();
+                                         pte_unmap_unlock()
+      // GUP now returns with a write protected page
+
+The first attempt to resolve this by using the write protect caused
+problems (and was missing a barrrier), see commit f3c64eda3e50 ("mm: avoid
+early COW write protect games during fork()")
+
+Instead wrap copy_p4d_range() with the write side of a seqcount and check
+the read side around gup_pgd_range().  If there is a collision then
+get_user_pages_fast() fails and falls back to slow GUP.
+
+Slow GUP is safe against this race because copy_page_range() is only
+called while holding the exclusive side of the mmap_lock on the src
+mm_struct.
+
+[akpm@linux-foundation.org: coding style fixes]
+  Link: https://lore.kernel.org/r/CAHk-=wi=iCnYCARbPGjkVJu9eyYeZ13N64tZYLdOB8CP5Q_PLw@mail.gmail.com
+
+Link: https://lkml.kernel.org/r/2-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
+Fixes: f3c64eda3e50 ("mm: avoid early COW write protect games during fork()")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Reviewed-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Acked-by: "Ahmed S. Darwish" <a.darwish@linutronix.de>	[seqcount_t parts]
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Kirill Shutemov <kirill@shutemov.name>
+Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
+Cc: Leon Romanovsky <leonro@nvidia.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tboot.c    |  1 +
+ drivers/firmware/efi/efi.c |  1 +
+ include/linux/mm_types.h   |  8 ++++++++
+ kernel/fork.c              |  1 +
+ mm/gup.c                   | 18 ++++++++++++++++++
+ mm/init-mm.c               |  1 +
+ mm/memory.c                | 13 ++++++++++++-
+ 7 files changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
+index ae64f98ec2ab6..4c09ba1102047 100644
+--- a/arch/x86/kernel/tboot.c
++++ b/arch/x86/kernel/tboot.c
+@@ -93,6 +93,7 @@ static struct mm_struct tboot_mm = {
+ 	.pgd            = swapper_pg_dir,
+ 	.mm_users       = ATOMIC_INIT(2),
+ 	.mm_count       = ATOMIC_INIT(1),
++	.write_protect_seq = SEQCNT_ZERO(tboot_mm.write_protect_seq),
+ 	MMAP_LOCK_INITIALIZER(init_mm)
+ 	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
+ 	.mmlist         = LIST_HEAD_INIT(init_mm.mmlist),
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 6c6eec044a978..df3f9bcab581c 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -57,6 +57,7 @@ struct mm_struct efi_mm = {
+ 	.mm_rb			= RB_ROOT,
+ 	.mm_users		= ATOMIC_INIT(2),
+ 	.mm_count		= ATOMIC_INIT(1),
++	.write_protect_seq      = SEQCNT_ZERO(efi_mm.write_protect_seq),
+ 	MMAP_LOCK_INITIALIZER(efi_mm)
+ 	.page_table_lock	= __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
+ 	.mmlist			= LIST_HEAD_INIT(efi_mm.mmlist),
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 5a9238f6caad9..915f4f100383b 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -14,6 +14,7 @@
+ #include <linux/uprobes.h>
+ #include <linux/page-flags-layout.h>
+ #include <linux/workqueue.h>
++#include <linux/seqlock.h>
+ 
+ #include <asm/mmu.h>
+ 
+@@ -446,6 +447,13 @@ struct mm_struct {
+ 		 */
+ 		atomic_t has_pinned;
+ 
++		/**
++		 * @write_protect_seq: Locked when any thread is write
++		 * protecting pages mapped by this mm to enforce a later COW,
++		 * for instance during page table copying for fork().
++		 */
++		seqcount_t write_protect_seq;
++
+ #ifdef CONFIG_MMU
+ 		atomic_long_t pgtables_bytes;	/* PTE page table pages */
+ #endif
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 6d266388d3804..dc55f68a6ee36 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1007,6 +1007,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
+ 	mm->vmacache_seqnum = 0;
+ 	atomic_set(&mm->mm_users, 1);
+ 	atomic_set(&mm->mm_count, 1);
++	seqcount_init(&mm->write_protect_seq);
+ 	mmap_init_lock(mm);
+ 	INIT_LIST_HEAD(&mm->mmlist);
+ 	mm->core_state = NULL;
+diff --git a/mm/gup.c b/mm/gup.c
+index c7e24301860ab..9c6a2f5001c5c 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -2684,11 +2684,18 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
+ {
+ 	unsigned long flags;
+ 	int nr_pinned = 0;
++	unsigned seq;
+ 
+ 	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
+ 	    !gup_fast_permitted(start, end))
+ 		return 0;
+ 
++	if (gup_flags & FOLL_PIN) {
++		seq = raw_read_seqcount(&current->mm->write_protect_seq);
++		if (seq & 1)
++			return 0;
++	}
++
+ 	/*
+ 	 * Disable interrupts. The nested form is used, in order to allow full,
+ 	 * general purpose use of this routine.
+@@ -2703,6 +2710,17 @@ static unsigned long lockless_pages_from_mm(unsigned long start,
+ 	local_irq_save(flags);
+ 	gup_pgd_range(start, end, gup_flags, pages, &nr_pinned);
+ 	local_irq_restore(flags);
++
++	/*
++	 * When pinning pages for DMA there could be a concurrent write protect
++	 * from fork() via copy_page_range(), in this case always fail fast GUP.
++	 */
++	if (gup_flags & FOLL_PIN) {
++		if (read_seqcount_retry(&current->mm->write_protect_seq, seq)) {
++			unpin_user_pages(pages, nr_pinned);
++			return 0;
++		}
++	}
+ 	return nr_pinned;
+ }
+ 
+diff --git a/mm/init-mm.c b/mm/init-mm.c
+index 3a613c85f9ede..153162669f806 100644
+--- a/mm/init-mm.c
++++ b/mm/init-mm.c
+@@ -31,6 +31,7 @@ struct mm_struct init_mm = {
+ 	.pgd		= swapper_pg_dir,
+ 	.mm_users	= ATOMIC_INIT(2),
+ 	.mm_count	= ATOMIC_INIT(1),
++	.write_protect_seq = SEQCNT_ZERO(init_mm.write_protect_seq),
+ 	MMAP_LOCK_INITIALIZER(init_mm)
+ 	.page_table_lock =  __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock),
+ 	.arg_lock	=  __SPIN_LOCK_UNLOCKED(init_mm.arg_lock),
+diff --git a/mm/memory.c b/mm/memory.c
+index c48f8df6e5026..50632c4366b8a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1171,6 +1171,15 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ 		mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE,
+ 					0, src_vma, src_mm, addr, end);
+ 		mmu_notifier_invalidate_range_start(&range);
++		/*
++		 * Disabling preemption is not needed for the write side, as
++		 * the read side doesn't spin, but goes to the mmap_lock.
++		 *
++		 * Use the raw variant of the seqcount_t write API to avoid
++		 * lockdep complaining about preemptibility.
++		 */
++		mmap_assert_write_locked(src_mm);
++		raw_write_seqcount_begin(&src_mm->write_protect_seq);
+ 	}
+ 
+ 	ret = 0;
+@@ -1187,8 +1196,10 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ 		}
+ 	} while (dst_pgd++, src_pgd++, addr = next, addr != end);
+ 
+-	if (is_cow)
++	if (is_cow) {
++		raw_write_seqcount_end(&src_mm->write_protect_seq);
+ 		mmu_notifier_invalidate_range_end(&range);
++	}
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-gup-reorganize-internal_get_user_pages_fast.patch b/queue-5.10/mm-gup-reorganize-internal_get_user_pages_fast.patch
new file mode 100644
index 00000000000..471d6833162
--- /dev/null
+++ b/queue-5.10/mm-gup-reorganize-internal_get_user_pages_fast.patch
@@ -0,0 +1,182 @@
+From bd5266507c1ce9c933aa6c3b6596d86ef7376afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:05:41 -0800
+Subject: mm/gup: reorganize internal_get_user_pages_fast()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit c28b1fc70390df32e29991eedd52bd86e7aba080 ]
+
+Patch series "Add a seqcount between gup_fast and copy_page_range()", v4.
+
+As discussed and suggested by Linus use a seqcount to close the small race
+between gup_fast and copy_page_range().
+
+Ahmed confirms that raw_write_seqcount_begin() is the correct API to use
+in this case and it doesn't trigger any lockdeps.
+
+I was able to test it using two threads, one forking and the other using
+ibv_reg_mr() to trigger GUP fast.  Modifying copy_page_range() to sleep
+made the window large enough to reliably hit to test the logic.
+
+This patch (of 2):
+
+The next patch in this series makes the lockless flow a little more
+complex, so move the entire block into a new function and remove a level
+of indention.  Tidy a bit of cruft:
+
+ - addr is always the same as start, so use start
+
+ - Use the modern check_add_overflow() for computing end = start + len
+
+ - nr_pinned/pages << PAGE_SHIFT needs the LHS to be unsigned long to
+   avoid shift overflow, make the variables unsigned long to avoid coding
+   casts in both places. nr_pinned was missing its cast
+
+ - The handling of ret and nr_pinned can be streamlined a bit
+
+No functional change.
+
+Link: https://lkml.kernel.org/r/0-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
+Link: https://lkml.kernel.org/r/1-v4-908497cf359a+4782-gup_fork_jgg@nvidia.com
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/gup.c | 99 ++++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 54 insertions(+), 45 deletions(-)
+
+diff --git a/mm/gup.c b/mm/gup.c
+index 98eb8e6d2609c..c7e24301860ab 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -2677,13 +2677,43 @@ static int __gup_longterm_unlocked(unsigned long start, int nr_pages,
+ 	return ret;
+ }
+ 
+-static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
++static unsigned long lockless_pages_from_mm(unsigned long start,
++					    unsigned long end,
++					    unsigned int gup_flags,
++					    struct page **pages)
++{
++	unsigned long flags;
++	int nr_pinned = 0;
++
++	if (!IS_ENABLED(CONFIG_HAVE_FAST_GUP) ||
++	    !gup_fast_permitted(start, end))
++		return 0;
++
++	/*
++	 * Disable interrupts. The nested form is used, in order to allow full,
++	 * general purpose use of this routine.
++	 *
++	 * With interrupts disabled, we block page table pages from being freed
++	 * from under us. See struct mmu_table_batch comments in
++	 * include/asm-generic/tlb.h for more details.
++	 *
++	 * We do not adopt an rcu_read_lock() here as we also want to block IPIs
++	 * that come from THPs splitting.
++	 */
++	local_irq_save(flags);
++	gup_pgd_range(start, end, gup_flags, pages, &nr_pinned);
++	local_irq_restore(flags);
++	return nr_pinned;
++}
++
++static int internal_get_user_pages_fast(unsigned long start,
++					unsigned long nr_pages,
+ 					unsigned int gup_flags,
+ 					struct page **pages)
+ {
+-	unsigned long addr, len, end;
+-	unsigned long flags;
+-	int nr_pinned = 0, ret = 0;
++	unsigned long len, end;
++	unsigned long nr_pinned;
++	int ret;
+ 
+ 	if (WARN_ON_ONCE(gup_flags & ~(FOLL_WRITE | FOLL_LONGTERM |
+ 				       FOLL_FORCE | FOLL_PIN | FOLL_GET |
+@@ -2697,54 +2727,33 @@ static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
+ 		might_lock_read(&current->mm->mmap_lock);
+ 
+ 	start = untagged_addr(start) & PAGE_MASK;
+-	addr = start;
+-	len = (unsigned long) nr_pages << PAGE_SHIFT;
+-	end = start + len;
+-
+-	if (end <= start)
++	len = nr_pages << PAGE_SHIFT;
++	if (check_add_overflow(start, len, &end))
+ 		return 0;
+ 	if (unlikely(!access_ok((void __user *)start, len)))
+ 		return -EFAULT;
+ 
+-	/*
+-	 * Disable interrupts. The nested form is used, in order to allow
+-	 * full, general purpose use of this routine.
+-	 *
+-	 * With interrupts disabled, we block page table pages from being
+-	 * freed from under us. See struct mmu_table_batch comments in
+-	 * include/asm-generic/tlb.h for more details.
+-	 *
+-	 * We do not adopt an rcu_read_lock(.) here as we also want to
+-	 * block IPIs that come from THPs splitting.
+-	 */
+-	if (IS_ENABLED(CONFIG_HAVE_FAST_GUP) && gup_fast_permitted(start, end)) {
+-		unsigned long fast_flags = gup_flags;
+-
+-		local_irq_save(flags);
+-		gup_pgd_range(addr, end, fast_flags, pages, &nr_pinned);
+-		local_irq_restore(flags);
+-		ret = nr_pinned;
+-	}
+-
+-	if (nr_pinned < nr_pages && !(gup_flags & FOLL_FAST_ONLY)) {
+-		/* Try to get the remaining pages with get_user_pages */
+-		start += nr_pinned << PAGE_SHIFT;
+-		pages += nr_pinned;
++	nr_pinned = lockless_pages_from_mm(start, end, gup_flags, pages);
++	if (nr_pinned == nr_pages || gup_flags & FOLL_FAST_ONLY)
++		return nr_pinned;
+ 
+-		ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned,
+-					      gup_flags, pages);
+-
+-		/* Have to be a bit careful with return values */
+-		if (nr_pinned > 0) {
+-			if (ret < 0)
+-				ret = nr_pinned;
+-			else
+-				ret += nr_pinned;
+-		}
++	/* Slow path: try to get the remaining pages with get_user_pages */
++	start += nr_pinned << PAGE_SHIFT;
++	pages += nr_pinned;
++	ret = __gup_longterm_unlocked(start, nr_pages - nr_pinned, gup_flags,
++				      pages);
++	if (ret < 0) {
++		/*
++		 * The caller has to unpin the pages we already pinned so
++		 * returning -errno is not an option
++		 */
++		if (nr_pinned)
++			return nr_pinned;
++		return ret;
+ 	}
+-
+-	return ret;
++	return ret + nr_pinned;
+ }
++
+ /**
+  * get_user_pages_fast_only() - pin user pages in memory
+  * @start:      starting user address
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-memcg-slab-fix-return-of-child-memcg-objcg-for-ro.patch b/queue-5.10/mm-memcg-slab-fix-return-of-child-memcg-objcg-for-ro.patch
new file mode 100644
index 00000000000..33556f73f57
--- /dev/null
+++ b/queue-5.10/mm-memcg-slab-fix-return-of-child-memcg-objcg-for-ro.patch
@@ -0,0 +1,61 @@
+From e09e047bd70ac7731c6f9ef4b995c4f42e046c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:06:31 -0800
+Subject: mm: memcg/slab: fix return of child memcg objcg for root memcg
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 2f7659a314736b32b66273dbf91c19874a052fde ]
+
+Consider the following memcg hierarchy.
+
+                    root
+                   /    \
+                  A      B
+
+If we failed to get the reference on objcg of memcg A, the
+get_obj_cgroup_from_current can return the wrong objcg for the root
+memcg.
+
+Link: https://lkml.kernel.org/r/20201029164429.58703-1-songmuchun@bytedance.com
+Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Cc: Shakeel Butt <shakeelb@google.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Yafang Shao <laoar.shao@gmail.com>
+Cc: Chris Down <chris@chrisdown.name>
+Cc: Christian Brauner <christian.brauner@ubuntu.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Eugene Syromiatnikov <esyr@redhat.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Adrian Reber <areber@redhat.com>
+Cc: Marco Elver <elver@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memcontrol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 29459a6ce1c7a..74b85077f89ad 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2987,6 +2987,7 @@ __always_inline struct obj_cgroup *get_obj_cgroup_from_current(void)
+ 		objcg = rcu_dereference(memcg->objcg);
+ 		if (objcg && obj_cgroup_tryget(objcg))
+ 			break;
++		objcg = NULL;
+ 	}
+ 	rcu_read_unlock();
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-memcg-slab-fix-use-after-free-in-obj_cgroup_charg.patch b/queue-5.10/mm-memcg-slab-fix-use-after-free-in-obj_cgroup_charg.patch
new file mode 100644
index 00000000000..f6e0467ff62
--- /dev/null
+++ b/queue-5.10/mm-memcg-slab-fix-use-after-free-in-obj_cgroup_charg.patch
@@ -0,0 +1,56 @@
+From dd1705732e1994d4413ac20265f4d349e5fad0be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:06:35 -0800
+Subject: mm: memcg/slab: fix use after free in obj_cgroup_charge
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit eefbfa7fd678805b38a46293e78543f98f353d3e ]
+
+The rcu_read_lock/unlock only can guarantee that the memcg will not be
+freed, but it cannot guarantee the success of css_get to memcg.
+
+If the whole process of a cgroup offlining is completed between reading a
+objcg->memcg pointer and bumping the css reference on another CPU, and
+there are exactly 0 external references to this memory cgroup (how we get
+to the obj_cgroup_charge() then?), css_get() can change the ref counter
+from 0 back to 1.
+
+Link: https://lkml.kernel.org/r/20201028035013.99711-2-songmuchun@bytedance.com
+Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Yafang Shao <laoar.shao@gmail.com>
+Cc: Chris Down <chris@chrisdown.name>
+Cc: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memcontrol.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 74b85077f89ad..a717728cc7b4a 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3247,8 +3247,10 @@ int obj_cgroup_charge(struct obj_cgroup *objcg, gfp_t gfp, size_t size)
+ 	 * independently later.
+ 	 */
+ 	rcu_read_lock();
++retry:
+ 	memcg = obj_cgroup_memcg(objcg);
+-	css_get(&memcg->css);
++	if (unlikely(!css_tryget(&memcg->css)))
++		goto retry;
+ 	rcu_read_unlock();
+ 
+ 	nr_pages = size >> PAGE_SHIFT;
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-memory_failure-always-pin-the-page-in-madvise_inj.patch b/queue-5.10/mm-memory_failure-always-pin-the-page-in-madvise_inj.patch
new file mode 100644
index 00000000000..6b0e886e306
--- /dev/null
+++ b/queue-5.10/mm-memory_failure-always-pin-the-page-in-madvise_inj.patch
@@ -0,0 +1,95 @@
+From 9f25e78611db0a251f2f2741f12f50d3fc3ac2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:11:48 -0800
+Subject: mm,memory_failure: always pin the page in madvise_inject_error
+
+From: Oscar Salvador <osalvador@suse.de>
+
+[ Upstream commit 1e8aaedb182d6ddffc894b832e4962629907b3e0 ]
+
+madvise_inject_error() uses get_user_pages_fast to translate the address
+we specified to a page.  After [1], we drop the extra reference count for
+memory_failure() path.  That commit says that memory_failure wanted to
+keep the pin in order to take the page out of circulation.
+
+The truth is that we need to keep the page pinned, otherwise the page
+might be re-used after the put_page() and we can end up messing with
+someone else's memory.
+
+E.g:
+
+CPU0
+process X					CPU1
+ madvise_inject_error
+  get_user_pages
+   put_page
+					page gets reclaimed
+					process Y allocates the page
+  memory_failure
+   // We mess with process Y memory
+
+madvise() is meant to operate on a self address space, so messing with
+pages that do not belong to us seems the wrong thing to do.
+To avoid that, let us keep the page pinned for memory_failure as well.
+
+Pages for DAX mappings will release this extra refcount in
+memory_failure_dev_pagemap.
+
+[1] ("23e7b5c2e271: mm, madvise_inject_error:
+      Let memory_failure() optionally take a page reference")
+
+Link: https://lkml.kernel.org/r/20201207094818.8518-1-osalvador@suse.de
+Fixes: 23e7b5c2e271 ("mm, madvise_inject_error: Let memory_failure() optionally take a page reference")
+Signed-off-by: Oscar Salvador <osalvador@suse.de>
+Suggested-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/madvise.c        | 9 +--------
+ mm/memory-failure.c | 6 ++++++
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 13f5677b93222..9abf4c5f2bce2 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -908,14 +908,7 @@ static int madvise_inject_error(int behavior,
+ 		} else {
+ 			pr_info("Injecting memory failure for pfn %#lx at process virtual address %#lx\n",
+ 				 pfn, start);
+-			/*
+-			 * Drop the page reference taken by get_user_pages_fast(). In
+-			 * the absence of MF_COUNT_INCREASED the memory_failure()
+-			 * routine is responsible for pinning the page to prevent it
+-			 * from being released back to the page allocator.
+-			 */
+-			put_page(page);
+-			ret = memory_failure(pfn, 0);
++			ret = memory_failure(pfn, MF_COUNT_INCREASED);
+ 		}
+ 
+ 		if (ret)
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 71295bb984af6..fd653c9953cfd 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1231,6 +1231,12 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
+ 	loff_t start;
+ 	dax_entry_t cookie;
+ 
++	if (flags & MF_COUNT_INCREASED)
++		/*
++		 * Drop the extra refcount in case we come from madvise().
++		 */
++		put_page(page);
++
+ 	/*
+ 	 * Prevent the inode from being freed while we are interrogating
+ 	 * the address_space, typically this would be handled by
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-rmap-always-do-ttu_ignore_access.patch b/queue-5.10/mm-rmap-always-do-ttu_ignore_access.patch
new file mode 100644
index 00000000000..33a1dc2ea23
--- /dev/null
+++ b/queue-5.10/mm-rmap-always-do-ttu_ignore_access.patch
@@ -0,0 +1,221 @@
+From a112741dda636bd90433d5f0a8f75949420a2403 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:06:39 -0800
+Subject: mm/rmap: always do TTU_IGNORE_ACCESS
+
+From: Shakeel Butt <shakeelb@google.com>
+
+[ Upstream commit 013339df116c2ee0d796dd8bfb8f293a2030c063 ]
+
+Since commit 369ea8242c0f ("mm/rmap: update to new mmu_notifier semantic
+v2"), the code to check the secondary MMU's page table access bit is
+broken for !(TTU_IGNORE_ACCESS) because the page is unmapped from the
+secondary MMU's page table before the check.  More specifically for those
+secondary MMUs which unmap the memory in
+mmu_notifier_invalidate_range_start() like kvm.
+
+However memory reclaim is the only user of !(TTU_IGNORE_ACCESS) or the
+absence of TTU_IGNORE_ACCESS and it explicitly performs the page table
+access check before trying to unmap the page.  So, at worst the reclaim
+will miss accesses in a very short window if we remove page table access
+check in unmapping code.
+
+There is an unintented consequence of !(TTU_IGNORE_ACCESS) for the memcg
+reclaim.  From memcg reclaim the page_referenced() only account the
+accesses from the processes which are in the same memcg of the target page
+but the unmapping code is considering accesses from all the processes, so,
+decreasing the effectiveness of memcg reclaim.
+
+The simplest solution is to always assume TTU_IGNORE_ACCESS in unmapping
+code.
+
+Link: https://lkml.kernel.org/r/20201104231928.1494083-1-shakeelb@google.com
+Fixes: 369ea8242c0f ("mm/rmap: update to new mmu_notifier semantic v2")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rmap.h |  1 -
+ mm/huge_memory.c     |  2 +-
+ mm/memory-failure.c  |  2 +-
+ mm/memory_hotplug.c  |  2 +-
+ mm/migrate.c         |  8 +++-----
+ mm/rmap.c            |  9 ---------
+ mm/vmscan.c          | 14 +++++---------
+ 7 files changed, 11 insertions(+), 27 deletions(-)
+
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index 3a6adfa70fb0e..70085ca1a3fc9 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -91,7 +91,6 @@ enum ttu_flags {
+ 
+ 	TTU_SPLIT_HUGE_PMD	= 0x4,	/* split huge PMD if any */
+ 	TTU_IGNORE_MLOCK	= 0x8,	/* ignore mlock */
+-	TTU_IGNORE_ACCESS	= 0x10,	/* don't age */
+ 	TTU_IGNORE_HWPOISON	= 0x20,	/* corrupted page is recoverable */
+ 	TTU_BATCH_FLUSH		= 0x40,	/* Batch TLB flushes where possible
+ 					 * and caller guarantees they will
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index ec2bb93f74314..85eda66eb625d 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2321,7 +2321,7 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
+ 
+ static void unmap_page(struct page *page)
+ {
+-	enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
++	enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK |
+ 		TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
+ 	bool unmap_success;
+ 
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 5d880d4eb9a26..71295bb984af6 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -989,7 +989,7 @@ static int get_hwpoison_page(struct page *page)
+ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
+ 				  int flags, struct page **hpagep)
+ {
+-	enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
++	enum ttu_flags ttu = TTU_IGNORE_MLOCK;
+ 	struct address_space *mapping;
+ 	LIST_HEAD(tokill);
+ 	bool unmap_success = true;
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 63b2e46b65552..0f855deea4b2d 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1304,7 +1304,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
+ 			if (WARN_ON(PageLRU(page)))
+ 				isolate_lru_page(page);
+ 			if (page_mapped(page))
+-				try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS);
++				try_to_unmap(page, TTU_IGNORE_MLOCK);
+ 			continue;
+ 		}
+ 
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 5795cb82e27c3..8ea0c65f10756 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1122,8 +1122,7 @@ static int __unmap_and_move(struct page *page, struct page *newpage,
+ 		/* Establish migration ptes */
+ 		VM_BUG_ON_PAGE(PageAnon(page) && !PageKsm(page) && !anon_vma,
+ 				page);
+-		try_to_unmap(page,
+-			TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
++		try_to_unmap(page, TTU_MIGRATION|TTU_IGNORE_MLOCK);
+ 		page_was_mapped = 1;
+ 	}
+ 
+@@ -1329,8 +1328,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
+ 
+ 	if (page_mapped(hpage)) {
+ 		bool mapping_locked = false;
+-		enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK|
+-					TTU_IGNORE_ACCESS;
++		enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK;
+ 
+ 		if (!PageAnon(hpage)) {
+ 			/*
+@@ -2688,7 +2686,7 @@ static void migrate_vma_prepare(struct migrate_vma *migrate)
+  */
+ static void migrate_vma_unmap(struct migrate_vma *migrate)
+ {
+-	int flags = TTU_MIGRATION | TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
++	int flags = TTU_MIGRATION | TTU_IGNORE_MLOCK;
+ 	const unsigned long npages = migrate->npages;
+ 	const unsigned long start = migrate->start;
+ 	unsigned long addr, i, restore = 0;
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 31b29321adfe1..6657000b18d41 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1533,15 +1533,6 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ 			goto discard;
+ 		}
+ 
+-		if (!(flags & TTU_IGNORE_ACCESS)) {
+-			if (ptep_clear_flush_young_notify(vma, address,
+-						pvmw.pte)) {
+-				ret = false;
+-				page_vma_mapped_walk_done(&pvmw);
+-				break;
+-			}
+-		}
+-
+ 		/* Nuke the page table entry. */
+ 		flush_cache_page(vma, address, pte_pfn(*pvmw.pte));
+ 		if (should_defer_flush(mm, flags)) {
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 7b4e31eac2cff..0ec6321e98878 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1072,7 +1072,6 @@ static void page_check_dirty_writeback(struct page *page,
+ static unsigned int shrink_page_list(struct list_head *page_list,
+ 				     struct pglist_data *pgdat,
+ 				     struct scan_control *sc,
+-				     enum ttu_flags ttu_flags,
+ 				     struct reclaim_stat *stat,
+ 				     bool ignore_references)
+ {
+@@ -1297,7 +1296,7 @@ static unsigned int shrink_page_list(struct list_head *page_list,
+ 		 * processes. Try to unmap it here.
+ 		 */
+ 		if (page_mapped(page)) {
+-			enum ttu_flags flags = ttu_flags | TTU_BATCH_FLUSH;
++			enum ttu_flags flags = TTU_BATCH_FLUSH;
+ 			bool was_swapbacked = PageSwapBacked(page);
+ 
+ 			if (unlikely(PageTransHuge(page)))
+@@ -1514,7 +1513,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
+ 	}
+ 
+ 	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
+-			TTU_IGNORE_ACCESS, &stat, true);
++					&stat, true);
+ 	list_splice(&clean_pages, page_list);
+ 	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
+ 			    -(long)nr_reclaimed);
+@@ -1958,8 +1957,7 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
+ 	if (nr_taken == 0)
+ 		return 0;
+ 
+-	nr_reclaimed = shrink_page_list(&page_list, pgdat, sc, 0,
+-				&stat, false);
++	nr_reclaimed = shrink_page_list(&page_list, pgdat, sc, &stat, false);
+ 
+ 	spin_lock_irq(&pgdat->lru_lock);
+ 
+@@ -2131,8 +2129,7 @@ unsigned long reclaim_pages(struct list_head *page_list)
+ 
+ 		nr_reclaimed += shrink_page_list(&node_page_list,
+ 						NODE_DATA(nid),
+-						&sc, 0,
+-						&dummy_stat, false);
++						&sc, &dummy_stat, false);
+ 		while (!list_empty(&node_page_list)) {
+ 			page = lru_to_page(&node_page_list);
+ 			list_del(&page->lru);
+@@ -2145,8 +2142,7 @@ unsigned long reclaim_pages(struct list_head *page_list)
+ 	if (!list_empty(&node_page_list)) {
+ 		nr_reclaimed += shrink_page_list(&node_page_list,
+ 						NODE_DATA(nid),
+-						&sc, 0,
+-						&dummy_stat, false);
++						&sc, &dummy_stat, false);
+ 		while (!list_empty(&node_page_list)) {
+ 			page = lru_to_page(&node_page_list);
+ 			list_del(&page->lru);
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-vmalloc-fix-unlock-order-in-s_stop.patch b/queue-5.10/mm-vmalloc-fix-unlock-order-in-s_stop.patch
new file mode 100644
index 00000000000..53d4b0d13c1
--- /dev/null
+++ b/queue-5.10/mm-vmalloc-fix-unlock-order-in-s_stop.patch
@@ -0,0 +1,55 @@
+From 831898c5eae00bfbb30a46e2bd1d2b0ef136148a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:08:59 -0800
+Subject: mm/vmalloc: Fix unlock order in s_stop()
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 0a7dd4e901b8a4ee040ba953900d1d7120b34ee5 ]
+
+When multiple locks are acquired, they should be released in reverse
+order. For s_start() and s_stop() in mm/vmalloc.c, that is not the
+case.
+
+  s_start: mutex_lock(&vmap_purge_lock); spin_lock(&vmap_area_lock);
+  s_stop : mutex_unlock(&vmap_purge_lock); spin_unlock(&vmap_area_lock);
+
+This unlock sequence, though allowed, is not optimal. If a waiter is
+present, mutex_unlock() will need to go through the slowpath of waking
+up the waiter with preemption disabled. Fix that by releasing the
+spinlock first before the mutex.
+
+Link: https://lkml.kernel.org/r/20201213180843.16938-1-longman@redhat.com
+Fixes: e36176be1c39 ("mm/vmalloc: rework vmap_area_lock")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 6ae491a8b210f..75913f685c71e 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -3448,11 +3448,11 @@ static void *s_next(struct seq_file *m, void *p, loff_t *pos)
+ }
+ 
+ static void s_stop(struct seq_file *m, void *p)
+-	__releases(&vmap_purge_lock)
+ 	__releases(&vmap_area_lock)
++	__releases(&vmap_purge_lock)
+ {
+-	mutex_unlock(&vmap_purge_lock);
+ 	spin_unlock(&vmap_area_lock);
++	mutex_unlock(&vmap_purge_lock);
+ }
+ 
+ static void show_numa_info(struct seq_file *m, struct vm_struct *v)
+-- 
+2.27.0
+
diff --git a/queue-5.10/mm-vmalloc.c-fix-kasan-shadow-poisoning-size.patch b/queue-5.10/mm-vmalloc.c-fix-kasan-shadow-poisoning-size.patch
new file mode 100644
index 00000000000..b5026bd3c48
--- /dev/null
+++ b/queue-5.10/mm-vmalloc.c-fix-kasan-shadow-poisoning-size.patch
@@ -0,0 +1,56 @@
+From 8fb0caa734ec5e9a4bd6f2e73b9d0d558a554f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:09:06 -0800
+Subject: mm/vmalloc.c: fix kasan shadow poisoning size
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit c041098c690fe53cea5d20c62f128a4f7a5c19fe ]
+
+The size of vm area can be affected by the presence or not of the guard
+page.  In particular when VM_NO_GUARD is present, the actual accessible
+size has to be considered like the real size minus the guard page.
+
+Currently kasan does not keep into account this information during the
+poison operation and in particular tries to poison the guard page as well.
+
+This approach, even if incorrect, does not cause an issue because the tags
+for the guard page are written in the shadow memory.  With the future
+introduction of the Tag-Based KASAN, being the guard page inaccessible by
+nature, the write tag operation on this page triggers a fault.
+
+Fix kasan shadow poisoning size invoking get_vm_area_size() instead of
+accessing directly the field in the data structure to detect the correct
+value.
+
+Link: https://lkml.kernel.org/r/20201027160213.32904-1-vincenzo.frascino@arm.com
+Fixes: d98c9e83b5e7c ("kasan: fix crashes on access to memory mapped by vm_map_ram()")
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: Andrey Konovalov <andreyknvl@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Marco Elver <elver@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 75913f685c71e..279dc0c96568c 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2256,7 +2256,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
+ 	debug_check_no_locks_freed(area->addr, get_vm_area_size(area));
+ 	debug_check_no_obj_freed(area->addr, get_vm_area_size(area));
+ 
+-	kasan_poison_vmalloc(area->addr, area->size);
++	kasan_poison_vmalloc(area->addr, get_vm_area_size(area));
+ 
+ 	vm_remove_mappings(area, deallocate_pages);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch b/queue-5.10/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch
new file mode 100644
index 00000000000..5ebdc11b51c
--- /dev/null
+++ b/queue-5.10/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch
@@ -0,0 +1,37 @@
+From 0f4d694d67090235e81204305db7fa77f3afb7c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 10:14:31 +0800
+Subject: mmc: pxamci: Fix error return code in pxamci_probe
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit d7b819b5d33869d41bdaa427aeb98ae24c57a38b ]
+
+Fix to return the error code from devm_gpiod_get_optional() instaed
+of 0 in pxamci_probe().
+
+Fixes: f54005b508b9a9d9c ("mmc: pxa: Use GPIO descriptor for power")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Link: https://lore.kernel.org/r/20201121021431.3168506-1-chengzhihao1@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/pxamci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index 29f6180a00363..316393c694d7a 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -731,6 +731,7 @@ static int pxamci_probe(struct platform_device *pdev)
+ 
+ 		host->power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+ 		if (IS_ERR(host->power)) {
++			ret = PTR_ERR(host->power);
+ 			dev_err(dev, "Failed requesting gpio_power\n");
+ 			goto out;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/mmc-sdhci-tegra-fix-wrong-unit-with-busy_timeout.patch b/queue-5.10/mmc-sdhci-tegra-fix-wrong-unit-with-busy_timeout.patch
new file mode 100644
index 00000000000..43b5996fc69
--- /dev/null
+++ b/queue-5.10/mmc-sdhci-tegra-fix-wrong-unit-with-busy_timeout.patch
@@ -0,0 +1,38 @@
+From 6109869dc493c0bfb1d4b3f28b68ee735d858d80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:22:06 +0100
+Subject: mmc: sdhci: tegra: fix wrong unit with busy_timeout
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit fcc541fea394d67ad607ee41acfa891e79fe17a2 ]
+
+'busy_timeout' is in msecs, not in jiffies. Use the correct factor.
+
+Fixes: 5e958e4aacf4 ("sdhci: tegra: Implement Tegra specific set_timeout callback")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Acked-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20201116132206.23518-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index ed12aacb1c736..41d193fa77bbf 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -1272,7 +1272,7 @@ static void tegra_sdhci_set_timeout(struct sdhci_host *host,
+ 	 * busy wait mode.
+ 	 */
+ 	val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_MISC_CTRL);
+-	if (cmd && cmd->busy_timeout >= 11 * HZ)
++	if (cmd && cmd->busy_timeout >= 11 * MSEC_PER_SEC)
+ 		val |= SDHCI_MISC_CTRL_ERASE_TIMEOUT_LIMIT;
+ 	else
+ 		val &= ~SDHCI_MISC_CTRL_ERASE_TIMEOUT_LIMIT;
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-dma-fix-possible-deadlock-running-mt76_dma_clea.patch b/queue-5.10/mt76-dma-fix-possible-deadlock-running-mt76_dma_clea.patch
new file mode 100644
index 00000000000..8e57d19d2ab
--- /dev/null
+++ b/queue-5.10/mt76-dma-fix-possible-deadlock-running-mt76_dma_clea.patch
@@ -0,0 +1,111 @@
+From 22c64ab61e064e24ec05f93039436747ba555d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 00:43:55 +0200
+Subject: mt76: dma: fix possible deadlock running mt76_dma_cleanup
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 5f0ce5848733b86deaba1c6d102e20479230b20a ]
+
+Fix the following possible deadlock reported by lockdep disabling BH
+running mt76_free_pending_txwi()
+
+================================
+WARNING: inconsistent lock state
+5.9.0-rc6 #14 Not tainted
+--------------------------------
+inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
+rmmod/1227 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ffff888156a83530 (&dev->lock#2){+.?.}-{2:2}, at: mt76_dma_cleanup+0x125/0x150 [mt76]
+{IN-SOFTIRQ-W} state was registered at:
+  __lock_acquire+0x20c/0x6b0
+  lock_acquire+0x9d/0x220
+  _raw_spin_lock+0x2c/0x70
+  mt76_dma_tx_cleanup+0xc7/0x200 [mt76]
+  mt76x02_poll_tx+0x31/0xb0 [mt76x02_lib]
+  napi_poll+0x3a/0x100
+  net_rx_action+0xa8/0x200
+  __do_softirq+0xc4/0x430
+  asm_call_on_stack+0xf/0x20
+  do_softirq_own_stack+0x49/0x60
+  irq_exit_rcu+0x9a/0xd0
+  common_interrupt+0xa4/0x190
+  asm_common_interrupt+0x1e/0x40
+irq event stamp: 9915
+hardirqs last  enabled at (9915): [<ffffffff8124e286>] __free_pages_ok+0x336/0x3b0
+hardirqs last disabled at (9914): [<ffffffff8124e24e>] __free_pages_ok+0x2fe/0x3b0
+softirqs last  enabled at (9912): [<ffffffffa03aa672>] mt76_dma_rx_cleanup+0xa2/0x120 [mt76]
+softirqs last disabled at (9846): [<ffffffffa03aa5ea>] mt76_dma_rx_cleanup+0x1a/0x120 [mt76]
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+       CPU0
+       ----
+  lock(&dev->lock#2);
+  <Interrupt>
+    lock(&dev->lock#2);
+
+ *** DEADLOCK ***
+
+1 lock held by rmmod/1227:
+ #0: ffff88815b5eb240 (&dev->mutex){....}-{3:3}, at: driver_detach+0xb5/0x110
+
+stack backtrace:
+CPU: 1 PID: 1227 Comm: rmmod Kdump: loaded Not tainted 5.9.0-rc6-wdn-src+ #14
+Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
+Call Trace:
+ dump_stack+0x77/0xa0
+ mark_lock_irq.cold+0x15/0x39
+ mark_lock+0x1fc/0x500
+ mark_usage+0xc7/0x140
+ __lock_acquire+0x20c/0x6b0
+ ? find_held_lock+0x2b/0x80
+ ? sched_clock_cpu+0xc/0xb0
+ lock_acquire+0x9d/0x220
+ ? mt76_dma_cleanup+0x125/0x150 [mt76]
+ _raw_spin_lock+0x2c/0x70
+ ? mt76_dma_cleanup+0x125/0x150 [mt76]
+ mt76_dma_cleanup+0x125/0x150 [mt76]
+ mt76x2_cleanup+0x5a/0x70 [mt76x2e]
+ mt76x2e_remove+0x18/0x30 [mt76x2e]
+ pci_device_remove+0x36/0xa0
+ __device_release_driver+0x16c/0x220
+ driver_detach+0xcf/0x110
+ bus_remove_driver+0x56/0xca
+ pci_unregister_driver+0x36/0x80
+ __do_sys_delete_module.constprop.0+0x127/0x200
+ ? syscall_enter_from_user_mode+0x1d/0x50
+ ? trace_hardirqs_on+0x1c/0xe0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x7ff0da54e36b
+Code: 73 01 c3 48 8b 0d 2d 0b 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 0c 00 f7 d8 64 89 01 48
+
+Fixes: dd57a95cfddc ("mt76: move txwi handling code to dma.c, since it is mmio specific")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 214fc95b8a33f..145e839fea4e5 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -72,9 +72,11 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+ {
+ 	struct mt76_txwi_cache *t;
+ 
++	local_bh_disable();
+ 	while ((t = __mt76_get_txwi(dev)) != NULL)
+ 		dma_unmap_single(dev->dev, t->dma_addr, dev->drv->txwi_size,
+ 				 DMA_TO_DEVICE);
++	local_bh_enable();
+ }
+ 
+ static int
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-fix-memory-leak-if-device-probing-fails.patch b/queue-5.10/mt76-fix-memory-leak-if-device-probing-fails.patch
new file mode 100644
index 00000000000..31cd7ed0a13
--- /dev/null
+++ b/queue-5.10/mt76-fix-memory-leak-if-device-probing-fails.patch
@@ -0,0 +1,107 @@
+From c479b1e60363e36c28763d8a15fea9a3df769d7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 10:33:49 +0200
+Subject: mt76: fix memory leak if device probing fails
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit bc348defcc6eceeb4f7784bf9a263ddb72fd3fb4 ]
+
+Run mt76_free_device instead of ieee80211_free_hw if device probing
+fails in order to remove the already allocated mt76 workqueue
+
+Fixes: a86f1d01f5ce5 ("mt76: move mt76 workqueue in common code")
+Fixes: f1d962369d568 ("mt76: mt7915: implement HE per-rate tx power support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/pci.c  | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt7615/mmio.c | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt76x0/pci.c  | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt76x2/pci.c  | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt7915/pci.c  | 5 +++--
+ 5 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/pci.c b/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
+index a5845da3547a9..06fa28f645f28 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/pci.c
+@@ -57,7 +57,8 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	return 0;
+ error:
+-	ieee80211_free_hw(mt76_hw(dev));
++	mt76_free_device(&dev->mt76);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
+index 6de492a4cf025..9b191307e140e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mmio.c
+@@ -240,7 +240,8 @@ int mt7615_mmio_probe(struct device *pdev, void __iomem *mem_base,
+ 
+ 	return 0;
+ error:
+-	ieee80211_free_hw(mt76_hw(dev));
++	mt76_free_device(&dev->mt76);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
+index dda11c704abaa..b87d8e136cb9a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/pci.c
+@@ -194,7 +194,8 @@ mt76x0e_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	return 0;
+ 
+ error:
+-	ieee80211_free_hw(mt76_hw(dev));
++	mt76_free_device(&dev->mt76);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
+index 4d50dad29ddff..ecaf85b483ac3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
+@@ -90,7 +90,8 @@ mt76x2e_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	return 0;
+ 
+ error:
+-	ieee80211_free_hw(mt76_hw(dev));
++	mt76_free_device(&dev->mt76);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
+index fe62b4d853e48..3ac5bbb94d294 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/pci.c
+@@ -140,7 +140,7 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
+ 	dev = container_of(mdev, struct mt7915_dev, mt76);
+ 	ret = mt7915_alloc_device(pdev, dev);
+ 	if (ret)
+-		return ret;
++		goto error;
+ 
+ 	mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
+ 	mdev->rev = (mt7915_l1_rr(dev, MT_HW_CHIPID) << 16) |
+@@ -163,7 +163,8 @@ static int mt7915_pci_probe(struct pci_dev *pdev,
+ 
+ 	return 0;
+ error:
+-	ieee80211_free_hw(mt76_hw(dev));
++	mt76_free_device(&dev->mt76);
++
+ 	return ret;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-fix-tkip-configuration-for-mt7615-7663-devices.patch b/queue-5.10/mt76-fix-tkip-configuration-for-mt7615-7663-devices.patch
new file mode 100644
index 00000000000..2ea47da2a2a
--- /dev/null
+++ b/queue-5.10/mt76-fix-tkip-configuration-for-mt7615-7663-devices.patch
@@ -0,0 +1,51 @@
+From 4b705f17685bc956e34da63d6bf5b1ce122fde2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Oct 2020 17:15:25 +0200
+Subject: mt76: fix tkip configuration for mt7615/7663 devices
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 930e0eaddf810cfa90e114a0df02f48539e1346f ]
+
+Fix Tx-Rx MIC overwrite during TKIP hw key configuration
+
+Fixes: 01cfc1b45421 ("mt76: mt7615: add BIP_CMAC_128 cipher support")
+Tested-by: YN Chen <yn.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index 8dc645e398fda..3d62fda067e44 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -1046,15 +1046,17 @@ int mt7615_mac_wtbl_update_key(struct mt7615_dev *dev,
+ 	if (cmd == SET_KEY) {
+ 		if (cipher == MT_CIPHER_TKIP) {
+ 			/* Rx/Tx MIC keys are swapped */
++			memcpy(data, key, 16);
+ 			memcpy(data + 16, key + 24, 8);
+ 			memcpy(data + 24, key + 16, 8);
++		} else {
++			if (cipher != MT_CIPHER_BIP_CMAC_128 && wcid->cipher)
++				memmove(data + 16, data, 16);
++			if (cipher != MT_CIPHER_BIP_CMAC_128 || !wcid->cipher)
++				memcpy(data, key, keylen);
++			else if (cipher == MT_CIPHER_BIP_CMAC_128)
++				memcpy(data + 16, key, 16);
+ 		}
+-		if (cipher != MT_CIPHER_BIP_CMAC_128 && wcid->cipher)
+-			memmove(data + 16, data, 16);
+-		if (cipher != MT_CIPHER_BIP_CMAC_128 || !wcid->cipher)
+-			memcpy(data, key, keylen);
+-		else if (cipher == MT_CIPHER_BIP_CMAC_128)
+-			memcpy(data + 16, key, 16);
+ 	} else {
+ 		if (wcid->cipher & ~BIT(cipher)) {
+ 			if (cipher != MT_CIPHER_BIP_CMAC_128)
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-mt7663s-fix-a-possible-ple-quota-underflow.patch b/queue-5.10/mt76-mt7663s-fix-a-possible-ple-quota-underflow.patch
new file mode 100644
index 00000000000..b8ab66de1c8
--- /dev/null
+++ b/queue-5.10/mt76-mt7663s-fix-a-possible-ple-quota-underflow.patch
@@ -0,0 +1,36 @@
+From 731f18583051cd2e9b297cf49b313a346bb50c37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Oct 2020 17:22:23 +0200
+Subject: mt76: mt7663s: fix a possible ple quota underflow
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 1c79a190e94325e01811f653f770a34e816fdd8f ]
+
+Properly account current consumed ple quota in mt7663s_tx_pick_quota
+routine and avoid possible underflow.
+
+Fixes: 6ef2d665f64d ("mt76: mt7663s: split mt7663s_tx_update_sched in mt7663s_tx_{pick,update}_quota")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+index 2486cda3243bc..69e38f477b1e4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+@@ -150,7 +150,7 @@ static int mt7663s_tx_pick_quota(struct mt76_sdio *sdio, enum mt76_txq_id qid,
+ 			return -EBUSY;
+ 	} else {
+ 		if (sdio->sched.pse_data_quota < *pse_size + pse_sz ||
+-		    sdio->sched.ple_data_quota < *ple_size)
++		    sdio->sched.ple_data_quota < *ple_size + 1)
+ 			return -EBUSY;
+ 
+ 		*ple_size = *ple_size + 1;
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-mt7915-set-fops_sta_stats.owner-to-this_module.patch b/queue-5.10/mt76-mt7915-set-fops_sta_stats.owner-to-this_module.patch
new file mode 100644
index 00000000000..7e81d272a43
--- /dev/null
+++ b/queue-5.10/mt76-mt7915-set-fops_sta_stats.owner-to-this_module.patch
@@ -0,0 +1,36 @@
+From 2b2224e5604e5b0a06fa7efe9b5a738aba708ee4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 15:51:57 +0000
+Subject: mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 5efbe3b1b8992d5f837388091920945c23212159 ]
+
+If THIS_MODULE is not set, the module would be removed while debugfs is
+being used.
+It eventually makes kernel panic.
+
+Fixes: ec9742a8f38e ("mt76: mt7915: add .sta_add_debugfs support")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index 1049927faf246..d2ac7e5ee60a2 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -460,6 +460,7 @@ static const struct file_operations fops_sta_stats = {
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+ 	.release = single_release,
++	.owner = THIS_MODULE,
+ };
+ 
+ void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-- 
+2.27.0
+
diff --git a/queue-5.10/mt76-set-fops_tx_stats.owner-to-this_module.patch b/queue-5.10/mt76-set-fops_tx_stats.owner-to-this_module.patch
new file mode 100644
index 00000000000..d199738770b
--- /dev/null
+++ b/queue-5.10/mt76-set-fops_tx_stats.owner-to-this_module.patch
@@ -0,0 +1,36 @@
+From a684b521815cd391412d9d578e3c32168162c093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 15:51:56 +0000
+Subject: mt76: set fops_tx_stats.owner to THIS_MODULE
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit f9df085ce1be5c599e4df590ff7ba853786c6d95 ]
+
+If THIS_MODULE is not set, the module would be removed while debugfs is
+being used.
+It eventually makes kernel panic.
+
+Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+index d2ac7e5ee60a2..8f2ad32ade180 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c
+@@ -233,6 +233,7 @@ static const struct file_operations fops_tx_stats = {
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+ 	.release = single_release,
++	.owner = THIS_MODULE,
+ };
+ 
+ static int mt7915_read_temperature(struct seq_file *s, void *data)
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch b/queue-5.10/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch
new file mode 100644
index 00000000000..f53d75abbd9
--- /dev/null
+++ b/queue-5.10/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch
@@ -0,0 +1,60 @@
+From 4d148154b749fe14f07d92caf522837a4922bde4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 19:05:52 +0800
+Subject: mtd: rawnand: gpmi: fix reference count leak in gpmi ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 1b391c7f2e863985668d705f525af3ceb55bc800 ]
+
+pm_runtime_get_sync() will increment pm usage at first and it
+will resume the device later. If runtime of the device has
+error or device is in inaccessible state(or other error state),
+resume operation will fail. If we do not call put operation to
+decrease the reference, it will result in reference leak in
+the two functions(gpmi_init and gpmi_nfc_exec_op). Moreover,
+this device cannot enter the idle state and always stay busy or
+other non-idle state later. So we fixed it through adding
+pm_runtime_put_noidle.
+
+Fixes: 5bc6bb603b4d0 ("mtd: rawnand: gpmi: Fix suspend/resume problem")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Han Xu <han.xu@nxp.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20201107110552.1568742-1-zhangqilong3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index dc8104e675062..b5f46f214a582 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -149,8 +149,10 @@ static int gpmi_init(struct gpmi_nand_data *this)
+ 	int ret;
+ 
+ 	ret = pm_runtime_get_sync(this->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(this->dev);
+ 		return ret;
++	}
+ 
+ 	ret = gpmi_reset_block(r->gpmi_regs, false);
+ 	if (ret)
+@@ -2263,8 +2265,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
+ 		this->transfers[i].direction = DMA_NONE;
+ 
+ 	ret = pm_runtime_get_sync(this->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(this->dev);
+ 		return ret;
++	}
+ 
+ 	/*
+ 	 * This driver currently supports only one NAND chip. Plus, dies share
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch b/queue-5.10/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch
new file mode 100644
index 00000000000..eb8db0762d2
--- /dev/null
+++ b/queue-5.10/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch
@@ -0,0 +1,216 @@
+From f3d397bb473d94a7d1c8d86b91a44d2df5bb7af6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 21:51:04 -0600
+Subject: mtd: rawnand: gpmi: Fix the random DMA timeout issue
+
+From: Han Xu <han.xu@nxp.com>
+
+[ Upstream commit 7671edeb193910482a9b0c22cd32176e7de7b2ed ]
+
+To get better performance, current gpmi driver collected and chained all
+small DMA transfers in gpmi_nfc_exec_op, the whole chain triggered and
+wait for complete at the end.
+
+But some random DMA timeout found in this new driver, with the help of
+ftrace, we found the root cause is as follows:
+
+Take gpmi_ecc_read_page() as an example, gpmi_nfc_exec_op collected 6
+DMA transfers and the DMA chain triggered at the end. It waits for bch
+completion and check jiffies if it's timeout. The typical function graph
+shown below,
+
+   63.216351 |   1)               |  gpmi_ecc_read_page() {
+   63.216352 |   1)   0.750 us    |    gpmi_bch_layout_std();
+   63.216354 |   1)               |    gpmi_nfc_exec_op() {
+   63.216355 |   1)               |      gpmi_chain_command() {
+   63.216356 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.216357 |   1)               |          /* mxs chan ccw idx: 0 */
+   63.216358 |   1)   1.750 us    |        }
+   63.216359 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.216360 |   1)               |          /* mxs chan ccw idx: 1 */
+   63.216361 |   1)   2.000 us    |        }
+   63.216361 |   1)   6.500 us    |      }
+   63.216362 |   1)               |      gpmi_chain_command() {
+   63.216363 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.216364 |   1)               |          /* mxs chan ccw idx: 2 */
+   63.216365 |   1)   1.750 us    |        }
+   63.216366 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.216367 |   1)               |          /* mxs chan ccw idx: 3 */
+   63.216367 |   1)   1.750 us    |        }
+   63.216368 |   1)   5.875 us    |      }
+   63.216369 |   1)               |      /* gpmi_chain_wait_ready */
+   63.216370 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.216372 |   1)               |        /* mxs chan ccw idx: 4 */
+   63.216373 |   1)   3.000 us    |      }
+   63.216374 |   1)               |      /* gpmi_chain_data_read */
+   63.216376 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.216377 |   1)               |        /* mxs chan ccw idx: 5 */
+   63.216378 |   1)   2.000 us    |      }
+   63.216379 |   1)   1.125 us    |      mxs_dma_tx_submit();
+   63.216381 |   1)   1.000 us    |      mxs_dma_enable_chan();
+   63.216712 |   0)   2.625 us    |  mxs_dma_int_handler();
+   63.216717 |   0)   4.250 us    |  bch_irq();
+   63.216723 |   0)   1.250 us    |  mxs_dma_tasklet();
+   63.216723 |   1)               |      /* jiffies left 250 */
+   63.216725 |   1) ! 372.000 us  |    }
+   63.216726 |   1)   2.625 us    |    gpmi_count_bitflips();
+   63.216730 |   1) ! 379.125 us  |  }
+
+but it's not gurantee that bch irq handled always after dma irq handled,
+sometimes bch_irq comes first and gpmi_nfc_exec_op won't wait anymore,
+another gpmi_nfc_exec_op may get invoked before last DMA chain IRQ
+handled, this messed up the next DMA chain and causes DMA timeout. Check
+the trace log when issue happened.
+
+   63.218923 |   1)               |  gpmi_ecc_read_page() {
+   63.218924 |   1)   0.625 us    |    gpmi_bch_layout_std();
+   63.218926 |   1)               |    gpmi_nfc_exec_op() {
+   63.218927 |   1)               |      gpmi_chain_command() {
+   63.218928 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.218929 |   1)               |          /* mxs chan ccw idx: 0 */
+   63.218929 |   1)   1.625 us    |        }
+   63.218931 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.218931 |   1)               |          /* mxs chan ccw idx: 1 */
+   63.218932 |   1)   1.750 us    |        }
+   63.218933 |   1)   5.875 us    |      }
+   63.218934 |   1)               |      gpmi_chain_command() {
+   63.218934 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.218935 |   1)               |          /* mxs chan ccw idx: 2 */
+   63.218936 |   1)   1.875 us    |        }
+   63.218937 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.218938 |   1)               |          /* mxs chan ccw idx: 3 */
+   63.218939 |   1)   1.625 us    |        }
+   63.218939 |   1)   5.875 us    |      }
+   63.218940 |   1)               |      /* gpmi_chain_wait_ready */
+   63.218941 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.218942 |   1)               |        /* mxs chan ccw idx: 4 */
+   63.218942 |   1)   1.625 us    |      }
+   63.218943 |   1)               |      /* gpmi_chain_data_read */
+   63.218944 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.218945 |   1)               |        /* mxs chan ccw idx: 5 */
+   63.218947 |   1)   2.375 us    |      }
+   63.218948 |   1)   0.625 us    |      mxs_dma_tx_submit();
+   63.218949 |   1)   1.000 us    |      mxs_dma_enable_chan();
+   63.219276 |   0)   5.125 us    |  bch_irq();                  <----
+   63.219283 |   1)               |      /* jiffies left 250 */
+   63.219285 |   1) ! 358.625 us  |    }
+   63.219286 |   1)   2.750 us    |    gpmi_count_bitflips();
+   63.219289 |   1) ! 366.000 us  |  }
+   63.219290 |   1)               |  gpmi_ecc_read_page() {
+   63.219291 |   1)   0.750 us    |    gpmi_bch_layout_std();
+   63.219293 |   1)               |    gpmi_nfc_exec_op() {
+   63.219294 |   1)               |      gpmi_chain_command() {
+   63.219295 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.219295 |   0)   1.875 us    |  mxs_dma_int_handler();      <----
+   63.219296 |   1)               |          /* mxs chan ccw idx: 6 */
+   63.219297 |   1)   2.250 us    |        }
+   63.219298 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.219298 |   0)   1.000 us    |  mxs_dma_tasklet();
+   63.219299 |   1)               |          /* mxs chan ccw idx: 0 */
+   63.219300 |   1)   1.625 us    |        }
+   63.219300 |   1)   6.375 us    |      }
+   63.219301 |   1)               |      gpmi_chain_command() {
+   63.219302 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.219303 |   1)               |          /* mxs chan ccw idx: 1 */
+   63.219304 |   1)   1.625 us    |        }
+   63.219305 |   1)               |        mxs_dma_prep_slave_sg() {
+   63.219306 |   1)               |          /* mxs chan ccw idx: 2 */
+   63.219306 |   1)   1.875 us    |        }
+   63.219307 |   1)   6.000 us    |      }
+   63.219308 |   1)               |      /* gpmi_chain_wait_ready */
+   63.219308 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.219309 |   1)               |        /* mxs chan ccw idx: 3 */
+   63.219310 |   1)   2.000 us    |      }
+   63.219311 |   1)               |      /* gpmi_chain_data_read */
+   63.219312 |   1)               |      mxs_dma_prep_slave_sg() {
+   63.219313 |   1)               |        /* mxs chan ccw idx: 4 */
+   63.219314 |   1)   1.750 us    |      }
+   63.219315 |   1)   0.625 us    |      mxs_dma_tx_submit();
+   63.219316 |   1)   0.875 us    |      mxs_dma_enable_chan();
+   64.224227 |   1)               |      /* jiffies left 0 */
+
+In the first gpmi_nfc_exec_op, bch_irq comes first and gpmi_nfc_exec_op
+exits, but DMA IRQ still not happened yet until the middle of following
+gpmi_nfc_exec_op, the first DMA transfer index get messed and DMA get
+timeout.
+
+To fix the issue, when there is bch ops in DMA chain, the
+gpmi_nfc_exec_op should wait for both completions rather than bch
+completion only.
+
+Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20201209035104.22679-3-han.xu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 30 +++++++++++++++-------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index b5f46f214a582..81028ba35f35d 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -2254,7 +2254,7 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
+ 	void *buf_read = NULL;
+ 	const void *buf_write = NULL;
+ 	bool direct = false;
+-	struct completion *completion;
++	struct completion *dma_completion, *bch_completion;
+ 	unsigned long to;
+ 
+ 	if (check_only)
+@@ -2351,22 +2351,24 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
+ 		       this->resources.bch_regs + HW_BCH_FLASH0LAYOUT1);
+ 	}
+ 
++	desc->callback = dma_irq_callback;
++	desc->callback_param = this;
++	dma_completion = &this->dma_done;
++	bch_completion = NULL;
++
++	init_completion(dma_completion);
++
+ 	if (this->bch && buf_read) {
+ 		writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
+ 		       this->resources.bch_regs + HW_BCH_CTRL_SET);
+-		completion = &this->bch_done;
+-	} else {
+-		desc->callback = dma_irq_callback;
+-		desc->callback_param = this;
+-		completion = &this->dma_done;
++		bch_completion = &this->bch_done;
++		init_completion(bch_completion);
+ 	}
+ 
+-	init_completion(completion);
+-
+ 	dmaengine_submit(desc);
+ 	dma_async_issue_pending(get_dma_chan(this));
+ 
+-	to = wait_for_completion_timeout(completion, msecs_to_jiffies(1000));
++	to = wait_for_completion_timeout(dma_completion, msecs_to_jiffies(1000));
+ 	if (!to) {
+ 		dev_err(this->dev, "DMA timeout, last DMA\n");
+ 		gpmi_dump_info(this);
+@@ -2374,6 +2376,16 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
+ 		goto unmap;
+ 	}
+ 
++	if (this->bch && buf_read) {
++		to = wait_for_completion_timeout(bch_completion, msecs_to_jiffies(1000));
++		if (!to) {
++			dev_err(this->dev, "BCH timeout, last DMA\n");
++			gpmi_dump_info(this);
++			ret = -ETIMEDOUT;
++			goto unmap;
++		}
++	}
++
+ 	writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
+ 	       this->resources.bch_regs + HW_BCH_CTRL_CLR);
+ 	gpmi_clear_bch(this);
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch b/queue-5.10/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch
new file mode 100644
index 00000000000..a29fbf02326
--- /dev/null
+++ b/queue-5.10/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch
@@ -0,0 +1,42 @@
+From f6adb4ed6f4e7fc67621ec9fa903a75872c08d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 11:39:48 +0300
+Subject: mtd: rawnand: meson: Fix a resource leak in init
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ad8566d3555c4731e6b48823b92d3929b0394c14 ]
+
+Call clk_disable_unprepare(nfc->phase_rx) if the clk_set_rate() function
+fails to avoid a resource leak.
+
+Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/X8ikVCnUsfTpffFB@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/meson_nand.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
+index 48e6dac96be6d..1fd7f7024c0b4 100644
+--- a/drivers/mtd/nand/raw/meson_nand.c
++++ b/drivers/mtd/nand/raw/meson_nand.c
+@@ -1044,9 +1044,12 @@ static int meson_nfc_clk_init(struct meson_nfc *nfc)
+ 
+ 	ret = clk_set_rate(nfc->device_clk, 24000000);
+ 	if (ret)
+-		goto err_phase_rx;
++		goto err_disable_rx;
+ 
+ 	return 0;
++
++err_disable_rx:
++	clk_disable_unprepare(nfc->phase_rx);
+ err_phase_rx:
+ 	clk_disable_unprepare(nfc->phase_tx);
+ err_phase_tx:
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-spi-nor-atmel-fix-unlock_all-for-at25fs010-040.patch b/queue-5.10/mtd-spi-nor-atmel-fix-unlock_all-for-at25fs010-040.patch
new file mode 100644
index 00000000000..0b142f75048
--- /dev/null
+++ b/queue-5.10/mtd-spi-nor-atmel-fix-unlock_all-for-at25fs010-040.patch
@@ -0,0 +1,119 @@
+From 8674adbef0900c57ccbbccd2090cbce62228d63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 17:29:58 +0100
+Subject: mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 8c174d1511d235ed6c049dcb2b704777ad0df7a5 ]
+
+These flashes have some weird BP bits mapping which aren't supported in
+the current locking code. Just add a simple unlock op to unprotect the
+entire flash array which is needed for legacy behavior.
+
+Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20201203162959.29589-7-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/atmel.c | 53 +++++++++++++++++++++++++++++++++++--
+ drivers/mtd/spi-nor/core.c  |  2 +-
+ drivers/mtd/spi-nor/core.h  |  1 +
+ 3 files changed, 53 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/atmel.c b/drivers/mtd/spi-nor/atmel.c
+index 49d392c6c8bc5..deacf87a68a06 100644
+--- a/drivers/mtd/spi-nor/atmel.c
++++ b/drivers/mtd/spi-nor/atmel.c
+@@ -8,10 +8,59 @@
+ 
+ #include "core.h"
+ 
++/*
++ * The Atmel AT25FS010/AT25FS040 parts have some weird configuration for the
++ * block protection bits. We don't support them. But legacy behavior in linux
++ * is to unlock the whole flash array on startup. Therefore, we have to support
++ * exactly this operation.
++ */
++static int atmel_at25fs_lock(struct spi_nor *nor, loff_t ofs, uint64_t len)
++{
++	return -EOPNOTSUPP;
++}
++
++static int atmel_at25fs_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len)
++{
++	int ret;
++
++	/* We only support unlocking the whole flash array */
++	if (ofs || len != nor->params->size)
++		return -EINVAL;
++
++	/* Write 0x00 to the status register to disable write protection */
++	ret = spi_nor_write_sr_and_check(nor, 0);
++	if (ret)
++		dev_dbg(nor->dev, "unable to clear BP bits, WP# asserted?\n");
++
++	return ret;
++}
++
++static int atmel_at25fs_is_locked(struct spi_nor *nor, loff_t ofs, uint64_t len)
++{
++	return -EOPNOTSUPP;
++}
++
++static const struct spi_nor_locking_ops atmel_at25fs_locking_ops = {
++	.lock = atmel_at25fs_lock,
++	.unlock = atmel_at25fs_unlock,
++	.is_locked = atmel_at25fs_is_locked,
++};
++
++static void atmel_at25fs_default_init(struct spi_nor *nor)
++{
++	nor->params->locking_ops = &atmel_at25fs_locking_ops;
++}
++
++static const struct spi_nor_fixups atmel_at25fs_fixups = {
++	.default_init = atmel_at25fs_default_init,
++};
++
+ static const struct flash_info atmel_parts[] = {
+ 	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
+-	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK) },
+-	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK)
++		.fixups = &atmel_at25fs_fixups },
++	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK)
++		.fixups = &atmel_at25fs_fixups },
+ 
+ 	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
+ 	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
+diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
+index 61b00d4965475..ad6c79d9a7f86 100644
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -906,7 +906,7 @@ static int spi_nor_write_16bit_cr_and_check(struct spi_nor *nor, u8 cr)
+  *
+  * Return: 0 on success, -errno otherwise.
+  */
+-static int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1)
++int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1)
+ {
+ 	if (nor->flags & SNOR_F_HAS_16BIT_SR)
+ 		return spi_nor_write_16bit_sr_and_check(nor, sr1);
+diff --git a/drivers/mtd/spi-nor/core.h b/drivers/mtd/spi-nor/core.h
+index 6f2f6b27173fd..6f62ee861231a 100644
+--- a/drivers/mtd/spi-nor/core.h
++++ b/drivers/mtd/spi-nor/core.h
+@@ -409,6 +409,7 @@ void spi_nor_unlock_and_unprep(struct spi_nor *nor);
+ int spi_nor_sr1_bit6_quad_enable(struct spi_nor *nor);
+ int spi_nor_sr2_bit1_quad_enable(struct spi_nor *nor);
+ int spi_nor_sr2_bit7_quad_enable(struct spi_nor *nor);
++int spi_nor_write_sr_and_check(struct spi_nor *nor, u8 sr1);
+ 
+ int spi_nor_xread_sr(struct spi_nor *nor, u8 *sr);
+ ssize_t spi_nor_read_data(struct spi_nor *nor, loff_t from, size_t len,
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-spi-nor-atmel-remove-global-protection-flag.patch b/queue-5.10/mtd-spi-nor-atmel-remove-global-protection-flag.patch
new file mode 100644
index 00000000000..1333f68ee39
--- /dev/null
+++ b/queue-5.10/mtd-spi-nor-atmel-remove-global-protection-flag.patch
@@ -0,0 +1,103 @@
+From 8ac5ad58dd30e346cb909cc72875f7f5aaad7a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 17:29:55 +0100
+Subject: mtd: spi-nor: atmel: remove global protection flag
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit e6204d4620276398ed7317d64c369813a1f96615 ]
+
+This is considered bad for the following reasons:
+ (1) We only support the block protection with BPn bits for write
+     protection. Not all Atmel parts support this.
+ (2) Newly added flash chip will automatically inherit the "has
+     locking" support and thus needs to explicitly tested. Better
+     be opt-in instead of opt-out.
+ (3) There are already supported flashes which doesn't support
+     the locking scheme. So I assume this wasn't properly tested
+     before adding that chip; which enforces my previous argument
+     that locking support should be an opt-in.
+
+Remove the global flag and add individual flags to all flashes which
+supports BP locking. In particular the following flashes don't support
+the BP scheme:
+ - AT26F004
+ - AT25SL321
+ - AT45DB081D
+
+Please note, that some flashes which are marked as SPI_NOR_HAS_LOCK just
+support Global Protection, i.e. not our supported block protection
+locking scheme. This is to keep backwards compatibility with the
+current "unlock all at boot" mechanism. In particular the following
+flashes doesn't have BP bits:
+ - AT25DF041A
+ - AT25DF321
+ - AT25DF321A
+ - AT25DF641
+ - AT26DF081A
+ - AT26DF161A
+ - AT26DF321
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20201203162959.29589-4-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/atmel.c | 28 +++++++++-------------------
+ 1 file changed, 9 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/atmel.c b/drivers/mtd/spi-nor/atmel.c
+index 3f5f21a473a69..49d392c6c8bc5 100644
+--- a/drivers/mtd/spi-nor/atmel.c
++++ b/drivers/mtd/spi-nor/atmel.c
+@@ -10,37 +10,27 @@
+ 
+ static const struct flash_info atmel_parts[] = {
+ 	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
+-	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
+-	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
++	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
+ 
+-	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K) },
+-	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K) },
+-	{ "at25df321a", INFO(0x1f4701, 0, 64 * 1024,  64, SECT_4K) },
+-	{ "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K) },
++	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at25df321",  INFO(0x1f4700, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at25df321a", INFO(0x1f4701, 0, 64 * 1024,  64, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K | SPI_NOR_HAS_LOCK) },
+ 
+ 	{ "at25sl321",	INFO(0x1f4216, 0, 64 * 1024, 64,
+ 			     SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+ 
+ 	{ "at26f004",   INFO(0x1f0400, 0, 64 * 1024,  8, SECT_4K) },
+-	{ "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K) },
+-	{ "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K) },
+-	{ "at26df321",  INFO(0x1f4700, 0, 64 * 1024, 64, SECT_4K) },
++	{ "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K | SPI_NOR_HAS_LOCK) },
++	{ "at26df321",  INFO(0x1f4700, 0, 64 * 1024, 64, SECT_4K | SPI_NOR_HAS_LOCK) },
+ 
+ 	{ "at45db081d", INFO(0x1f2500, 0, 64 * 1024, 16, SECT_4K) },
+ };
+ 
+-static void atmel_default_init(struct spi_nor *nor)
+-{
+-	nor->flags |= SNOR_F_HAS_LOCK;
+-}
+-
+-static const struct spi_nor_fixups atmel_fixups = {
+-	.default_init = atmel_default_init,
+-};
+-
+ const struct spi_nor_manufacturer spi_nor_atmel = {
+ 	.name = "atmel",
+ 	.parts = atmel_parts,
+ 	.nparts = ARRAY_SIZE(atmel_parts),
+-	.fixups = &atmel_fixups,
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-spi-nor-ignore-errors-in-spi_nor_unlock_all.patch b/queue-5.10/mtd-spi-nor-ignore-errors-in-spi_nor_unlock_all.patch
new file mode 100644
index 00000000000..1043c40e573
--- /dev/null
+++ b/queue-5.10/mtd-spi-nor-ignore-errors-in-spi_nor_unlock_all.patch
@@ -0,0 +1,88 @@
+From e44f85914f83e22de50765184d556367be163a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 17:29:54 +0100
+Subject: mtd: spi-nor: ignore errors in spi_nor_unlock_all()
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit bdb1a75e4b9df6861ec6a6e3e3997820d3cebabe ]
+
+Just try to unlock the whole SPI-NOR flash array. Don't abort the
+probing in case of an error. Justifications:
+ (1) For some boards, this just works because
+     spi_nor_write_16bit_sr_and_check() is broken and just checks the
+     second half of the 16bit. Once that will be fixed, SPI probe will
+     fail for boards which has hardware-write protected SPI-NOR flashes.
+ (2) Until now, hardware write-protection was the only viable solution
+     to use the block protection bits. This is because this very
+     function spi_nor_unlock_all() will be called unconditionally on
+     every linux boot. Therefore, this bits only makes sense in
+     combination with the hardware write-protection. If we would fail
+     the SPI probe on an error in spi_nor_unlock_all() we'd break
+     virtually all users of the block protection bits.
+ (3) We should try hard to keep the MTD working even if the flash might
+     not be writable/erasable.
+
+Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20201203162959.29589-3-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/core.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
+index f0ae7a01703a1..61b00d4965475 100644
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -2915,20 +2915,27 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
+ }
+ 
+ /**
+- * spi_nor_unlock_all() - Unlocks the entire flash memory array.
++ * spi_nor_try_unlock_all() - Tries to unlock the entire flash memory array.
+  * @nor:	pointer to a 'struct spi_nor'.
+  *
+  * Some SPI NOR flashes are write protected by default after a power-on reset
+  * cycle, in order to avoid inadvertent writes during power-up. Backward
+  * compatibility imposes to unlock the entire flash memory array at power-up
+  * by default.
++ *
++ * Unprotecting the entire flash array will fail for boards which are hardware
++ * write-protected. Thus any errors are ignored.
+  */
+-static int spi_nor_unlock_all(struct spi_nor *nor)
++static void spi_nor_try_unlock_all(struct spi_nor *nor)
+ {
+-	if (nor->flags & SNOR_F_HAS_LOCK)
+-		return spi_nor_unlock(&nor->mtd, 0, nor->params->size);
++	int ret;
+ 
+-	return 0;
++	if (!(nor->flags & SNOR_F_HAS_LOCK))
++		return;
++
++	ret = spi_nor_unlock(&nor->mtd, 0, nor->params->size);
++	if (ret)
++		dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
+ }
+ 
+ static int spi_nor_init(struct spi_nor *nor)
+@@ -2941,11 +2948,7 @@ static int spi_nor_init(struct spi_nor *nor)
+ 		return err;
+ 	}
+ 
+-	err = spi_nor_unlock_all(nor);
+-	if (err) {
+-		dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
+-		return err;
+-	}
++	spi_nor_try_unlock_all(nor);
+ 
+ 	if (nor->addr_width == 4 && !(nor->flags & SNOR_F_4B_OPCODES)) {
+ 		/*
+-- 
+2.27.0
+
diff --git a/queue-5.10/mtd-spi-nor-sst-fix-bpn-bits-for-the-sst25vf064c.patch b/queue-5.10/mtd-spi-nor-sst-fix-bpn-bits-for-the-sst25vf064c.patch
new file mode 100644
index 00000000000..0cf0a9ccffc
--- /dev/null
+++ b/queue-5.10/mtd-spi-nor-sst-fix-bpn-bits-for-the-sst25vf064c.patch
@@ -0,0 +1,42 @@
+From 5ee2a1b9a1b44a35a265075d04ecfb842fc6087a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 17:29:53 +0100
+Subject: mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 989d4b72bae3b05c1564d38e71e18f65b12734fb ]
+
+This flash part actually has 4 block protection bits.
+
+Please note, that this patch is just based on information of the
+datasheet of the datasheet and wasn't tested.
+
+Fixes: 3e0930f109e7 ("mtd: spi-nor: Rework the disabling of block write protection")
+Reported-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20201203162959.29589-2-michael@walle.cc
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/sst.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/sst.c b/drivers/mtd/spi-nor/sst.c
+index e0af6d25d573b..0ab07624fb73f 100644
+--- a/drivers/mtd/spi-nor/sst.c
++++ b/drivers/mtd/spi-nor/sst.c
+@@ -18,7 +18,8 @@ static const struct flash_info sst_parts[] = {
+ 			      SECT_4K | SST_WRITE) },
+ 	{ "sst25vf032b", INFO(0xbf254a, 0, 64 * 1024, 64,
+ 			      SECT_4K | SST_WRITE) },
+-	{ "sst25vf064c", INFO(0xbf254b, 0, 64 * 1024, 128, SECT_4K) },
++	{ "sst25vf064c", INFO(0xbf254b, 0, 64 * 1024, 128,
++			      SECT_4K | SPI_NOR_4BIT_BP) },
+ 	{ "sst25wf512",  INFO(0xbf2501, 0, 64 * 1024,  1,
+ 			      SECT_4K | SST_WRITE) },
+ 	{ "sst25wf010",  INFO(0xbf2502, 0, 64 * 1024,  2,
+-- 
+2.27.0
+
diff --git a/queue-5.10/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch b/queue-5.10/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch
new file mode 100644
index 00000000000..5b403e1db88
--- /dev/null
+++ b/queue-5.10/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch
@@ -0,0 +1,78 @@
+From b7020a0877fc44e76d227e277a2d51fe7f1b1cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 23:21:09 +0900
+Subject: mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
+
+From: Tsuchiya Yuto <kitakar@gmail.com>
+
+[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]
+
+When a PCIe function level reset (FLR) is performed but without fw reset for
+some reasons (e.g., on Microsoft Surface devices, fw reset requires other
+quirks), it fails to reset wifi properly. You can trigger the issue on such
+devices via debugfs entry for reset:
+
+    $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset
+
+and the resulting dmesg log:
+
+    [   45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
+    [   45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
+    [   45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
+    [   45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+    [   45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
+    [   53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
+    [   75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+    [   85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
+    [   87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+    [   87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [   99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+    [   99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [  111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+    [  111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+    [...]
+
+When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
+lacks mwifiex_init_shutdown_fw().
+
+This commit fixes mwifiex_shutdown_sw() by adding the missing
+mwifiex_init_shutdown_fw().
+
+Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
+Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index 9ba8a8f64976b..6283df5aaaf8b 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -1471,6 +1471,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
+ 	priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+ 	mwifiex_deauthenticate(priv, NULL);
+ 
++	mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
++
+ 	mwifiex_uninit_sw(adapter);
+ 	adapter->is_up = false;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-allwinner-fix-some-resources-leak-in-the-error-h.patch b/queue-5.10/net-allwinner-fix-some-resources-leak-in-the-error-h.patch
new file mode 100644
index 00000000000..941129eb495
--- /dev/null
+++ b/queue-5.10/net-allwinner-fix-some-resources-leak-in-the-error-h.patch
@@ -0,0 +1,65 @@
+From 2ae28d35dd47c1a8a86132a9228176ff6416d941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 21:21:17 +0100
+Subject: net: allwinner: Fix some resources leak in the error handling path of
+ the probe and in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]
+
+'irq_of_parse_and_map()' should be balanced by a corresponding
+'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
+
+Add such a call in the error handling path of the probe function and in the
+remove function.
+
+Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
+index 862ea44beea77..5ed80d9a6b9fe 100644
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -828,13 +828,13 @@ static int emac_probe(struct platform_device *pdev)
+ 	db->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(db->clk)) {
+ 		ret = PTR_ERR(db->clk);
+-		goto out_iounmap;
++		goto out_dispose_mapping;
+ 	}
+ 
+ 	ret = clk_prepare_enable(db->clk);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
+-		goto out_iounmap;
++		goto out_dispose_mapping;
+ 	}
+ 
+ 	ret = sunxi_sram_claim(&pdev->dev);
+@@ -893,6 +893,8 @@ out_release_sram:
+ 	sunxi_sram_release(&pdev->dev);
+ out_clk_disable_unprepare:
+ 	clk_disable_unprepare(db->clk);
++out_dispose_mapping:
++	irq_dispose_mapping(ndev->irq);
+ out_iounmap:
+ 	iounmap(db->membase);
+ out:
+@@ -911,6 +913,7 @@ static int emac_remove(struct platform_device *pdev)
+ 	unregister_netdev(ndev);
+ 	sunxi_sram_release(&pdev->dev);
+ 	clk_disable_unprepare(db->clk);
++	irq_dispose_mapping(ndev->irq);
+ 	iounmap(db->membase);
+ 	free_netdev(ndev);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch b/queue-5.10/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch
new file mode 100644
index 00000000000..e6f80257d70
--- /dev/null
+++ b/queue-5.10/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch
@@ -0,0 +1,42 @@
+From 82828485640385cfa4d3d46eb0d615b18cfc1a57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 19:20:05 +0100
+Subject: net: bcmgenet: Fix a resource leak in an error handling path in the
+ probe functin
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]
+
+If the 'register_netdev()' call fails, we must undo a previous
+'bcmgenet_mii_init()' call.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index be85dad2e3bc4..fcca023f22e54 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -4069,8 +4069,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
+ 	clk_disable_unprepare(priv->clk);
+ 
+ 	err = register_netdev(dev);
+-	if (err)
++	if (err) {
++		bcmgenet_mii_exit(dev);
+ 		goto err;
++	}
+ 
+ 	return err;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-dsa-qca-ar9331-fix-sleeping-function-called-from.patch b/queue-5.10/net-dsa-qca-ar9331-fix-sleeping-function-called-from.patch
new file mode 100644
index 00000000000..84c1b4e6169
--- /dev/null
+++ b/queue-5.10/net-dsa-qca-ar9331-fix-sleeping-function-called-from.patch
@@ -0,0 +1,153 @@
+From 11f49ea3d1115aef1ab23338032004b1e797eab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 12:03:17 +0100
+Subject: net: dsa: qca: ar9331: fix sleeping function called from invalid
+ context bug
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 3e47495fc4de4122598dd51ae8527b09b8209646 ]
+
+With lockdep enabled, we will get following warning:
+
+ ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
+ BUG: sleeping function called from invalid context at kernel/locking/mutex.c:935
+ in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 18, name: kworker/0:1
+ INFO: lockdep is turned off.
+ irq event stamp: 602
+ hardirqs last  enabled at (601): [<8073fde0>] _raw_spin_unlock_irq+0x3c/0x80
+ hardirqs last disabled at (602): [<8073a4f4>] __schedule+0x184/0x800
+ softirqs last  enabled at (0): [<80080f60>] copy_process+0x578/0x14c8
+ softirqs last disabled at (0): [<00000000>] 0x0
+ CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 5.10.0-rc3-ar9331-00734-g7d644991df0c #31
+ Workqueue: events deferred_probe_work_func
+ Stack : 80980000 80980000 8089ef70 80890000 804b5414 80980000 00000002 80b53728
+         00000000 800d1268 804b5414 ffffffde 00000017 800afe08 81943860 0f5bfc32
+         00000000 00000000 8089ef70 819436c0 ffffffea 00000000 00000000 00000000
+         8194390c 808e353c 0000000f 66657272 80980000 00000000 00000000 80890000
+         804b5414 80980000 00000002 80b53728 00000000 00000000 00000000 80d40000
+         ...
+ Call Trace:
+ [<80069ce0>] show_stack+0x9c/0x140
+ [<800afe08>] ___might_sleep+0x220/0x244
+ [<8073bfb0>] __mutex_lock+0x70/0x374
+ [<8073c2e0>] mutex_lock_nested+0x2c/0x38
+ [<804b5414>] regmap_update_bits_base+0x38/0x8c
+ [<804ee584>] regmap_update_bits+0x1c/0x28
+ [<804ee714>] ar9331_sw_unmask_irq+0x34/0x60
+ [<800d91f0>] unmask_irq+0x48/0x70
+ [<800d93d4>] irq_startup+0x114/0x11c
+ [<800d65b4>] __setup_irq+0x4f4/0x6d0
+ [<800d68a0>] request_threaded_irq+0x110/0x190
+ [<804e3ef0>] phy_request_interrupt+0x4c/0xe4
+ [<804df508>] phylink_bringup_phy+0x2c0/0x37c
+ [<804df7bc>] phylink_of_phy_connect+0x118/0x130
+ [<806c1a64>] dsa_slave_create+0x3d0/0x578
+ [<806bc4ec>] dsa_register_switch+0x934/0xa20
+ [<804eef98>] ar9331_sw_probe+0x34c/0x364
+ [<804eb48c>] mdio_probe+0x44/0x70
+ [<8049e3b4>] really_probe+0x30c/0x4f4
+ [<8049ea10>] driver_probe_device+0x264/0x26c
+ [<8049bc10>] bus_for_each_drv+0xb4/0xd8
+ [<8049e684>] __device_attach+0xe8/0x18c
+ [<8049ce58>] bus_probe_device+0x48/0xc4
+ [<8049db70>] deferred_probe_work_func+0xdc/0xf8
+ [<8009ff64>] process_one_work+0x2e4/0x4a0
+ [<800a0770>] worker_thread+0x2a8/0x354
+ [<800a774c>] kthread+0x16c/0x174
+ [<8006306c>] ret_from_kernel_thread+0x14/0x1c
+
+ ar9331_switch ethernet.1:10 lan1 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:02] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
+ DSA: tree 0 setup
+
+To fix it, it is better to move access to MDIO register to the .irq_bus_sync_unlock
+call back.
+
+Fixes: ec6698c272de ("net: dsa: add support for Atheros AR9331 built-in switch")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20201211110317.17061-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca/ar9331.c | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c
+index e24a99031b80f..4d49c5f2b7905 100644
+--- a/drivers/net/dsa/qca/ar9331.c
++++ b/drivers/net/dsa/qca/ar9331.c
+@@ -159,6 +159,8 @@ struct ar9331_sw_priv {
+ 	struct dsa_switch ds;
+ 	struct dsa_switch_ops ops;
+ 	struct irq_domain *irqdomain;
++	u32 irq_mask;
++	struct mutex lock_irq;
+ 	struct mii_bus *mbus; /* mdio master */
+ 	struct mii_bus *sbus; /* mdio slave */
+ 	struct regmap *regmap;
+@@ -520,32 +522,44 @@ static irqreturn_t ar9331_sw_irq(int irq, void *data)
+ static void ar9331_sw_mask_irq(struct irq_data *d)
+ {
+ 	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
+-	struct regmap *regmap = priv->regmap;
+-	int ret;
+ 
+-	ret = regmap_update_bits(regmap, AR9331_SW_REG_GINT_MASK,
+-				 AR9331_SW_GINT_PHY_INT, 0);
+-	if (ret)
+-		dev_err(priv->dev, "could not mask IRQ\n");
++	priv->irq_mask = 0;
+ }
+ 
+ static void ar9331_sw_unmask_irq(struct irq_data *d)
++{
++	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
++
++	priv->irq_mask = AR9331_SW_GINT_PHY_INT;
++}
++
++static void ar9331_sw_irq_bus_lock(struct irq_data *d)
++{
++	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
++
++	mutex_lock(&priv->lock_irq);
++}
++
++static void ar9331_sw_irq_bus_sync_unlock(struct irq_data *d)
+ {
+ 	struct ar9331_sw_priv *priv = irq_data_get_irq_chip_data(d);
+ 	struct regmap *regmap = priv->regmap;
+ 	int ret;
+ 
+ 	ret = regmap_update_bits(regmap, AR9331_SW_REG_GINT_MASK,
+-				 AR9331_SW_GINT_PHY_INT,
+-				 AR9331_SW_GINT_PHY_INT);
++				 AR9331_SW_GINT_PHY_INT, priv->irq_mask);
+ 	if (ret)
+-		dev_err(priv->dev, "could not unmask IRQ\n");
++		dev_err(priv->dev, "failed to change IRQ mask\n");
++
++	mutex_unlock(&priv->lock_irq);
+ }
+ 
+ static struct irq_chip ar9331_sw_irq_chip = {
+ 	.name = AR9331_SW_NAME,
+ 	.irq_mask = ar9331_sw_mask_irq,
+ 	.irq_unmask = ar9331_sw_unmask_irq,
++	.irq_bus_lock = ar9331_sw_irq_bus_lock,
++	.irq_bus_sync_unlock = ar9331_sw_irq_bus_sync_unlock,
+ };
+ 
+ static int ar9331_sw_irq_map(struct irq_domain *domain, unsigned int irq,
+@@ -584,6 +598,7 @@ static int ar9331_sw_irq_init(struct ar9331_sw_priv *priv)
+ 		return irq ? irq : -EINVAL;
+ 	}
+ 
++	mutex_init(&priv->lock_irq);
+ 	ret = devm_request_threaded_irq(dev, irq, NULL, ar9331_sw_irq,
+ 					IRQF_ONESHOT, AR9331_SW_NAME, priv);
+ 	if (ret) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch b/queue-5.10/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch
new file mode 100644
index 00000000000..d1e181395e3
--- /dev/null
+++ b/queue-5.10/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch
@@ -0,0 +1,38 @@
+From 30e1c1cfc25fcbf0b2c23b22d247598e9ba3f193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 20:35:14 +0100
+Subject: net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
+
+From: Vincent Bernat <vincent@bernat.ch>
+
+[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]
+
+Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
+per-interface sysctl to tune proxy ARP support for private VLANs.
+While the "all" variant is exposed, it was a noop and never evaluated.
+We use the usual "or" logic for this kind of sysctls.
+
+Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index 3bbcddd22df8c..53aa0343bf694 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
+ 
+ #define IN_DEV_LOG_MARTIANS(in_dev)	IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
+ #define IN_DEV_PROXY_ARP(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP)
+-#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
++#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
+ #define IN_DEV_SHARED_MEDIA(in_dev)	IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
+ #define IN_DEV_TX_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
+ #define IN_DEV_SEC_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), \
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch b/queue-5.10/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch
new file mode 100644
index 00000000000..f9cf688e847
--- /dev/null
+++ b/queue-5.10/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch
@@ -0,0 +1,111 @@
+From 7f94e47b2f521ca7050fbf36f5944eede15e9001 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 20:35:13 +0100
+Subject: net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
+
+From: Vincent Bernat <vincent@bernat.ch>
+
+[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
+
+Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
+ignores a route whose interface is down. It is provided as a
+per-interface sysctl. However, while a "all" variant is exposed, it
+was a noop since it was never evaluated. We use the usual "or" logic
+for this kind of sysctls.
+
+Tested with:
+
+    ip link add type veth # veth0 + veth1
+    ip link add type veth # veth1 + veth2
+    ip link set up dev veth0
+    ip link set up dev veth1 # link-status paired with veth0
+    ip link set up dev veth2
+    ip link set up dev veth3 # link-status paired with veth2
+
+    # First available path
+    ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
+    ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0
+
+    # Second available path
+    ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
+    ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2
+
+    # More specific route through first path
+    ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
+    ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0
+
+    # Less specific route through second path
+    ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
+    ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2
+
+    # H1: enable on "all"
+    # H2: enable on "veth0"
+    for v in ipv4 ipv6; do
+      case $uts in
+        H1)
+          sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
+          ;;
+        H2)
+          sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
+          ;;
+      esac
+    done
+
+    set -xe
+    # When veth0 is up, best route is through veth0
+    ip -o route get 198.51.100.1 | grep -Fw veth0
+    ip -o route get 2001:db8:3::1 | grep -Fw veth0
+
+    # When veth0 is down, best route should be through veth2 on H1/H2,
+    # but on veth0 on H2
+    ip link set down dev veth1 # down veth0
+    ip route show
+    [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
+    [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
+    [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
+    [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2
+
+Without this patch, the two last lines would fail on H1 (the one using
+the "all" sysctl). With the patch, everything succeeds as expected.
+
+Also document the sysctl in `ip-sysctl.rst`.
+
+Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/ip-sysctl.rst | 3 +++
+ include/linux/inetdevice.h             | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
+index 25e6673a085a0..91069bf636235 100644
+--- a/Documentation/networking/ip-sysctl.rst
++++ b/Documentation/networking/ip-sysctl.rst
+@@ -1554,6 +1554,9 @@ igmpv3_unsolicited_report_interval - INTEGER
+ 
+ 	Default: 1000 (1 seconds)
+ 
++ignore_routes_with_linkdown - BOOLEAN
++        Ignore routes whose link is down when performing a FIB lookup.
++
+ promote_secondaries - BOOLEAN
+ 	When a primary IP address is removed from this interface
+ 	promote a corresponding secondary IP address instead of
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index 3515ca64e638a..3bbcddd22df8c 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
+ 	  IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
+ 
+ #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
+-	IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
++	IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+ 
+ #define IN_DEV_ARPFILTER(in_dev)	IN_DEV_ORCONF((in_dev), ARPFILTER)
+ #define IN_DEV_ARP_ACCEPT(in_dev)	IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-korina-fix-return-value.patch b/queue-5.10/net-korina-fix-return-value.patch
new file mode 100644
index 00000000000..5cb9a43f3a9
--- /dev/null
+++ b/queue-5.10/net-korina-fix-return-value.patch
@@ -0,0 +1,43 @@
+From bac596fc4f80fb2028018045ea47543a8bcaf2ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 23:09:52 +0100
+Subject: net: korina: fix return value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]
+
+The ndo_start_xmit() method must not attempt to free the skb to transmit
+when returning NETDEV_TX_BUSY. Therefore, make sure the
+korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.
+
+Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/korina.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
+index bf48f0ded9c7d..925161959b9ba 100644
+--- a/drivers/net/ethernet/korina.c
++++ b/drivers/net/ethernet/korina.c
+@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
+ 			dev_kfree_skb_any(skb);
+ 			spin_unlock_irqrestore(&lp->lock, flags);
+ 
+-			return NETDEV_TX_BUSY;
++			return NETDEV_TX_OK;
+ 		}
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-mlx5-properly-convey-driver-version-to-firmware.patch b/queue-5.10/net-mlx5-properly-convey-driver-version-to-firmware.patch
new file mode 100644
index 00000000000..f92164ba94f
--- /dev/null
+++ b/queue-5.10/net-mlx5-properly-convey-driver-version-to-firmware.patch
@@ -0,0 +1,47 @@
+From 56f571ea6746387663e359127ad63befc6000a04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:52:00 +0300
+Subject: net/mlx5: Properly convey driver version to firmware
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]
+
+mlx5 firmware expects driver version in specific format X.X.X, so
+make it always correct and based on real kernel version aligned with
+the driver.
+
+Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 8ff207aa14792..e455a2f31f070 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -50,6 +50,7 @@
+ #ifdef CONFIG_RFS_ACCEL
+ #include <linux/cpu_rmap.h>
+ #endif
++#include <linux/version.h>
+ #include <net/devlink.h>
+ #include "mlx5_core.h"
+ #include "lib/eq.h"
+@@ -233,7 +234,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
+ 	strncat(string, ",", remaining_size);
+ 
+ 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
+-	strncat(string, DRIVER_VERSION, remaining_size);
++
++	snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
++		 (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
++		 (u16)(LINUX_VERSION_CODE & 0xffff));
+ 
+ 	/*Send the command*/
+ 	MLX5_SET(set_driver_version_in, in, opcode,
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-mscc-ocelot-fix-a-resource-leak-in-the-error-han.patch b/queue-5.10/net-mscc-ocelot-fix-a-resource-leak-in-the-error-han.patch
new file mode 100644
index 00000000000..1568e69fb17
--- /dev/null
+++ b/queue-5.10/net-mscc-ocelot-fix-a-resource-leak-in-the-error-han.patch
@@ -0,0 +1,55 @@
+From 442d9d83d8ca7fe2b4e62a7af11113c719e49cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 12:48:38 +0100
+Subject: net: mscc: ocelot: Fix a resource leak in the error handling path of
+ the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit f87675b836b324d270fd52f1f5e6d6bb9f4bd1d5 ]
+
+In case of error after calling 'ocelot_init()', it must be undone by a
+corresponding 'ocelot_deinit()' call, as already done in the remove
+function.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201213114838.126922-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_vsc7514.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_vsc7514.c b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+index 1e7729421a825..9cf2bc5f42892 100644
+--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c
++++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+@@ -1267,7 +1267,7 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 
+ 	err = mscc_ocelot_init_ports(pdev, ports);
+ 	if (err)
+-		goto out_put_ports;
++		goto out_ocelot_deinit;
+ 
+ 	if (ocelot->ptp) {
+ 		err = ocelot_init_timestamp(ocelot, &ocelot_ptp_clock_info);
+@@ -1282,8 +1282,14 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ 	register_switchdev_notifier(&ocelot_switchdev_nb);
+ 	register_switchdev_blocking_notifier(&ocelot_switchdev_blocking_nb);
+ 
++	of_node_put(ports);
++
+ 	dev_info(&pdev->dev, "Ocelot switch probed\n");
+ 
++	return 0;
++
++out_ocelot_deinit:
++	ocelot_deinit(ocelot);
+ out_put_ports:
+ 	of_node_put(ports);
+ 	return err;
+-- 
+2.27.0
+
diff --git a/queue-5.10/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch b/queue-5.10/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch
new file mode 100644
index 00000000000..84d7f5be68d
--- /dev/null
+++ b/queue-5.10/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch
@@ -0,0 +1,45 @@
+From 27ad0c3837d860783a3613d677dfae115fb229bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 16:59:08 +0300
+Subject: net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
+
+From: Fedor Tokarev <ftokarev@gmail.com>
+
+[ Upstream commit 35a6d396721e28ba161595b0fc9e8896c00399bb ]
+
+'snprintf' returns the number of characters which would have been written
+if enough space had been available, excluding the terminating null byte.
+Thus, the return value of 'sizeof(buf)' means that the last character
+has been dropped.
+
+Signed-off-by: Fedor Tokarev <ftokarev@gmail.com>
+Fixes: 2f34b8bfae19 ("SUNRPC: add links for all client xprts to debugfs")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
+index fd9bca2427242..56029e3af6ff0 100644
+--- a/net/sunrpc/debugfs.c
++++ b/net/sunrpc/debugfs.c
+@@ -128,13 +128,13 @@ static int do_xprt_debugfs(struct rpc_clnt *clnt, struct rpc_xprt *xprt, void *n
+ 		return 0;
+ 	len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
+ 		       xprt->debugfs->d_name.name);
+-	if (len > sizeof(name))
++	if (len >= sizeof(name))
+ 		return -1;
+ 	if (*nump == 0)
+ 		strcpy(link, "xprt");
+ 	else {
+ 		len = snprintf(link, sizeof(link), "xprt%d", *nump);
+-		if (len > sizeof(link))
++		if (len >= sizeof(link))
+ 			return -1;
+ 	}
+ 	debugfs_create_symlink(link, clnt->cl_debugfs, name);
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfc-s3fwrn5-release-the-nfc-firmware.patch b/queue-5.10/nfc-s3fwrn5-release-the-nfc-firmware.patch
new file mode 100644
index 00000000000..1283e9dfcbd
--- /dev/null
+++ b/queue-5.10/nfc-s3fwrn5-release-the-nfc-firmware.patch
@@ -0,0 +1,41 @@
+From 224d54a010afc867d1518e5522519a7cc6de0db9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 18:58:50 +0900
+Subject: nfc: s3fwrn5: Release the nfc firmware
+
+From: Bongsu Jeon <bongsu.jeon@samsung.com>
+
+[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]
+
+add the code to release the nfc firmware when the firmware image size is
+wrong.
+
+Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
+Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/s3fwrn5/firmware.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
+index ec930ee2c847e..64df50827642b 100644
+--- a/drivers/nfc/s3fwrn5/firmware.c
++++ b/drivers/nfc/s3fwrn5/firmware.c
+@@ -293,8 +293,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
++	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
++		release_firmware(fw->fw);
+ 		return -EINVAL;
++	}
+ 
+ 	memcpy(fw->date, fw->fw->data + 0x00, 12);
+ 	fw->date[12] = '\0';
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfp-move-indirect-block-cleanup-to-flower-app-stop-c.patch b/queue-5.10/nfp-move-indirect-block-cleanup-to-flower-app-stop-c.patch
new file mode 100644
index 00000000000..eb3c4759154
--- /dev/null
+++ b/queue-5.10/nfp-move-indirect-block-cleanup-to-flower-app-stop-c.patch
@@ -0,0 +1,57 @@
+From 1d733996fc179baf4f4937ff1617b899ba92ad0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 15:57:01 +0100
+Subject: nfp: move indirect block cleanup to flower app stop callback
+
+From: Simon Horman <simon.horman@netronome.com>
+
+[ Upstream commit 5b33afee93a1e7665a5ffae027fc66f9376f4ea7 ]
+
+The indirect block cleanup may cause control messages to be sent
+if offloaded flows are present. However, by the time the flower app
+cleanup callback is called txbufs are no longer available and attempts
+to send control messages result in a NULL-pointer dereference in
+nfp_ctrl_tx_one().
+
+This problem may be resolved by moving the indirect block cleanup
+to the stop callback, where txbufs are still available.
+
+As suggested by Jakub Kicinski and Louis Peens.
+
+Fixes: a1db217861f3 ("net: flow_offload: fix flow_indr_dev_unregister path")
+Signed-off-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: Louis Peens <louis.peens@netronome.com>
+Link: https://lore.kernel.org/r/20201216145701.30005-1-simon.horman@netronome.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
+index bb448c82cdc28..c029950a81e20 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
+@@ -860,9 +860,6 @@ static void nfp_flower_clean(struct nfp_app *app)
+ 	skb_queue_purge(&app_priv->cmsg_skbs_low);
+ 	flush_work(&app_priv->cmsg_work);
+ 
+-	flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
+-				 nfp_flower_setup_indr_tc_release);
+-
+ 	if (app_priv->flower_ext_feats & NFP_FL_FEATS_VF_RLIM)
+ 		nfp_flower_qos_cleanup(app);
+ 
+@@ -951,6 +948,9 @@ static int nfp_flower_start(struct nfp_app *app)
+ static void nfp_flower_stop(struct nfp_app *app)
+ {
+ 	nfp_tunnel_config_stop(app);
++
++	flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
++				 nfp_flower_setup_indr_tc_release);
+ }
+ 
+ static int
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfs-pnfs-fix-a-typo-in-ff_layout_resend_pnfs_read.patch b/queue-5.10/nfs-pnfs-fix-a-typo-in-ff_layout_resend_pnfs_read.patch
new file mode 100644
index 00000000000..a420a7b051a
--- /dev/null
+++ b/queue-5.10/nfs-pnfs-fix-a-typo-in-ff_layout_resend_pnfs_read.patch
@@ -0,0 +1,34 @@
+From 92f039c7e3a46cb80162d043f920f087fc0e9949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 17:17:45 -0500
+Subject: NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 52104f274e2d7f134d34bab11cada8913d4544e2 ]
+
+Don't bump the index twice.
+
+Fixes: 563c53e73b8b ("NFS: Fix flexfiles read failover")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 24bf5797f88ae..fd0eda328943b 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -1056,7 +1056,7 @@ static void ff_layout_resend_pnfs_read(struct nfs_pgio_header *hdr)
+ 	u32 idx = hdr->pgio_mirror_idx + 1;
+ 	u32 new_idx = 0;
+ 
+-	if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx + 1, &new_idx))
++	if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx, &new_idx))
+ 		ff_layout_send_layouterror(hdr->lseg);
+ 	else
+ 		pnfs_error_mark_layout_for_return(hdr->inode, hdr->lseg);
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch b/queue-5.10/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch
new file mode 100644
index 00000000000..77221868f67
--- /dev/null
+++ b/queue-5.10/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch
@@ -0,0 +1,52 @@
+From f989ef711d72177ffbc1408c217a9117d02ad8bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 11:24:33 +1100
+Subject: NFS: switch nfsiod to be an UNBOUND workqueue.
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]
+
+nfsiod is currently a concurrency-managed workqueue (CMWQ).
+This means that workitems scheduled to nfsiod on a given CPU are queued
+behind all other work items queued on any CMWQ on the same CPU.  This
+can introduce unexpected latency.
+
+Occaionally nfsiod can even cause excessive latency.  If the work item
+to complete a CLOSE request calls the final iput() on an inode, the
+address_space of that inode will be dismantled.  This takes time
+proportional to the number of in-memory pages, which on a large host
+working on large files (e.g..  5TB), can be a large number of pages
+resulting in a noticable number of seconds.
+
+We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
+This causes each concurrent work item to gets a dedicated thread which
+can be scheduled to an idle CPU.
+
+There is precedent for this as several other filesystems use WQ_UNBOUND
+workqueue for handling various async events.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index aa6493905bbe8..43af053f467a7 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -2180,7 +2180,7 @@ static int nfsiod_start(void)
+ {
+ 	struct workqueue_struct *wq;
+ 	dprintk("RPC:       creating workqueue nfsiod\n");
+-	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
++	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
+ 	if (wq == NULL)
+ 		return -ENOMEM;
+ 	nfsiod_workqueue = wq;
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfs_common-need-lock-during-iterate-through-the-list.patch b/queue-5.10/nfs_common-need-lock-during-iterate-through-the-list.patch
new file mode 100644
index 00000000000..88b24d11c0f
--- /dev/null
+++ b/queue-5.10/nfs_common-need-lock-during-iterate-through-the-list.patch
@@ -0,0 +1,79 @@
+From 8c232ca59f0c25e28f0db3e084783dcd65ae6e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 07:06:35 -0500
+Subject: nfs_common: need lock during iterate through the list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cheng Lin <cheng.lin130@zte.com.cn>
+
+[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]
+
+If the elem is deleted during be iterated on it, the iteration
+process will fall into an endless loop.
+
+kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]
+
+PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd"
+    [exception RIP: __state_in_grace+76]
+    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246
+    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50
+    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580
+    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40
+    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40
+    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000
+    CS: 0010  SS: 0018
+ #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
+ #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
+ #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
+ #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
+ #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
+ #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
+ #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
+ #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
+ #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
+ #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607
+
+The troublemake elem:
+crash> lock_manager ffff881dc0c38298
+struct lock_manager {
+  list = {
+    next = 0xffff881dc0c38298,
+    prev = 0xffff881dc0c38298
+  },
+  block_opens = false
+}
+
+Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
+Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs_common/grace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
+index b73d9dd37f73c..26f2a50eceac9 100644
+--- a/fs/nfs_common/grace.c
++++ b/fs/nfs_common/grace.c
+@@ -69,10 +69,14 @@ __state_in_grace(struct net *net, bool open)
+ 	if (!open)
+ 		return !list_empty(grace_list);
+ 
++	spin_lock(&grace_lock);
+ 	list_for_each_entry(lm, grace_list, list) {
+-		if (lm->block_opens)
++		if (lm->block_opens) {
++			spin_unlock(&grace_lock);
+ 			return true;
++		}
+ 	}
++	spin_unlock(&grace_lock);
+ 	return false;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfsd-fix-5-seconds-delay-when-doing-inter-server-cop.patch b/queue-5.10/nfsd-fix-5-seconds-delay-when-doing-inter-server-cop.patch
new file mode 100644
index 00000000000..03d7503052b
--- /dev/null
+++ b/queue-5.10/nfsd-fix-5-seconds-delay-when-doing-inter-server-cop.patch
@@ -0,0 +1,52 @@
+From 4267e3429aaca6302b7cd5583eb5e7ed54ff3b93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 16:24:49 -0500
+Subject: NFSD: Fix 5 seconds delay when doing inter server copy
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit ca9364dde50daba93eff711b4b945fd08beafcc2 ]
+
+Since commit b4868b44c5628 ("NFSv4: Wait for stateid updates after
+CLOSE/OPEN_DOWNGRADE"), every inter server copy operation suffers 5
+seconds delay regardless of the size of the copy. The delay is from
+nfs_set_open_stateid_locked when the check by nfs_stateid_is_sequential
+fails because the seqid in both nfs4_state and nfs4_stateid are 0.
+
+Fix by modifying nfs4_init_cp_state to return the stateid with seqid 1
+instead of 0. This is also to conform with section 4.8 of RFC 7862.
+
+Here is the relevant paragraph from section 4.8 of RFC 7862:
+
+   A copy offload stateid's seqid MUST NOT be zero.  In the context of a
+   copy offload operation, it is inappropriate to indicate "the most
+   recent copy offload operation" using a stateid with a seqid of zero
+   (see Section 8.2.2 of [RFC5661]).  It is inappropriate because the
+   stateid refers to internal state in the server and there may be
+   several asynchronous COPY operations being performed in parallel on
+   the same file by the server.  Therefore, a copy offload stateid with
+   a seqid of zero MUST be considered invalid.
+
+Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index d7f27ed6b7941..47006eec724e6 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -769,6 +769,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
+ 	spin_lock(&nn->s2s_cp_lock);
+ 	new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
+ 	stid->stid.si_opaque.so_id = new_id;
++	stid->stid.si_generation = 1;
+ 	spin_unlock(&nn->s2s_cp_lock);
+ 	idr_preload_end();
+ 	if (new_id < 0)
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfsd-fix-message-level-for-normal-termination.patch b/queue-5.10/nfsd-fix-message-level-for-normal-termination.patch
new file mode 100644
index 00000000000..d0071e6c94e
--- /dev/null
+++ b/queue-5.10/nfsd-fix-message-level-for-normal-termination.patch
@@ -0,0 +1,41 @@
+From cc5475dd59db2528f4e4a90f069dc50ce80cd62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 15:26:59 +0900
+Subject: nfsd: Fix message level for normal termination
+
+From: kazuo ito <kzpn200@gmail.com>
+
+[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]
+
+The warning message from nfsd terminating normally
+can confuse system adminstrators or monitoring software.
+
+Though it's not exactly fair to pin-point a commit where it
+originated, the current form in the current place started
+to appear in:
+
+Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP")
+Signed-off-by: kazuo ito <kzpn200@gmail.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 27b1ad1361508..9323e30a7eafe 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -527,8 +527,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
+ 		return;
+ 
+ 	nfsd_shutdown_net(net);
+-	printk(KERN_WARNING "nfsd: last server has exited, flushing export "
+-			    "cache\n");
++	pr_info("nfsd: last server has exited, flushing export cache\n");
+ 	nfsd_export_flush(net);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch b/queue-5.10/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch
new file mode 100644
index 00000000000..5999c0fe4bf
--- /dev/null
+++ b/queue-5.10/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch
@@ -0,0 +1,48 @@
+From 5dfaf07cbfe2326d33c4ea425d0e3d449374a626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:42:16 -0500
+Subject: NFSv4: Fix the alignment of page data in the getdeviceinfo reply
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 046e5ccb4198b990190e11fb52fd9cfd264402eb ]
+
+We can fit the device_addr4 opaque data padding in the pages.
+
+Fixes: cf500bac8fd4 ("SUNRPC: Introduce rpc_prepare_reply_pages()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4xdr.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index c6dbfcae75171..c16b93df1bc14 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3009,15 +3009,19 @@ static void nfs4_xdr_enc_getdeviceinfo(struct rpc_rqst *req,
+ 	struct compound_hdr hdr = {
+ 		.minorversion = nfs4_xdr_minorversion(&args->seq_args),
+ 	};
++	uint32_t replen;
+ 
+ 	encode_compound_hdr(xdr, req, &hdr);
+ 	encode_sequence(xdr, &args->seq_args, &hdr);
++
++	replen = hdr.replen + op_decode_hdr_maxsz;
++
+ 	encode_getdeviceinfo(xdr, args, &hdr);
+ 
+-	/* set up reply kvec. Subtract notification bitmap max size (2)
+-	 * so that notification bitmap is put in xdr_buf tail */
++	/* set up reply kvec. device_addr4 opaque data is read into the
++	 * pages */
+ 	rpc_prepare_reply_pages(req, args->pdev->pages, args->pdev->pgbase,
+-				args->pdev->pglen, hdr.replen - 2);
++				args->pdev->pglen, replen + 2 + 1);
+ 	encode_nops(&hdr);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch b/queue-5.10/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch
new file mode 100644
index 00000000000..9f411f4b789
--- /dev/null
+++ b/queue-5.10/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch
@@ -0,0 +1,74 @@
+From 2be5ecab65f5aa4333f3eb65dcffdfa06ec4e550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:03:38 -0500
+Subject: NFSv4.2: condition READDIR's mask for security label based on LSM
+ state
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]
+
+Currently, the client will always ask for security_labels if the server
+returns that it supports that feature regardless of any LSM modules
+(such as Selinux) enforcing security policy. This adds performance
+penalty to the READDIR operation.
+
+Client adjusts superblock's support of the security_label based on
+the server's support but also current client's configuration of the
+LSM modules. Thus, prior to using the default bitmask in READDIR,
+this patch checks the server's capabilities and then instructs
+READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.
+
+v5: fixing silly mistakes of the rushed v4
+v4: simplifying logic
+v3: changing label's initialization per Ondrej's comment
+v2: dropping selinux hook and using the sb cap.
+
+Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
+Suggested-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e89468678ae16..6858b4bb556d5 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4961,12 +4961,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
+ 		u64 cookie, struct page **pages, unsigned int count, bool plus)
+ {
+ 	struct inode		*dir = d_inode(dentry);
++	struct nfs_server	*server = NFS_SERVER(dir);
+ 	struct nfs4_readdir_arg args = {
+ 		.fh = NFS_FH(dir),
+ 		.pages = pages,
+ 		.pgbase = 0,
+ 		.count = count,
+-		.bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
+ 		.plus = plus,
+ 	};
+ 	struct nfs4_readdir_res res;
+@@ -4981,9 +4981,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
+ 	dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
+ 			dentry,
+ 			(unsigned long long)cookie);
++	if (!(server->caps & NFS_CAP_SECURITY_LABEL))
++		args.bitmask = server->attr_bitmask_nl;
++	else
++		args.bitmask = server->attr_bitmask;
++
+ 	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
+ 	res.pgbase = args.pgbase;
+-	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
++	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
++			&res.seq_res, 0);
+ 	if (status >= 0) {
+ 		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
+ 		status += args.pgbase;
+-- 
+2.27.0
+
diff --git a/queue-5.10/nl80211-cfg80211-fix-potential-infinite-loop.patch b/queue-5.10/nl80211-cfg80211-fix-potential-infinite-loop.patch
new file mode 100644
index 00000000000..3ac10e73d58
--- /dev/null
+++ b/queue-5.10/nl80211-cfg80211-fix-potential-infinite-loop.patch
@@ -0,0 +1,40 @@
+From bb3b374a65af4378f087807676247410fac92c6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 22:24:07 +0000
+Subject: nl80211/cfg80211: fix potential infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit ba5c25236bc3d399df82ebe923490ea8d2d35cf2 ]
+
+The for-loop iterates with a u8 loop counter and compares this
+with the loop upper limit of request->n_ssids which is an int type.
+There is a potential infinite loop if n_ssids is larger than the
+u8 loop counter, so fix this by making the loop counter an int.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201029222407.390218-1-colin.king@canonical.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 8d0e49c46db37..3409f37d838b3 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -694,7 +694,7 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
+ static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
+ 				     struct cfg80211_scan_request *request)
+ {
+-	u8 i;
++	int i;
+ 	u32 s_ssid;
+ 
+ 	for (i = 0; i < request->n_ssids; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/orinoco-move-context-allocation-after-processing-the.patch b/queue-5.10/orinoco-move-context-allocation-after-processing-the.patch
new file mode 100644
index 00000000000..71dba6c413a
--- /dev/null
+++ b/queue-5.10/orinoco-move-context-allocation-after-processing-the.patch
@@ -0,0 +1,60 @@
+From 76312ddebfa72ac297c6939f19ac53f33f46b300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 22:22:43 +0100
+Subject: orinoco: Move context allocation after processing the skb
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]
+
+ezusb_xmit() allocates a context which is leaked if
+orinoco_process_xmit_skb() returns an error.
+
+Move ezusb_alloc_ctx() after the invocation of
+orinoco_process_xmit_skb() because the context is not needed so early.
+ezusb_access_ltv() will cleanup the context in case of an error.
+
+Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intersil/orinoco/orinoco_usb.c    | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index b849d27bd741e..d1fc948364c79 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1223,13 +1223,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	if (skb->len < ETH_HLEN)
+ 		goto drop;
+ 
+-	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+-	if (!ctx)
+-		goto busy;
+-
+-	memset(ctx->buf, 0, BULK_BUF_SIZE);
+-	buf = ctx->buf->data;
+-
+ 	tx_control = 0;
+ 
+ 	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
+@@ -1237,6 +1230,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	if (err)
+ 		goto drop;
+ 
++	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
++	if (!ctx)
++		goto drop;
++
++	memset(ctx->buf, 0, BULK_BUF_SIZE);
++	buf = ctx->buf->data;
++
+ 	{
+ 		__le16 *tx_cntl = (__le16 *)buf;
+ 		*tx_cntl = cpu_to_le16(tx_control);
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-bounds-check-command-line-resource-alignment-req.patch b/queue-5.10/pci-bounds-check-command-line-resource-alignment-req.patch
new file mode 100644
index 00000000000..df5c5f307c5
--- /dev/null
+++ b/queue-5.10/pci-bounds-check-command-line-resource-alignment-req.patch
@@ -0,0 +1,56 @@
+From 42f957922dfe64fffb41bc57be45129536d32268 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 14:51:36 -0600
+Subject: PCI: Bounds-check command-line resource alignment requests
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]
+
+32-bit BARs are limited to 2GB size (2^31).  By extension, I assume 64-bit
+BARs are limited to 2^63 bytes.  Limit the alignment requested by the
+"pci=resource_alignment=" command-line parameter to 2^63.
+
+Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index e578d34095e91..b7a860e790979 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -6202,19 +6202,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
+ 	while (*p) {
+ 		count = 0;
+ 		if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
+-							p[count] == '@') {
++		    p[count] == '@') {
+ 			p += count + 1;
++			if (align_order > 63) {
++				pr_err("PCI: Invalid requested alignment (order %d)\n",
++				       align_order);
++				align_order = PAGE_SHIFT;
++			}
+ 		} else {
+-			align_order = -1;
++			align_order = PAGE_SHIFT;
+ 		}
+ 
+ 		ret = pci_dev_str_match(dev, p, &p);
+ 		if (ret == 1) {
+ 			*resize = true;
+-			if (align_order == -1)
+-				align = PAGE_SIZE;
+-			else
+-				align = 1 << align_order;
++			align = 1 << align_order;
+ 			break;
+ 		} else if (ret < 0) {
+ 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-brcmstb-initialize-tmp-before-use.patch b/queue-5.10/pci-brcmstb-initialize-tmp-before-use.patch
new file mode 100644
index 00000000000..78b08544d2a
--- /dev/null
+++ b/queue-5.10/pci-brcmstb-initialize-tmp-before-use.patch
@@ -0,0 +1,44 @@
+From 6ffa61f51832749f686a666534dcaf9da9b81d50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 15:57:12 -0500
+Subject: PCI: brcmstb: Initialize "tmp" before use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jim Quinlan <james.quinlan@broadcom.com>
+
+[ Upstream commit ddaff0af653136ee1e0b49116ecf2988c2fc64ca ]
+
+The variable 'tmp' is used multiple times in the brcm_pcie_setup()
+function.  One such usage did not initialize 'tmp' to the current value
+of the target register.  By luck the mistake does not currently affect
+behavior;  regardless 'tmp' is now initialized properly.
+
+Suggested-by: Rafał Miłecki <zajec5@gmail.com>
+Link: https://lore.kernel.org/r/20201102205712.23332-1-james.quinlan@broadcom.com
+Fixes: c0452137034b ("PCI: brcmstb: Add Broadcom STB PCIe host controller driver")
+Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
+index bea86899bd5df..9c3d2982248d3 100644
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -893,6 +893,7 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
+ 		burst = 0x2; /* 512 bytes */
+ 
+ 	/* Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN */
++	tmp = readl(base + PCIE_MISC_MISC_CTRL);
+ 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_SCB_ACCESS_EN_MASK);
+ 	u32p_replace_bits(&tmp, 1, PCIE_MISC_MISC_CTRL_CFG_READ_UR_MODE_MASK);
+ 	u32p_replace_bits(&tmp, burst, PCIE_MISC_MISC_CTRL_MAX_BURST_SIZE_MASK);
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-disable-msi-for-pericom-pcie-usb-adapter.patch b/queue-5.10/pci-disable-msi-for-pericom-pcie-usb-adapter.patch
new file mode 100644
index 00000000000..931fe9ad9cc
--- /dev/null
+++ b/queue-5.10/pci-disable-msi-for-pericom-pcie-usb-adapter.patch
@@ -0,0 +1,65 @@
+From d0d4c466ebd358067aac92275368d7ddfcd3e0c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 12:05:25 +0200
+Subject: PCI: Disable MSI for Pericom PCIe-USB adapter
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f83c37941e881224885f2e694e0626bea358e96b ]
+
+Pericom PCIe-USB adapter advertises MSI, but documentation says "The MSI
+Function is not implemented on this device" in chapters 7.3.27,
+7.3.29-7.3.31, and Alberto found that MSI in fact does not work.
+
+Disable MSI for these devices.
+
+Datasheet: https://www.diodes.com/assets/Datasheets/PI7C9X440SL.pdf
+Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
+Link: https://lore.kernel.org/linux-usb/20201030134826.GP4077@smile.fi.intel.com/
+Link: https://lore.kernel.org/r/20201106100526.17726-1-andriy.shevchenko@linux.intel.com
+Reported-by: alberto.vignani@fastwebnet.it
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f70692ac79c56..fb1dc11e7cc52 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5567,17 +5567,26 @@ static void pci_fixup_no_d0_pme(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x2142, pci_fixup_no_d0_pme);
+ 
+ /*
+- * Device [12d8:0x400e] and [12d8:0x400f]
++ * Device 12d8:0x400e [OHCI] and 12d8:0x400f [EHCI]
++ *
+  * These devices advertise PME# support in all power states but don't
+  * reliably assert it.
++ *
++ * These devices also advertise MSI, but documentation (PI7C9X440SL.pdf)
++ * says "The MSI Function is not implemented on this device" in chapters
++ * 7.3.27, 7.3.29-7.3.31.
+  */
+-static void pci_fixup_no_pme(struct pci_dev *dev)
++static void pci_fixup_no_msi_no_pme(struct pci_dev *dev)
+ {
++#ifdef CONFIG_PCI_MSI
++	pci_info(dev, "MSI is not implemented on this device, disabling it\n");
++	dev->no_msi = 1;
++#endif
+ 	pci_info(dev, "PME# is unreliable, disabling it\n");
+ 	dev->pme_support = 0;
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_pme);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_pme);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_msi_no_pme);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_msi_no_pme);
+ 
+ static void apex_pci_fixup_class(struct pci_dev *pdev)
+ {
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-fix-overflow-in-command-line-resource-alignment-.patch b/queue-5.10/pci-fix-overflow-in-command-line-resource-alignment-.patch
new file mode 100644
index 00000000000..0a3e4cc23f9
--- /dev/null
+++ b/queue-5.10/pci-fix-overflow-in-command-line-resource-alignment-.patch
@@ -0,0 +1,40 @@
+From 2b4c8fe549ebc5d441c33fb7a2cf61e878717b39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 15:48:04 -0600
+Subject: PCI: Fix overflow in command-line resource alignment requests
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]
+
+The shift of 1 by align_order is evaluated using 32 bit arithmetic and the
+result is assigned to a resource_size_t type variable that is a 64 bit
+unsigned integer on 64 bit platforms. Fix an overflow before widening issue
+by making the 1 a ULL.
+
+Addresses-Coverity: ("Unintentional integer overflow")
+Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index b7a860e790979..6427cbd0a5be2 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -6216,7 +6216,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
+ 		ret = pci_dev_str_match(dev, p, &p);
+ 		if (ret == 1) {
+ 			*resize = true;
+-			align = 1 << align_order;
++			align = 1ULL << align_order;
+ 			break;
+ 		} else if (ret < 0) {
+ 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-iproc-fix-out-of-bound-array-accesses.patch b/queue-5.10/pci-iproc-fix-out-of-bound-array-accesses.patch
new file mode 100644
index 00000000000..ebd04a57fed
--- /dev/null
+++ b/queue-5.10/pci-iproc-fix-out-of-bound-array-accesses.patch
@@ -0,0 +1,74 @@
+From 8207aa08641056d5621ff1eacd4bf56f79f49fa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 11:30:52 +0530
+Subject: PCI: iproc: Fix out-of-bound array accesses
+
+From: Bharat Gooty <bharat.gooty@broadcom.com>
+
+[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]
+
+Declare the full size array for all revisions of PAX register sets
+to avoid potentially out of bound access of the register array
+when they are being initialized in iproc_pcie_rev_init().
+
+Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
+Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
+Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 905e938082432..d901b9d392b8c 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -307,7 +307,7 @@ enum iproc_pcie_reg {
+ };
+ 
+ /* iProc PCIe PAXB BCMA registers */
+-static const u16 iproc_pcie_reg_paxb_bcma[] = {
++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
+ 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
+ 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
+@@ -318,7 +318,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
+ };
+ 
+ /* iProc PCIe PAXB registers */
+-static const u16 iproc_pcie_reg_paxb[] = {
++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
+ 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
+ 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
+@@ -334,7 +334,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
+ };
+ 
+ /* iProc PCIe PAXB v2 registers */
+-static const u16 iproc_pcie_reg_paxb_v2[] = {
++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
+ 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
+ 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
+@@ -363,7 +363,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
+ };
+ 
+ /* iProc PCIe PAXC v1 registers */
+-static const u16 iproc_pcie_reg_paxc[] = {
++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
+ 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x1f0,
+ 	[IPROC_PCIE_CFG_IND_DATA]	= 0x1f4,
+@@ -372,7 +372,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
+ };
+ 
+ /* iProc PCIe PAXC v2 registers */
+-static const u16 iproc_pcie_reg_paxc_v2[] = {
++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_MSI_GIC_MODE]	= 0x050,
+ 	[IPROC_PCIE_MSI_BASE_ADDR]	= 0x074,
+ 	[IPROC_PCIE_MSI_WINDOW_SIZE]	= 0x078,
+-- 
+2.27.0
+
diff --git a/queue-5.10/pci-iproc-invalidate-correct-paxb-inbound-windows.patch b/queue-5.10/pci-iproc-invalidate-correct-paxb-inbound-windows.patch
new file mode 100644
index 00000000000..ac76b392514
--- /dev/null
+++ b/queue-5.10/pci-iproc-invalidate-correct-paxb-inbound-windows.patch
@@ -0,0 +1,60 @@
+From 2318359595cbe80cd5e024711347fc938b0c7db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 11:30:53 +0530
+Subject: PCI: iproc: Invalidate correct PAXB inbound windows
+
+From: Roman Bacik <roman.bacik@broadcom.com>
+
+[ Upstream commit 89bbcaac3dff21f3567956b3416f5ec8b45f5555 ]
+
+Second stage bootloaders prior to Linux boot may use all inbound windows
+including IARR1/IMAP1. We need to ensure that all previous configuration
+of inbound windows are invalidated during the initialization stage of
+the Linux iProc PCIe driver so let's add a fix to define and invalidate
+IARR1/IMAP1 because it is currently missing, fixing the issue.
+
+Link: https://lore.kernel.org/r/20201001060054.6616-3-srinath.mannam@broadcom.com
+Fixes: 9415743e4c8a ("PCI: iproc: Invalidate PAXB address mapping")
+Signed-off-by: Roman Bacik <roman.bacik@broadcom.com>
+Signed-off-by: Srinath Mannam <srinath.mannam@broadcom.com>
+[lorenzo.pieralisi@arm.com: commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index d901b9d392b8c..cc5b7823edeb7 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -192,8 +192,15 @@ static const struct iproc_pcie_ib_map paxb_v2_ib_map[] = {
+ 		.imap_window_offset = 0x4,
+ 	},
+ 	{
+-		/* IARR1/IMAP1 (currently unused) */
+-		.type = IPROC_PCIE_IB_MAP_INVALID,
++		/* IARR1/IMAP1 */
++		.type = IPROC_PCIE_IB_MAP_MEM,
++		.size_unit = SZ_1M,
++		.region_sizes = { 8 },
++		.nr_sizes = 1,
++		.nr_windows = 8,
++		.imap_addr_offset = 0x4,
++		.imap_window_offset = 0x8,
++
+ 	},
+ 	{
+ 		/* IARR2/IMAP2 */
+@@ -351,6 +358,8 @@ static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ 	[IPROC_PCIE_OMAP3]		= 0xdf8,
+ 	[IPROC_PCIE_IARR0]		= 0xd00,
+ 	[IPROC_PCIE_IMAP0]		= 0xc00,
++	[IPROC_PCIE_IARR1]		= 0xd08,
++	[IPROC_PCIE_IMAP1]		= 0xd70,
+ 	[IPROC_PCIE_IARR2]		= 0xd10,
+ 	[IPROC_PCIE_IMAP2]		= 0xcc0,
+ 	[IPROC_PCIE_IARR3]		= 0xe00,
+-- 
+2.27.0
+
diff --git a/queue-5.10/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch b/queue-5.10/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch
new file mode 100644
index 00000000000..3e531f4189a
--- /dev/null
+++ b/queue-5.10/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch
@@ -0,0 +1,77 @@
+From 65038d949af8b04d1f87b371b0972f34eeaeeb35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Dec 2020 10:52:10 -0300
+Subject: perf probe: Fix memory leak when synthesizing SDT probes
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 5149303fdfe5c67ddb51c911e23262f781cd75eb ]
+
+The argv_split() function must be paired with argv_free(), else we must
+keep a reference to the argv array received or do the freeing ourselves,
+in synthesize_sdt_probe_command() we were simply leaking that argv[]
+array.
+
+Fixes: 3b1f8311f6963cd1 ("perf probe: Add sdt probes arguments into the uprobe cmd string")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Truong <alexandre.truong@arm.com>
+Cc: Alexis Berlemont <alexis.berlemont@gmail.com>
+Cc: He Zhe <zhe.he@windriver.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20201224135139.GF477817@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-file.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
+index 064b63a6a3f31..bbecb449ea944 100644
+--- a/tools/perf/util/probe-file.c
++++ b/tools/perf/util/probe-file.c
+@@ -791,7 +791,7 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
+ 					const char *sdtgrp)
+ {
+ 	struct strbuf buf;
+-	char *ret = NULL, **args;
++	char *ret = NULL;
+ 	int i, args_count, err;
+ 	unsigned long long ref_ctr_offset;
+ 
+@@ -813,12 +813,19 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
+ 		goto out;
+ 
+ 	if (note->args) {
+-		args = argv_split(note->args, &args_count);
++		char **args = argv_split(note->args, &args_count);
++
++		if (args == NULL)
++			goto error;
+ 
+ 		for (i = 0; i < args_count; ++i) {
+-			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0)
++			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0) {
++				argv_free(args);
+ 				goto error;
++			}
+ 		}
++
++		argv_free(args);
+ 	}
+ 
+ out:
+-- 
+2.27.0
+
diff --git a/queue-5.10/perf-record-fix-memory-leak-when-using-user-regs-to-.patch b/queue-5.10/perf-record-fix-memory-leak-when-using-user-regs-to-.patch
new file mode 100644
index 00000000000..728c54334c0
--- /dev/null
+++ b/queue-5.10/perf-record-fix-memory-leak-when-using-user-regs-to-.patch
@@ -0,0 +1,45 @@
+From f1db494e770c4ec9640edda608e7c5e1360c69f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 17:33:44 +0800
+Subject: =?UTF-8?q?perf=20record:=20Fix=20memory=20leak=20when=20using=20'?=
+ =?UTF-8?q?--user-regs=3D=3F'=20to=20list=20registers?=
+
+From: Zheng Zengkai <zhengzengkai@huawei.com>
+
+[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]
+
+When using 'perf record's option '-I' or '--user-regs=' along with
+argument '?' to list available register names, memory of variable 'os'
+allocated by strdup() needs to be released before __parse_regs()
+returns, otherwise memory leak will occur.
+
+Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
+Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Li Bin <huawei.libin@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-regs-options.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
+index e687497b3aac0..a4a100425b3a2 100644
+--- a/tools/perf/util/parse-regs-options.c
++++ b/tools/perf/util/parse-regs-options.c
+@@ -54,7 +54,7 @@ __parse_regs(const struct option *opt, const char *str, int unset, bool intr)
+ #endif
+ 				fputc('\n', stderr);
+ 				/* just printing available regs */
+-				return -1;
++				goto error;
+ 			}
+ #ifdef HAVE_PERF_REGS_SUPPORT
+ 			for (r = sample_reg_masks; r->name; r++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/perf-test-fix-metric-parsing-test.patch b/queue-5.10/perf-test-fix-metric-parsing-test.patch
new file mode 100644
index 00000000000..01bcd18873e
--- /dev/null
+++ b/queue-5.10/perf-test-fix-metric-parsing-test.patch
@@ -0,0 +1,78 @@
+From 435ece6e3e05d1e997981a5c0f0e74a838312c22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 20:54:11 +0530
+Subject: perf test: Fix metric parsing test
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit b2ce5dbc15819ea4bef47dbd368239cb1e965158 ]
+
+Commit e1c92a7fbbc5 ("perf tests: Add another metric parsing test") add
+another test for metric parsing. The test goes through all metrics
+compiled for arch within pmu events and try to parse them.
+
+Right now this test is failing in powerpc machine.
+
+Result in power9 platform:
+
+  [command]# ./perf test 10
+  10: PMU events                                                      :
+  10.1: PMU event table sanity                                        : Ok
+  10.2: PMU event map aliases                                         : Ok
+  10.3: Parsing of PMU event table metrics                            : Skip (some metrics failed)
+  10.4: Parsing of PMU event table metrics with fake PMUs             : FAILED!
+
+Issue is we are passing different runtime parameter value in
+"expr__find_other" and "expr__parse" function which is called from
+function `metric_parse_fake`.  And because of this parsing of hv-24x7
+metrics is failing.
+
+  [command]# ./perf test 10 -vv
+  .....
+  hv_24x7/pm_mcs01_128b_rd_disp_port01,chip=1/ not found
+  expr__parse failed
+  test child finished with -1
+  ---- end ----
+  PMU events subtest 4: FAILED!
+
+This patch fix this issue and change runtime parameter value to '0' in
+expr__parse function.
+
+Result in power9 platform after this patch:
+
+  [command]# ./perf test 10
+  10: PMU events                                                      :
+  10.1: PMU event table sanity                                        : Ok
+  10.2: PMU event map aliases                                         : Ok
+  10.3: Parsing of PMU event table metrics                            : Skip (some metrics failed)
+  10.4: Parsing of PMU event table metrics with fake PMUs             : Ok
+
+Fixes: e1c92a7fbbc5 ("perf tests: Add another metric parsing test")
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Link: http://lore.kernel.org/lkml/20201119152411.46041-1-kjain@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/pmu-events.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/pmu-events.c b/tools/perf/tests/pmu-events.c
+index d3517a74d95e3..31f987bb7ebba 100644
+--- a/tools/perf/tests/pmu-events.c
++++ b/tools/perf/tests/pmu-events.c
+@@ -561,7 +561,7 @@ static int metric_parse_fake(const char *str)
+ 		}
+ 	}
+ 
+-	if (expr__parse(&result, &ctx, str, 1))
++	if (expr__parse(&result, &ctx, str, 0))
+ 		pr_err("expr__parse failed\n");
+ 	else
+ 		ret = 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/perf-test-use-generic-event-for-expand_libpfm_events.patch b/queue-5.10/perf-test-use-generic-event-for-expand_libpfm_events.patch
new file mode 100644
index 00000000000..bd72ceafb4a
--- /dev/null
+++ b/queue-5.10/perf-test-use-generic-event-for-expand_libpfm_events.patch
@@ -0,0 +1,45 @@
+From 05a4989667ea7b60aa4194c20aa4432cf7aa7268 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 16:28:54 +0900
+Subject: perf test: Use generic event for expand_libpfm_events()
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 9b0a7836359443227c9af101f7aea8412e739458 ]
+
+I found that the UNHALTED_CORE_CYCLES event is only available in the
+Intel machines and it makes other vendors/archs fail on the test.  As
+libpfm4 can parse the generic events like cycles, let's use them.
+
+Fixes: 40b74c30ffb9 ("perf test: Add expand cgroup event test")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20201027072855.655449-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/expand-cgroup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/expand-cgroup.c b/tools/perf/tests/expand-cgroup.c
+index d5771e4d094f8..4c59f3ae438fc 100644
+--- a/tools/perf/tests/expand-cgroup.c
++++ b/tools/perf/tests/expand-cgroup.c
+@@ -145,7 +145,7 @@ static int expand_libpfm_events(void)
+ 	int ret;
+ 	struct evlist *evlist;
+ 	struct rblist metric_events;
+-	const char event_str[] = "UNHALTED_CORE_CYCLES";
++	const char event_str[] = "CYCLES";
+ 	struct option opt = {
+ 		.value = &evlist,
+ 	};
+-- 
+2.27.0
+
diff --git a/queue-5.10/phy-mediatek-allow-compile-testing-the-hdmi-phy.patch b/queue-5.10/phy-mediatek-allow-compile-testing-the-hdmi-phy.patch
new file mode 100644
index 00000000000..58add29cdd2
--- /dev/null
+++ b/queue-5.10/phy-mediatek-allow-compile-testing-the-hdmi-phy.patch
@@ -0,0 +1,56 @@
+From bf00baf8763510e81ef29c213aad90f9c2c5dde0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:56:43 +0100
+Subject: phy: mediatek: allow compile-testing the hdmi phy
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit f5f6e01f9164040ba120f30522efdb4deceb529a ]
+
+Compile-testing the DRM_MEDIATEK_HDMI driver shows two missing
+dependencies, one results in a link failure:
+
+arm-linux-gnueabi-ld: drivers/phy/mediatek/phy-mtk-hdmi.o: in function `mtk_hdmi_phy_probe':
+phy-mtk-hdmi.c:(.text+0xd8): undefined reference to `__clk_get_name'
+arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x12c): undefined reference to `devm_clk_register'
+arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x250): undefined reference to `of_clk_add_provider'
+arm-linux-gnueabi-ld: phy-mtk-hdmi.c:(.text+0x298): undefined reference to `of_clk_src_simple_get'
+
+The other one is a harmless warning:
+
+WARNING: unmet direct dependencies detected for PHY_MTK_HDMI
+  Depends on [n]: ARCH_MEDIATEK [=n] && OF [=y]
+  Selected by [y]:
+  - DRM_MEDIATEK_HDMI [=y] && HAS_IOMEM [=y] && DRM_MEDIATEK [=y]
+
+Fix these by adding dependencies on CONFIG_OF and CONFIG_COMMON_CLK.
+With that done, there is also no reason against adding
+CONFIG_COMPILE_TEST.
+
+Fixes: b28be59a2e26 ("phy: mediatek: Move mtk_hdmi_phy driver into drivers/phy/mediatek folder")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20201204135650.2744481-1-arnd@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/mediatek/Kconfig | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/mediatek/Kconfig b/drivers/phy/mediatek/Kconfig
+index c8126bde9d7cc..43150608d8b62 100644
+--- a/drivers/phy/mediatek/Kconfig
++++ b/drivers/phy/mediatek/Kconfig
+@@ -38,7 +38,9 @@ config PHY_MTK_XSPHY
+ 
+ config PHY_MTK_HDMI
+ 	tristate "MediaTek HDMI-PHY Driver"
+-	depends on ARCH_MEDIATEK && OF
++	depends on ARCH_MEDIATEK || COMPILE_TEST
++	depends on COMMON_CLK
++	depends on OF
+ 	select GENERIC_PHY
+ 	help
+ 	  Support HDMI PHY for Mediatek SoCs.
+-- 
+2.27.0
+
diff --git a/queue-5.10/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch b/queue-5.10/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch
new file mode 100644
index 00000000000..57764ed46e7
--- /dev/null
+++ b/queue-5.10/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch
@@ -0,0 +1,42 @@
+From c4e48013018d412025b5c3d9a3d76657609c6e7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 10:44:12 +0800
+Subject: phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
+
+From: Wang Li <wangli74@huawei.com>
+
+[ Upstream commit 51e339deab1e51443f6ac3b1bd5cd6cc8e8fe1d9 ]
+
+pm_runtime_enable() will decrease power disable depth. Thus a pairing
+increment is needed on the error handling path to keep it balanced.
+
+Fixes: 5d8042e95fd4 ("phy: rcar-gen3-usb2: Add support for r8a77470")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Li <wangli74@huawei.com>
+Link: https://lore.kernel.org/r/20201126024412.4046845-1-wangli74@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index e34e4475027ca..2cb949f931b69 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -656,8 +656,10 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
+ 	 */
+ 	pm_runtime_enable(dev);
+ 	phy_usb2_ops = of_device_get_match_data(dev);
+-	if (!phy_usb2_ops)
+-		return -EINVAL;
++	if (!phy_usb2_ops) {
++		ret = -EINVAL;
++		goto error;
++	}
+ 
+ 	mutex_init(&channel->lock);
+ 	for (i = 0; i < NUM_OF_PHYS; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/phy-tegra-xusb-fix-usb_phy-device-driver-field.patch b/queue-5.10/phy-tegra-xusb-fix-usb_phy-device-driver-field.patch
new file mode 100644
index 00000000000..6adb0d4b0a4
--- /dev/null
+++ b/queue-5.10/phy-tegra-xusb-fix-usb_phy-device-driver-field.patch
@@ -0,0 +1,106 @@
+From aa03307887d9a11ffb8bcc38c37cb2eecdb4590e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 16:38:03 +0800
+Subject: phy: tegra: xusb: Fix usb_phy device driver field
+
+From: JC Kuo <jckuo@nvidia.com>
+
+[ Upstream commit 4ea0bf2a52f1eea76578eac5a9148d95f5e181c0 ]
+
+In commit "phy: tegra: xusb: Add usb-phy support", an OTG capable PHY
+device, such as phy-usb2.0 device of Jetson-TX1 platform, will be
+bound to the tegra-xusb-padctl driver by the following line in
+tegra_xusb_setup_usb_role_switch().
+
+	port->usb_phy.dev->driver = port->padctl->dev->driver;
+
+With this, dev_pm_ops set of tegra-xusb-padctl driver will be invoked
+for the OTG capable PHY incorrectly as below logs show.
+
+This commit fixes the issue by assigning an empty driver to it.
+
+[  153.451108] tegra-xusb-padctl phy-usb2.0: > tegra_xusb_padctl_suspend_noirq(dev=ffff000080917000)
+[  153.460353] tegra-xusb-padctl phy-usb2.0:   driver: ffff8000114453e0 (tegra_xusb_padctl_driver)
+[  153.469245] tegra-xusb-padctl phy-usb2.0:   padctl: ffff0000829f6480
+[  153.475772] tegra-xusb-padctl phy-usb2.0:     soc: ef7bdd7fffffffff (0xef7bdd7fffffffff)
+[  153.484061] Unable to handle kernel paging request at virtual address 007bdd800000004f
+[  153.492132] Mem abort info:
+[  153.495083]   ESR = 0x96000004
+[  153.498308]   EC = 0x25: DABT (current EL), IL = 32 bits
+[  153.503771]   SET = 0, FnV = 0
+[  153.506979]   EA = 0, S1PTW = 0
+[  153.510260] Data abort info:
+[  153.513200]   ISV = 0, ISS = 0x00000004
+[  153.517181]   CM = 0, WnR = 0
+[  153.520302] [007bdd800000004f] address between user and kernel address ranges
+[  153.527600] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[  153.533231] Modules linked in: nouveau panel_simple tegra_video(C) tegra_drm drm_ttm_helper videobuf2_dma_contig ttm videobuf2_memops cec videobuf2_v4l2 videobuf2_common drm_kms_helper v4l2_fwnode videodev drm mc snd_hda_codec_hdmi cdc_ether usbnet snd_hda_tegra r8152 crct10dif_ce snd_hda_codec snd_hda_core tegra_xudc host1x lp855x_bl at24 ip_tables x_tables ipv6
+[  153.566417] CPU: 0 PID: 300 Comm: systemd-sleep Tainted: G         C        5.10.0-rc3-next-20201113-00019-g5c064d5372b0-dirty #624
+[  153.578283] Hardware name: NVIDIA Jetson TX1 Developer Kit (DT)
+[  153.584281] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
+[  153.590381] pc : tegra_xusb_padctl_suspend_noirq+0x88/0x100
+[  153.596016] lr : tegra_xusb_padctl_suspend_noirq+0x80/0x100
+[  153.601632] sp : ffff8000120dbb60
+[  153.604999] x29: ffff8000120dbb60 x28: ffff000080a1df00
+[  153.610430] x27: 0000000000000002 x26: ffff8000106f8540
+[  153.615858] x25: ffff8000113ac4a4 x24: ffff80001148c198
+[  153.621277] x23: ffff800010c4538c x22: 0000000000000002
+[  153.626692] x21: ffff800010ccde80 x20: ffff0000829f6480
+[  153.632107] x19: ffff000080917000 x18: 0000000000000030
+[  153.637521] x17: 0000000000000000 x16: 0000000000000000
+[  153.642933] x15: ffff000080a1e380 x14: 74636461702d6273
+[  153.648346] x13: ffff8000113ad058 x12: 0000000000000f39
+[  153.653759] x11: 0000000000000513 x10: ffff800011405058
+[  153.659176] x9 : 00000000fffff000 x8 : ffff8000113ad058
+[  153.664590] x7 : ffff800011405058 x6 : 0000000000000000
+[  153.670002] x5 : 0000000000000000 x4 : ffff0000fe908bc0
+[  153.675414] x3 : ffff0000fe910228 x2 : 162ef67e0581e700
+[  153.680826] x1 : 162ef67e0581e700 x0 : ef7bdd7fffffffff
+[  153.686241] Call trace:
+[  153.688769]  tegra_xusb_padctl_suspend_noirq+0x88/0x100
+[  153.694077]  __device_suspend_noirq+0x68/0x1cc
+[  153.698594]  dpm_noirq_suspend_devices+0x10c/0x1d0
+[  153.703456]  dpm_suspend_noirq+0x28/0xa0
+[  153.707461]  suspend_devices_and_enter+0x234/0x4bc
+[  153.712314]  pm_suspend+0x1e4/0x270
+[  153.715868]  state_store+0x8c/0x110
+[  153.719440]  kobj_attr_store+0x1c/0x30
+[  153.723259]  sysfs_kf_write+0x4c/0x7c
+[  153.726981]  kernfs_fop_write+0x124/0x240
+[  153.731065]  vfs_write+0xe4/0x204
+[  153.734449]  ksys_write+0x6c/0x100
+[  153.737925]  __arm64_sys_write+0x20/0x30
+[  153.741931]  el0_svc_common.constprop.0+0x78/0x1a0
+[  153.746789]  do_el0_svc+0x24/0x90
+[  153.750181]  el0_sync_handler+0x254/0x260
+[  153.754251]  el0_sync+0x174/0x180
+[  153.757663] Code: aa0303e2 94000f64 f9405680 b40000e0 (f9402803)
+[  153.763826] ---[ end trace 81543a3394cb409d ]---
+
+Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support")
+
+Signed-off-by: JC Kuo <jckuo@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20201117083803.185209-1-jckuo@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index ad88d74c18842..181a1be5f4917 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -688,7 +688,7 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port)
+ 	 * reference to retrieve usb-phy details.
+ 	 */
+ 	port->usb_phy.dev = &lane->pad->lanes[port->index]->dev;
+-	port->usb_phy.dev->driver = port->padctl->dev->driver;
++	port->usb_phy.dev->driver = port->dev.driver;
+ 	port->usb_phy.otg->usb_phy = &port->usb_phy;
+ 	port->usb_phy.otg->set_peripheral = tegra_xusb_set_peripheral;
+ 	port->usb_phy.otg->set_host = tegra_xusb_set_host;
+-- 
+2.27.0
+
diff --git a/queue-5.10/pinctrl-core-add-missing-ifdef-config_gpiolib.patch b/queue-5.10/pinctrl-core-add-missing-ifdef-config_gpiolib.patch
new file mode 100644
index 00000000000..737a8714c54
--- /dev/null
+++ b/queue-5.10/pinctrl-core-add-missing-ifdef-config_gpiolib.patch
@@ -0,0 +1,50 @@
+From 51cb517e0bc8d81490bbe684fcdc4fa6cdc76058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 18:39:21 +0800
+Subject: pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB
+
+From: He Zhe <zhe.he@windriver.com>
+
+[ Upstream commit b507cb92477ad85902783a183c5ce01d16296687 ]
+
+To fix the following build warnings when CONFIG_GPIOLIB=n.
+
+drivers/pinctrl/core.c:1607:20: warning: unused variable 'chip' [-Wunused-variable]
+ 1608 |  struct gpio_chip *chip;
+      |                    ^~~~
+drivers/pinctrl/core.c:1606:15: warning: unused variable 'gpio_num' [-Wunused-variable]
+ 1607 |  unsigned int gpio_num;
+      |               ^~~~~~~~
+drivers/pinctrl/core.c:1605:29: warning: unused variable 'range' [-Wunused-variable]
+ 1606 |  struct pinctrl_gpio_range *range;
+      |                             ^~~~~
+
+Fixes: f1b206cf7c57 ("pinctrl: core: print gpio in pins debugfs file")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20201028103921.22486-1-zhe.he@windriver.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 3663d87f51a01..9fc4433fece4f 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1602,9 +1602,11 @@ static int pinctrl_pins_show(struct seq_file *s, void *what)
+ 	struct pinctrl_dev *pctldev = s->private;
+ 	const struct pinctrl_ops *ops = pctldev->desc->pctlops;
+ 	unsigned i, pin;
++#ifdef CONFIG_GPIOLIB
+ 	struct pinctrl_gpio_range *range;
+ 	unsigned int gpio_num;
+ 	struct gpio_chip *chip;
++#endif
+ 
+ 	seq_printf(s, "registered pins: %d\n", pctldev->desc->npins);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch b/queue-5.10/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch
new file mode 100644
index 00000000000..f3b20920e3a
--- /dev/null
+++ b/queue-5.10/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch
@@ -0,0 +1,64 @@
+From 6092893831b797e05e8f018ec3cbaf499d5649f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 09:12:19 +0800
+Subject: pinctrl: falcon: add missing put_device() call in
+ pinctrl_falcon_probe()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]
+
+if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
+index 62c02b969327f..7521a924dffb0 100644
+--- a/drivers/pinctrl/pinctrl-falcon.c
++++ b/drivers/pinctrl/pinctrl-falcon.c
+@@ -431,24 +431,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
+ 
+ 	/* load and remap the pad resources of the different banks */
+ 	for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
+-		struct platform_device *ppdev = of_find_device_by_node(np);
+ 		const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
+ 		struct resource res;
++		struct platform_device *ppdev;
+ 		u32 avail;
+ 		int pins;
+ 
+ 		if (!of_device_is_available(np))
+ 			continue;
+ 
+-		if (!ppdev) {
+-			dev_err(&pdev->dev, "failed to find pad pdev\n");
+-			continue;
+-		}
+ 		if (!bank || *bank >= PORTS)
+ 			continue;
+ 		if (of_address_to_resource(np, 0, &res))
+ 			continue;
++
++		ppdev = of_find_device_by_node(np);
++		if (!ppdev) {
++			dev_err(&pdev->dev, "failed to find pad pdev\n");
++			continue;
++		}
++
+ 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
++		put_device(&ppdev->dev);
+ 		if (IS_ERR(falcon_info.clk[*bank])) {
+ 			dev_err(&ppdev->dev, "failed to get clock\n");
+ 			of_node_put(np);
+-- 
+2.27.0
+
diff --git a/queue-5.10/pinctrl-sunxi-fix-irq-bank-map-for-the-allwinner-a10.patch b/queue-5.10/pinctrl-sunxi-fix-irq-bank-map-for-the-allwinner-a10.patch
new file mode 100644
index 00000000000..5f6e5b55f73
--- /dev/null
+++ b/queue-5.10/pinctrl-sunxi-fix-irq-bank-map-for-the-allwinner-a10.patch
@@ -0,0 +1,37 @@
+From da73d56973abcb1b5cf691cd30daf9c4feec9f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 14:22:55 +0800
+Subject: pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin
+ controller
+
+From: Yangtao Li <frank@allwinnertech.com>
+
+[ Upstream commit 6de7ed693c631d4689acfe90c434147598d75543 ]
+
+A100's pin starts with PB, so it should start with 1.
+
+Fixes: 473436e7647d6 ("pinctrl: sunxi: add support for the Allwinner A100 pin controller")
+Signed-off-by: Yangtao Li <frank@allwinnertech.com>
+Link: https://lore.kernel.org/r/9db51667bf9065be55beafd56e5c319e3bbe8310.1604988979.git.frank@allwinnertech.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
+index 19cfd1e76ee2c..e69f6da40dc0a 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100.c
+@@ -677,7 +677,7 @@ static const struct sunxi_desc_pin a100_pins[] = {
+ 		  SUNXI_FUNCTION_IRQ_BANK(0x6, 6, 19)),
+ };
+ 
+-static const unsigned int a100_irq_bank_map[] = { 0, 1, 2, 3, 4, 5, 6};
++static const unsigned int a100_irq_bank_map[] = { 1, 2, 3, 4, 5, 6, 7};
+ 
+ static const struct sunxi_pinctrl_desc a100_pinctrl_data = {
+ 	.pins = a100_pins,
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch b/queue-5.10/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch
new file mode 100644
index 00000000000..c1f9b682c73
--- /dev/null
+++ b/queue-5.10/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch
@@ -0,0 +1,49 @@
+From 39c72a30d986ee2bc6d1cb7e10bc400d19866216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 11:35:38 -0800
+Subject: platform/chrome: cros_ec_spi: Don't overwrite spi::mode
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 74639cbf51d7c0304342544a83dfda354a6bd208 ]
+
+There isn't any need to overwrite the mode here in the driver with what
+has been detected by the firmware, such as DT or ACPI. In fact, if we
+use the SPI CS gpio descriptor feature we will overwrite the mode with
+SPI_MODE_0 where it already contains SPI_MODE_0 and more importantly
+SPI_CS_HIGH. Clearing the SPI_CS_HIGH bit causes the CS line to toggle
+when the device is probed when it shouldn't change, confusing the driver
+and making it fail to probe. Drop the assignment and let the spi core
+take care of it.
+
+Fixes: a17d94f0b6e1 ("mfd: Add ChromeOS EC SPI driver")
+Cc: Simon Glass <sjg@chromium.org>
+Cc: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Cc: Alexandru M Stan <amstan@chromium.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+Link: https://lore.kernel.org/r/20201204193540.3047030-2-swboyd@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_spi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_spi.c b/drivers/platform/chrome/cros_ec_spi.c
+index dfa1f816a45f4..f9df218fc2bbe 100644
+--- a/drivers/platform/chrome/cros_ec_spi.c
++++ b/drivers/platform/chrome/cros_ec_spi.c
+@@ -742,7 +742,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
+ 	int err;
+ 
+ 	spi->bits_per_word = 8;
+-	spi->mode = SPI_MODE_0;
+ 	spi->rt = true;
+ 	err = spi_setup(spi);
+ 	if (err < 0)
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-dell-smbios-base-fix-error-return-code-.patch b/queue-5.10/platform-x86-dell-smbios-base-fix-error-return-code-.patch
new file mode 100644
index 00000000000..684a3445df2
--- /dev/null
+++ b/queue-5.10/platform-x86-dell-smbios-base-fix-error-return-code-.patch
@@ -0,0 +1,39 @@
+From 3344abf295783d51fd686e71c28e05035d761652 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 14:50:32 +0800
+Subject: platform/x86: dell-smbios-base: Fix error return code in
+ dell_smbios_init
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]
+
+Fix to return the error code -ENODEV when fails to init wmi and
+smm.
+
+Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell-smbios-base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
+index 2e2cd565926aa..3a1dbf1994413 100644
+--- a/drivers/platform/x86/dell-smbios-base.c
++++ b/drivers/platform/x86/dell-smbios-base.c
+@@ -594,6 +594,7 @@ static int __init dell_smbios_init(void)
+ 	if (wmi && smm) {
+ 		pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
+ 			wmi, smm);
++		ret = -ENODEV;
+ 		goto fail_create_group;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-intel-vbtn-fix-sw_tablet_mode-always-re.patch b/queue-5.10/platform-x86-intel-vbtn-fix-sw_tablet_mode-always-re.patch
new file mode 100644
index 00000000000..62b62441c5d
--- /dev/null
+++ b/queue-5.10/platform-x86-intel-vbtn-fix-sw_tablet_mode-always-re.patch
@@ -0,0 +1,75 @@
+From 2a3310530fd8c767d5d33f8590e615dd72ef33ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Sep 2020 11:35:32 +0200
+Subject: platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on
+ some HP x360 models
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a4327979a19e8734ddefbd8bcbb73bd9905b69cd ]
+
+Some HP x360 models have an ACPI VGBS method which sets bit 4 instead of
+bit 6 when NOT in tablet mode at boot. Inspecting all the DSDTs in my DSDT
+collection shows only one other model, the Medion E1239T ever setting bit 4
+and it always sets this together with bit 6.
+
+So lets treat bit 4 as a second bit which when set indicates the device not
+being in tablet-mode, as we already do for bit 6.
+
+While at it also prefix all VGBS constant defines with "VGBS_".
+
+Note this wrokaround was first added to the kernel as
+commit d823346876a9 ("platform/x86: intel-vbtn: Fix SW_TABLET_MODE always
+reporting 1 on the HP Pavilion 11 x360").
+After commit 8169bd3e6e19 ("platform/x86: intel-vbtn: Switch to an
+allow-list for SW_TABLET_MODE reporting") got added to the kernel this
+was reverted, because with the new allow-list approach the workaround
+was no longer necessary for the model on which the issue was first
+reported.
+
+But it turns out that the workaround is still necessary because some
+affected models report a chassis-type of 31 which is on the allow-list.
+
+BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1894017
+Fixes: 21d64817c724 ("platform/x86: intel-vbtn: Revert "Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360"")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-vbtn.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 0419c8001fe33..123401f04b55a 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -15,9 +15,13 @@
+ #include <linux/platform_device.h>
+ #include <linux/suspend.h>
+ 
++/* Returned when NOT in tablet mode on some HP Stream x360 11 models */
++#define VGBS_TABLET_MODE_FLAG_ALT	0x10
+ /* When NOT in tablet mode, VGBS returns with the flag 0x40 */
+-#define TABLET_MODE_FLAG 0x40
+-#define DOCK_MODE_FLAG   0x80
++#define VGBS_TABLET_MODE_FLAG		0x40
++#define VGBS_DOCK_MODE_FLAG		0x80
++
++#define VGBS_TABLET_MODE_FLAGS (VGBS_TABLET_MODE_FLAG | VGBS_TABLET_MODE_FLAG_ALT)
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("AceLan Kao");
+@@ -72,9 +76,9 @@ static void detect_tablet_mode(struct platform_device *device)
+ 	if (ACPI_FAILURE(status))
+ 		return;
+ 
+-	m = !(vgbs & TABLET_MODE_FLAG);
++	m = !(vgbs & VGBS_TABLET_MODE_FLAGS);
+ 	input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
+-	m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;
++	m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;
+ 	input_report_switch(priv->input_dev, SW_DOCK, m);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch b/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch
new file mode 100644
index 00000000000..e103e0cf99f
--- /dev/null
+++ b/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch
@@ -0,0 +1,58 @@
+From 53dcf7888a94aa1a69b1a52fbb9c9eaf9702e6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 19:47:44 +0200
+Subject: platform/x86: mlx-platform: Fix item counter assignment for MSN2700,
+ MSN24xx systems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ]
+
+Fix array names to match assignments for data items and data items
+counter in 'mlxplat_mlxcpld_default_items' structure for:
+	.data = mlxplat_mlxcpld_default_pwr_items_data,
+	.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+and
+	.data = mlxplat_mlxcpld_default_fan_items_data,
+	.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+
+Replace:
+- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
+   ARRAY_SIZE() calculation.
+- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
+   for ARRAY_SIZE() calculation.
+
+Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201207174745.22889-2-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 598f445587649..902424e06180c 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -465,7 +465,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ 		.aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF,
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
+ 		.mask = MLXPLAT_CPLD_PWR_MASK,
+-		.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
++		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
+ 		.inversed = 0,
+ 		.health = false,
+ 	},
+@@ -474,7 +474,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ 		.aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF,
+ 		.reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
+ 		.mask = MLXPLAT_CPLD_FAN_MASK,
+-		.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
++		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
+ 		.inversed = 1,
+ 		.health = false,
+ 	},
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch-3823 b/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch-3823
new file mode 100644
index 00000000000..cd570c3f2e1
--- /dev/null
+++ b/queue-5.10/platform-x86-mlx-platform-fix-item-counter-assignmen.patch-3823
@@ -0,0 +1,58 @@
+From d99aa2df2bebffc9eab8563a51cccf4fed9c4598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 19:47:45 +0200
+Subject: platform/x86: mlx-platform: Fix item counter assignment for
+ MSN2700/ComEx system
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit cf791774a16caf87b0e4c0c55b82979bad0b6c01 ]
+
+Fix array names to match assignments for data items and data items
+counter in 'mlxplat_mlxcpld_comex_items' structure for:
+	.data = mlxplat_mlxcpld_default_pwr_items_data,
+	.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+and
+	.data = mlxplat_mlxcpld_default_fan_items_data,
+	.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+
+Replace:
+- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
+   ARRAY_SIZE() calculation.
+- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
+   for ARRAY_SIZE() calculation.
+
+Fixes: bdd6e155e0d6 ("platform/x86: mlx-platform: Add support for new system type")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201207174745.22889-3-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 902424e06180c..be8cb880de596 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -504,7 +504,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_comex_items[] = {
+ 		.aggr_mask = MLXPLAT_CPLD_AGGR_MASK_CARRIER,
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
+ 		.mask = MLXPLAT_CPLD_PWR_MASK,
+-		.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
++		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
+ 		.inversed = 0,
+ 		.health = false,
+ 	},
+@@ -513,7 +513,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_comex_items[] = {
+ 		.aggr_mask = MLXPLAT_CPLD_AGGR_MASK_CARRIER,
+ 		.reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
+ 		.mask = MLXPLAT_CPLD_FAN_MASK,
+-		.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
++		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
+ 		.inversed = 1,
+ 		.health = false,
+ 	},
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch b/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch
new file mode 100644
index 00000000000..605f79c14d4
--- /dev/null
+++ b/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch
@@ -0,0 +1,57 @@
+From 7a684a677a30435389dc2d19db15d02efeba29a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 12:10:55 +0200
+Subject: platform/x86: mlx-platform: Remove PSU EEPROM from default platform
+ configuration
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]
+
+Remove PSU EEPROM configuration for systems class equipped with
+Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100.
+Till now all the systems from this class used few types of power units,
+all equipped with EEPROM device with address space two bytes. Thus, all
+these devices have been handled by EEPROM driver "24c02".
+
+There is a new requirement is to support power unit replacement by "off
+the shelf" device, matching electrical required parameters. Such device
+can be equipped with different EEPROM type, which could be one byte
+address space addressing or even could be not equipped with EEPROM.
+In such case "24c02" will not work.
+
+Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
+Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 986ad3dda1c10..623e7f737d4ab 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -383,15 +383,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
+ 		.label = "psu1",
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ 		.mask = BIT(0),
+-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ 	},
+ 	{
+ 		.label = "psu2",
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ 		.mask = BIT(1),
+-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ 	},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch b/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch
new file mode 100644
index 00000000000..f98c879b17b
--- /dev/null
+++ b/queue-5.10/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch
@@ -0,0 +1,56 @@
+From ad4d07efd8c9ae68c94a5b0764ea104ccc0b00fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 12:10:56 +0200
+Subject: platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform
+ configuration
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]
+
+Remove PSU EEPROM configuration for systems class equipped with
+Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
+all the systems from this class used few types of power units, all
+equipped with EEPROM device with address space two bytes. Thus, all
+these devices have been handled by EEPROM driver "24c02".
+
+There is a new requirement is to support power unit replacement by "off
+the shelf" device, matching electrical required parameters. Such device
+can be equipped with different EEPROM type, which could be one byte
+address space addressing or even could be not equipped with EEPROM.
+In such case "24c02" will not work.
+
+Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 623e7f737d4ab..598f445587649 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -601,15 +601,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
+ 		.label = "psu1",
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ 		.mask = BIT(0),
+-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ 	},
+ 	{
+ 		.label = "psu2",
+ 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ 		.mask = BIT(1),
+-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ 	},
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch b/queue-5.10/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch
new file mode 100644
index 00000000000..09ee2e3aff6
--- /dev/null
+++ b/queue-5.10/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch
@@ -0,0 +1,102 @@
+From fe2233c120e0fa6850bfeb215b82b3f48b4589c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 13:13:12 +0100
+Subject: power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]
+
+Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling
+for HP Pavilion x2 10") added special handling for HP Pavilion x2 10
+models which use the weird combination of a Type-C connector and the
+non Type-C aware AXP288 PMIC.
+
+This special handling was activated by a DMI match a the product-name
+of "HP Pavilion x2 Detachable". Recently I've learned that there are
+also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC +
+a micro-usb connector where we should not activate the special handling
+for the Type-C connectors.
+
+Extend the matching to also match on the DMI board-name and match on the
+2 boards (one Bay Trail based one Cherry Trail based) of which we are
+certain that they use the AXP288 + Type-C connector combination.
+
+Note the DSDT code from these older (AXP288 + micro-USB) models contains
+some AML code (which never runs under Linux) which reads the micro-USB
+connector id-pin and if it is pulled to ground, which would normally mean
+the port is in host mode!, then it sets the input-current-limit to 3A,
+it seems HP is using the micro-USB port as a charging only connector
+and identifies their own 3A capable charger though this hack which is a
+major violation of the USB specs. Note HP also hardcodes a 2A limit
+when the id-pin is not pulled to ground, which is also in violation
+of the specs.
+
+I've no intention to add support for HP's hack to support 3A charging
+on these older models. By making the DMI matches for the Type-C equipped
+models workaround more tighter, these older models will be treated just
+like any other AXP288 + micro-USB equipped device and the input-current
+limit will follow the BC 1.2 spec (using the defacto standard values
+there where the BC 1.2 spec defines a range).
+
+Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10")
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
+index 9d981b76c1e72..a4df1ea923864 100644
+--- a/drivers/power/supply/axp288_charger.c
++++ b/drivers/power/supply/axp288_charger.c
+@@ -548,14 +548,15 @@ out:
+ 
+ /*
+  * The HP Pavilion x2 10 series comes in a number of variants:
+- * Bay Trail SoC    + AXP288 PMIC, DMI_BOARD_NAME: "815D"
+- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
+- * Cherry Trail SoC + TI PMIC,     DMI_BOARD_NAME: "827C" or "82F4"
++ * Bay Trail SoC    + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
++ * Bay Trail SoC    + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "815D"
++ * Cherry Trail SoC + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "813E"
++ * Cherry Trail SoC + TI PMIC,     Type-C,    DMI_BOARD_NAME: "827C" or "82F4"
+  *
+- * The variants with the AXP288 PMIC are all kinds of special:
++ * The variants with the AXP288 + Type-C connector are all kinds of special:
+  *
+- * 1. All variants use a Type-C connector which the AXP288 does not support, so
+- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
++ * 1. They use a Type-C connector which the AXP288 does not support, so when
++ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+  * this model actually has mostly working ACPI AC / Battery code, the ACPI code
+  * "solves" this by simply setting the input_current_limit to 3A.
+  * There are still some issues with the ACPI code, so we use this native driver,
+@@ -578,12 +579,17 @@ out:
+  */
+ static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
+ 	{
+-		/*
+-		 * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
+-		 * Trail model has "HP", so we only match on product_name.
+-		 */
+ 		.matches = {
+-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
++		},
++	},
++	{
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++			DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
+ 		},
+ 	},
+ 	{} /* Terminating entry */
+-- 
+2.27.0
+
diff --git a/queue-5.10/power-supply-bq24190_charger-fix-reference-leak.patch b/queue-5.10/power-supply-bq24190_charger-fix-reference-leak.patch
new file mode 100644
index 00000000000..e3b1179e63b
--- /dev/null
+++ b/queue-5.10/power-supply-bq24190_charger-fix-reference-leak.patch
@@ -0,0 +1,91 @@
+From 2a4c688d2556a148eca403664bd7adecfad8dfcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:33:21 +0800
+Subject: power: supply: bq24190_charger: fix reference leak
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to call pm_runtime_put_noidle will result
+in reference leak in callers(bq24190_sysfs_show,
+bq24190_charger_get_property, bq24190_charger_set_property,
+bq24190_battery_get_property, bq24190_battery_set_property),
+so we should fix it.
+
+Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index d14186525e1e9..845af0f44c022 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -448,8 +448,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	ret = pm_runtime_get_sync(bdi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(bdi->dev);
+ 		return ret;
++	}
+ 
+ 	ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
+ 	if (ret)
+@@ -1077,8 +1079,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
+ 	dev_dbg(bdi->dev, "prop: %d\n", psp);
+ 
+ 	ret = pm_runtime_get_sync(bdi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(bdi->dev);
+ 		return ret;
++	}
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_CHARGE_TYPE:
+@@ -1149,8 +1153,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
+ 	dev_dbg(bdi->dev, "prop: %d\n", psp);
+ 
+ 	ret = pm_runtime_get_sync(bdi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(bdi->dev);
+ 		return ret;
++	}
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_ONLINE:
+@@ -1410,8 +1416,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
+ 	dev_dbg(bdi->dev, "prop: %d\n", psp);
+ 
+ 	ret = pm_runtime_get_sync(bdi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(bdi->dev);
+ 		return ret;
++	}
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_STATUS:
+@@ -1456,8 +1464,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
+ 	dev_dbg(bdi->dev, "prop: %d\n", psp);
+ 
+ 	ret = pm_runtime_get_sync(bdi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(bdi->dev);
+ 		return ret;
++	}
+ 
+ 	switch (psp) {
+ 	case POWER_SUPPLY_PROP_ONLINE:
+-- 
+2.27.0
+
diff --git a/queue-5.10/power-supply-bq25890-use-the-correct-range-for-iilim.patch b/queue-5.10/power-supply-bq25890-use-the-correct-range-for-iilim.patch
new file mode 100644
index 00000000000..e53864b41e1
--- /dev/null
+++ b/queue-5.10/power-supply-bq25890-use-the-correct-range-for-iilim.patch
@@ -0,0 +1,40 @@
+From 0eeba984c38557125211cc7c10bc491fe354ef89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 04:48:05 +0100
+Subject: power: supply: bq25890: Use the correct range for IILIM register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit d4e9e7b6f7ae37a99bc11ce9efe6e8bdc711362f ]
+
+I've checked bq25890, bq25892, bq25895 and bq25896 datasheets and
+they all define IILIM to be between 100mA-3.25A with 50mA steps.
+
+Fixes: 478efc79ee32 ("power: bq25890: implement INPUT_CURRENT_LIMIT property")
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Reviewed-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq25890_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c
+index 34c21c51bac10..945c3257ca931 100644
+--- a/drivers/power/supply/bq25890_charger.c
++++ b/drivers/power/supply/bq25890_charger.c
+@@ -299,7 +299,7 @@ static const union {
+ 	/* TODO: BQ25896 has max ICHG 3008 mA */
+ 	[TBL_ICHG] =	{ .rt = {0,	  5056000, 64000} },	 /* uA */
+ 	[TBL_ITERM] =	{ .rt = {64000,   1024000, 64000} },	 /* uA */
+-	[TBL_IILIM] =   { .rt = {50000,   3200000, 50000} },	 /* uA */
++	[TBL_IILIM] =   { .rt = {100000,  3250000, 50000} },	 /* uA */
+ 	[TBL_VREG] =	{ .rt = {3840000, 4608000, 16000} },	 /* uV */
+ 	[TBL_BOOSTV] =	{ .rt = {4550000, 5510000, 64000} },	 /* uV */
+ 	[TBL_SYSVMIN] = { .rt = {3000000, 3700000, 100000} },	 /* uV */
+-- 
+2.27.0
+
diff --git a/queue-5.10/power-supply-max17042_battery-fix-current_-avg-now-h.patch b/queue-5.10/power-supply-max17042_battery-fix-current_-avg-now-h.patch
new file mode 100644
index 00000000000..ff08d7ca0d6
--- /dev/null
+++ b/queue-5.10/power-supply-max17042_battery-fix-current_-avg-now-h.patch
@@ -0,0 +1,41 @@
+From 225a15b1ad6d853dabb5d0f5abd00ce55ab935eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 05:44:44 +0100
+Subject: power: supply: max17042_battery: Fix current_{avg,now} hiding with no
+ current sense
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit 4b0a56e692503692da6555337a697c17feabbb3e ]
+
+When current sense is disabled, max17042_no_current_sense_psy_desc gets
+used which ignores two last properties from the list.
+
+Fixes: 21b01cc879cc ("power: supply: max17042_battery: Add support for the TTE_NOW prop")
+Reported-by: Timon Baetz <timon.baetz@protonmail.com>
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max17042_battery.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index f284547913d6f..2e9672fe4df1f 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -85,9 +85,10 @@ static enum power_supply_property max17042_battery_props[] = {
+ 	POWER_SUPPLY_PROP_TEMP_MAX,
+ 	POWER_SUPPLY_PROP_HEALTH,
+ 	POWER_SUPPLY_PROP_SCOPE,
++	POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
++	// these two have to be at the end on the list
+ 	POWER_SUPPLY_PROP_CURRENT_NOW,
+ 	POWER_SUPPLY_PROP_CURRENT_AVG,
+-	POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
+ };
+ 
+ static int max17042_get_temperature(struct max17042_chip *chip, int *temp)
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-32s-fix-cleanup_cpu_mmu_context-compile-bug.patch b/queue-5.10/powerpc-32s-fix-cleanup_cpu_mmu_context-compile-bug.patch
new file mode 100644
index 00000000000..4828e309d42
--- /dev/null
+++ b/queue-5.10/powerpc-32s-fix-cleanup_cpu_mmu_context-compile-bug.patch
@@ -0,0 +1,47 @@
+From 37e98b563db9ef5ecbfbda52f41581ae94314eff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 12:57:20 +1100
+Subject: powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit c1bea0a840ac75dca19bc6aa05575a33eb9fd058 ]
+
+Currently pmac32_defconfig with SMP=y doesn't build:
+
+  arch/powerpc/platforms/powermac/smp.c:
+  error: implicit declaration of function 'cleanup_cpu_mmu_context'
+
+It would be nice for consistency if all platforms clear mm_cpumask and
+flush TLBs on unplug, but the TLB invalidation bug described in commit
+01b0f0eae081 ("powerpc/64s: Trim offlined CPUs from mm_cpumasks") only
+applies to 64s and for now we only have the TLB flush code for that
+platform.
+
+So just add an empty version for 32-bit Book3S.
+
+Fixes: 01b0f0eae081 ("powerpc/64s: Trim offlined CPUs from mm_cpumasks")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Change log based on comments from Nick]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/32/mmu-hash.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/include/asm/book3s/32/mmu-hash.h b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+index 2e277ca0170fb..a8982d52f6b1d 100644
+--- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h
++++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+@@ -94,6 +94,7 @@ typedef struct {
+ } mm_context_t;
+ 
+ void update_bats(void);
++static inline void cleanup_cpu_mmu_context(void) { };
+ 
+ /* patch sites */
+ extern s32 patch__hash_page_A0, patch__hash_page_A1, patch__hash_page_A2;
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch b/queue-5.10/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch
new file mode 100644
index 00000000000..cd21b0714ca
--- /dev/null
+++ b/queue-5.10/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch
@@ -0,0 +1,41 @@
+From ac0724890c6b549b632564bc61c92feed2578159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 11:44:04 +1100
+Subject: powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+[ Upstream commit fe18a35e685c9bdabc8b11b3e19deb85a068b75d ]
+
+Commit 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard
+trap") added an EMIT_BUG_ENTRY for the trap after the branch to
+start_kernel(). The EMIT_BUG_ENTRY was for the address "0b", however the
+trap was not labeled with "0". Hence the address used for bug is in
+relative_toc() where the previous "0" label is. Label the trap as "0" so
+the correct address is used.
+
+Fixes: 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard trap")
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201130004404.30953-1-jniethe5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_64.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 7b7c8c5ee6602..2d6581db0c7b6 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -990,7 +990,7 @@ start_here_common:
+ 	bl	start_kernel
+ 
+ 	/* Not reached */
+-	trap
++0:	trap
+ 	EMIT_BUG_ENTRY 0b, __FILE__, __LINE__, 0
+ 	.previous
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch b/queue-5.10/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch
new file mode 100644
index 00000000000..823058200aa
--- /dev/null
+++ b/queue-5.10/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch
@@ -0,0 +1,105 @@
+From 89f961a31735da0096f084bc8733770ea268b4f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Oct 2020 18:28:36 +1100
+Subject: powerpc/64: Set up a kernel stack for secondaries before
+ cpu_restore()
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]
+
+Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
+is called before a stack has been set up in r1. This was previously fine
+as the cpu_restore() functions were implemented in assembly and did not
+use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
+device tree binding for discovering CPU features") used
+__restore_cpu_cpufeatures() as the cpu_restore() function for a
+device-tree features based cputable entry. This is a C function and
+hence uses a stack in r1.
+
+generic_secondary_smp_init() is entered on the secondary cpus via the
+primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
+thread has its own stack. The OPAL call is ran in the primary's hardware
+thread. During the call, a job is scheduled on a secondary cpu that will
+start executing at the address of generic_secondary_smp_init().  Hence
+the value that will be left in r1 when the secondary cpu enters the
+kernel is part of that secondary cpu's individual OPAL stack. This means
+that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
+not horribly bad as each hardware thread has its own stack and the call
+that enters the kernel from OPAL never returns, but it is still wrong
+and should be corrected.
+
+Create the temp kernel stack before calling cpu_restore().
+
+As noted by mpe, for a kexec boot, the secondary CPUs are released from
+the spin loop at address 0x60 by smp_release_cpus() and then jump to
+generic_secondary_smp_init(). The call to smp_release_cpus() is in
+setup_arch(), and it comes before the call to emergency_stack_init().
+emergency_stack_init() allocates an emergency stack in the PACA for each
+CPU.  This address in the PACA is what is used to set up the temp kernel
+stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
+to after the PACAs have been allocated an emergency stack, otherwise the
+PACA stack pointer will contain garbage and hence the temp kernel stack
+created from it will be broken.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_64.S      | 8 ++++----
+ arch/powerpc/kernel/setup-common.c | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 1510b2a56669f..7b7c8c5ee6602 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -417,6 +417,10 @@ generic_secondary_common_init:
+ 	/* From now on, r24 is expected to be logical cpuid */
+ 	mr	r24,r5
+ 
++	/* Create a temp kernel stack for use before relocation is on.	*/
++	ld	r1,PACAEMERGSP(r13)
++	subi	r1,r1,STACK_FRAME_OVERHEAD
++
+ 	/* See if we need to call a cpu state restore handler */
+ 	LOAD_REG_ADDR(r23, cur_cpu_spec)
+ 	ld	r23,0(r23)
+@@ -445,10 +449,6 @@ generic_secondary_common_init:
+ 	sync				/* order paca.run and cur_cpu_spec */
+ 	isync				/* In case code patching happened */
+ 
+-	/* Create a temp kernel stack for use before relocation is on.	*/
+-	ld	r1,PACAEMERGSP(r13)
+-	subi	r1,r1,STACK_FRAME_OVERHEAD
+-
+ 	b	__secondary_start
+ #endif /* SMP */
+ 
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 808ec9fab6052..da8c71f321ad3 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -919,8 +919,6 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	/* On BookE, setup per-core TLB data structures. */
+ 	setup_tlb_core_data();
+-
+-	smp_release_cpus();
+ #endif
+ 
+ 	/* Print various info about the machine that has been gathered so far. */
+@@ -944,6 +942,8 @@ void __init setup_arch(char **cmdline_p)
+ 	exc_lvl_early_init();
+ 	emergency_stack_init();
+ 
++	smp_release_cpus();
++
+ 	initmem_init();
+ 
+ 	early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT);
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-avoid-broken-gcc-__attribute__-optimize.patch b/queue-5.10/powerpc-avoid-broken-gcc-__attribute__-optimize.patch
new file mode 100644
index 00000000000..4b134cc7089
--- /dev/null
+++ b/queue-5.10/powerpc-avoid-broken-gcc-__attribute__-optimize.patch
@@ -0,0 +1,108 @@
+From 52af646592d2f507b99db2587fbd7158129bc3f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 09:04:33 +0100
+Subject: powerpc: Avoid broken GCC __attribute__((optimize))
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit a7223f5bfcaeade4a86d35263493bcda6c940891 ]
+
+Commit 7053f80d9696 ("powerpc/64: Prevent stack protection in early
+boot") introduced a couple of uses of __attribute__((optimize)) with
+function scope, to disable the stack protector in some early boot
+code.
+
+Unfortunately, and this is documented in the GCC man pages [0],
+overriding function attributes for optimization is broken, and is only
+supported for debug scenarios, not for production: the problem appears
+to be that setting GCC -f flags using this method will cause it to
+forget about some or all other optimization settings that have been
+applied.
+
+So the only safe way to disable the stack protector is to disable it
+for the entire source file.
+
+[0] https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html
+
+Fixes: 7053f80d9696 ("powerpc/64: Prevent stack protection in early boot")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+[mpe: Drop one remaining use of __nostackprotector, reported by snowpatch]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201028080433.26799-1-ardb@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/Makefile   | 3 +++
+ arch/powerpc/kernel/paca.c     | 4 ++--
+ arch/powerpc/kernel/setup.h    | 6 ------
+ arch/powerpc/kernel/setup_64.c | 2 +-
+ 4 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index bf0bf1b900d21..fe2ef598e2ead 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -173,6 +173,9 @@ KCOV_INSTRUMENT_cputable.o := n
+ KCOV_INSTRUMENT_setup_64.o := n
+ KCOV_INSTRUMENT_paca.o := n
+ 
++CFLAGS_setup_64.o		+= -fno-stack-protector
++CFLAGS_paca.o			+= -fno-stack-protector
++
+ extra-$(CONFIG_PPC_FPU)		+= fpu.o
+ extra-$(CONFIG_ALTIVEC)		+= vector.o
+ extra-$(CONFIG_PPC64)		+= entry_64.o
+diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
+index 0ad15768d762c..7f5aae3c387d2 100644
+--- a/arch/powerpc/kernel/paca.c
++++ b/arch/powerpc/kernel/paca.c
+@@ -208,7 +208,7 @@ static struct rtas_args * __init new_rtas_args(int cpu, unsigned long limit)
+ struct paca_struct **paca_ptrs __read_mostly;
+ EXPORT_SYMBOL(paca_ptrs);
+ 
+-void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int cpu)
++void __init initialise_paca(struct paca_struct *new_paca, int cpu)
+ {
+ #ifdef CONFIG_PPC_PSERIES
+ 	new_paca->lppaca_ptr = NULL;
+@@ -241,7 +241,7 @@ void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int
+ }
+ 
+ /* Put the paca pointer into r13 and SPRG_PACA */
+-void __nostackprotector setup_paca(struct paca_struct *new_paca)
++void setup_paca(struct paca_struct *new_paca)
+ {
+ 	/* Setup r13 */
+ 	local_paca = new_paca;
+diff --git a/arch/powerpc/kernel/setup.h b/arch/powerpc/kernel/setup.h
+index 2ec835574cc94..2dd0d9cb5a208 100644
+--- a/arch/powerpc/kernel/setup.h
++++ b/arch/powerpc/kernel/setup.h
+@@ -8,12 +8,6 @@
+ #ifndef __ARCH_POWERPC_KERNEL_SETUP_H
+ #define __ARCH_POWERPC_KERNEL_SETUP_H
+ 
+-#ifdef CONFIG_CC_IS_CLANG
+-#define __nostackprotector
+-#else
+-#define __nostackprotector __attribute__((__optimize__("no-stack-protector")))
+-#endif
+-
+ void initialize_cache_info(void);
+ void irqstack_early_init(void);
+ 
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 74fd47f46fa58..c28e949cc2229 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -283,7 +283,7 @@ void __init record_spr_defaults(void)
+  * device-tree is not accessible via normal means at this point.
+  */
+ 
+-void __init __nostackprotector early_setup(unsigned long dt_ptr)
++void __init early_setup(unsigned long dt_ptr)
+ {
+ 	static __initdata struct paca_struct boot_paca;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-boot-fix-build-of-dts-fsl.patch b/queue-5.10/powerpc-boot-fix-build-of-dts-fsl.patch
new file mode 100644
index 00000000000..2b367b0ed52
--- /dev/null
+++ b/queue-5.10/powerpc-boot-fix-build-of-dts-fsl.patch
@@ -0,0 +1,49 @@
+From 91abbf5ad727f3fcd1d8e1b7cb0071e9541e2fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 14:29:06 +1100
+Subject: powerpc/boot: Fix build of dts/fsl
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit b36f835b636908e4122f2e17310b1dbc380a3b19 ]
+
+The lkp robot reported that some configs fail to build, for example
+mpc85xx_smp_defconfig, with:
+
+  cc1: fatal error: opening output file arch/powerpc/boot/dts/fsl/.mpc8540ads.dtb.dts.tmp: No such file or directory
+
+This bisects to:
+  cc8a51ca6f05 ("kbuild: always create directories of targets")
+
+Although that commit claims to be about in-tree builds, it somehow
+breaks out-of-tree builds. But presumably it's just exposing a latent
+bug in our Makefiles.
+
+We can fix it by adding to targets for dts/fsl in the same way that we
+do for dts.
+
+Fixes: cc8a51ca6f05 ("kbuild: always create directories of targets")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201215032906.473460-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index f8ce6d2dde7b1..e4b364b5da9e7 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -368,6 +368,8 @@ initrd-y := $(filter-out $(image-y), $(initrd-y))
+ targets	+= $(image-y) $(initrd-y)
+ targets += $(foreach x, dtbImage uImage cuImage simpleImage treeImage, \
+ 		$(patsubst $(x).%, dts/%.dtb, $(filter $(x).%, $(image-y))))
++targets += $(foreach x, dtbImage uImage cuImage simpleImage treeImage, \
++		$(patsubst $(x).%, dts/fsl/%.dtb, $(filter $(x).%, $(image-y))))
+ 
+ $(addprefix $(obj)/, $(initrd-y)): $(obj)/ramdisk.image.gz
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch b/queue-5.10/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch
new file mode 100644
index 00000000000..46b7e84b75b
--- /dev/null
+++ b/queue-5.10/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch
@@ -0,0 +1,68 @@
+From ee2a8b4e52457182096d06f833f722e6aceb4141 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 18:07:12 +0000
+Subject: powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]
+
+On 8xx, we get the following features:
+
+[    0.000000] cpu_features      = 0x0000000000000100
+[    0.000000]   possible        = 0x0000000000000120
+[    0.000000]   always          = 0x0000000000000000
+
+This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
+other configurations, the three lines should be equal.
+
+The problem is due to CPU_FTRS_GENERIC_32 which is taken when
+CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
+pointless because there is no generic configuration supporting
+all 32 bits but book3s/32.
+
+Remove this pointless generic features definition to unbreak the
+calculation of 'possible' features and 'always' features.
+
+Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 3d2f94afc13ae..5e31960a56a9d 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -409,7 +409,6 @@ static inline void cpu_feature_keys_init(void) { }
+ 	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
+ 	    CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
+ 	    CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
+-#define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
+ 
+ /* 64-bit CPUs */
+ #define CPU_FTRS_PPC970	(CPU_FTR_LWSYNC | \
+@@ -520,8 +519,6 @@ enum {
+ 	    CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
+ 	    CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
+ 	    CPU_FTRS_CLASSIC32 |
+-#else
+-	    CPU_FTRS_GENERIC_32 |
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ 	    CPU_FTRS_8XX |
+@@ -596,8 +593,6 @@ enum {
+ 	    CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
+ 	    CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
+ 	    CPU_FTRS_CLASSIC32 &
+-#else
+-	    CPU_FTRS_GENERIC_32 &
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ 	    CPU_FTRS_8XX &
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch b/queue-5.10/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch
new file mode 100644
index 00000000000..058668b694b
--- /dev/null
+++ b/queue-5.10/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch
@@ -0,0 +1,62 @@
+From 2d4b1a911db03ae37e9bbe7e2e4a9eb20cdb9a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 05:29:21 +0000
+Subject: powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7ceb40027e19567a0a066e3b380cc034cdd9a124 ]
+
+The verification and message introduced by commit 374f3f5979f9
+("powerpc/mm/hash: Handle user access of kernel address gracefully")
+applies to all platforms, it should not be limited to BOOK3S.
+
+Make the BOOK3S version of sanity_check_fault() the one for all,
+and bail out earlier if not BOOK3S.
+
+Fixes: 374f3f5979f9 ("powerpc/mm/hash: Handle user access of kernel address gracefully")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/fe199d5af3578d3bf80035d203a94d742a7a28af.1607491748.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 0add963a849b3..72e1b51beb10c 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -303,7 +303,6 @@ static inline void cmo_account_page_fault(void)
+ static inline void cmo_account_page_fault(void) { }
+ #endif /* CONFIG_PPC_SMLPAR */
+ 
+-#ifdef CONFIG_PPC_BOOK3S
+ static void sanity_check_fault(bool is_write, bool is_user,
+ 			       unsigned long error_code, unsigned long address)
+ {
+@@ -320,6 +319,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
+ 		return;
+ 	}
+ 
++	if (!IS_ENABLED(CONFIG_PPC_BOOK3S))
++		return;
++
+ 	/*
+ 	 * For hash translation mode, we should never get a
+ 	 * PROTFAULT. Any update to pte to reduce access will result in us
+@@ -354,10 +356,6 @@ static void sanity_check_fault(bool is_write, bool is_user,
+ 
+ 	WARN_ON_ONCE(error_code & DSISR_PROTFAULT);
+ }
+-#else
+-static void sanity_check_fault(bool is_write, bool is_user,
+-			       unsigned long error_code, unsigned long address) { }
+-#endif /* CONFIG_PPC_BOOK3S */
+ 
+ /*
+  * Define the correct "is_write" bit in error_code based
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch b/queue-5.10/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch
new file mode 100644
index 00000000000..ab76fbb0e94
--- /dev/null
+++ b/queue-5.10/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch
@@ -0,0 +1,71 @@
+From 1233b3ed280b171e270210b282e875cc9d5cfed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 21:40:40 -0500
+Subject: powerpc/perf: Fix crash with is_sier_available when pmu is not set
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit f75e7d73bdf73f07b0701a6d21c111ef5d9021dd ]
+
+On systems without any specific PMU driver support registered, running
+'perf record' with —intr-regs  will crash ( perf record -I <workload> ).
+
+The relevant portion from crash logs and Call Trace:
+
+Unable to handle kernel paging request for data at address 0x00000068
+Faulting instruction address: 0xc00000000013eb18
+Oops: Kernel access of bad area, sig: 11 [#1]
+CPU: 2 PID: 13435 Comm: kill Kdump: loaded Not tainted 4.18.0-193.el8.ppc64le #1
+NIP:  c00000000013eb18 LR: c000000000139f2c CTR: c000000000393d80
+REGS: c0000004a07ab4f0 TRAP: 0300   Not tainted  (4.18.0-193.el8.ppc64le)
+NIP [c00000000013eb18] is_sier_available+0x18/0x30
+LR [c000000000139f2c] perf_reg_value+0x6c/0xb0
+Call Trace:
+[c0000004a07ab770] [c0000004a07ab7c8] 0xc0000004a07ab7c8 (unreliable)
+[c0000004a07ab7a0] [c0000000003aa77c] perf_output_sample+0x60c/0xac0
+[c0000004a07ab840] [c0000000003ab3f0] perf_event_output_forward+0x70/0xb0
+[c0000004a07ab8c0] [c00000000039e208] __perf_event_overflow+0x88/0x1a0
+[c0000004a07ab910] [c00000000039e42c] perf_swevent_hrtimer+0x10c/0x1d0
+[c0000004a07abc50] [c000000000228b9c] __hrtimer_run_queues+0x17c/0x480
+[c0000004a07abcf0] [c00000000022aaf4] hrtimer_interrupt+0x144/0x520
+[c0000004a07abdd0] [c00000000002a864] timer_interrupt+0x104/0x2f0
+[c0000004a07abe30] [c0000000000091c4] decrementer_common+0x114/0x120
+
+When perf record session is started with "-I" option, capturing registers
+on each sample calls is_sier_available() to check for the
+SIER (Sample Instruction Event Register) availability in the platform.
+This function in core-book3s accesses 'ppmu->flags'. If a platform specific
+PMU driver is not registered, ppmu is set to NULL and accessing its
+members results in a crash. Fix the crash by returning false in
+is_sier_available() if ppmu is not set.
+
+Fixes: 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER")
+Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1606185640-1720-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/core-book3s.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 08643cba14948..1de4770c2194b 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -137,6 +137,9 @@ static void pmao_restore_workaround(bool ebb) { }
+ 
+ bool is_sier_available(void)
+ {
++	if (!ppmu)
++		return false;
++
+ 	if (ppmu->flags & PPMU_HAS_SIER)
+ 		return true;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-perf-fix-the-pmu-group-constraints-for-thres.patch b/queue-5.10/powerpc-perf-fix-the-pmu-group-constraints-for-thres.patch
new file mode 100644
index 00000000000..8f1cb415ad8
--- /dev/null
+++ b/queue-5.10/powerpc-perf-fix-the-pmu-group-constraints-for-thres.patch
@@ -0,0 +1,67 @@
+From 09ca1719563ae01aa77f5558b8621a4136fdd56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 11:54:40 -0500
+Subject: powerpc/perf: Fix the PMU group constraints for threshold events in
+ power10
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 0263bbb377af0c2d38bc8b2ad2ff147e240094de ]
+
+The PMU group constraints mask for threshold events covers
+all thresholding bits which includes threshold control value
+(start/stop), select value as well as thresh_cmp value (MMCRA[9:18].
+In power9, thresh_cmp bits were part of the event code. But in case
+of power10, thresh_cmp bits are not part of event code due to
+inclusion of MMCR3 bits. Hence thresh_cmp is not valid for
+group constraints for power10.
+
+Fix the PMU group constraints checking for threshold events in
+power10 by using constraint mask and value for only threshold control
+and select bits.
+
+Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1606409684-1589-4-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 7 ++++++-
+ arch/powerpc/perf/isa207-common.h | 3 +++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 38ed450c78557..0f4983ef41036 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -351,7 +351,12 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ 		value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
+ 	}
+ 
+-	if (cpu_has_feature(CPU_FTR_ARCH_300))  {
++	if (cpu_has_feature(CPU_FTR_ARCH_31)) {
++		if (event_is_threshold(event)) {
++			mask  |= CNST_THRESH_CTL_SEL_MASK;
++			value |= CNST_THRESH_CTL_SEL_VAL(event >> EVENT_THRESH_SHIFT);
++		}
++	} else if (cpu_has_feature(CPU_FTR_ARCH_300))  {
+ 		if (event_is_threshold(event) && is_thresh_cmp_valid(event)) {
+ 			mask  |= CNST_THRESH_MASK;
+ 			value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT);
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index dc9c3d22fb38d..42087643c3331 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -149,6 +149,9 @@
+ #define CNST_THRESH_VAL(v)	(((v) & EVENT_THRESH_MASK) << 32)
+ #define CNST_THRESH_MASK	CNST_THRESH_VAL(EVENT_THRESH_MASK)
+ 
++#define CNST_THRESH_CTL_SEL_VAL(v)	(((v) & 0x7ffull) << 32)
++#define CNST_THRESH_CTL_SEL_MASK	CNST_THRESH_CTL_SEL_VAL(0x7ff)
++
+ #define CNST_EBB_VAL(v)		(((v) & EVENT_EBB_MASK) << 24)
+ #define CNST_EBB_MASK		CNST_EBB_VAL(EVENT_EBB_MASK)
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-perf-fix-threshold-event-counter-multiplier-.patch b/queue-5.10/powerpc-perf-fix-threshold-event-counter-multiplier-.patch
new file mode 100644
index 00000000000..c25e32d7073
--- /dev/null
+++ b/queue-5.10/powerpc-perf-fix-threshold-event-counter-multiplier-.patch
@@ -0,0 +1,61 @@
+From 535d5f9a7af96a0bb8987800c949b86ae5439e0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 03:56:18 -0500
+Subject: powerpc/perf: Fix Threshold Event Counter Multiplier width for P10
+
+From: Madhavan Srinivasan <maddy@linux.ibm.com>
+
+[ Upstream commit ef0e3b650f8ddc54bb70868852f50642ee3ae765 ]
+
+Threshold Event Counter Multiplier (TECM) is part of Monitor Mode
+Control Register A (MMCRA). This field along with Threshold Event
+Counter Exponent (TECE) is used to get threshould counter value.
+In Power10, this is a 8bit field, so patch fixes the
+current code to modify the MMCRA[TECM] extraction macro to
+handle this change. ISA v3.1 says this is a 7 bit field but
+POWER10 it's actually 8 bits which will hopefully be fixed
+in ISA v3.1 update.
+
+Fixes: 170a315f41c6 ("powerpc/perf: Support to export MMCRA[TEC*] field to userspace")
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1608022578-1532-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 3 +++
+ arch/powerpc/perf/isa207-common.h | 4 ++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 0f4983ef41036..e1a21d34c6e49 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -247,6 +247,9 @@ void isa207_get_mem_weight(u64 *weight)
+ 	u64 sier = mfspr(SPRN_SIER);
+ 	u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
+ 
++	if (cpu_has_feature(CPU_FTR_ARCH_31))
++		mantissa = P10_MMCRA_THR_CTR_MANT(mmcra);
++
+ 	if (val == 0 || val == 7)
+ 		*weight = 0;
+ 	else
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 42087643c3331..454b32c314406 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -231,6 +231,10 @@
+ #define MMCRA_THR_CTR_EXP(v)		(((v) >> MMCRA_THR_CTR_EXP_SHIFT) &\
+ 						MMCRA_THR_CTR_EXP_MASK)
+ 
++#define P10_MMCRA_THR_CTR_MANT_MASK	0xFFul
++#define P10_MMCRA_THR_CTR_MANT(v)	(((v) >> MMCRA_THR_CTR_MANT_SHIFT) &\
++						P10_MMCRA_THR_CTR_MANT_MASK)
++
+ /* MMCRA Threshold Compare bit constant for power9 */
+ #define p9_MMCRA_THR_CMP_SHIFT	45
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-perf-fix-to-update-radix_scope_qual-in-power.patch b/queue-5.10/powerpc-perf-fix-to-update-radix_scope_qual-in-power.patch
new file mode 100644
index 00000000000..67c1390f7fe
--- /dev/null
+++ b/queue-5.10/powerpc-perf-fix-to-update-radix_scope_qual-in-power.patch
@@ -0,0 +1,152 @@
+From 39cc2f817dc1b6bdab6cc069c9192ca16f687222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 11:54:38 -0500
+Subject: powerpc/perf: Fix to update radix_scope_qual in power10
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit d3afd28cd2f35b2a1046b76e0cf010b684da2e84 ]
+
+power10 uses bit 9 of the raw event code as RADIX_SCOPE_QUAL.
+This bit is used for enabling the radix process events.
+Patch fixes the PMU counter support functions to program bit
+18 of MMCR1 ( Monitor Mode Control Register1 ) with the
+RADIX_SCOPE_QUAL bit value. Since this field is not per-pmc,
+add this to PMU group constraints to make sure events in a
+group will have same bit value for this field. Use bit 21 as
+constraint bit field for radix_scope_qual. Patch also updates
+the power10 raw event encoding layout information, format field
+and constraints bit layout to include the radix_scope_qual bit.
+
+Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1606409684-1589-2-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 12 ++++++++++++
+ arch/powerpc/perf/isa207-common.h | 13 ++++++++++---
+ arch/powerpc/perf/power10-pmu.c   | 11 +++++++----
+ 3 files changed, 29 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 2848904df6383..f57f54f92c10f 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -339,6 +339,11 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ 		value |= CNST_L1_QUAL_VAL(cache);
+ 	}
+ 
++	if (cpu_has_feature(CPU_FTR_ARCH_31)) {
++		mask |= CNST_RADIX_SCOPE_GROUP_MASK;
++		value |= CNST_RADIX_SCOPE_GROUP_VAL(event >> p10_EVENT_RADIX_SCOPE_QUAL_SHIFT);
++	}
++
+ 	if (is_event_marked(event)) {
+ 		mask  |= CNST_SAMPLE_MASK;
+ 		value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
+@@ -456,6 +461,13 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
+ 			}
+ 		}
+ 
++		/* Set RADIX_SCOPE_QUAL bit */
++		if (cpu_has_feature(CPU_FTR_ARCH_31)) {
++			val = (event[i] >> p10_EVENT_RADIX_SCOPE_QUAL_SHIFT) &
++				p10_EVENT_RADIX_SCOPE_QUAL_MASK;
++			mmcr1 |= val << p10_MMCR1_RADIX_SCOPE_QUAL_SHIFT;
++		}
++
+ 		if (is_event_marked(event[i])) {
+ 			mmcra |= MMCRA_SAMPLE_ENABLE;
+ 
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 7025de5e60e7d..dc9c3d22fb38d 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -101,6 +101,9 @@
+ #define p10_EVENT_CACHE_SEL_MASK	0x3ull
+ #define p10_EVENT_MMCR3_MASK		0x7fffull
+ #define p10_EVENT_MMCR3_SHIFT		45
++#define p10_EVENT_RADIX_SCOPE_QUAL_SHIFT	9
++#define p10_EVENT_RADIX_SCOPE_QUAL_MASK	0x1
++#define p10_MMCR1_RADIX_SCOPE_QUAL_SHIFT	45
+ 
+ #define p10_EVENT_VALID_MASK		\
+ 	((p10_SDAR_MODE_MASK   << p10_SDAR_MODE_SHIFT		|	\
+@@ -112,6 +115,7 @@
+ 	(p9_EVENT_COMBINE_MASK << p9_EVENT_COMBINE_SHIFT)	|	\
+ 	(p10_EVENT_MMCR3_MASK  << p10_EVENT_MMCR3_SHIFT)	|	\
+ 	(EVENT_MARKED_MASK     << EVENT_MARKED_SHIFT)		|	\
++	(p10_EVENT_RADIX_SCOPE_QUAL_MASK << p10_EVENT_RADIX_SCOPE_QUAL_SHIFT)	|	\
+ 	 EVENT_LINUX_MASK					|	\
+ 	EVENT_PSEL_MASK))
+ /*
+@@ -125,9 +129,9 @@
+  *
+  *        28        24        20        16        12         8         4         0
+  * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
+- *               [ ] |   [ ]   [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
+- *                |  |    |                     |
+- *      BHRB IFM -*  |    |                     |      Count of events for each PMC.
++ *               [ ] |   [ ] |  [  sample ]   [     ]   [6] [5]   [4] [3]   [2] [1]
++ *                |  |    |  |                  |
++ *      BHRB IFM -*  |    |  |*radix_scope      |      Count of events for each PMC.
+  *              EBB -*    |                     |        p1, p2, p3, p4, p5, p6.
+  *      L1 I/D qualifier -*                     |
+  *                     nc - number of counters -*
+@@ -165,6 +169,9 @@
+ #define CNST_L2L3_GROUP_VAL(v)	(((v) & 0x1full) << 55)
+ #define CNST_L2L3_GROUP_MASK	CNST_L2L3_GROUP_VAL(0x1f)
+ 
++#define CNST_RADIX_SCOPE_GROUP_VAL(v)	(((v) & 0x1ull) << 21)
++#define CNST_RADIX_SCOPE_GROUP_MASK	CNST_RADIX_SCOPE_GROUP_VAL(1)
++
+ /*
+  * For NC we are counting up to 4 events. This requires three bits, and we need
+  * the fifth event to overflow and set the 4th bit. To achieve that we bias the
+diff --git a/arch/powerpc/perf/power10-pmu.c b/arch/powerpc/perf/power10-pmu.c
+index 9dbe8f9b89b4f..cf44fb7446130 100644
+--- a/arch/powerpc/perf/power10-pmu.c
++++ b/arch/powerpc/perf/power10-pmu.c
+@@ -23,10 +23,10 @@
+  *
+  *        28        24        20        16        12         8         4         0
+  * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - |
+- *   [   ] [  sample ]   [ ] [ ]   [ pmc ]   [unit ]   [ ]   m   [    pmcxsel    ]
+- *     |        |        |    |                        |     |
+- *     |        |        |    |                        |     *- mark
+- *     |        |        |    *- L1/L2/L3 cache_sel    |
++ *   [   ] [  sample ]   [ ] [ ]   [ pmc ]   [unit ]   [ ] |  m   [    pmcxsel    ]
++ *     |        |        |    |                        |   |  |
++ *     |        |        |    |                        |   |  *- mark
++ *     |        |        |    *- L1/L2/L3 cache_sel    |   |*-radix_scope_qual
+  *     |        |        sdar_mode                     |
+  *     |        *- sampling mode for marked events     *- combine
+  *     |
+@@ -59,6 +59,7 @@
+  *
+  * MMCR1[16] = cache_sel[0]
+  * MMCR1[17] = cache_sel[1]
++ * MMCR1[18] = radix_scope_qual
+  *
+  * if mark:
+  *	MMCRA[63]    = 1		(SAMPLE_ENABLE)
+@@ -175,6 +176,7 @@ PMU_FORMAT_ATTR(src_sel,        "config:45-46");
+ PMU_FORMAT_ATTR(invert_bit,     "config:47");
+ PMU_FORMAT_ATTR(src_mask,       "config:48-53");
+ PMU_FORMAT_ATTR(src_match,      "config:54-59");
++PMU_FORMAT_ATTR(radix_scope,	"config:9");
+ 
+ static struct attribute *power10_pmu_format_attr[] = {
+ 	&format_attr_event.attr,
+@@ -194,6 +196,7 @@ static struct attribute *power10_pmu_format_attr[] = {
+ 	&format_attr_invert_bit.attr,
+ 	&format_attr_src_mask.attr,
+ 	&format_attr_src_match.attr,
++	&format_attr_radix_scope.attr,
+ 	NULL,
+ };
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-perf-update-the-pmu-group-constraints-for-l2.patch b/queue-5.10/powerpc-perf-update-the-pmu-group-constraints-for-l2.patch
new file mode 100644
index 00000000000..d5a0c5c818c
--- /dev/null
+++ b/queue-5.10/powerpc-perf-update-the-pmu-group-constraints-for-l2.patch
@@ -0,0 +1,56 @@
+From f7c918e7d328a0fb8cf888490876a3e950464d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 11:54:39 -0500
+Subject: powerpc/perf: Update the PMU group constraints for l2l3 events in
+ power10
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit e924be7b0b0d1f37d0509c854a92c7a71e3cdfe7 ]
+
+In Power9, L2/L3 bus events are always available as a
+"bank" of 4 events. To obtain the counts for any of the
+l2/l3 bus events in a given bank, the user will have to
+program PMC4 with corresponding l2/l3 bus event for that
+bank.
+
+Commit 59029136d750 ("powerpc/perf: Add constraints for power9 l2/l3 bus events")
+enforced this rule in Power9. But this is not valid for
+Power10, since in Power10 Monitor Mode Control Register2
+(MMCR2) has bits to configure l2/l3 event bits. Hence remove
+this PMC4 constraint check from power10.
+
+Since the l2/l3 bits in MMCR2 are not per-pmc, patch handles
+group constrints checks for l2/l3 bits in MMCR2.
+
+Fixes: a64e697cef23 ("powerpc/perf: power10 Performance Monitoring support")
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1606409684-1589-3-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index f57f54f92c10f..38ed450c78557 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -311,9 +311,11 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ 	}
+ 
+ 	if (unit >= 6 && unit <= 9) {
+-		if (cpu_has_feature(CPU_FTR_ARCH_31) && (unit == 6)) {
+-			mask |= CNST_L2L3_GROUP_MASK;
+-			value |= CNST_L2L3_GROUP_VAL(event >> p10_L2L3_EVENT_SHIFT);
++		if (cpu_has_feature(CPU_FTR_ARCH_31)) {
++			if (unit == 6) {
++				mask |= CNST_L2L3_GROUP_MASK;
++				value |= CNST_L2L3_GROUP_VAL(event >> p10_L2L3_EVENT_SHIFT);
++			}
+ 		} else if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+ 			mask  |= CNST_CACHE_GROUP_MASK;
+ 			value |= CNST_CACHE_GROUP_VAL(event & 0xff);
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-powermac-fix-low_sleep_handler-with-config_v.patch b/queue-5.10/powerpc-powermac-fix-low_sleep_handler-with-config_v.patch
new file mode 100644
index 00000000000..6511b6cdb4c
--- /dev/null
+++ b/queue-5.10/powerpc-powermac-fix-low_sleep_handler-with-config_v.patch
@@ -0,0 +1,297 @@
+From 06911749bdd16e62b8a2e244e8e6a916b31c6036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 05:24:19 +0000
+Subject: powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit db972a3787d12b1ce9ba7a31ec376d8a79e04c47 ]
+
+low_sleep_handler() can't restore the context from standard
+stack because the stack can hardly be accessed with MMU OFF.
+
+Store everything in a global storage area instead of storing
+a pointer to the stack in that global storage area.
+
+To avoid a complete churn of the function, still use r1 as
+the pointer to the storage area during restore.
+
+Fixes: cd08f109e262 ("powerpc/32s: Enable CONFIG_VMAP_STACK")
+Reported-by: Giuseppe Sacco <giuseppe@sguazz.it>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Tested-by: Giuseppe Sacco <giuseppe@sguazz.it>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/e3e0d8042a3ba75cb4a9546c19c408b5b5b28994.1607404931.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/Kconfig.cputype  |   2 +-
+ arch/powerpc/platforms/powermac/sleep.S | 132 +++++++++++-------------
+ 2 files changed, 60 insertions(+), 74 deletions(-)
+
+diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
+index c194c4ae8bc7d..32a9c4c09b989 100644
+--- a/arch/powerpc/platforms/Kconfig.cputype
++++ b/arch/powerpc/platforms/Kconfig.cputype
+@@ -36,7 +36,7 @@ config PPC_BOOK3S_6xx
+ 	select PPC_HAVE_PMU_SUPPORT
+ 	select PPC_HAVE_KUEP
+ 	select PPC_HAVE_KUAP
+-	select HAVE_ARCH_VMAP_STACK if !ADB_PMU
++	select HAVE_ARCH_VMAP_STACK
+ 
+ config PPC_85xx
+ 	bool "Freescale 85xx"
+diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
+index 7e0f8ba6e54a5..d497a60003d2d 100644
+--- a/arch/powerpc/platforms/powermac/sleep.S
++++ b/arch/powerpc/platforms/powermac/sleep.S
+@@ -44,7 +44,8 @@
+ #define SL_TB		0xa0
+ #define SL_R2		0xa8
+ #define SL_CR		0xac
+-#define SL_R12		0xb0	/* r12 to r31 */
++#define SL_LR		0xb0
++#define SL_R12		0xb4	/* r12 to r31 */
+ #define SL_SIZE		(SL_R12 + 80)
+ 
+ 	.section .text
+@@ -63,105 +64,107 @@ _GLOBAL(low_sleep_handler)
+ 	blr
+ #else
+ 	mflr	r0
+-	stw	r0,4(r1)
+-	stwu	r1,-SL_SIZE(r1)
++	lis	r11,sleep_storage@ha
++	addi	r11,r11,sleep_storage@l
++	stw	r0,SL_LR(r11)
+ 	mfcr	r0
+-	stw	r0,SL_CR(r1)
+-	stw	r2,SL_R2(r1)
+-	stmw	r12,SL_R12(r1)
++	stw	r0,SL_CR(r11)
++	stw	r1,SL_SP(r11)
++	stw	r2,SL_R2(r11)
++	stmw	r12,SL_R12(r11)
+ 
+ 	/* Save MSR & SDR1 */
+ 	mfmsr	r4
+-	stw	r4,SL_MSR(r1)
++	stw	r4,SL_MSR(r11)
+ 	mfsdr1	r4
+-	stw	r4,SL_SDR1(r1)
++	stw	r4,SL_SDR1(r11)
+ 
+ 	/* Get a stable timebase and save it */
+ 1:	mftbu	r4
+-	stw	r4,SL_TB(r1)
++	stw	r4,SL_TB(r11)
+ 	mftb	r5
+-	stw	r5,SL_TB+4(r1)
++	stw	r5,SL_TB+4(r11)
+ 	mftbu	r3
+ 	cmpw	r3,r4
+ 	bne	1b
+ 
+ 	/* Save SPRGs */
+ 	mfsprg	r4,0
+-	stw	r4,SL_SPRG0(r1)
++	stw	r4,SL_SPRG0(r11)
+ 	mfsprg	r4,1
+-	stw	r4,SL_SPRG0+4(r1)
++	stw	r4,SL_SPRG0+4(r11)
+ 	mfsprg	r4,2
+-	stw	r4,SL_SPRG0+8(r1)
++	stw	r4,SL_SPRG0+8(r11)
+ 	mfsprg	r4,3
+-	stw	r4,SL_SPRG0+12(r1)
++	stw	r4,SL_SPRG0+12(r11)
+ 
+ 	/* Save BATs */
+ 	mfdbatu	r4,0
+-	stw	r4,SL_DBAT0(r1)
++	stw	r4,SL_DBAT0(r11)
+ 	mfdbatl	r4,0
+-	stw	r4,SL_DBAT0+4(r1)
++	stw	r4,SL_DBAT0+4(r11)
+ 	mfdbatu	r4,1
+-	stw	r4,SL_DBAT1(r1)
++	stw	r4,SL_DBAT1(r11)
+ 	mfdbatl	r4,1
+-	stw	r4,SL_DBAT1+4(r1)
++	stw	r4,SL_DBAT1+4(r11)
+ 	mfdbatu	r4,2
+-	stw	r4,SL_DBAT2(r1)
++	stw	r4,SL_DBAT2(r11)
+ 	mfdbatl	r4,2
+-	stw	r4,SL_DBAT2+4(r1)
++	stw	r4,SL_DBAT2+4(r11)
+ 	mfdbatu	r4,3
+-	stw	r4,SL_DBAT3(r1)
++	stw	r4,SL_DBAT3(r11)
+ 	mfdbatl	r4,3
+-	stw	r4,SL_DBAT3+4(r1)
++	stw	r4,SL_DBAT3+4(r11)
+ 	mfibatu	r4,0
+-	stw	r4,SL_IBAT0(r1)
++	stw	r4,SL_IBAT0(r11)
+ 	mfibatl	r4,0
+-	stw	r4,SL_IBAT0+4(r1)
++	stw	r4,SL_IBAT0+4(r11)
+ 	mfibatu	r4,1
+-	stw	r4,SL_IBAT1(r1)
++	stw	r4,SL_IBAT1(r11)
+ 	mfibatl	r4,1
+-	stw	r4,SL_IBAT1+4(r1)
++	stw	r4,SL_IBAT1+4(r11)
+ 	mfibatu	r4,2
+-	stw	r4,SL_IBAT2(r1)
++	stw	r4,SL_IBAT2(r11)
+ 	mfibatl	r4,2
+-	stw	r4,SL_IBAT2+4(r1)
++	stw	r4,SL_IBAT2+4(r11)
+ 	mfibatu	r4,3
+-	stw	r4,SL_IBAT3(r1)
++	stw	r4,SL_IBAT3(r11)
+ 	mfibatl	r4,3
+-	stw	r4,SL_IBAT3+4(r1)
++	stw	r4,SL_IBAT3+4(r11)
+ 
+ BEGIN_MMU_FTR_SECTION
+ 	mfspr	r4,SPRN_DBAT4U
+-	stw	r4,SL_DBAT4(r1)
++	stw	r4,SL_DBAT4(r11)
+ 	mfspr	r4,SPRN_DBAT4L
+-	stw	r4,SL_DBAT4+4(r1)
++	stw	r4,SL_DBAT4+4(r11)
+ 	mfspr	r4,SPRN_DBAT5U
+-	stw	r4,SL_DBAT5(r1)
++	stw	r4,SL_DBAT5(r11)
+ 	mfspr	r4,SPRN_DBAT5L
+-	stw	r4,SL_DBAT5+4(r1)
++	stw	r4,SL_DBAT5+4(r11)
+ 	mfspr	r4,SPRN_DBAT6U
+-	stw	r4,SL_DBAT6(r1)
++	stw	r4,SL_DBAT6(r11)
+ 	mfspr	r4,SPRN_DBAT6L
+-	stw	r4,SL_DBAT6+4(r1)
++	stw	r4,SL_DBAT6+4(r11)
+ 	mfspr	r4,SPRN_DBAT7U
+-	stw	r4,SL_DBAT7(r1)
++	stw	r4,SL_DBAT7(r11)
+ 	mfspr	r4,SPRN_DBAT7L
+-	stw	r4,SL_DBAT7+4(r1)
++	stw	r4,SL_DBAT7+4(r11)
+ 	mfspr	r4,SPRN_IBAT4U
+-	stw	r4,SL_IBAT4(r1)
++	stw	r4,SL_IBAT4(r11)
+ 	mfspr	r4,SPRN_IBAT4L
+-	stw	r4,SL_IBAT4+4(r1)
++	stw	r4,SL_IBAT4+4(r11)
+ 	mfspr	r4,SPRN_IBAT5U
+-	stw	r4,SL_IBAT5(r1)
++	stw	r4,SL_IBAT5(r11)
+ 	mfspr	r4,SPRN_IBAT5L
+-	stw	r4,SL_IBAT5+4(r1)
++	stw	r4,SL_IBAT5+4(r11)
+ 	mfspr	r4,SPRN_IBAT6U
+-	stw	r4,SL_IBAT6(r1)
++	stw	r4,SL_IBAT6(r11)
+ 	mfspr	r4,SPRN_IBAT6L
+-	stw	r4,SL_IBAT6+4(r1)
++	stw	r4,SL_IBAT6+4(r11)
+ 	mfspr	r4,SPRN_IBAT7U
+-	stw	r4,SL_IBAT7(r1)
++	stw	r4,SL_IBAT7(r11)
+ 	mfspr	r4,SPRN_IBAT7L
+-	stw	r4,SL_IBAT7+4(r1)
++	stw	r4,SL_IBAT7+4(r11)
+ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 
+ 	/* Backup various CPU config stuffs */
+@@ -180,9 +183,9 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 	lis	r5,grackle_wake_up@ha
+ 	addi	r5,r5,grackle_wake_up@l
+ 	tophys(r5,r5)
+-	stw	r5,SL_PC(r1)
++	stw	r5,SL_PC(r11)
+ 	lis	r4,KERNELBASE@h
+-	tophys(r5,r1)
++	tophys(r5,r11)
+ 	addi	r5,r5,SL_PC
+ 	lis	r6,MAGIC@ha
+ 	addi	r6,r6,MAGIC@l
+@@ -194,12 +197,6 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 	tophys(r3,r3)
+ 	stw	r3,0x80(r4)
+ 	stw	r5,0x84(r4)
+-	/* Store a pointer to our backup storage into
+-	 * a kernel global
+-	 */
+-	lis r3,sleep_storage@ha
+-	addi r3,r3,sleep_storage@l
+-	stw r5,0(r3)
+ 
+ 	.globl	low_cpu_offline_self
+ low_cpu_offline_self:
+@@ -279,7 +276,7 @@ _GLOBAL(core99_wake_up)
+ 	lis	r3,sleep_storage@ha
+ 	addi	r3,r3,sleep_storage@l
+ 	tophys(r3,r3)
+-	lwz	r1,0(r3)
++	addi	r1,r3,SL_PC
+ 
+ 	/* Pass thru to older resume code ... */
+ _ASM_NOKPROBE_SYMBOL(core99_wake_up)
+@@ -399,13 +396,6 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 	blt	1b
+ 	sync
+ 
+-	/* restore the MSR and turn on the MMU */
+-	lwz	r3,SL_MSR(r1)
+-	bl	turn_on_mmu
+-
+-	/* get back the stack pointer */
+-	tovirt(r1,r1)
+-
+ 	/* Restore TB */
+ 	li	r3,0
+ 	mttbl	r3
+@@ -419,28 +409,24 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+ 	mtcr	r0
+ 	lwz	r2,SL_R2(r1)
+ 	lmw	r12,SL_R12(r1)
+-	addi	r1,r1,SL_SIZE
+-	lwz	r0,4(r1)
+-	mtlr	r0
+-	blr
+-_ASM_NOKPROBE_SYMBOL(grackle_wake_up)
+ 
+-turn_on_mmu:
+-	mflr	r4
+-	tovirt(r4,r4)
++	/* restore the MSR and SP and turn on the MMU and return */
++	lwz	r3,SL_MSR(r1)
++	lwz	r4,SL_LR(r1)
++	lwz	r1,SL_SP(r1)
+ 	mtsrr0	r4
+ 	mtsrr1	r3
+ 	sync
+ 	isync
+ 	rfi
+-_ASM_NOKPROBE_SYMBOL(turn_on_mmu)
++_ASM_NOKPROBE_SYMBOL(grackle_wake_up)
+ 
+ #endif /* defined(CONFIG_PM) || defined(CONFIG_CPU_FREQ) */
+ 
+-	.section .data
++	.section .bss
+ 	.balign	L1_CACHE_BYTES
+ sleep_storage:
+-	.long 0
++	.space SL_SIZE
+ 	.balign	L1_CACHE_BYTES, 0
+ 
+ #endif /* CONFIG_PPC_BOOK3S_32 */
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-powernv-sriov-fix-unsigned-int-win-compared-.patch b/queue-5.10/powerpc-powernv-sriov-fix-unsigned-int-win-compared-.patch
new file mode 100644
index 00000000000..ea7b9ad1ec6
--- /dev/null
+++ b/queue-5.10/powerpc-powernv-sriov-fix-unsigned-int-win-compared-.patch
@@ -0,0 +1,45 @@
+From 68c79b7ff492e7543774aed344b95da3389876cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 19:19:30 +0800
+Subject: powerpc/powernv/sriov: fix unsigned int win compared to less than
+ zero
+
+From: Kaixu Xia <kaixuxia@tencent.com>
+
+[ Upstream commit 027717a45ca251a7ba67a63db359994836962cd2 ]
+
+Fix coccicheck warning:
+
+  arch/powerpc/platforms/powernv/pci-sriov.c:443:7-10:
+  WARNING: Unsigned expression compared with zero: win < 0
+
+  arch/powerpc/platforms/powernv/pci-sriov.c:462:7-10:
+  WARNING: Unsigned expression compared with zero: win < 0
+
+Fixes: 39efc03e3ee8 ("powerpc/powernv/sriov: Move M64 BAR allocation into a helper")
+Reported-by: Tosk Robot <tencent_os_robot@tencent.com>
+Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1605007170-22171-1-git-send-email-kaixuxia@tencent.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-sriov.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-sriov.c b/arch/powerpc/platforms/powernv/pci-sriov.c
+index c4434f20f42fa..28aac933a4391 100644
+--- a/arch/powerpc/platforms/powernv/pci-sriov.c
++++ b/arch/powerpc/platforms/powernv/pci-sriov.c
+@@ -422,7 +422,7 @@ static int pnv_pci_vf_assign_m64(struct pci_dev *pdev, u16 num_vfs)
+ {
+ 	struct pnv_iov_data   *iov;
+ 	struct pnv_phb        *phb;
+-	unsigned int           win;
++	int                    win;
+ 	struct resource       *res;
+ 	int                    i, j;
+ 	int64_t                rc;
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-ps3-use-dma_mapping_error.patch b/queue-5.10/powerpc-ps3-use-dma_mapping_error.patch
new file mode 100644
index 00000000000..5b62f06cf70
--- /dev/null
+++ b/queue-5.10/powerpc-ps3-use-dma_mapping_error.patch
@@ -0,0 +1,41 @@
+From ef642e203cd63a0f22449f326be8e0e976664986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 19:26:22 +0100
+Subject: powerpc/ps3: use dma_mapping_error()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]
+
+The DMA address returned by dma_map_single() should be checked with
+dma_mapping_error(). Fix the ps3stor_setup() function accordingly.
+
+Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ps3/ps3stor_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
+index 333ba83006e48..a12a1ad9b5fe3 100644
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -189,7 +189,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
+ 	dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
+ 	dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
+ 					 dev->bounce_size, DMA_BIDIRECTIONAL);
+-	if (!dev->bounce_dma) {
++	if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
+ 		dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
+ 			__func__, __LINE__);
+ 		error = -ENODEV;
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch b/queue-5.10/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch
new file mode 100644
index 00000000000..bf814b3d930
--- /dev/null
+++ b/queue-5.10/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch
@@ -0,0 +1,73 @@
+From 7a1672e6a85a1767dbc5f8bb97ff4318f8a0b1cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:51:49 -0600
+Subject: powerpc/pseries/hibernation: drop pseries_suspend_begin() from
+ suspend ops
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]
+
+There are three ways pseries_suspend_begin() can be reached:
+
+1. When "mem" is written to /sys/power/state:
+
+kobj_attr_store()
+-> state_store()
+  -> pm_suspend()
+    -> suspend_devices_and_enter()
+      -> pseries_suspend_begin()
+
+This never works because there is no way to supply a valid stream id
+using this interface, and H_VASI_STATE is called with a stream id of
+zero. So this call path is useless at best.
+
+2. When a stream id is written to /sys/devices/system/power/hibernate.
+pseries_suspend_begin() is polled directly from store_hibernate()
+until the stream is in the "Suspending" state (i.e. the platform is
+ready for the OS to suspend execution):
+
+dev_attr_store()
+-> store_hibernate()
+  -> pseries_suspend_begin()
+
+3. When a stream id is written to /sys/devices/system/power/hibernate
+(continued). After #2, pseries_suspend_begin() is called once again
+from the pm core:
+
+dev_attr_store()
+-> store_hibernate()
+  -> pm_suspend()
+    -> suspend_devices_and_enter()
+      -> pseries_suspend_begin()
+
+This is redundant because the VASI suspend state is already known to
+be Suspending.
+
+The begin() callback of platform_suspend_ops is optional, so we can
+simply remove that assignment with no loss of function.
+
+Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/suspend.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 81e0ac58d6204..3eaa9d59dc7ab 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -187,7 +187,6 @@ static struct bus_type suspend_subsys = {
+ 
+ static const struct platform_suspend_ops pseries_suspend_ops = {
+ 	.valid		= suspend_valid_only_mem,
+-	.begin		= pseries_suspend_begin,
+ 	.prepare_late	= pseries_prepare_late,
+ 	.enter		= pseries_suspend_enter,
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-pseries-hibernation-remove-redundant-cachein.patch b/queue-5.10/powerpc-pseries-hibernation-remove-redundant-cachein.patch
new file mode 100644
index 00000000000..4de8bbb4423
--- /dev/null
+++ b/queue-5.10/powerpc-pseries-hibernation-remove-redundant-cachein.patch
@@ -0,0 +1,53 @@
+From b2865d93f359212aeaf2a1b200665cb1f2cb81ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:51:56 -0600
+Subject: powerpc/pseries/hibernation: remove redundant cacheinfo update
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]
+
+Partitions with cache nodes in the device tree can encounter the
+following warning on resume:
+
+CPU 0 already accounted in PowerPC,POWER9@0(Data)
+WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820
+
+These calls to cacheinfo_cpu_offline/online have been redundant since
+commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo
+hierarchy post-migration").
+
+Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/suspend.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 3eaa9d59dc7ab..64b36a93c33a6 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -13,7 +13,6 @@
+ #include <asm/mmu.h>
+ #include <asm/rtas.h>
+ #include <asm/topology.h>
+-#include "../../kernel/cacheinfo.h"
+ 
+ static u64 stream_id;
+ static struct device suspend_dev;
+@@ -78,9 +77,7 @@ static void pseries_suspend_enable_irqs(void)
+ 	 * Update configuration which can be modified based on device tree
+ 	 * changes during resume.
+ 	 */
+-	cacheinfo_cpu_offline(smp_processor_id());
+ 	post_mobility_fixup();
+-	cacheinfo_cpu_online(smp_processor_id());
+ }
+ 
+ /**
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-smp-add-__init-to-init_big_cores.patch b/queue-5.10/powerpc-smp-add-__init-to-init_big_cores.patch
new file mode 100644
index 00000000000..7cb9bb0967e
--- /dev/null
+++ b/queue-5.10/powerpc-smp-add-__init-to-init_big_cores.patch
@@ -0,0 +1,45 @@
+From a2f5992a252c26d1a0b3bd82d9c502b2ee11bec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 08:41:54 +0100
+Subject: powerpc/smp: Add __init to init_big_cores()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit 9014eab6a38c60fd185bc92ed60f46cf99a462ab ]
+
+It fixes this link warning:
+
+WARNING: modpost: vmlinux.o(.text.unlikely+0x2d98): Section mismatch in reference from the function init_big_cores.isra.0() to the function .init.text:init_thread_group_cache_map()
+The function init_big_cores.isra.0() references
+the function __init init_thread_group_cache_map().
+This is often because init_big_cores.isra.0 lacks a __init
+annotation or the annotation of init_thread_group_cache_map is wrong.
+
+Fixes: 425752c63b6f ("powerpc: Detect the presence of big-cores via "ibm, thread-groups"")
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201221074154.403779-1-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 8c2857cbd9609..7d6cf75a7fd80 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -919,7 +919,7 @@ static struct sched_domain_topology_level powerpc_topology[] = {
+ 	{ NULL, },
+ };
+ 
+-static int init_big_cores(void)
++static int __init init_big_cores(void)
+ {
+ 	int cpu;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-sstep-cover-new-vsx-instructions-under-confi.patch b/queue-5.10/powerpc-sstep-cover-new-vsx-instructions-under-confi.patch
new file mode 100644
index 00000000000..aac8ef9b0d0
--- /dev/null
+++ b/queue-5.10/powerpc-sstep-cover-new-vsx-instructions-under-confi.patch
@@ -0,0 +1,54 @@
+From 476d781f2e844940d55f08692016af1bab967c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Oct 2020 10:39:05 +0530
+Subject: powerpc/sstep: Cover new VSX instructions under CONFIG_VSX
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 1817de2f141c718f1a0ae59927ec003e9b144349 ]
+
+Recently added Power10 prefixed VSX instruction are included
+unconditionally in the kernel. If they are executed on a
+machine without VSX support, it might create issues. Fix that.
+Also fix one mnemonics spelling mistake in comment.
+
+Fixes: 50b80a12e4cc ("powerpc sstep: Add support for prefixed load/stores")
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201011050908.72173-3-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index bf2cd3d42125d..b18bce1a209fa 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -2757,6 +2757,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 			case 41:	/* plwa */
+ 				op->type = MKOP(LOAD, PREFIXED | SIGNEXT, 4);
+ 				break;
++#ifdef CONFIG_VSX
+ 			case 42:        /* plxsd */
+ 				op->reg = rd + 32;
+ 				op->type = MKOP(LOAD_VSX, PREFIXED, 8);
+@@ -2797,13 +2798,14 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 				op->element_size = 16;
+ 				op->vsx_flags = VSX_CHECK_VEC;
+ 				break;
++#endif /* CONFIG_VSX */
+ 			case 56:        /* plq */
+ 				op->type = MKOP(LOAD, PREFIXED, 16);
+ 				break;
+ 			case 57:	/* pld */
+ 				op->type = MKOP(LOAD, PREFIXED, 8);
+ 				break;
+-			case 60:        /* stq */
++			case 60:        /* pstq */
+ 				op->type = MKOP(STORE, PREFIXED, 16);
+ 				break;
+ 			case 61:	/* pstd */
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-sstep-emulate-prefixed-instructions-only-whe.patch b/queue-5.10/powerpc-sstep-emulate-prefixed-instructions-only-whe.patch
new file mode 100644
index 00000000000..8cbf66b35a5
--- /dev/null
+++ b/queue-5.10/powerpc-sstep-emulate-prefixed-instructions-only-whe.patch
@@ -0,0 +1,54 @@
+From 33eb00e79d4373f17f2a8510fcf3b2d9e14601fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Oct 2020 10:39:04 +0530
+Subject: powerpc/sstep: Emulate prefixed instructions only when
+ CPU_FTR_ARCH_31 is set
+
+From: Balamuruhan S <bala24@linux.ibm.com>
+
+[ Upstream commit ef6879f8c8053cc3b493f400a06d452d7fb13650 ]
+
+Unconditional emulation of prefixed instructions will allow
+emulation of them on Power10 predecessors which might cause
+issues. Restrict that.
+
+Fixes: 3920742b92f5 ("powerpc sstep: Add support for prefixed fixed-point arithmetic")
+Fixes: 50b80a12e4cc ("powerpc sstep: Add support for prefixed load/stores")
+Signed-off-by: Balamuruhan S <bala24@linux.ibm.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Reviewed-by: Sandipan Das <sandipan@linux.ibm.com>
+Reviewed-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201011050908.72173-2-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 855457ed09b54..bf2cd3d42125d 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1346,6 +1346,9 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 	switch (opcode) {
+ #ifdef __powerpc64__
+ 	case 1:
++		if (!cpu_has_feature(CPU_FTR_ARCH_31))
++			return -1;
++
+ 		prefix_r = GET_PREFIX_R(word);
+ 		ra = GET_PREFIX_RA(suffix);
+ 		rd = (suffix >> 21) & 0x1f;
+@@ -2733,6 +2736,9 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ 		}
+ 		break;
+ 	case 1: /* Prefixed instructions */
++		if (!cpu_has_feature(CPU_FTR_ARCH_31))
++			return -1;
++
+ 		prefix_r = GET_PREFIX_R(word);
+ 		ra = GET_PREFIX_RA(suffix);
+ 		op->update_reg = ra;
+-- 
+2.27.0
+
diff --git a/queue-5.10/powerpc-xmon-fix-build-failure-for-8xx.patch b/queue-5.10/powerpc-xmon-fix-build-failure-for-8xx.patch
new file mode 100644
index 00000000000..99b42adc2d8
--- /dev/null
+++ b/queue-5.10/powerpc-xmon-fix-build-failure-for-8xx.patch
@@ -0,0 +1,49 @@
+From 1418bd602faf9ece28aa29aa57e1892cacda7fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 09:14:06 +0530
+Subject: powerpc/xmon: Fix build failure for 8xx
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit f3e90408019b353fd1fcd338091fb8d3c4a1c1a5 ]
+
+With CONFIG_PPC_8xx and CONFIG_XMON set, kernel build fails with
+
+  arch/powerpc/xmon/xmon.c:1379:12: error: 'find_free_data_bpt' defined
+  but not used [-Werror=unused-function]
+
+Fix it by enclosing find_free_data_bpt() inside #ifndef CONFIG_PPC_8xx.
+
+Fixes: 30df74d67d48 ("powerpc/watchpoint/xmon: Support 2nd DAWR")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201130034406.288047-1-ravi.bangoria@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 55c43a6c91112..5559edf36756c 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -1383,6 +1383,7 @@ static long check_bp_loc(unsigned long addr)
+ 	return 1;
+ }
+ 
++#ifndef CONFIG_PPC_8xx
+ static int find_free_data_bpt(void)
+ {
+ 	int i;
+@@ -1394,6 +1395,7 @@ static int find_free_data_bpt(void)
+ 	printf("Couldn't find free breakpoint register\n");
+ 	return -1;
+ }
++#endif
+ 
+ static void print_data_bpts(void)
+ {
+-- 
+2.27.0
+
diff --git a/queue-5.10/proc-fix-lookup-in-proc-net-subdirectories-after-set.patch b/queue-5.10/proc-fix-lookup-in-proc-net-subdirectories-after-set.patch
new file mode 100644
index 00000000000..cc8713aefe9
--- /dev/null
+++ b/queue-5.10/proc-fix-lookup-in-proc-net-subdirectories-after-set.patch
@@ -0,0 +1,173 @@
+From 5e23ed0eed62e5d951ab5057b9f8dc26c61d123f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 20:42:39 -0800
+Subject: proc: fix lookup in /proc/net subdirectories after setns(2)
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit c6c75deda81344c3a95d1d1f606d5cee109e5d54 ]
+
+Commit 1fde6f21d90f ("proc: fix /proc/net/* after setns(2)") only forced
+revalidation of regular files under /proc/net/
+
+However, /proc/net/ is unusual in the sense of /proc/net/foo handlers
+take netns pointer from parent directory which is old netns.
+
+Steps to reproduce:
+
+	(void)open("/proc/net/sctp/snmp", O_RDONLY);
+	unshare(CLONE_NEWNET);
+
+	int fd = open("/proc/net/sctp/snmp", O_RDONLY);
+	read(fd, &c, 1);
+
+Read will read wrong data from original netns.
+
+Patch forces lookup on every directory under /proc/net .
+
+Link: https://lkml.kernel.org/r/20201205160916.GA109739@localhost.localdomain
+Fixes: 1da4d377f943 ("proc: revalidate misc dentries")
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/generic.c       | 24 ++++++++++++++++++++++--
+ fs/proc/internal.h      |  7 +++++++
+ fs/proc/proc_net.c      | 16 ----------------
+ include/linux/proc_fs.h |  8 +++++++-
+ 4 files changed, 36 insertions(+), 19 deletions(-)
+
+diff --git a/fs/proc/generic.c b/fs/proc/generic.c
+index b84663252adda..6c0a05f55d6b1 100644
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -349,6 +349,16 @@ static const struct file_operations proc_dir_operations = {
+ 	.iterate_shared		= proc_readdir,
+ };
+ 
++static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
++{
++	return 0;
++}
++
++const struct dentry_operations proc_net_dentry_ops = {
++	.d_revalidate	= proc_net_d_revalidate,
++	.d_delete	= always_delete_dentry,
++};
++
+ /*
+  * proc directories can do almost nothing..
+  */
+@@ -471,8 +481,8 @@ struct proc_dir_entry *proc_symlink(const char *name,
+ }
+ EXPORT_SYMBOL(proc_symlink);
+ 
+-struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
+-		struct proc_dir_entry *parent, void *data)
++struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
++		struct proc_dir_entry *parent, void *data, bool force_lookup)
+ {
+ 	struct proc_dir_entry *ent;
+ 
+@@ -484,10 +494,20 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
+ 		ent->data = data;
+ 		ent->proc_dir_ops = &proc_dir_operations;
+ 		ent->proc_iops = &proc_dir_inode_operations;
++		if (force_lookup) {
++			pde_force_lookup(ent);
++		}
+ 		ent = proc_register(parent, ent);
+ 	}
+ 	return ent;
+ }
++EXPORT_SYMBOL_GPL(_proc_mkdir);
++
++struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
++		struct proc_dir_entry *parent, void *data)
++{
++	return _proc_mkdir(name, mode, parent, data, false);
++}
+ EXPORT_SYMBOL_GPL(proc_mkdir_data);
+ 
+ struct proc_dir_entry *proc_mkdir_mode(const char *name, umode_t mode,
+diff --git a/fs/proc/internal.h b/fs/proc/internal.h
+index 917cc85e34663..afbe96b6bf77d 100644
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -310,3 +310,10 @@ extern unsigned long task_statm(struct mm_struct *,
+ 				unsigned long *, unsigned long *,
+ 				unsigned long *, unsigned long *);
+ extern void task_mem(struct seq_file *, struct mm_struct *);
++
++extern const struct dentry_operations proc_net_dentry_ops;
++static inline void pde_force_lookup(struct proc_dir_entry *pde)
++{
++	/* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
++	pde->proc_dops = &proc_net_dentry_ops;
++}
+diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
+index ed8a6306990c4..1aa9236bf1af5 100644
+--- a/fs/proc/proc_net.c
++++ b/fs/proc/proc_net.c
+@@ -39,22 +39,6 @@ static struct net *get_proc_net(const struct inode *inode)
+ 	return maybe_get_net(PDE_NET(PDE(inode)));
+ }
+ 
+-static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+-{
+-	return 0;
+-}
+-
+-static const struct dentry_operations proc_net_dentry_ops = {
+-	.d_revalidate	= proc_net_d_revalidate,
+-	.d_delete	= always_delete_dentry,
+-};
+-
+-static void pde_force_lookup(struct proc_dir_entry *pde)
+-{
+-	/* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+-	pde->proc_dops = &proc_net_dentry_ops;
+-}
+-
+ static int seq_open_net(struct inode *inode, struct file *file)
+ {
+ 	unsigned int state_size = PDE(inode)->state_size;
+diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
+index 270cab43ca3da..000cc0533c336 100644
+--- a/include/linux/proc_fs.h
++++ b/include/linux/proc_fs.h
+@@ -80,6 +80,7 @@ extern void proc_flush_pid(struct pid *);
+ 
+ extern struct proc_dir_entry *proc_symlink(const char *,
+ 		struct proc_dir_entry *, const char *);
++struct proc_dir_entry *_proc_mkdir(const char *, umode_t, struct proc_dir_entry *, void *, bool);
+ extern struct proc_dir_entry *proc_mkdir(const char *, struct proc_dir_entry *);
+ extern struct proc_dir_entry *proc_mkdir_data(const char *, umode_t,
+ 					      struct proc_dir_entry *, void *);
+@@ -162,6 +163,11 @@ static inline struct proc_dir_entry *proc_symlink(const char *name,
+ static inline struct proc_dir_entry *proc_mkdir(const char *name,
+ 	struct proc_dir_entry *parent) {return NULL;}
+ static inline struct proc_dir_entry *proc_create_mount_point(const char *name) { return NULL; }
++static inline struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
++		struct proc_dir_entry *parent, void *data, bool force_lookup)
++{
++	return NULL;
++}
+ static inline struct proc_dir_entry *proc_mkdir_data(const char *name,
+ 	umode_t mode, struct proc_dir_entry *parent, void *data) { return NULL; }
+ static inline struct proc_dir_entry *proc_mkdir_mode(const char *name,
+@@ -199,7 +205,7 @@ struct net;
+ static inline struct proc_dir_entry *proc_net_mkdir(
+ 	struct net *net, const char *name, struct proc_dir_entry *parent)
+ {
+-	return proc_mkdir_data(name, 0, parent, net);
++	return _proc_mkdir(name, 0, parent, net, true);
+ }
+ 
+ struct ns_common;
+-- 
+2.27.0
+
diff --git a/queue-5.10/proc-mountinfo-make-splice-available-again.patch b/queue-5.10/proc-mountinfo-make-splice-available-again.patch
new file mode 100644
index 00000000000..f67cd804981
--- /dev/null
+++ b/queue-5.10/proc-mountinfo-make-splice-available-again.patch
@@ -0,0 +1,73 @@
+From aa543f188e7b8e73693381cb57737ee01fc67bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Dec 2020 10:56:33 -0800
+Subject: proc mountinfo: make splice available again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 14e3e989f6a5d9646b6cf60690499cc8bdc11f7d ]
+
+Since commit 36e2c7421f02 ("fs: don't allow splice read/write without
+explicit ops") we've required that file operation structures explicitly
+enable splice support, rather than falling back to the default handlers.
+
+Most /proc files use the indirect 'struct proc_ops' to describe their
+file operations, and were fixed up to support splice earlier in commits
+40be821d627c..b24c30c67863, but the mountinfo files interact with the
+VFS directly using their own 'struct file_operations' and got missed as
+a result.
+
+This adds the necessary support for splice to work for /proc/*/mountinfo
+and friends.
+
+Reported-by: Joan Bruguera Micó <joanbrugueram@gmail.com>
+Reported-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=209971
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc_namespace.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c
+index e59d4bb3a89e4..eafb75755fa37 100644
+--- a/fs/proc_namespace.c
++++ b/fs/proc_namespace.c
+@@ -320,7 +320,8 @@ static int mountstats_open(struct inode *inode, struct file *file)
+ 
+ const struct file_operations proc_mounts_operations = {
+ 	.open		= mounts_open,
+-	.read		= seq_read,
++	.read_iter	= seq_read_iter,
++	.splice_read	= generic_file_splice_read,
+ 	.llseek		= seq_lseek,
+ 	.release	= mounts_release,
+ 	.poll		= mounts_poll,
+@@ -328,7 +329,8 @@ const struct file_operations proc_mounts_operations = {
+ 
+ const struct file_operations proc_mountinfo_operations = {
+ 	.open		= mountinfo_open,
+-	.read		= seq_read,
++	.read_iter	= seq_read_iter,
++	.splice_read	= generic_file_splice_read,
+ 	.llseek		= seq_lseek,
+ 	.release	= mounts_release,
+ 	.poll		= mounts_poll,
+@@ -336,7 +338,8 @@ const struct file_operations proc_mountinfo_operations = {
+ 
+ const struct file_operations proc_mountstats_operations = {
+ 	.open		= mountstats_open,
+-	.read		= seq_read,
++	.read_iter	= seq_read_iter,
++	.splice_read	= generic_file_splice_read,
+ 	.llseek		= seq_lseek,
+ 	.release	= mounts_release,
+ };
+-- 
+2.27.0
+
diff --git a/queue-5.10/pwm-imx27-fix-overflow-for-bigger-periods.patch b/queue-5.10/pwm-imx27-fix-overflow-for-bigger-periods.patch
new file mode 100644
index 00000000000..609a787bb48
--- /dev/null
+++ b/queue-5.10/pwm-imx27-fix-overflow-for-bigger-periods.patch
@@ -0,0 +1,49 @@
+From 8ab76d7724c43237712ca5de9ad15bf19776f764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:13:24 +0100
+Subject: pwm: imx27: Fix overflow for bigger periods
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <uwe@kleine-koenig.org>
+
+[ Upstream commit 1ce65396e6b2386b4fd54f87beff0647a772e1cd ]
+
+The second parameter of do_div is an u32 and NSEC_PER_SEC * prescale
+overflows this for bigger periods. Assuming the usual pwm input clk rate
+of 66 MHz this happens starting at requested period > 606060 ns.
+
+Splitting the division into two operations doesn't loose any precision.
+It doesn't need to be feared that c / NSEC_PER_SEC doesn't fit into the
+unsigned long variable "duty_cycles" because in this case the assignment
+above to period_cycles would already have been overflowing as
+period >= duty_cycle and then the calculation is moot anyhow.
+
+Fixes: aef1a3799b5c ("pwm: imx27: Fix rounding behavior")
+Signed-off-by: Uwe Kleine-König <uwe@kleine-koenig.org>
+Tested-by: Johannes Pointner <johannes.pointner@br-automation.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-imx27.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-imx27.c b/drivers/pwm/pwm-imx27.c
+index c50d453552bd4..86bcafd23e4f6 100644
+--- a/drivers/pwm/pwm-imx27.c
++++ b/drivers/pwm/pwm-imx27.c
+@@ -235,8 +235,9 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 
+ 	period_cycles /= prescale;
+ 	c = clkrate * state->duty_cycle;
+-	do_div(c, NSEC_PER_SEC * prescale);
++	do_div(c, NSEC_PER_SEC);
+ 	duty_cycles = c;
++	duty_cycles /= prescale;
+ 
+ 	/*
+ 	 * according to imx pwm RM, the real period value should be PERIOD
+-- 
+2.27.0
+
diff --git a/queue-5.10/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch b/queue-5.10/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch
new file mode 100644
index 00000000000..0c03c7fe98e
--- /dev/null
+++ b/queue-5.10/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch
@@ -0,0 +1,44 @@
+From 79f8478d447b3b3cacefef7b596fe2c9685a0b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 19:11:35 +0530
+Subject: pwm: lp3943: Dynamically allocate PWM chip base
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit 1f0f1e80fdd3aa9631f6c22cda4f8550cfcfcc3e ]
+
+When there are other PWM controllers enabled along with pwm-lp3943,
+pwm-lp3942 is failing to probe with -EEXIST error. This is because
+other PWM controllers are probed first and assigned PWM base 0 and
+pwm-lp3943 is requesting for 0 again.
+
+In order to avoid this, assign the chip base with -1, so that it is
+dynamically allocated.
+
+Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver")
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-könig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lp3943.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
+index 7551253ada32b..bf3f14fb5f244 100644
+--- a/drivers/pwm/pwm-lp3943.c
++++ b/drivers/pwm/pwm-lp3943.c
+@@ -275,6 +275,7 @@ static int lp3943_pwm_probe(struct platform_device *pdev)
+ 	lp3943_pwm->chip.dev = &pdev->dev;
+ 	lp3943_pwm->chip.ops = &lp3943_pwm_ops;
+ 	lp3943_pwm->chip.npwm = LP3943_NUM_PWMS;
++	lp3943_pwm->chip.base = -1;
+ 
+ 	platform_set_drvdata(pdev, lp3943_pwm);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/pwm-sun4i-remove-erroneous-else-branch.patch b/queue-5.10/pwm-sun4i-remove-erroneous-else-branch.patch
new file mode 100644
index 00000000000..95d4ccc674a
--- /dev/null
+++ b/queue-5.10/pwm-sun4i-remove-erroneous-else-branch.patch
@@ -0,0 +1,56 @@
+From 81ca53a84ec293697770b6f73391827807f1a65d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 18:33:55 +0100
+Subject: pwm: sun4i: Remove erroneous else branch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thierry Reding <thierry.reding@gmail.com>
+
+[ Upstream commit 6eefb79d6f5bc4086bd02c76f1072dd4a8d9d9f6 ]
+
+Commit d3817a647059 ("pwm: sun4i: Remove redundant needs_delay") changed
+the logic of an else branch so that the PWM_EN and PWM_CLK_GATING bits
+are now cleared if the PWM is to be disabled, whereas previously the
+condition was always false, and hence the branch never got executed.
+
+This code is reported causing backlight issues on boards based on the
+Allwinner A20 SoC. Fix this by removing the else branch, which restores
+the behaviour prior to the offending commit.
+
+Note that the PWM_EN and PWM_CLK_GATING bits still get cleared later in
+sun4i_pwm_apply() if the PWM is to be disabled.
+
+Fixes: d3817a647059 ("pwm: sun4i: Remove redundant needs_delay")
+Reported-by: Taras Galchenko <tpgalchenko@gmail.com>
+Suggested-by: Taras Galchenko <tpgalchenko@gmail.com>
+Tested-by: Taras Galchenko <tpgalchenko@gmail.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-sun4i.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-sun4i.c b/drivers/pwm/pwm-sun4i.c
+index 38a4c5c1317b2..482d5b9cec1fb 100644
+--- a/drivers/pwm/pwm-sun4i.c
++++ b/drivers/pwm/pwm-sun4i.c
+@@ -294,12 +294,8 @@ static int sun4i_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 
+ 	ctrl |= BIT_CH(PWM_CLK_GATING, pwm->hwpwm);
+ 
+-	if (state->enabled) {
++	if (state->enabled)
+ 		ctrl |= BIT_CH(PWM_EN, pwm->hwpwm);
+-	} else {
+-		ctrl &= ~BIT_CH(PWM_EN, pwm->hwpwm);
+-		ctrl &= ~BIT_CH(PWM_CLK_GATING, pwm->hwpwm);
+-	}
+ 
+ 	sun4i_pwm_writel(sun4i_pwm, ctrl, PWM_CTRL_REG);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/pwm-zx-add-missing-cleanup-in-error-path.patch b/queue-5.10/pwm-zx-add-missing-cleanup-in-error-path.patch
new file mode 100644
index 00000000000..0d7c2953370
--- /dev/null
+++ b/queue-5.10/pwm-zx-add-missing-cleanup-in-error-path.patch
@@ -0,0 +1,39 @@
+From b599040899a046ccafee6462e71e8852853f7bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 10:13:21 +0200
+Subject: pwm: zx: Add missing cleanup in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]
+
+zx_pwm_probe() called clk_prepare_enable() before; this must be undone
+in the error path.
+
+Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-zx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
+index e2c21cc34a96a..3763ce5311ac2 100644
+--- a/drivers/pwm/pwm-zx.c
++++ b/drivers/pwm/pwm-zx.c
+@@ -238,6 +238,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
+ 	ret = pwmchip_add(&zpc->chip);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
++		clk_disable_unprepare(zpc->pclk);
+ 		return ret;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/qlcnic-fix-error-code-in-probe.patch b/queue-5.10/qlcnic-fix-error-code-in-probe.patch
new file mode 100644
index 00000000000..82b89f5b747
--- /dev/null
+++ b/queue-5.10/qlcnic-fix-error-code-in-probe.patch
@@ -0,0 +1,36 @@
+From 81f98eeeb8190caf30288214cf2490b64c4da932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 11:38:04 +0300
+Subject: qlcnic: Fix error code in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]
+
+Return -EINVAL if we can't find the correct device.  Currently it
+returns success.
+
+Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index 5a7e240fd4698..c2faf96fcade8 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -2492,6 +2492,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		qlcnic_sriov_vf_register_map(ahw);
+ 		break;
+ 	default:
++		err = -EINVAL;
+ 		goto err_out_free_hw_res;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch b/queue-5.10/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch
new file mode 100644
index 00000000000..cbd78509aa4
--- /dev/null
+++ b/queue-5.10/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch
@@ -0,0 +1,52 @@
+From 8df8f76f3e018aeeb5df1cbfe1b5baef0a17ed6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 20:33:47 +0800
+Subject: qtnfmac: fix error return code in qtnf_pcie_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 31e07aa33fa7cdc93fa91c3f78f031e8d38862c2 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: b7da53cd6cd1 ("qtnfmac_pcie: use single PCIe driver for all platforms")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201114123347.29632-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+index 5337e67092ca6..0f328ce47fee3 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+@@ -299,19 +299,19 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	sysctl_bar = qtnf_map_bar(pdev, QTN_SYSCTL_BAR);
+ 	if (IS_ERR(sysctl_bar)) {
+ 		pr_err("failed to map BAR%u\n", QTN_SYSCTL_BAR);
+-		return ret;
++		return PTR_ERR(sysctl_bar);
+ 	}
+ 
+ 	dmareg_bar = qtnf_map_bar(pdev, QTN_DMA_BAR);
+ 	if (IS_ERR(dmareg_bar)) {
+ 		pr_err("failed to map BAR%u\n", QTN_DMA_BAR);
+-		return ret;
++		return PTR_ERR(dmareg_bar);
+ 	}
+ 
+ 	epmem_bar = qtnf_map_bar(pdev, QTN_SHMEM_BAR);
+ 	if (IS_ERR(epmem_bar)) {
+ 		pr_err("failed to map BAR%u\n", QTN_SHMEM_BAR);
+-		return ret;
++		return PTR_ERR(epmem_bar);
+ 	}
+ 
+ 	chipid = qtnf_chip_id_get(sysctl_bar);
+-- 
+2.27.0
+
diff --git a/queue-5.10/rcu-allow-rcu_irq_enter_check_tick-from-nmi.patch b/queue-5.10/rcu-allow-rcu_irq_enter_check_tick-from-nmi.patch
new file mode 100644
index 00000000000..281a2694998
--- /dev/null
+++ b/queue-5.10/rcu-allow-rcu_irq_enter_check_tick-from-nmi.patch
@@ -0,0 +1,49 @@
+From 7e53f5cda4c23307a92df1cec79f3ed91c2638d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 13:10:12 +0100
+Subject: rcu: Allow rcu_irq_enter_check_tick() from NMI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 6dbce04d8417ae706596366e16841d77c454ba52 ]
+
+Eugenio managed to tickle #PF from NMI context which resulted in
+hitting a WARN in RCU through irqentry_enter() ->
+__rcu_irq_enter_check_tick().
+
+However, this situation is perfectly sane and does not warrant an
+WARN. The #PF will (necessarily) be atomic and not require messing
+with the tick state, so early return is correct.  This commit
+therefore removes the WARN.
+
+Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
+Reported-by: "Eugenio Pérez" <eupm90@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index bd04b09b84b32..655ade095e043 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -928,8 +928,8 @@ void __rcu_irq_enter_check_tick(void)
+ {
+ 	struct rcu_data *rdp = this_cpu_ptr(&rcu_data);
+ 
+-	 // Enabling the tick is unsafe in NMI handlers.
+-	if (WARN_ON_ONCE(in_nmi()))
++	// If we're here from NMI there's nothing to do.
++	if (in_nmi())
+ 		return;
+ 
+ 	RCU_LOCKDEP_WARN(rcu_dynticks_curr_cpu_in_eqs(),
+-- 
+2.27.0
+
diff --git a/queue-5.10/rcu-ftrace-fix-ftrace-recursion.patch b/queue-5.10/rcu-ftrace-fix-ftrace-recursion.patch
new file mode 100644
index 00000000000..22fc7ec64f0
--- /dev/null
+++ b/queue-5.10/rcu-ftrace-fix-ftrace-recursion.patch
@@ -0,0 +1,50 @@
+From f084bb9751eef387f1bd2f76c89e173aa0881b14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Sep 2020 13:33:40 +0200
+Subject: rcu,ftrace: Fix ftrace recursion
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit d2098b4440981705e844c50254540ba7b5f82795 ]
+
+Kim reported that perf-ftrace made his box unhappy. It turns out that
+commit:
+
+  ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr")
+
+removed one too many notrace qualifiers, probably due to there not being
+a helpful comment.
+
+This commit therefore reinstates the notrace and adds a comment to avoid
+losing it again.
+
+[ paulmck: Apply Steven Rostedt's feedback on the comment. ]
+Fixes: ff5c4f5cad33 ("rcu/tree: Mark the idle relevant functions noinstr")
+Reported-by: Kim Phillips <kim.phillips@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 655ade095e043..585bf112ee08d 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -1093,8 +1093,11 @@ static void rcu_disable_urgency_upon_qs(struct rcu_data *rdp)
+  * CPU can safely enter RCU read-side critical sections.  In other words,
+  * if the current CPU is not in its idle loop or is in an interrupt or
+  * NMI handler, return true.
++ *
++ * Make notrace because it can be called by the internal functions of
++ * ftrace, and making this notrace removes unnecessary recursion calls.
+  */
+-bool rcu_is_watching(void)
++notrace bool rcu_is_watching(void)
+ {
+ 	bool ret;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rcu-tree-defer-kvfree_rcu-allocation-to-a-clean-cont.patch b/queue-5.10/rcu-tree-defer-kvfree_rcu-allocation-to-a-clean-cont.patch
new file mode 100644
index 00000000000..828f64717f0
--- /dev/null
+++ b/queue-5.10/rcu-tree-defer-kvfree_rcu-allocation-to-a-clean-cont.patch
@@ -0,0 +1,233 @@
+From 7eef2d7afb5da7182d38d7317f30755ae4b7598f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 17:50:04 +0100
+Subject: rcu/tree: Defer kvfree_rcu() allocation to a clean context
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+[ Upstream commit 56292e8609e39537297a7468dda4d87b9bd81d6a ]
+
+The current memmory-allocation interface causes the following difficulties
+for kvfree_rcu():
+
+a) If built with CONFIG_PROVE_RAW_LOCK_NESTING, the lockdep will
+   complain about violation of the nesting rules, as in "BUG: Invalid
+   wait context".  This Kconfig option checks for proper raw_spinlock
+   vs. spinlock nesting, in particular, it is not legal to acquire a
+   spinlock_t while holding a raw_spinlock_t.
+
+   This is a problem because kfree_rcu() uses raw_spinlock_t whereas the
+   "page allocator" internally deals with spinlock_t to access to its
+   zones. The code also can be broken from higher level of view:
+   <snip>
+       raw_spin_lock(&some_lock);
+       kfree_rcu(some_pointer, some_field_offset);
+   <snip>
+
+b) If built with CONFIG_PREEMPT_RT, spinlock_t is converted into
+   sleeplock.  This means that invoking the page allocator from atomic
+   contexts results in "BUG: scheduling while atomic".
+
+c) Please note that call_rcu() is already invoked from raw atomic context,
+   so it is only reasonable to expaect that kfree_rcu() and kvfree_rcu()
+   will also be called from atomic raw context.
+
+This commit therefore defers page allocation to a clean context using the
+combination of an hrtimer and a workqueue.  The hrtimer stage is required
+in order to avoid deadlocks with the scheduler.  This deferred allocation
+is required only when kvfree_rcu()'s per-CPU page cache is empty.
+
+Link: https://lore.kernel.org/lkml/20200630164543.4mdcf6zb4zfclhln@linutronix.de/
+Fixes: 3042f83f19be ("rcu: Support reclaim for head-less object")
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 109 ++++++++++++++++++++++++++++------------------
+ 1 file changed, 66 insertions(+), 43 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 585bf112ee08d..593df7edfe97f 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -177,7 +177,7 @@ module_param(rcu_unlock_delay, int, 0444);
+  * per-CPU. Object size is equal to one page. This value
+  * can be changed at boot time.
+  */
+-static int rcu_min_cached_objs = 2;
++static int rcu_min_cached_objs = 5;
+ module_param(rcu_min_cached_objs, int, 0444);
+ 
+ /* Retrieve RCU kthreads priority for rcutorture */
+@@ -3087,6 +3087,9 @@ struct kfree_rcu_cpu_work {
+  *	In order to save some per-cpu space the list is singular.
+  *	Even though it is lockless an access has to be protected by the
+  *	per-cpu lock.
++ * @page_cache_work: A work to refill the cache when it is empty
++ * @work_in_progress: Indicates that page_cache_work is running
++ * @hrtimer: A hrtimer for scheduling a page_cache_work
+  * @nr_bkv_objs: number of allocated objects at @bkvcache.
+  *
+  * This is a per-CPU structure.  The reason that it is not included in
+@@ -3103,6 +3106,11 @@ struct kfree_rcu_cpu {
+ 	bool monitor_todo;
+ 	bool initialized;
+ 	int count;
++
++	struct work_struct page_cache_work;
++	atomic_t work_in_progress;
++	struct hrtimer hrtimer;
++
+ 	struct llist_head bkvcache;
+ 	int nr_bkv_objs;
+ };
+@@ -3220,10 +3228,10 @@ static void kfree_rcu_work(struct work_struct *work)
+ 			}
+ 			rcu_lock_release(&rcu_callback_map);
+ 
+-			krcp = krc_this_cpu_lock(&flags);
++			raw_spin_lock_irqsave(&krcp->lock, flags);
+ 			if (put_cached_bnode(krcp, bkvhead[i]))
+ 				bkvhead[i] = NULL;
+-			krc_this_cpu_unlock(krcp, flags);
++			raw_spin_unlock_irqrestore(&krcp->lock, flags);
+ 
+ 			if (bkvhead[i])
+ 				free_page((unsigned long) bkvhead[i]);
+@@ -3350,6 +3358,57 @@ static void kfree_rcu_monitor(struct work_struct *work)
+ 		raw_spin_unlock_irqrestore(&krcp->lock, flags);
+ }
+ 
++static enum hrtimer_restart
++schedule_page_work_fn(struct hrtimer *t)
++{
++	struct kfree_rcu_cpu *krcp =
++		container_of(t, struct kfree_rcu_cpu, hrtimer);
++
++	queue_work(system_highpri_wq, &krcp->page_cache_work);
++	return HRTIMER_NORESTART;
++}
++
++static void fill_page_cache_func(struct work_struct *work)
++{
++	struct kvfree_rcu_bulk_data *bnode;
++	struct kfree_rcu_cpu *krcp =
++		container_of(work, struct kfree_rcu_cpu,
++			page_cache_work);
++	unsigned long flags;
++	bool pushed;
++	int i;
++
++	for (i = 0; i < rcu_min_cached_objs; i++) {
++		bnode = (struct kvfree_rcu_bulk_data *)
++			__get_free_page(GFP_KERNEL | __GFP_NOWARN);
++
++		if (bnode) {
++			raw_spin_lock_irqsave(&krcp->lock, flags);
++			pushed = put_cached_bnode(krcp, bnode);
++			raw_spin_unlock_irqrestore(&krcp->lock, flags);
++
++			if (!pushed) {
++				free_page((unsigned long) bnode);
++				break;
++			}
++		}
++	}
++
++	atomic_set(&krcp->work_in_progress, 0);
++}
++
++static void
++run_page_cache_worker(struct kfree_rcu_cpu *krcp)
++{
++	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING &&
++			!atomic_xchg(&krcp->work_in_progress, 1)) {
++		hrtimer_init(&krcp->hrtimer, CLOCK_MONOTONIC,
++			HRTIMER_MODE_REL);
++		krcp->hrtimer.function = schedule_page_work_fn;
++		hrtimer_start(&krcp->hrtimer, 0, HRTIMER_MODE_REL);
++	}
++}
++
+ static inline bool
+ kvfree_call_rcu_add_ptr_to_bulk(struct kfree_rcu_cpu *krcp, void *ptr)
+ {
+@@ -3366,32 +3425,8 @@ kvfree_call_rcu_add_ptr_to_bulk(struct kfree_rcu_cpu *krcp, void *ptr)
+ 	if (!krcp->bkvhead[idx] ||
+ 			krcp->bkvhead[idx]->nr_records == KVFREE_BULK_MAX_ENTR) {
+ 		bnode = get_cached_bnode(krcp);
+-		if (!bnode) {
+-			/*
+-			 * To keep this path working on raw non-preemptible
+-			 * sections, prevent the optional entry into the
+-			 * allocator as it uses sleeping locks. In fact, even
+-			 * if the caller of kfree_rcu() is preemptible, this
+-			 * path still is not, as krcp->lock is a raw spinlock.
+-			 * With additional page pre-allocation in the works,
+-			 * hitting this return is going to be much less likely.
+-			 */
+-			if (IS_ENABLED(CONFIG_PREEMPT_RT))
+-				return false;
+-
+-			/*
+-			 * NOTE: For one argument of kvfree_rcu() we can
+-			 * drop the lock and get the page in sleepable
+-			 * context. That would allow to maintain an array
+-			 * for the CONFIG_PREEMPT_RT as well if no cached
+-			 * pages are available.
+-			 */
+-			bnode = (struct kvfree_rcu_bulk_data *)
+-				__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
+-		}
+-
+ 		/* Switch to emergency path. */
+-		if (unlikely(!bnode))
++		if (!bnode)
+ 			return false;
+ 
+ 		/* Initialize the new block. */
+@@ -3455,12 +3490,10 @@ void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
+ 		goto unlock_return;
+ 	}
+ 
+-	/*
+-	 * Under high memory pressure GFP_NOWAIT can fail,
+-	 * in that case the emergency path is maintained.
+-	 */
+ 	success = kvfree_call_rcu_add_ptr_to_bulk(krcp, ptr);
+ 	if (!success) {
++		run_page_cache_worker(krcp);
++
+ 		if (head == NULL)
+ 			// Inline if kvfree_rcu(one_arg) call.
+ 			goto unlock_return;
+@@ -4452,24 +4485,14 @@ static void __init kfree_rcu_batch_init(void)
+ 
+ 	for_each_possible_cpu(cpu) {
+ 		struct kfree_rcu_cpu *krcp = per_cpu_ptr(&krc, cpu);
+-		struct kvfree_rcu_bulk_data *bnode;
+ 
+ 		for (i = 0; i < KFREE_N_BATCHES; i++) {
+ 			INIT_RCU_WORK(&krcp->krw_arr[i].rcu_work, kfree_rcu_work);
+ 			krcp->krw_arr[i].krcp = krcp;
+ 		}
+ 
+-		for (i = 0; i < rcu_min_cached_objs; i++) {
+-			bnode = (struct kvfree_rcu_bulk_data *)
+-				__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
+-
+-			if (bnode)
+-				put_cached_bnode(krcp, bnode);
+-			else
+-				pr_err("Failed to preallocate for %d CPU!\n", cpu);
+-		}
+-
+ 		INIT_DELAYED_WORK(&krcp->monitor_work, kfree_rcu_monitor);
++		INIT_WORK(&krcp->page_cache_work, fill_page_cache_func);
+ 		krcp->initialized = true;
+ 	}
+ 	if (register_shrinker(&kfree_rcu_shrinker))
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-bnxt_re-fix-entry-size-during-srq-create.patch b/queue-5.10/rdma-bnxt_re-fix-entry-size-during-srq-create.patch
new file mode 100644
index 00000000000..93bda5f7c9e
--- /dev/null
+++ b/queue-5.10/rdma-bnxt_re-fix-entry-size-during-srq-create.patch
@@ -0,0 +1,40 @@
+From 2503bf7586cd0b120c2febd44f715a159da31dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 23:15:52 -0700
+Subject: RDMA/bnxt_re: Fix entry size during SRQ create
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit b898d5c50cab1f985e77d053eb5c4d2c4a7694ae ]
+
+Only static WQE is supported for SRQ. So always use the max supported SGEs
+while calculating SRQ entry size.
+
+Fixes: 2bb3c32c5c5f ("RDMA/bnxt_re: Change wr posting logic to accommodate variable wqes")
+Link: https://lore.kernel.org/r/1602569752-12745-1-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index f9c999d5ba28e..266de55f57192 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1657,8 +1657,8 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
+ 	srq->qplib_srq.max_wqe = entries;
+ 
+ 	srq->qplib_srq.max_sge = srq_init_attr->attr.max_sge;
+-	srq->qplib_srq.wqe_size =
+-			bnxt_re_get_rwqe_size(srq->qplib_srq.max_sge);
++	 /* 128 byte wqe size for SRQ . So use max sges */
++	srq->qplib_srq.wqe_size = bnxt_re_get_rwqe_size(dev_attr->max_srq_sges);
+ 	srq->qplib_srq.threshold = srq_init_attr->attr.srq_limit;
+ 	srq->srq_limit = srq_init_attr->attr.srq_limit;
+ 	srq->qplib_srq.eventq_hw_ring_id = rdev->nq[0].ring_id;
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch b/queue-5.10/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch
new file mode 100644
index 00000000000..b47e5c58f82
--- /dev/null
+++ b/queue-5.10/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch
@@ -0,0 +1,37 @@
+From 211a5abb2802e88a7a6ee2bc49c63213359aadf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 14:49:52 +0300
+Subject: RDMA/bnxt_re: Set queue pair state when being queried
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]
+
+The API for ib_query_qp requires the driver to set cur_qp_state on return,
+add the missing set.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index cf3db96283976..f9c999d5ba28e 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -2078,6 +2078,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
+ 		goto out;
+ 	}
+ 	qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
++	qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
+ 	qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
+ 	qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
+ 	qp_attr->pkey_index = qplib_qp->pkey_index;
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-cma-add-missing-error-handling-of-listen_id.patch b/queue-5.10/rdma-cma-add-missing-error-handling-of-listen_id.patch
new file mode 100644
index 00000000000..6c571c73726
--- /dev/null
+++ b/queue-5.10/rdma-cma-add-missing-error-handling-of-listen_id.patch
@@ -0,0 +1,258 @@
+From ec477cdc23d2a63fd66bff76dd32c9b9d8222328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 16:40:07 +0200
+Subject: RDMA/cma: Add missing error handling of listen_id
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit c80a0c52d85c49a910d0dc0e342e8d8898677dc0 ]
+
+Don't silently continue if rdma_listen() fails but destroy previously
+created CM_ID and return an error to the caller.
+
+Fixes: d02d1f5359e7 ("RDMA/cma: Fix deadlock destroying listen requests")
+Link: https://lore.kernel.org/r/20201104144008.3808124-5-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 175 ++++++++++++++++++++--------------
+ 1 file changed, 101 insertions(+), 74 deletions(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index a77750b8954db..4585f654f8836 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2495,8 +2495,8 @@ static int cma_listen_handler(struct rdma_cm_id *id,
+ 	return id_priv->id.event_handler(id, event);
+ }
+ 
+-static void cma_listen_on_dev(struct rdma_id_private *id_priv,
+-			      struct cma_device *cma_dev)
++static int cma_listen_on_dev(struct rdma_id_private *id_priv,
++			     struct cma_device *cma_dev)
+ {
+ 	struct rdma_id_private *dev_id_priv;
+ 	struct net *net = id_priv->id.route.addr.dev_addr.net;
+@@ -2505,13 +2505,13 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv,
+ 	lockdep_assert_held(&lock);
+ 
+ 	if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1))
+-		return;
++		return 0;
+ 
+ 	dev_id_priv =
+ 		__rdma_create_id(net, cma_listen_handler, id_priv,
+ 				 id_priv->id.ps, id_priv->id.qp_type, id_priv);
+ 	if (IS_ERR(dev_id_priv))
+-		return;
++		return PTR_ERR(dev_id_priv);
+ 
+ 	dev_id_priv->state = RDMA_CM_ADDR_BOUND;
+ 	memcpy(cma_src_addr(dev_id_priv), cma_src_addr(id_priv),
+@@ -2527,19 +2527,34 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv,
+ 
+ 	ret = rdma_listen(&dev_id_priv->id, id_priv->backlog);
+ 	if (ret)
+-		dev_warn(&cma_dev->device->dev,
+-			 "RDMA CMA: cma_listen_on_dev, error %d\n", ret);
++		goto err_listen;
++	return 0;
++err_listen:
++	list_del(&id_priv->listen_list);
++	dev_warn(&cma_dev->device->dev, "RDMA CMA: %s, error %d\n", __func__, ret);
++	rdma_destroy_id(&dev_id_priv->id);
++	return ret;
+ }
+ 
+-static void cma_listen_on_all(struct rdma_id_private *id_priv)
++static int cma_listen_on_all(struct rdma_id_private *id_priv)
+ {
+ 	struct cma_device *cma_dev;
++	int ret;
+ 
+ 	mutex_lock(&lock);
+ 	list_add_tail(&id_priv->list, &listen_any_list);
+-	list_for_each_entry(cma_dev, &dev_list, list)
+-		cma_listen_on_dev(id_priv, cma_dev);
++	list_for_each_entry(cma_dev, &dev_list, list) {
++		ret = cma_listen_on_dev(id_priv, cma_dev);
++		if (ret)
++			goto err_listen;
++	}
++	mutex_unlock(&lock);
++	return 0;
++
++err_listen:
++	list_del(&id_priv->list);
+ 	mutex_unlock(&lock);
++	return ret;
+ }
+ 
+ void rdma_set_service_type(struct rdma_cm_id *id, int tos)
+@@ -3692,8 +3707,11 @@ int rdma_listen(struct rdma_cm_id *id, int backlog)
+ 			ret = -ENOSYS;
+ 			goto err;
+ 		}
+-	} else
+-		cma_listen_on_all(id_priv);
++	} else {
++		ret = cma_listen_on_all(id_priv);
++		if (ret)
++			goto err;
++	}
+ 
+ 	return 0;
+ err:
+@@ -4773,69 +4791,6 @@ static struct notifier_block cma_nb = {
+ 	.notifier_call = cma_netdev_callback
+ };
+ 
+-static int cma_add_one(struct ib_device *device)
+-{
+-	struct cma_device *cma_dev;
+-	struct rdma_id_private *id_priv;
+-	unsigned int i;
+-	unsigned long supported_gids = 0;
+-	int ret;
+-
+-	cma_dev = kmalloc(sizeof *cma_dev, GFP_KERNEL);
+-	if (!cma_dev)
+-		return -ENOMEM;
+-
+-	cma_dev->device = device;
+-	cma_dev->default_gid_type = kcalloc(device->phys_port_cnt,
+-					    sizeof(*cma_dev->default_gid_type),
+-					    GFP_KERNEL);
+-	if (!cma_dev->default_gid_type) {
+-		ret = -ENOMEM;
+-		goto free_cma_dev;
+-	}
+-
+-	cma_dev->default_roce_tos = kcalloc(device->phys_port_cnt,
+-					    sizeof(*cma_dev->default_roce_tos),
+-					    GFP_KERNEL);
+-	if (!cma_dev->default_roce_tos) {
+-		ret = -ENOMEM;
+-		goto free_gid_type;
+-	}
+-
+-	rdma_for_each_port (device, i) {
+-		supported_gids = roce_gid_type_mask_support(device, i);
+-		WARN_ON(!supported_gids);
+-		if (supported_gids & (1 << CMA_PREFERRED_ROCE_GID_TYPE))
+-			cma_dev->default_gid_type[i - rdma_start_port(device)] =
+-				CMA_PREFERRED_ROCE_GID_TYPE;
+-		else
+-			cma_dev->default_gid_type[i - rdma_start_port(device)] =
+-				find_first_bit(&supported_gids, BITS_PER_LONG);
+-		cma_dev->default_roce_tos[i - rdma_start_port(device)] = 0;
+-	}
+-
+-	init_completion(&cma_dev->comp);
+-	refcount_set(&cma_dev->refcount, 1);
+-	INIT_LIST_HEAD(&cma_dev->id_list);
+-	ib_set_client_data(device, &cma_client, cma_dev);
+-
+-	mutex_lock(&lock);
+-	list_add_tail(&cma_dev->list, &dev_list);
+-	list_for_each_entry(id_priv, &listen_any_list, list)
+-		cma_listen_on_dev(id_priv, cma_dev);
+-	mutex_unlock(&lock);
+-
+-	trace_cm_add_one(device);
+-	return 0;
+-
+-free_gid_type:
+-	kfree(cma_dev->default_gid_type);
+-
+-free_cma_dev:
+-	kfree(cma_dev);
+-	return ret;
+-}
+-
+ static void cma_send_device_removal_put(struct rdma_id_private *id_priv)
+ {
+ 	struct rdma_cm_event event = { .event = RDMA_CM_EVENT_DEVICE_REMOVAL };
+@@ -4898,6 +4853,78 @@ static void cma_process_remove(struct cma_device *cma_dev)
+ 	wait_for_completion(&cma_dev->comp);
+ }
+ 
++static int cma_add_one(struct ib_device *device)
++{
++	struct cma_device *cma_dev;
++	struct rdma_id_private *id_priv;
++	unsigned int i;
++	unsigned long supported_gids = 0;
++	int ret;
++
++	cma_dev = kmalloc(sizeof(*cma_dev), GFP_KERNEL);
++	if (!cma_dev)
++		return -ENOMEM;
++
++	cma_dev->device = device;
++	cma_dev->default_gid_type = kcalloc(device->phys_port_cnt,
++					    sizeof(*cma_dev->default_gid_type),
++					    GFP_KERNEL);
++	if (!cma_dev->default_gid_type) {
++		ret = -ENOMEM;
++		goto free_cma_dev;
++	}
++
++	cma_dev->default_roce_tos = kcalloc(device->phys_port_cnt,
++					    sizeof(*cma_dev->default_roce_tos),
++					    GFP_KERNEL);
++	if (!cma_dev->default_roce_tos) {
++		ret = -ENOMEM;
++		goto free_gid_type;
++	}
++
++	rdma_for_each_port (device, i) {
++		supported_gids = roce_gid_type_mask_support(device, i);
++		WARN_ON(!supported_gids);
++		if (supported_gids & (1 << CMA_PREFERRED_ROCE_GID_TYPE))
++			cma_dev->default_gid_type[i - rdma_start_port(device)] =
++				CMA_PREFERRED_ROCE_GID_TYPE;
++		else
++			cma_dev->default_gid_type[i - rdma_start_port(device)] =
++				find_first_bit(&supported_gids, BITS_PER_LONG);
++		cma_dev->default_roce_tos[i - rdma_start_port(device)] = 0;
++	}
++
++	init_completion(&cma_dev->comp);
++	refcount_set(&cma_dev->refcount, 1);
++	INIT_LIST_HEAD(&cma_dev->id_list);
++	ib_set_client_data(device, &cma_client, cma_dev);
++
++	mutex_lock(&lock);
++	list_add_tail(&cma_dev->list, &dev_list);
++	list_for_each_entry(id_priv, &listen_any_list, list) {
++		ret = cma_listen_on_dev(id_priv, cma_dev);
++		if (ret)
++			goto free_listen;
++	}
++	mutex_unlock(&lock);
++
++	trace_cm_add_one(device);
++	return 0;
++
++free_listen:
++	list_del(&cma_dev->list);
++	mutex_unlock(&lock);
++
++	cma_process_remove(cma_dev);
++	kfree(cma_dev->default_roce_tos);
++free_gid_type:
++	kfree(cma_dev->default_gid_type);
++
++free_cma_dev:
++	kfree(cma_dev);
++	return ret;
++}
++
+ static void cma_remove_one(struct ib_device *device, void *client_data)
+ {
+ 	struct cma_device *cma_dev = client_data;
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch b/queue-5.10/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch
new file mode 100644
index 00000000000..fc3312e98ce
--- /dev/null
+++ b/queue-5.10/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch
@@ -0,0 +1,78 @@
+From 66266802b6384565dd56fd63dd62d6343f1d36d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 15:29:39 +0200
+Subject: RDMA/cma: Don't overwrite sgid_attr after device is released
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit e246b7c035d74abfb3507fa10082d0c42cc016c3 ]
+
+As part of the cma_dev release, that pointer will be set to NULL.  In case
+it happens in rdma_bind_addr() (part of an error flow), the next call to
+addr_handler() will have a call to cma_acquire_dev_by_src_ip() which will
+overwrite sgid_attr without releasing it.
+
+  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
+  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
+  CPU: 2 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+  Workqueue: ib_addr process_one_req
+  RIP: 0010:cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
+  RIP: 0010:cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
+  Code: 66 d9 4a ff 4d 8b 6e 10 49 8d bd 1c 08 00 00 e8 b6 d6 4a ff 45 0f b6 bd 1c 08 00 00 41 83 e7 01 e9 49 fd ff ff e8 90 c5 29 ff <0f> 0b e9 80 fe ff ff e8 84 c5 29 ff 4c 89 f7 e8 2c d9 4a ff 4d 8b
+  RSP: 0018:ffff8881047c7b40 EFLAGS: 00010293
+  RAX: ffff888104789c80 RBX: 0000000000000001 RCX: ffffffff820b8ef8
+  RDX: 0000000000000000 RSI: ffffffff820b9080 RDI: ffff88810cd4c998
+  RBP: ffff8881047c7c08 R08: ffff888104789c80 R09: ffffed10209f4036
+  R10: ffff888104fa01ab R11: ffffed10209f4035 R12: ffff88810cd4c800
+  R13: ffff888105750e28 R14: ffff888108f0a100 R15: ffff88810cd4c998
+  FS:  0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 0000000000000000 CR3: 0000000104e60005 CR4: 0000000000370ea0
+  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+  Call Trace:
+   addr_handler+0x266/0x350 drivers/infiniband/core/cma.c:3190
+   process_one_req+0xa3/0x300 drivers/infiniband/core/addr.c:645
+   process_one_work+0x54c/0x930 kernel/workqueue.c:2272
+   worker_thread+0x82/0x830 kernel/workqueue.c:2418
+   kthread+0x1ca/0x220 kernel/kthread.c:292
+   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
+
+Fixes: ff11c6cd521f ("RDMA/cma: Introduce and use cma_acquire_dev_by_src_ip()")
+Link: https://lore.kernel.org/r/20201213132940.345554-5-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index c06c87a4dc5e7..c51b84b2d2f37 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -477,6 +477,10 @@ static void cma_release_dev(struct rdma_id_private *id_priv)
+ 	list_del(&id_priv->list);
+ 	cma_dev_put(id_priv->cma_dev);
+ 	id_priv->cma_dev = NULL;
++	if (id_priv->id.route.addr.dev_addr.sgid_attr) {
++		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
++		id_priv->id.route.addr.dev_addr.sgid_attr = NULL;
++	}
+ 	mutex_unlock(&lock);
+ }
+ 
+@@ -1861,9 +1865,6 @@ static void _destroy_id(struct rdma_id_private *id_priv,
+ 
+ 	kfree(id_priv->id.route.path_rec);
+ 
+-	if (id_priv->id.route.addr.dev_addr.sgid_attr)
+-		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
+-
+ 	put_net(id_priv->id.route.addr.dev_addr.net);
+ 	rdma_restrack_del(&id_priv->res);
+ 	kfree(id_priv);
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-cma-fix-deadlock-on-lock-in-rdma_cma_listen_on_.patch b/queue-5.10/rdma-cma-fix-deadlock-on-lock-in-rdma_cma_listen_on_.patch
new file mode 100644
index 00000000000..94d29c01fd7
--- /dev/null
+++ b/queue-5.10/rdma-cma-fix-deadlock-on-lock-in-rdma_cma_listen_on_.patch
@@ -0,0 +1,133 @@
+From 79fb0601302c8593cc2735c6884ae5534b7e97c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:33:23 -0400
+Subject: RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error
+ unwind
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit dd37d2f59eb839d51b988f6668ce5f0d533b23fd ]
+
+rdma_detroy_id() cannot be called under &lock - we must instead keep the
+error'd ID around until &lock can be released, then destroy it.
+
+This is complicated by the usual way listen IDs are destroyed through
+cma_process_remove() which can run at any time and will asynchronously
+destroy the same ID.
+
+Remove the ID from visiblity of cma_process_remove() before going down the
+destroy path outside the locking.
+
+Fixes: c80a0c52d85c ("RDMA/cma: Add missing error handling of listen_id")
+Link: https://lore.kernel.org/r/20201118133756.GK244516@ziepe.ca
+Reported-by: syzbot+1bc48bf7f78253f664a9@syzkaller.appspotmail.com
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 4585f654f8836..c06c87a4dc5e7 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2496,7 +2496,8 @@ static int cma_listen_handler(struct rdma_cm_id *id,
+ }
+ 
+ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+-			     struct cma_device *cma_dev)
++			     struct cma_device *cma_dev,
++			     struct rdma_id_private **to_destroy)
+ {
+ 	struct rdma_id_private *dev_id_priv;
+ 	struct net *net = id_priv->id.route.addr.dev_addr.net;
+@@ -2504,6 +2505,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+ 
+ 	lockdep_assert_held(&lock);
+ 
++	*to_destroy = NULL;
+ 	if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1))
+ 		return 0;
+ 
+@@ -2518,7 +2520,6 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+ 	       rdma_addr_size(cma_src_addr(id_priv)));
+ 
+ 	_cma_attach_to_dev(dev_id_priv, cma_dev);
+-	list_add_tail(&dev_id_priv->listen_list, &id_priv->listen_list);
+ 	cma_id_get(id_priv);
+ 	dev_id_priv->internal_id = 1;
+ 	dev_id_priv->afonly = id_priv->afonly;
+@@ -2528,25 +2529,31 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv,
+ 	ret = rdma_listen(&dev_id_priv->id, id_priv->backlog);
+ 	if (ret)
+ 		goto err_listen;
++	list_add_tail(&dev_id_priv->listen_list, &id_priv->listen_list);
+ 	return 0;
+ err_listen:
+-	list_del(&id_priv->listen_list);
++	/* Caller must destroy this after releasing lock */
++	*to_destroy = dev_id_priv;
+ 	dev_warn(&cma_dev->device->dev, "RDMA CMA: %s, error %d\n", __func__, ret);
+-	rdma_destroy_id(&dev_id_priv->id);
+ 	return ret;
+ }
+ 
+ static int cma_listen_on_all(struct rdma_id_private *id_priv)
+ {
++	struct rdma_id_private *to_destroy;
+ 	struct cma_device *cma_dev;
+ 	int ret;
+ 
+ 	mutex_lock(&lock);
+ 	list_add_tail(&id_priv->list, &listen_any_list);
+ 	list_for_each_entry(cma_dev, &dev_list, list) {
+-		ret = cma_listen_on_dev(id_priv, cma_dev);
+-		if (ret)
++		ret = cma_listen_on_dev(id_priv, cma_dev, &to_destroy);
++		if (ret) {
++			/* Prevent racing with cma_process_remove() */
++			if (to_destroy)
++				list_del_init(&to_destroy->list);
+ 			goto err_listen;
++		}
+ 	}
+ 	mutex_unlock(&lock);
+ 	return 0;
+@@ -2554,6 +2561,8 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)
+ err_listen:
+ 	list_del(&id_priv->list);
+ 	mutex_unlock(&lock);
++	if (to_destroy)
++		rdma_destroy_id(&to_destroy->id);
+ 	return ret;
+ }
+ 
+@@ -4855,6 +4864,7 @@ static void cma_process_remove(struct cma_device *cma_dev)
+ 
+ static int cma_add_one(struct ib_device *device)
+ {
++	struct rdma_id_private *to_destroy;
+ 	struct cma_device *cma_dev;
+ 	struct rdma_id_private *id_priv;
+ 	unsigned int i;
+@@ -4902,7 +4912,7 @@ static int cma_add_one(struct ib_device *device)
+ 	mutex_lock(&lock);
+ 	list_add_tail(&cma_dev->list, &dev_list);
+ 	list_for_each_entry(id_priv, &listen_any_list, list) {
+-		ret = cma_listen_on_dev(id_priv, cma_dev);
++		ret = cma_listen_on_dev(id_priv, cma_dev, &to_destroy);
+ 		if (ret)
+ 			goto free_listen;
+ 	}
+@@ -4915,6 +4925,7 @@ free_listen:
+ 	list_del(&cma_dev->list);
+ 	mutex_unlock(&lock);
+ 
++	/* cma_process_remove() will delete to_destroy */
+ 	cma_process_remove(cma_dev);
+ 	kfree(cma_dev->default_roce_tos);
+ free_gid_type:
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-core-do-not-indicate-device-ready-when-device-e.patch b/queue-5.10/rdma-core-do-not-indicate-device-ready-when-device-e.patch
new file mode 100644
index 00000000000..28d3dca4d3f
--- /dev/null
+++ b/queue-5.10/rdma-core-do-not-indicate-device-ready-when-device-e.patch
@@ -0,0 +1,60 @@
+From 3b20bf808de6bf03e45f4357502868a48c5688f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 09:35:44 +0200
+Subject: RDMA/core: Do not indicate device ready when device enablement fails
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 779e0bf47632c609c59f527f9711ecd3214dccb0 ]
+
+In procedure ib_register_device, procedure kobject_uevent is called
+(advertising that the device is ready for userspace usage) even when
+device_enable_and_get() returned an error.
+
+As a result, various RDMA modules attempted to register for the device
+even while the device driver was preparing to unregister the device.
+
+Fix this by advertising the device availability only after enabling the
+device succeeds.
+
+Fixes: e7a5b4aafd82 ("RDMA/device: Don't fire uevent before device is fully initialized")
+Link: https://lore.kernel.org/r/20201208073545.9723-3-leon@kernel.org
+Suggested-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index a3b1fc84cdcab..4a041511b70ec 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1374,9 +1374,6 @@ int ib_register_device(struct ib_device *device, const char *name,
+ 	}
+ 
+ 	ret = enable_device_and_get(device);
+-	dev_set_uevent_suppress(&device->dev, false);
+-	/* Mark for userspace that device is ready */
+-	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
+ 	if (ret) {
+ 		void (*dealloc_fn)(struct ib_device *);
+ 
+@@ -1396,8 +1393,12 @@ int ib_register_device(struct ib_device *device, const char *name,
+ 		ib_device_put(device);
+ 		__ib_unregister_device(device);
+ 		device->ops.dealloc_driver = dealloc_fn;
++		dev_set_uevent_suppress(&device->dev, false);
+ 		return ret;
+ 	}
++	dev_set_uevent_suppress(&device->dev, false);
++	/* Mark for userspace that device is ready */
++	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
+ 	ib_device_put(device);
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-core-fix-error-return-in-_ib_modify_qp.patch b/queue-5.10/rdma-core-fix-error-return-in-_ib_modify_qp.patch
new file mode 100644
index 00000000000..e6edc3cf0b5
--- /dev/null
+++ b/queue-5.10/rdma-core-fix-error-return-in-_ib_modify_qp.patch
@@ -0,0 +1,41 @@
+From 1378a9f2e454254686aa0be01729cbfa70834bd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 15:58:45 +0800
+Subject: RDMA/core: Fix error return in _ib_modify_qp()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 5333499c6014224756e97fa1a1047dfa592d76d3 ]
+
+Fix to return error code PTR_ERR() from the error handling case instead of
+0.
+
+Fixes: 51aab12631dd ("RDMA/core: Get xmit slave for LAG")
+Link: https://lore.kernel.org/r/20201016075845.129562-1-jingxiangfeng@huawei.com
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 740f8454b6b46..3d895cc41c3ad 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1698,8 +1698,10 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
+ 			slave = rdma_lag_get_ah_roce_slave(qp->device,
+ 							   &attr->ah_attr,
+ 							   GFP_KERNEL);
+-			if (IS_ERR(slave))
++			if (IS_ERR(slave)) {
++				ret = PTR_ERR(slave);
+ 				goto out_av;
++			}
+ 			attr->xmit_slave = slave;
+ 		}
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-core-track-device-memory-mrs.patch b/queue-5.10/rdma-core-track-device-memory-mrs.patch
new file mode 100644
index 00000000000..78c1cddd98e
--- /dev/null
+++ b/queue-5.10/rdma-core-track-device-memory-mrs.patch
@@ -0,0 +1,56 @@
+From 2cfc87946750aff0e40bf8905293714417ebba3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 09:01:46 +0200
+Subject: RDMA/core: Track device memory MRs
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit b47a98efa97889c5b16d17e77eed3dc4500674eb ]
+
+Device memory (DM) are registered as MR during initialization flow, these
+MRs were not tracked by resource tracker and had res->valid set as a
+false. Update the code to manage them too.
+
+Before this change:
+$ ibv_rc_pingpong -j &
+$ rdma res show mr <-- shows nothing
+
+After this change:
+$ ibv_rc_pingpong -j &
+$ rdma res show mr
+dev ibp0s9 mrn 0 mrlen 4096 pdn 3 pid 734 comm ibv_rc_pingpong
+
+Fixes: be934cca9e98 ("IB/uverbs: Add device memory registration ioctl support")
+Link: https://lore.kernel.org/r/20201117070148.1974114-2-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_std_types_mr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
+index 9b22bb553e8b3..dc58564417292 100644
+--- a/drivers/infiniband/core/uverbs_std_types_mr.c
++++ b/drivers/infiniband/core/uverbs_std_types_mr.c
+@@ -33,6 +33,7 @@
+ #include "rdma_core.h"
+ #include "uverbs.h"
+ #include <rdma/uverbs_std_types.h>
++#include "restrack.h"
+ 
+ static int uverbs_free_mr(struct ib_uobject *uobject,
+ 			  enum rdma_remove_reason why,
+@@ -134,6 +135,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DM_MR_REG)(
+ 	atomic_inc(&pd->usecnt);
+ 	atomic_inc(&dm->usecnt);
+ 
++	rdma_restrack_new(&mr->res, RDMA_RESTRACK_MR);
++	rdma_restrack_set_name(&mr->res, NULL);
++	rdma_restrack_add(&mr->res);
+ 	uobj->object = mr;
+ 
+ 	uverbs_finalize_uobj_create(attrs, UVERBS_ATTR_REG_DM_MR_HANDLE);
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-cxgb4-validate-the-number-of-cqes.patch b/queue-5.10/rdma-cxgb4-validate-the-number-of-cqes.patch
new file mode 100644
index 00000000000..53ace373de4
--- /dev/null
+++ b/queue-5.10/rdma-cxgb4-validate-the-number-of-cqes.patch
@@ -0,0 +1,38 @@
+From 99d16caa9b2b744c4195dc40c9eab37d3d09db94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 15:20:07 +0200
+Subject: RDMA/cxgb4: Validate the number of CQEs
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]
+
+Before create CQ, make sure that the requested number of CQEs is in the
+supported range.
+
+Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
+Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 28349ed508854..d6cfefc269ee3 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -1008,6 +1008,9 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
+ 	if (attr->flags)
+ 		return -EINVAL;
+ 
++	if (entries < 1 || entries > ibdev->attrs.max_cqe)
++		return -EINVAL;
++
+ 	if (vector >= rhp->rdev.lldi.nciq)
+ 		return -EINVAL;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-avoid-setting-loopback-indicator-when-smac-.patch b/queue-5.10/rdma-hns-avoid-setting-loopback-indicator-when-smac-.patch
new file mode 100644
index 00000000000..82f7845777e
--- /dev/null
+++ b/queue-5.10/rdma-hns-avoid-setting-loopback-indicator-when-smac-.patch
@@ -0,0 +1,52 @@
+From db2d9ca3ed49a2db3373232e97679020edd2f4ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 19:33:24 +0800
+Subject: RDMA/hns: Avoid setting loopback indicator when smac is same as dmac
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit 3631dadfb118821236098a215e59fb5d3e1c30a8 ]
+
+The loopback flag will be set to 1 by the hardware when the source mac
+address is same as the destination mac address. So the driver don't need
+to compare them.
+
+Fixes: d6a3627e311c ("RDMA/hns: Optimize wqe buffer set flow for post send")
+Link: https://lore.kernel.org/r/1605526408-6936-4-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index d127e0e4c3cda..4db7eea3dcec5 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -433,8 +433,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
+ 	unsigned int curr_idx = *sge_idx;
+ 	int valid_num_sge;
+ 	u32 msg_len = 0;
+-	bool loopback;
+-	u8 *smac;
+ 	int ret;
+ 
+ 	valid_num_sge = calc_wr_sge_num(wr, &msg_len);
+@@ -457,13 +455,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
+ 	roce_set_field(ud_sq_wqe->byte_48, V2_UD_SEND_WQE_BYTE_48_DMAC_5_M,
+ 		       V2_UD_SEND_WQE_BYTE_48_DMAC_5_S, ah->av.mac[5]);
+ 
+-	/* MAC loopback */
+-	smac = (u8 *)hr_dev->dev_addr[qp->port];
+-	loopback = ether_addr_equal_unaligned(ah->av.mac, smac) ? 1 : 0;
+-
+-	roce_set_bit(ud_sq_wqe->byte_40,
+-		     V2_UD_SEND_WQE_BYTE_40_LBI_S, loopback);
+-
+ 	ud_sq_wqe->msg_len = cpu_to_le32(msg_len);
+ 
+ 	/* Set sig attr */
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-bugfix-for-calculation-of-extended-sge.patch b/queue-5.10/rdma-hns-bugfix-for-calculation-of-extended-sge.patch
new file mode 100644
index 00000000000..17067a55eef
--- /dev/null
+++ b/queue-5.10/rdma-hns-bugfix-for-calculation-of-extended-sge.patch
@@ -0,0 +1,47 @@
+From c793438f91aa5b629ee385803e7adc1b8cca3ef7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 18:22:38 +0800
+Subject: RDMA/hns: Bugfix for calculation of extended sge
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+[ Upstream commit d34895c319faa1e0fc1a48c3b06bba6a8a39ba44 ]
+
+Page alignment is required when setting the number of extended sge
+according to the hardware's achivement. If the space of needed extended
+sge is greater than one page, the roundup_pow_of_two() can ensure
+that. But if the needed extended sge isn't 0 and can not be filled in a
+whole page, the driver should align it specifically.
+
+Fixes: 54d6638765b0 ("RDMA/hns: Optimize WQE buffer size calculating process")
+Link: https://lore.kernel.org/r/1606558959-48510-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 6c081dd985fc9..71ea8fd9041b9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -432,7 +432,12 @@ static int set_extend_sge_param(struct hns_roce_dev *hr_dev, u32 sq_wqe_cnt,
+ 	}
+ 
+ 	hr_qp->sge.sge_shift = HNS_ROCE_SGE_SHIFT;
+-	hr_qp->sge.sge_cnt = cnt;
++
++	/* If the number of extended sge is not zero, they MUST use the
++	 * space of HNS_HW_PAGE_SIZE at least.
++	 */
++	hr_qp->sge.sge_cnt = cnt ?
++			max(cnt, (u32)HNS_HW_PAGE_SIZE / HNS_ROCE_SGE_SIZE) : 0;
+ 
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-do-shift-on-traffic-class-when-using-rocev2.patch b/queue-5.10/rdma-hns-do-shift-on-traffic-class-when-using-rocev2.patch
new file mode 100644
index 00000000000..d684c53402f
--- /dev/null
+++ b/queue-5.10/rdma-hns-do-shift-on-traffic-class-when-using-rocev2.patch
@@ -0,0 +1,83 @@
+From cc40503d25d45df3c3aeb41b0151ef9535d9940d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 09:37:29 +0800
+Subject: RDMA/hns: Do shift on traffic class when using RoCEv2
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit 603bee935f38080a3674c763c50787751e387779 ]
+
+The high 6 bits of traffic class in GRH is DSCP (Differentiated Services
+Codepoint), the driver should shift it before the hardware gets it when
+using RoCEv2.
+
+Fixes: 606bf89e98ef ("RDMA/hns: Refactor for hns_roce_v2_modify_qp function")
+Fixes: fba429fcf9a5 ("RDMA/hns: Fix missing fields in address vector")
+Link: https://lore.kernel.org/r/1607650657-35992-4-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_ah.c     |  2 +-
+ drivers/infiniband/hw/hns/hns_roce_device.h |  8 ++++++++
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 10 +++-------
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
+index d65ff6aa322fa..7dd3b6097226f 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
++++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
+@@ -74,7 +74,7 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ 	ah->av.flowlabel = grh->flow_label;
+ 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
+ 	ah->av.sl = rdma_ah_get_sl(ah_attr);
+-	ah->av.tclass = grh->traffic_class;
++	ah->av.tclass = get_tclass(grh);
+ 
+ 	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
+ 	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index b025841e08154..1ea87f92aabbe 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -1132,6 +1132,14 @@ static inline u32 to_hr_hem_entries_shift(u32 count, u32 buf_shift)
+ 	return ilog2(to_hr_hem_entries_count(count, buf_shift));
+ }
+ 
++#define DSCP_SHIFT 2
++
++static inline u8 get_tclass(const struct ib_global_route *grh)
++{
++	return grh->sgid_attr->gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP ?
++	       grh->traffic_class >> DSCP_SHIFT : grh->traffic_class;
++}
++
+ int hns_roce_init_uar_table(struct hns_roce_dev *dev);
+ int hns_roce_uar_alloc(struct hns_roce_dev *dev, struct hns_roce_uar *uar);
+ void hns_roce_uar_free(struct hns_roce_dev *dev, struct hns_roce_uar *uar);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index c287dbd2f384d..5c29c7d8c50e6 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4460,15 +4460,11 @@ static int hns_roce_v2_set_path(struct ib_qp *ibqp,
+ 	roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_HOP_LIMIT_M,
+ 		       V2_QPC_BYTE_24_HOP_LIMIT_S, 0);
+ 
+-	if (is_udp)
+-		roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
+-			       V2_QPC_BYTE_24_TC_S, grh->traffic_class >> 2);
+-	else
+-		roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
+-			       V2_QPC_BYTE_24_TC_S, grh->traffic_class);
+-
++	roce_set_field(context->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
++		       V2_QPC_BYTE_24_TC_S, get_tclass(&attr->ah_attr.grh));
+ 	roce_set_field(qpc_mask->byte_24_mtu_tc, V2_QPC_BYTE_24_TC_M,
+ 		       V2_QPC_BYTE_24_TC_S, 0);
++
+ 	roce_set_field(context->byte_28_at_fl, V2_QPC_BYTE_28_FL_M,
+ 		       V2_QPC_BYTE_28_FL_S, grh->flow_label);
+ 	roce_set_field(qpc_mask->byte_28_at_fl, V2_QPC_BYTE_28_FL_M,
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-fix-0-length-sge-calculation-error.patch b/queue-5.10/rdma-hns-fix-0-length-sge-calculation-error.patch
new file mode 100644
index 00000000000..b1af435b064
--- /dev/null
+++ b/queue-5.10/rdma-hns-fix-0-length-sge-calculation-error.patch
@@ -0,0 +1,84 @@
+From 7acf237b3118f8448790eac4437790410f927aa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 18:22:37 +0800
+Subject: RDMA/hns: Fix 0-length sge calculation error
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit 0fd0175e30e487f8d70ecb2cdd67fbb514fdf50f ]
+
+One RC SQ WQE can store 2 sges but UD can't, so ignore 2 valid sges of
+wr.sglist for RC which have been filled in WQE before setting extended
+sge.  Either of RC and UD can not contain 0-length sges, so these 0-length
+sges should be skipped.
+
+Fixes: 54d6638765b0 ("RDMA/hns: Optimize WQE buffer size calculating process")
+Link: https://lore.kernel.org/r/1606558959-48510-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 24 +++++++++-------------
+ 1 file changed, 10 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 4db7eea3dcec5..c287dbd2f384d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -214,25 +214,20 @@ static int fill_ext_sge_inl_data(struct hns_roce_qp *qp,
+ 	return 0;
+ }
+ 
+-static void set_extend_sge(struct hns_roce_qp *qp, const struct ib_send_wr *wr,
+-			   unsigned int *sge_ind, unsigned int valid_num_sge)
++static void set_extend_sge(struct hns_roce_qp *qp, struct ib_sge *sge,
++			   unsigned int *sge_ind, unsigned int cnt)
+ {
+ 	struct hns_roce_v2_wqe_data_seg *dseg;
+-	unsigned int cnt = valid_num_sge;
+-	struct ib_sge *sge = wr->sg_list;
+ 	unsigned int idx = *sge_ind;
+ 
+-	if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC) {
+-		cnt -= HNS_ROCE_SGE_IN_WQE;
+-		sge += HNS_ROCE_SGE_IN_WQE;
+-	}
+-
+ 	while (cnt > 0) {
+ 		dseg = hns_roce_get_extend_sge(qp, idx & (qp->sge.sge_cnt - 1));
+-		set_data_seg_v2(dseg, sge);
+-		idx++;
++		if (likely(sge->length)) {
++			set_data_seg_v2(dseg, sge);
++			idx++;
++			cnt--;
++		}
+ 		sge++;
+-		cnt--;
+ 	}
+ 
+ 	*sge_ind = idx;
+@@ -340,7 +335,8 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ 			}
+ 		}
+ 
+-		set_extend_sge(qp, wr, sge_ind, valid_num_sge);
++		set_extend_sge(qp, wr->sg_list + i, sge_ind,
++			       valid_num_sge - HNS_ROCE_SGE_IN_WQE);
+ 	}
+ 
+ 	roce_set_field(rc_sq_wqe->byte_16,
+@@ -511,7 +507,7 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
+ 
+ 	memcpy(&ud_sq_wqe->dgid[0], &ah->av.dgid[0], GID_LEN_V2);
+ 
+-	set_extend_sge(qp, wr, &curr_idx, valid_num_sge);
++	set_extend_sge(qp, wr->sg_list, &curr_idx, valid_num_sge);
+ 
+ 	*sge_idx = curr_idx;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-fix-missing-fields-in-address-vector.patch b/queue-5.10/rdma-hns-fix-missing-fields-in-address-vector.patch
new file mode 100644
index 00000000000..1e281add575
--- /dev/null
+++ b/queue-5.10/rdma-hns-fix-missing-fields-in-address-vector.patch
@@ -0,0 +1,54 @@
+From 456b4b729fdcbcb546454325b90586935b97aeae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 19:33:23 +0800
+Subject: RDMA/hns: Fix missing fields in address vector
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit fba429fcf9a5e0c4ec2523ecf4cf18bc0507fcbc ]
+
+Traffic class and hop limit in address vector is not assigned from GRH,
+but it will be filled into UD SQ WQE. So the hardware will get a wrong
+value.
+
+Fixes: 82e620d9c3a0 ("RDMA/hns: Modify the data structure of hns_roce_av")
+Link: https://lore.kernel.org/r/1605526408-6936-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_ah.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
+index 3be80d42e03a9..d65ff6aa322fa 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
++++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
+@@ -64,18 +64,20 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ 	struct hns_roce_ah *ah = to_hr_ah(ibah);
+ 	int ret = 0;
+ 
+-	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
+-
+ 	ah->av.port = rdma_ah_get_port_num(ah_attr);
+ 	ah->av.gid_index = grh->sgid_index;
+ 
+ 	if (rdma_ah_get_static_rate(ah_attr))
+ 		ah->av.stat_rate = IB_RATE_10_GBPS;
+ 
+-	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
+-	ah->av.sl = rdma_ah_get_sl(ah_attr);
++	ah->av.hop_limit = grh->hop_limit;
+ 	ah->av.flowlabel = grh->flow_label;
+ 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
++	ah->av.sl = rdma_ah_get_sl(ah_attr);
++	ah->av.tclass = grh->traffic_class;
++
++	memcpy(ah->av.dgid, grh->dgid.raw, HNS_ROCE_GID_SIZE);
++	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
+ 
+ 	/* HIP08 needs to record vlan info in Address Vector */
+ 	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-limit-the-length-of-data-copied-between-ker.patch b/queue-5.10/rdma-hns-limit-the-length-of-data-copied-between-ker.patch
new file mode 100644
index 00000000000..f44cbfd36cc
--- /dev/null
+++ b/queue-5.10/rdma-hns-limit-the-length-of-data-copied-between-ker.patch
@@ -0,0 +1,149 @@
+From 490631fc5332b2b6d1b73597ff78534d64e68a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 09:37:27 +0800
+Subject: RDMA/hns: Limit the length of data copied between kernel and
+ userspace
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit 1c0ca9cd1741687f529498ddb899805fc2c51caa ]
+
+For ib_copy_from_user(), the length of udata may not be the same as that
+of cmd. For ib_copy_to_user(), the length of udata may not be the same as
+that of resp. So limit the length to prevent out-of-bounds read and write
+operations from ib_copy_from_user() and ib_copy_to_user().
+
+Fixes: de77503a5940 ("RDMA/hns: RDMA/hns: Assign rq head pointer when enable rq record db")
+Fixes: 633fb4d9fdaa ("RDMA/hns: Use structs to describe the uABI instead of opencoding")
+Fixes: ae85bf92effc ("RDMA/hns: Optimize qp param setup flow")
+Fixes: 6fd610c5733d ("RDMA/hns: Support 0 hop addressing for SRQ buffer")
+Fixes: 9d9d4ff78884 ("RDMA/hns: Update the kernel header file of hns")
+Link: https://lore.kernel.org/r/1607650657-35992-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_cq.c   |  5 +++--
+ drivers/infiniband/hw/hns/hns_roce_main.c |  3 ++-
+ drivers/infiniband/hw/hns/hns_roce_pd.c   | 11 ++++++-----
+ drivers/infiniband/hw/hns/hns_roce_qp.c   |  9 ++++++---
+ drivers/infiniband/hw/hns/hns_roce_srq.c  | 10 +++++-----
+ 5 files changed, 22 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
+index 809b22aa5056c..da346129f6e9e 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
+@@ -274,7 +274,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
+ 
+ 	if (udata) {
+ 		ret = ib_copy_from_udata(&ucmd, udata,
+-					 min(sizeof(ucmd), udata->inlen));
++					 min(udata->inlen, sizeof(ucmd)));
+ 		if (ret) {
+ 			ibdev_err(ibdev, "Failed to copy CQ udata, err %d\n",
+ 				  ret);
+@@ -313,7 +313,8 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
+ 
+ 	if (udata) {
+ 		resp.cqn = hr_cq->cqn;
+-		ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
++		ret = ib_copy_to_udata(udata, &resp,
++				       min(udata->outlen, sizeof(resp)));
+ 		if (ret)
+ 			goto err_cqc;
+ 	}
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index afeffafc59f90..a6277d1c36ba9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -325,7 +325,8 @@ static int hns_roce_alloc_ucontext(struct ib_ucontext *uctx,
+ 
+ 	resp.cqe_size = hr_dev->caps.cqe_sz;
+ 
+-	ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
++	ret = ib_copy_to_udata(udata, &resp,
++			       min(udata->outlen, sizeof(resp)));
+ 	if (ret)
+ 		goto error_fail_copy_to_udata;
+ 
+diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
+index 98f69496adb49..f78fa1d3d8075 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
+@@ -70,16 +70,17 @@ int hns_roce_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
+ 	}
+ 
+ 	if (udata) {
+-		struct hns_roce_ib_alloc_pd_resp uresp = {.pdn = pd->pdn};
++		struct hns_roce_ib_alloc_pd_resp resp = {.pdn = pd->pdn};
+ 
+-		if (ib_copy_to_udata(udata, &uresp, sizeof(uresp))) {
++		ret = ib_copy_to_udata(udata, &resp,
++				       min(udata->outlen, sizeof(resp)));
++		if (ret) {
+ 			hns_roce_pd_free(to_hr_dev(ib_dev), pd->pdn);
+-			ibdev_err(ib_dev, "failed to copy to udata\n");
+-			return -EFAULT;
++			ibdev_err(ib_dev, "failed to copy to udata, ret = %d\n", ret);
+ 		}
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ int hns_roce_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 71ea8fd9041b9..800141ab643a3 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -865,9 +865,12 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
+ 	}
+ 
+ 	if (udata) {
+-		if (ib_copy_from_udata(ucmd, udata, sizeof(*ucmd))) {
+-			ibdev_err(ibdev, "Failed to copy QP ucmd\n");
+-			return -EFAULT;
++		ret = ib_copy_from_udata(ucmd, udata,
++					 min(udata->inlen, sizeof(*ucmd)));
++		if (ret) {
++			ibdev_err(ibdev,
++				  "failed to copy QP ucmd, ret = %d\n", ret);
++			return ret;
+ 		}
+ 
+ 		ret = set_user_sq_size(hr_dev, &init_attr->cap, hr_qp, ucmd);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 8caf74e44efd9..75d74f4bb52c9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -300,7 +300,8 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ 	srq->max_gs = init_attr->attr.max_sge;
+ 
+ 	if (udata) {
+-		ret = ib_copy_from_udata(&ucmd, udata, sizeof(ucmd));
++		ret = ib_copy_from_udata(&ucmd, udata,
++					 min(udata->inlen, sizeof(ucmd)));
+ 		if (ret) {
+ 			ibdev_err(ibdev, "Failed to copy SRQ udata, err %d\n",
+ 				  ret);
+@@ -343,11 +344,10 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ 	resp.srqn = srq->srqn;
+ 
+ 	if (udata) {
+-		if (ib_copy_to_udata(udata, &resp,
+-				     min(udata->outlen, sizeof(resp)))) {
+-			ret = -EFAULT;
++		ret = ib_copy_to_udata(udata, &resp,
++				       min(udata->outlen, sizeof(resp)));
++		if (ret)
+ 			goto err_srqc_alloc;
+-		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-normalization-the-judgment-of-some-features.patch b/queue-5.10/rdma-hns-normalization-the-judgment-of-some-features.patch
new file mode 100644
index 00000000000..e8c3c010324
--- /dev/null
+++ b/queue-5.10/rdma-hns-normalization-the-judgment-of-some-features.patch
@@ -0,0 +1,99 @@
+From 629bd491f05daef74f9d2d32e01135ef47514e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 09:37:28 +0800
+Subject: RDMA/hns: Normalization the judgment of some features
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit 4ddeacf68a3dd05f346b63f4507e1032a15cc3cc ]
+
+Whether to enable the these features should better depend on the enable
+flags, not the value of related fields.
+
+Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08")
+Fixes: 3cb2c996c9dc ("RDMA/hns: Add support for SCCC in size of 64 Bytes")
+Link: https://lore.kernel.org/r/1607650657-35992-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c  | 4 ++--
+ drivers/infiniband/hw/hns/hns_roce_main.c | 8 ++++----
+ drivers/infiniband/hw/hns/hns_roce_qp.c   | 2 +-
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index 7487cf3d2c37a..66f9f036ef946 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -1017,7 +1017,7 @@ void hns_roce_cleanup_hem_table(struct hns_roce_dev *hr_dev,
+ 
+ void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
+ {
+-	if (hr_dev->caps.srqc_entry_sz)
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
+ 		hns_roce_cleanup_hem_table(hr_dev,
+ 					   &hr_dev->srq_table.table);
+ 	hns_roce_cleanup_hem_table(hr_dev, &hr_dev->cq_table.table);
+@@ -1027,7 +1027,7 @@ void hns_roce_cleanup_hem(struct hns_roce_dev *hr_dev)
+ 	if (hr_dev->caps.cqc_timer_entry_sz)
+ 		hns_roce_cleanup_hem_table(hr_dev,
+ 					   &hr_dev->cqc_timer_table);
+-	if (hr_dev->caps.sccc_sz)
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)
+ 		hns_roce_cleanup_hem_table(hr_dev,
+ 					   &hr_dev->qp_table.sccc_table);
+ 	if (hr_dev->caps.trrl_entry_sz)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index a6277d1c36ba9..ae721fa61e0e4 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -632,7 +632,7 @@ static int hns_roce_init_hem(struct hns_roce_dev *hr_dev)
+ 		goto err_unmap_trrl;
+ 	}
+ 
+-	if (hr_dev->caps.srqc_entry_sz) {
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) {
+ 		ret = hns_roce_init_hem_table(hr_dev, &hr_dev->srq_table.table,
+ 					      HEM_TYPE_SRQC,
+ 					      hr_dev->caps.srqc_entry_sz,
+@@ -644,7 +644,7 @@ static int hns_roce_init_hem(struct hns_roce_dev *hr_dev)
+ 		}
+ 	}
+ 
+-	if (hr_dev->caps.sccc_sz) {
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) {
+ 		ret = hns_roce_init_hem_table(hr_dev,
+ 					      &hr_dev->qp_table.sccc_table,
+ 					      HEM_TYPE_SCCC,
+@@ -688,11 +688,11 @@ err_unmap_qpc_timer:
+ 		hns_roce_cleanup_hem_table(hr_dev, &hr_dev->qpc_timer_table);
+ 
+ err_unmap_ctx:
+-	if (hr_dev->caps.sccc_sz)
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL)
+ 		hns_roce_cleanup_hem_table(hr_dev,
+ 					   &hr_dev->qp_table.sccc_table);
+ err_unmap_srq:
+-	if (hr_dev->caps.srqc_entry_sz)
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
+ 		hns_roce_cleanup_hem_table(hr_dev, &hr_dev->srq_table.table);
+ 
+ err_unmap_cq:
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 800141ab643a3..ef1452215b17d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -286,7 +286,7 @@ static int alloc_qpc(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+ 		}
+ 	}
+ 
+-	if (hr_dev->caps.sccc_sz) {
++	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_FLOW_CTRL) {
+ 		/* Alloc memory for SCC CTX */
+ 		ret = hns_roce_table_get(hr_dev, &qp_table->sccc_table,
+ 					 hr_qp->qpn);
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-hns-only-record-vlan-info-for-hip08.patch b/queue-5.10/rdma-hns-only-record-vlan-info-for-hip08.patch
new file mode 100644
index 00000000000..5873a03f175
--- /dev/null
+++ b/queue-5.10/rdma-hns-only-record-vlan-info-for-hip08.patch
@@ -0,0 +1,159 @@
+From a0cca0392b3685079117adf8cb74a1b0833662f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 19:33:22 +0800
+Subject: RDMA/hns: Only record vlan info for HIP08
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit 7406c0036f851ee1cd93cb08349f24b051b4cbf8 ]
+
+Information about vlan is stored in GMV(GID/MAC/VLAN) table for HIP09, so
+there is no need to copy it to address vector.
+
+Link: https://lore.kernel.org/r/1605526408-6936-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_ah.c     | 51 ++++++++++-----------
+ drivers/infiniband/hw/hns/hns_roce_device.h |  2 +-
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 13 ++++--
+ 3 files changed, 33 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
+index 75b06db60f7c2..3be80d42e03a9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
++++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
+@@ -31,13 +31,13 @@
+  */
+ 
+ #include <linux/platform_device.h>
++#include <linux/pci.h>
+ #include <rdma/ib_addr.h>
+ #include <rdma/ib_cache.h>
+ #include "hns_roce_device.h"
+ 
+-#define HNS_ROCE_PORT_NUM_SHIFT		24
+-#define HNS_ROCE_VLAN_SL_BIT_MASK	7
+-#define HNS_ROCE_VLAN_SL_SHIFT		13
++#define VLAN_SL_MASK 7
++#define VLAN_SL_SHIFT 13
+ 
+ static inline u16 get_ah_udp_sport(const struct rdma_ah_attr *ah_attr)
+ {
+@@ -58,37 +58,16 @@ static inline u16 get_ah_udp_sport(const struct rdma_ah_attr *ah_attr)
+ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ 		       struct ib_udata *udata)
+ {
+-	struct hns_roce_dev *hr_dev = to_hr_dev(ibah->device);
+-	const struct ib_gid_attr *gid_attr;
+-	struct device *dev = hr_dev->dev;
+-	struct hns_roce_ah *ah = to_hr_ah(ibah);
+ 	struct rdma_ah_attr *ah_attr = init_attr->ah_attr;
+ 	const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr);
+-	u16 vlan_id = 0xffff;
+-	bool vlan_en = false;
+-	int ret;
+-
+-	gid_attr = ah_attr->grh.sgid_attr;
+-	ret = rdma_read_gid_l2_fields(gid_attr, &vlan_id, NULL);
+-	if (ret)
+-		return ret;
++	struct hns_roce_dev *hr_dev = to_hr_dev(ibah->device);
++	struct hns_roce_ah *ah = to_hr_ah(ibah);
++	int ret = 0;
+ 
+-	/* Get mac address */
+ 	memcpy(ah->av.mac, ah_attr->roce.dmac, ETH_ALEN);
+ 
+-	if (vlan_id < VLAN_N_VID) {
+-		vlan_en = true;
+-		vlan_id |= (rdma_ah_get_sl(ah_attr) &
+-			     HNS_ROCE_VLAN_SL_BIT_MASK) <<
+-			     HNS_ROCE_VLAN_SL_SHIFT;
+-	}
+-
+ 	ah->av.port = rdma_ah_get_port_num(ah_attr);
+ 	ah->av.gid_index = grh->sgid_index;
+-	ah->av.vlan_id = vlan_id;
+-	ah->av.vlan_en = vlan_en;
+-	dev_dbg(dev, "gid_index = 0x%x,vlan_id = 0x%x\n", ah->av.gid_index,
+-		ah->av.vlan_id);
+ 
+ 	if (rdma_ah_get_static_rate(ah_attr))
+ 		ah->av.stat_rate = IB_RATE_10_GBPS;
+@@ -98,7 +77,23 @@ int hns_roce_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ 	ah->av.flowlabel = grh->flow_label;
+ 	ah->av.udp_sport = get_ah_udp_sport(ah_attr);
+ 
+-	return 0;
++	/* HIP08 needs to record vlan info in Address Vector */
++	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
++		ah->av.vlan_en = 0;
++
++		ret = rdma_read_gid_l2_fields(ah_attr->grh.sgid_attr,
++					      &ah->av.vlan_id, NULL);
++		if (ret)
++			return ret;
++
++		if (ah->av.vlan_id < VLAN_N_VID) {
++			ah->av.vlan_en = 1;
++			ah->av.vlan_id |= (rdma_ah_get_sl(ah_attr) & VLAN_SL_MASK) <<
++					  VLAN_SL_SHIFT;
++		}
++	}
++
++	return ret;
+ }
+ 
+ int hns_roce_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 6d2acff69f982..b025841e08154 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -547,7 +547,7 @@ struct hns_roce_av {
+ 	u8 dgid[HNS_ROCE_GID_SIZE];
+ 	u8 mac[ETH_ALEN];
+ 	u16 vlan_id;
+-	bool vlan_en;
++	u8 vlan_en;
+ };
+ 
+ struct hns_roce_ah {
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 0468028ffe390..d127e0e4c3cda 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -495,8 +495,6 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
+ 	roce_set_field(ud_sq_wqe->byte_32, V2_UD_SEND_WQE_BYTE_32_DQPN_M,
+ 		       V2_UD_SEND_WQE_BYTE_32_DQPN_S, ud_wr(wr)->remote_qpn);
+ 
+-	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_VLAN_M,
+-		       V2_UD_SEND_WQE_BYTE_36_VLAN_S, ah->av.vlan_id);
+ 	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_M,
+ 		       V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_S, ah->av.hop_limit);
+ 	roce_set_field(ud_sq_wqe->byte_36, V2_UD_SEND_WQE_BYTE_36_TCLASS_M,
+@@ -508,11 +506,18 @@ static inline int set_ud_wqe(struct hns_roce_qp *qp,
+ 	roce_set_field(ud_sq_wqe->byte_40, V2_UD_SEND_WQE_BYTE_40_PORTN_M,
+ 		       V2_UD_SEND_WQE_BYTE_40_PORTN_S, qp->port);
+ 
+-	roce_set_bit(ud_sq_wqe->byte_40, V2_UD_SEND_WQE_BYTE_40_UD_VLAN_EN_S,
+-		     ah->av.vlan_en ? 1 : 0);
+ 	roce_set_field(ud_sq_wqe->byte_48, V2_UD_SEND_WQE_BYTE_48_SGID_INDX_M,
+ 		       V2_UD_SEND_WQE_BYTE_48_SGID_INDX_S, ah->av.gid_index);
+ 
++	if (hr_dev->pci_dev->revision <= PCI_REVISION_ID_HIP08) {
++		roce_set_bit(ud_sq_wqe->byte_40,
++			     V2_UD_SEND_WQE_BYTE_40_UD_VLAN_EN_S,
++			     ah->av.vlan_en);
++		roce_set_field(ud_sq_wqe->byte_36,
++			       V2_UD_SEND_WQE_BYTE_36_VLAN_M,
++			       V2_UD_SEND_WQE_BYTE_36_VLAN_S, ah->av.vlan_id);
++	}
++
+ 	memcpy(&ud_sq_wqe->dgid[0], &ah->av.dgid[0], GID_LEN_V2);
+ 
+ 	set_extend_sge(qp, wr, &curr_idx, valid_num_sge);
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-mlx5-fix-corruption-of-reg_pages-in-mlx5_ib_rer.patch b/queue-5.10/rdma-mlx5-fix-corruption-of-reg_pages-in-mlx5_ib_rer.patch
new file mode 100644
index 00000000000..1668f171e90
--- /dev/null
+++ b/queue-5.10/rdma-mlx5-fix-corruption-of-reg_pages-in-mlx5_ib_rer.patch
@@ -0,0 +1,107 @@
+From 9233831dbd3bb1ee831dbdb84df21d978987ade7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 15:19:31 +0200
+Subject: RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit fc3325701a6353594083f08e297d4c1965c601aa ]
+
+reg_pages should always contain mr->npage since when the mr is finally
+de-reg'd it is always subtracted out.
+
+If there were any error exits then mlx5_ib_rereg_user_mr() would leave the
+reg_pages adjusted and this will cause it to be double subtracted
+eventually.
+
+The manipulation of reg_pages is inherently connected to the umem, so lift
+it out of set_mr_fields() and only adjust it around creating/destroying a
+umem.
+
+reg_pages is only used for diagnostics in sysfs.
+
+Fixes: 7d0cc6edcc70 ("IB/mlx5: Add MR cache for large UMR regions")
+Link: https://lore.kernel.org/r/20201026131936.1335664-3-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index b261797b258fd..3468ae804eaee 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1247,10 +1247,8 @@ err_1:
+ }
+ 
+ static void set_mr_fields(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
+-			  int npages, u64 length, int access_flags)
++			  u64 length, int access_flags)
+ {
+-	mr->npages = npages;
+-	atomic_add(npages, &dev->mdev->priv.reg_pages);
+ 	mr->ibmr.lkey = mr->mmkey.key;
+ 	mr->ibmr.rkey = mr->mmkey.key;
+ 	mr->ibmr.length = length;
+@@ -1290,8 +1288,7 @@ static struct ib_mr *mlx5_ib_get_dm_mr(struct ib_pd *pd, u64 start_addr,
+ 
+ 	kfree(in);
+ 
+-	mr->umem = NULL;
+-	set_mr_fields(dev, mr, 0, length, acc);
++	set_mr_fields(dev, mr, length, acc);
+ 
+ 	return &mr->ibmr;
+ 
+@@ -1419,7 +1416,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ 	mlx5_ib_dbg(dev, "mkey 0x%x\n", mr->mmkey.key);
+ 
+ 	mr->umem = umem;
+-	set_mr_fields(dev, mr, npages, length, access_flags);
++	mr->npages = npages;
++	atomic_add(mr->npages, &dev->mdev->priv.reg_pages);
++	set_mr_fields(dev, mr, length, access_flags);
+ 
+ 	if (xlt_with_umr && !(access_flags & IB_ACCESS_ON_DEMAND)) {
+ 		/*
+@@ -1531,8 +1530,6 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
+ 	mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
+ 		    start, virt_addr, length, access_flags);
+ 
+-	atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
+-
+ 	if (!mr->umem)
+ 		return -EINVAL;
+ 
+@@ -1553,12 +1550,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
+ 		 * used.
+ 		 */
+ 		flags |= IB_MR_REREG_TRANS;
++		atomic_sub(mr->npages, &dev->mdev->priv.reg_pages);
++		mr->npages = 0;
+ 		ib_umem_release(mr->umem);
+ 		mr->umem = NULL;
++
+ 		err = mr_umem_get(dev, addr, len, access_flags, &mr->umem,
+ 				  &npages, &page_shift, &ncont, &order);
+ 		if (err)
+ 			goto err;
++		mr->npages = ncont;
++		atomic_add(mr->npages, &dev->mdev->priv.reg_pages);
+ 	}
+ 
+ 	if (!mlx5_ib_can_reconfig_with_umr(dev, mr->access_flags,
+@@ -1609,7 +1611,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
+ 			goto err;
+ 	}
+ 
+-	set_mr_fields(dev, mr, npages, len, access_flags);
++	set_mr_fields(dev, mr, len, access_flags);
+ 
+ 	return 0;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-mlx5-fix-mr-cache-memory-leak.patch b/queue-5.10/rdma-mlx5-fix-mr-cache-memory-leak.patch
new file mode 100644
index 00000000000..970b9da338f
--- /dev/null
+++ b/queue-5.10/rdma-mlx5-fix-mr-cache-memory-leak.patch
@@ -0,0 +1,54 @@
+From a601f1898b83fe6157fd977272126d771712ca67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 15:29:36 +0200
+Subject: RDMA/mlx5: Fix MR cache memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit e89938902927a54abebccc9537991aca5237dfaf ]
+
+If the MR cache entry invalidation failed, then we detach this entry from
+the cache, therefore we must to free the memory as well.
+
+Allcation backtrace for the leaker:
+
+    [<00000000d8e423b0>] alloc_cache_mr+0x23/0xc0 [mlx5_ib]
+    [<000000001f21304c>] create_cache_mr+0x3f/0xf0 [mlx5_ib]
+    [<000000009d6b45dc>] mlx5_ib_alloc_implicit_mr+0x41/0×210 [mlx5_ib]
+    [<00000000879d0d68>] mlx5_ib_reg_user_mr+0x9e/0×6e0 [mlx5_ib]
+    [<00000000be74bf89>] create_qp+0x2fc/0xf00 [ib_uverbs]
+    [<000000001a532d22>] ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ+0x1d9/0×230 [ib_uverbs]
+    [<0000000070f46001>] rdma_alloc_commit_uobject+0xb5/0×120 [ib_uverbs]
+    [<000000006d8a0b38>] uverbs_alloc+0x2b/0xf0 [ib_uverbs]
+    [<00000000075217c9>] ksysioctl+0x234/0×7d0
+    [<00000000eb5c120b>] __x64_sys_ioctl+0x16/0×20
+    [<00000000db135b48>] do_syscall_64+0x59/0×2e0
+
+Fixes: 1769c4c57548 ("RDMA/mlx5: Always remove MRs from the cache before destroying them")
+Link: https://lore.kernel.org/r/20201213132940.345554-2-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 3468ae804eaee..971694e781b65 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -642,6 +642,7 @@ void mlx5_mr_cache_free(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ 	if (mlx5_mr_cache_invalidate(mr)) {
+ 		detach_mr_from_cache(mr);
+ 		destroy_mkey(dev, mr);
++		kfree(mr);
+ 		return;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-mthca-work-around-wenum-conversion-warning.patch b/queue-5.10/rdma-mthca-work-around-wenum-conversion-warning.patch
new file mode 100644
index 00000000000..1e4e91f9ddc
--- /dev/null
+++ b/queue-5.10/rdma-mthca-work-around-wenum-conversion-warning.patch
@@ -0,0 +1,61 @@
+From 25ebec63494033c0e7a98ff71c49e584a8e4a8c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 22:12:30 +0100
+Subject: RDMa/mthca: Work around -Wenum-conversion warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]
+
+gcc points out a suspicious mixing of enum types in a function that
+converts from MTHCA_OPCODE_* values to IB_WC_* values:
+
+drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
+drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
+  607 |    entry->opcode    = MTHCA_OPCODE_INVALID;
+
+Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
+this is meaningful, but it seems harmless as it deals with an invalid
+input.
+
+Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
+still bogus, but at least doesn't make compiler warnings.
+
+Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
+Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cq.c  | 2 +-
+ drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index 119b2573c9a08..26c3408dcacae 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -604,7 +604,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
+ 			entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
+ 			break;
+ 		default:
+-			entry->opcode    = MTHCA_OPCODE_INVALID;
++			entry->opcode = 0xFF;
+ 			break;
+ 		}
+ 	} else {
+diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
+index 9dbbf4d16796a..a445160de3e16 100644
+--- a/drivers/infiniband/hw/mthca/mthca_dev.h
++++ b/drivers/infiniband/hw/mthca/mthca_dev.h
+@@ -105,7 +105,6 @@ enum {
+ 	MTHCA_OPCODE_ATOMIC_CS      = 0x11,
+ 	MTHCA_OPCODE_ATOMIC_FA      = 0x12,
+ 	MTHCA_OPCODE_BIND_MW        = 0x18,
+-	MTHCA_OPCODE_INVALID        = 0xff
+ };
+ 
+ enum {
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-rtrs-clt-missing-error-from-rtrs_rdma_conn_esta.patch b/queue-5.10/rdma-rtrs-clt-missing-error-from-rtrs_rdma_conn_esta.patch
new file mode 100644
index 00000000000..a85755f9042
--- /dev/null
+++ b/queue-5.10/rdma-rtrs-clt-missing-error-from-rtrs_rdma_conn_esta.patch
@@ -0,0 +1,42 @@
+From 6bffa358034793fb03d4c9d2d9a2288a659591e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 09:43:45 +0200
+Subject: RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established
+
+From: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+
+[ Upstream commit f553e7601df9566ba7644541fc09152a3a81f793 ]
+
+When rtrs_rdma_conn_established returns error (non-zero value), the error
+value is stored in con->cm_err and it cannot trigger
+rtrs_rdma_error_recovery. Finally the error of rtrs_rdma_con_established
+will be forgot.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20201023074353.21946-5-jinpu.wang@cloud.ionos.com
+Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 3cc957fea93ee..d54a77ebe1184 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1835,8 +1835,8 @@ static int rtrs_clt_rdma_cm_handler(struct rdma_cm_id *cm_id,
+ 		cm_err = rtrs_rdma_route_resolved(con);
+ 		break;
+ 	case RDMA_CM_EVENT_ESTABLISHED:
+-		con->cm_err = rtrs_rdma_conn_established(con, ev);
+-		if (likely(!con->cm_err)) {
++		cm_err = rtrs_rdma_conn_established(con, ev);
++		if (likely(!cm_err)) {
+ 			/*
+ 			 * Report success and wake up. Here we abuse state_wq,
+ 			 * i.e. wake up without state change, but we set cm_err.
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-rtrs-clt-remove-destroy_con_cq_qp-in-case-route.patch b/queue-5.10/rdma-rtrs-clt-remove-destroy_con_cq_qp-in-case-route.patch
new file mode 100644
index 00000000000..b9bbf223f10
--- /dev/null
+++ b/queue-5.10/rdma-rtrs-clt-remove-destroy_con_cq_qp-in-case-route.patch
@@ -0,0 +1,46 @@
+From e611b49a3fbddbc67bb04bcabd42f8198cbc28aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 09:43:42 +0200
+Subject: RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving
+ failed
+
+From: Danil Kipnis <danil.kipnis@cloud.ionos.com>
+
+[ Upstream commit 2b3062e4d997f201c1ad2bbde88b7271dd9ef35f ]
+
+We call destroy_con_cq_qp(con) in rtrs_rdma_addr_resolved() in case route
+couldn't be resolved and then again in create_cm() because nothing
+happens.
+
+Don't call destroy_con_cq_qp from rtrs_rdma_addr_resolved, create_cm()
+does the clean up already.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20201023074353.21946-2-jinpu.wang@cloud.ionos.com
+Signed-off-by: Danil Kipnis <danil.kipnis@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index f298adc02acba..3cc957fea93ee 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1640,10 +1640,8 @@ static int rtrs_rdma_addr_resolved(struct rtrs_clt_con *con)
+ 		return err;
+ 	}
+ 	err = rdma_resolve_route(con->c.cm_id, RTRS_CONNECT_TIMEOUT_MS);
+-	if (err) {
++	if (err)
+ 		rtrs_err(s, "Resolving route failed, err: %d\n", err);
+-		destroy_con_cq_qp(con);
+-	}
+ 
+ 	return err;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-rtrs-srv-don-t-guard-the-whole-__alloc_srv-with.patch b/queue-5.10/rdma-rtrs-srv-don-t-guard-the-whole-__alloc_srv-with.patch
new file mode 100644
index 00000000000..ba196cc7fc3
--- /dev/null
+++ b/queue-5.10/rdma-rtrs-srv-don-t-guard-the-whole-__alloc_srv-with.patch
@@ -0,0 +1,193 @@
+From 91f20b8135f148e899352c30446e4e5fbc6ae43e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 09:43:46 +0200
+Subject: RDMA/rtrs-srv: Don't guard the whole __alloc_srv with srv_mutex
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit d715ff8acbd5876549ef2b21b755ed919f40dcc1 ]
+
+The purpose of srv_mutex is to protect srv_list as in put_srv, so no need
+to hold it when allocate memory for srv since it could be time consuming.
+
+Otherwise if one machine has limited memory, rsrv_close_work could be
+blocked for a longer time due to the mutex is held by get_or_create_srv
+since it can't get memory in time.
+
+  INFO: task kworker/1:1:27478 blocked for more than 120 seconds.
+        Tainted: G           O    4.14.171-1-storage #4.14.171-1.3~deb9
+  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+  kworker/1:1     D    0 27478      2 0x80000000
+  Workqueue: rtrs_server_wq rtrs_srv_close_work [rtrs_server]
+  Call Trace:
+   ? __schedule+0x38c/0x7e0
+   schedule+0x32/0x80
+   schedule_preempt_disabled+0xa/0x10
+   __mutex_lock.isra.2+0x25e/0x4d0
+   ? put_srv+0x44/0x100 [rtrs_server]
+   put_srv+0x44/0x100 [rtrs_server]
+   rtrs_srv_close_work+0x16c/0x280 [rtrs_server]
+   process_one_work+0x1c5/0x3c0
+   worker_thread+0x47/0x3e0
+   kthread+0xfc/0x130
+   ? trace_event_raw_event_workqueue_execute_start+0xa0/0xa0
+   ? kthread_create_on_node+0x70/0x70
+   ret_from_fork+0x1f/0x30
+
+Let's move all the logics from __find_srv_and_get and __alloc_srv to
+get_or_create_srv, and remove the two functions. Then it should be safe
+for multiple processes to access the same srv since it is protected with
+srv_mutex.
+
+And since we don't want to allocate chunks with srv_mutex held, let's
+check the srv->refcount after get srv because the chunks could not be
+allocated yet.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20201023074353.21946-6-jinpu.wang@cloud.ionos.com
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 86 +++++++++++---------------
+ 1 file changed, 37 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index d6f93601712e4..1cb778aff3c59 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1328,17 +1328,42 @@ static void rtrs_srv_dev_release(struct device *dev)
+ 	kfree(srv);
+ }
+ 
+-static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+-				     const uuid_t *paths_uuid)
++static void free_srv(struct rtrs_srv *srv)
++{
++	int i;
++
++	WARN_ON(refcount_read(&srv->refcount));
++	for (i = 0; i < srv->queue_depth; i++)
++		mempool_free(srv->chunks[i], chunk_pool);
++	kfree(srv->chunks);
++	mutex_destroy(&srv->paths_mutex);
++	mutex_destroy(&srv->paths_ev_mutex);
++	/* last put to release the srv structure */
++	put_device(&srv->dev);
++}
++
++static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
++					   const uuid_t *paths_uuid)
+ {
+ 	struct rtrs_srv *srv;
+ 	int i;
+ 
++	mutex_lock(&ctx->srv_mutex);
++	list_for_each_entry(srv, &ctx->srv_list, ctx_list) {
++		if (uuid_equal(&srv->paths_uuid, paths_uuid) &&
++		    refcount_inc_not_zero(&srv->refcount)) {
++			mutex_unlock(&ctx->srv_mutex);
++			return srv;
++		}
++	}
++
++	/* need to allocate a new srv */
+ 	srv = kzalloc(sizeof(*srv), GFP_KERNEL);
+-	if  (!srv)
++	if  (!srv) {
++		mutex_unlock(&ctx->srv_mutex);
+ 		return NULL;
++	}
+ 
+-	refcount_set(&srv->refcount, 1);
+ 	INIT_LIST_HEAD(&srv->paths_list);
+ 	mutex_init(&srv->paths_mutex);
+ 	mutex_init(&srv->paths_ev_mutex);
+@@ -1347,6 +1372,8 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+ 	srv->ctx = ctx;
+ 	device_initialize(&srv->dev);
+ 	srv->dev.release = rtrs_srv_dev_release;
++	list_add(&srv->ctx_list, &ctx->srv_list);
++	mutex_unlock(&ctx->srv_mutex);
+ 
+ 	srv->chunks = kcalloc(srv->queue_depth, sizeof(*srv->chunks),
+ 			      GFP_KERNEL);
+@@ -1358,7 +1385,7 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+ 		if (!srv->chunks[i])
+ 			goto err_free_chunks;
+ 	}
+-	list_add(&srv->ctx_list, &ctx->srv_list);
++	refcount_set(&srv->refcount, 1);
+ 
+ 	return srv;
+ 
+@@ -1369,52 +1396,9 @@ err_free_chunks:
+ 
+ err_free_srv:
+ 	kfree(srv);
+-
+ 	return NULL;
+ }
+ 
+-static void free_srv(struct rtrs_srv *srv)
+-{
+-	int i;
+-
+-	WARN_ON(refcount_read(&srv->refcount));
+-	for (i = 0; i < srv->queue_depth; i++)
+-		mempool_free(srv->chunks[i], chunk_pool);
+-	kfree(srv->chunks);
+-	mutex_destroy(&srv->paths_mutex);
+-	mutex_destroy(&srv->paths_ev_mutex);
+-	/* last put to release the srv structure */
+-	put_device(&srv->dev);
+-}
+-
+-static inline struct rtrs_srv *__find_srv_and_get(struct rtrs_srv_ctx *ctx,
+-						   const uuid_t *paths_uuid)
+-{
+-	struct rtrs_srv *srv;
+-
+-	list_for_each_entry(srv, &ctx->srv_list, ctx_list) {
+-		if (uuid_equal(&srv->paths_uuid, paths_uuid) &&
+-		    refcount_inc_not_zero(&srv->refcount))
+-			return srv;
+-	}
+-
+-	return NULL;
+-}
+-
+-static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+-					   const uuid_t *paths_uuid)
+-{
+-	struct rtrs_srv *srv;
+-
+-	mutex_lock(&ctx->srv_mutex);
+-	srv = __find_srv_and_get(ctx, paths_uuid);
+-	if (!srv)
+-		srv = __alloc_srv(ctx, paths_uuid);
+-	mutex_unlock(&ctx->srv_mutex);
+-
+-	return srv;
+-}
+-
+ static void put_srv(struct rtrs_srv *srv)
+ {
+ 	if (refcount_dec_and_test(&srv->refcount)) {
+@@ -1813,7 +1797,11 @@ static int rtrs_rdma_connect(struct rdma_cm_id *cm_id,
+ 	}
+ 	recon_cnt = le16_to_cpu(msg->recon_cnt);
+ 	srv = get_or_create_srv(ctx, &msg->paths_uuid);
+-	if (!srv) {
++	/*
++	 * "refcount == 0" happens if a previous thread calls get_or_create_srv
++	 * allocate srv, but chunks of srv are not allocated yet.
++	 */
++	if (!srv || refcount_read(&srv->refcount) == 0) {
+ 		err = -ENOMEM;
+ 		goto reject_w_err;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-rxe-compute-psn-windows-correctly.patch b/queue-5.10/rdma-rxe-compute-psn-windows-correctly.patch
new file mode 100644
index 00000000000..bd503716f5a
--- /dev/null
+++ b/queue-5.10/rdma-rxe-compute-psn-windows-correctly.patch
@@ -0,0 +1,43 @@
+From 3fda01f6fbdcd2647af30574e818facd60562a9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 12:07:42 -0500
+Subject: RDMA/rxe: Compute PSN windows correctly
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]
+
+The code which limited the number of unacknowledged PSNs was incorrect.
+The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
+The test was computing a 32 bit value which wraps at 32 bits so that
+qp->req.psn can appear smaller than the limit when it is actually larger.
+
+Replace '>' test with psn_compare which is used for other PSN comparisons
+and correctly handles the 24 bit size.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index af3923bf0a36b..d4917646641aa 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -634,7 +634,8 @@ next_wqe:
+ 	}
+ 
+ 	if (unlikely(qp_type(qp) == IB_QPT_RC &&
+-		     qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
++		psn_compare(qp->req.psn, (qp->comp.psn +
++				RXE_MAX_UNACKED_PSNS)) > 0)) {
+ 		qp->req.wait_psn = 1;
+ 		goto exit;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/rdma-uverbs-fix-incorrect-variable-type.patch b/queue-5.10/rdma-uverbs-fix-incorrect-variable-type.patch
new file mode 100644
index 00000000000..79cb95fbdf0
--- /dev/null
+++ b/queue-5.10/rdma-uverbs-fix-incorrect-variable-type.patch
@@ -0,0 +1,90 @@
+From b0ab52a55de337a943765445e40f8cdd4c53bc55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 09:35:45 +0200
+Subject: RDMA/uverbs: Fix incorrect variable type
+
+From: Avihai Horon <avihaih@nvidia.com>
+
+[ Upstream commit e0da68994d16b46384cce7b86eb645f1ef7c51ef ]
+
+Fix incorrect type of max_entries in UVERBS_METHOD_QUERY_GID_TABLE -
+max_entries is of type size_t although it can take negative values.
+
+The following static check revealed it:
+
+drivers/infiniband/core/uverbs_std_types_device.c:338 ib_uverbs_handler_UVERBS_METHOD_QUERY_GID_TABLE() warn: 'max_entries' unsigned <= 0
+
+Fixes: 9f85cbe50aa0 ("RDMA/uverbs: Expose the new GID query API to user space")
+Link: https://lore.kernel.org/r/20201208073545.9723-4-leon@kernel.org
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_std_types_device.c | 14 +++++---------
+ include/rdma/uverbs_ioctl.h                       | 10 ++++++++++
+ 2 files changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
+index 302f898c5833f..9ec6971056fa8 100644
+--- a/drivers/infiniband/core/uverbs_std_types_device.c
++++ b/drivers/infiniband/core/uverbs_std_types_device.c
+@@ -317,8 +317,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)(
+ 	struct ib_device *ib_dev;
+ 	size_t user_entry_size;
+ 	ssize_t num_entries;
+-	size_t max_entries;
+-	size_t num_bytes;
++	int max_entries;
+ 	u32 flags;
+ 	int ret;
+ 
+@@ -336,19 +335,16 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)(
+ 		attrs, UVERBS_ATTR_QUERY_GID_TABLE_RESP_ENTRIES,
+ 		user_entry_size);
+ 	if (max_entries <= 0)
+-		return -EINVAL;
++		return max_entries ?: -EINVAL;
+ 
+ 	ucontext = ib_uverbs_get_ucontext(attrs);
+ 	if (IS_ERR(ucontext))
+ 		return PTR_ERR(ucontext);
+ 	ib_dev = ucontext->device;
+ 
+-	if (check_mul_overflow(max_entries, sizeof(*entries), &num_bytes))
+-		return -EINVAL;
+-
+-	entries = uverbs_zalloc(attrs, num_bytes);
+-	if (!entries)
+-		return -ENOMEM;
++	entries = uverbs_kcalloc(attrs, max_entries, sizeof(*entries));
++	if (IS_ERR(entries))
++		return PTR_ERR(entries);
+ 
+ 	num_entries = rdma_query_gid_table(ib_dev, entries, max_entries);
+ 	if (num_entries < 0)
+diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
+index b00270c72740f..94fac55772f57 100644
+--- a/include/rdma/uverbs_ioctl.h
++++ b/include/rdma/uverbs_ioctl.h
+@@ -862,6 +862,16 @@ static inline __malloc void *uverbs_zalloc(struct uverbs_attr_bundle *bundle,
+ {
+ 	return _uverbs_alloc(bundle, size, GFP_KERNEL | __GFP_ZERO);
+ }
++
++static inline __malloc void *uverbs_kcalloc(struct uverbs_attr_bundle *bundle,
++					    size_t n, size_t size)
++{
++	size_t bytes;
++
++	if (unlikely(check_mul_overflow(n, size, &bytes)))
++		return ERR_PTR(-EOVERFLOW);
++	return uverbs_zalloc(bundle, bytes);
++}
+ int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
+ 		      size_t idx, s64 lower_bound, u64 upper_bound,
+ 		      s64 *def_val);
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-k3-dsp-fix-return-value-check-in-k3_dsp_r.patch b/queue-5.10/remoteproc-k3-dsp-fix-return-value-check-in-k3_dsp_r.patch
new file mode 100644
index 00000000000..87fce1566a3
--- /dev/null
+++ b/queue-5.10/remoteproc-k3-dsp-fix-return-value-check-in-k3_dsp_r.patch
@@ -0,0 +1,45 @@
+From 55d733d4b2897ebd2df0a644512da846c449ea3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Sep 2020 20:25:03 +0800
+Subject: remoteproc: k3-dsp: Fix return value check in
+ k3_dsp_rproc_of_get_memories()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6dfdf6e4e7096fead7755d47d91d72e896bb4804 ]
+
+In case of error, the function devm_ioremap_wc() returns NULL pointer
+not ERR_PTR(). The IS_ERR() test in the return value check should be
+replaced with NULL test.
+
+Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Fixes: 6edbe024ba17 ("remoteproc: k3-dsp: Add a remoteproc driver of K3 C66x DSPs")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Suman Anna <s-anna@ti.com>
+Link: https://lore.kernel.org/r/20200905122503.17352-1-yuehaibing@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/ti_k3_dsp_remoteproc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/remoteproc/ti_k3_dsp_remoteproc.c b/drivers/remoteproc/ti_k3_dsp_remoteproc.c
+index 9011e477290ce..863c0214e0a8e 100644
+--- a/drivers/remoteproc/ti_k3_dsp_remoteproc.c
++++ b/drivers/remoteproc/ti_k3_dsp_remoteproc.c
+@@ -445,10 +445,10 @@ static int k3_dsp_rproc_of_get_memories(struct platform_device *pdev,
+ 
+ 		kproc->mem[i].cpu_addr = devm_ioremap_wc(dev, res->start,
+ 							 resource_size(res));
+-		if (IS_ERR(kproc->mem[i].cpu_addr)) {
++		if (!kproc->mem[i].cpu_addr) {
+ 			dev_err(dev, "failed to map %s memory\n",
+ 				data->mems[i].name);
+-			return PTR_ERR(kproc->mem[i].cpu_addr);
++			return -ENOMEM;
+ 		}
+ 		kproc->mem[i].bus_addr = res->start;
+ 		kproc->mem[i].dev_addr = data->mems[i].dev_addr;
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-mediatek-change-mt8192-cfg-register-base.patch b/queue-5.10/remoteproc-mediatek-change-mt8192-cfg-register-base.patch
new file mode 100644
index 00000000000..e1b737c28c2
--- /dev/null
+++ b/queue-5.10/remoteproc-mediatek-change-mt8192-cfg-register-base.patch
@@ -0,0 +1,64 @@
+From abb82f7f95057b645f7316e7789afc14e0146ab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 13:41:09 +0800
+Subject: remoteproc/mediatek: change MT8192 CFG register base
+
+From: Tzung-Bi Shih <tzungbi@google.com>
+
+[ Upstream commit 0a441514bc2b8a48ebe23c2dcb9feee6351d45b6 ]
+
+The correct MT8192 CFG register base is 0x20000 off.  Changes the
+registers accordingly.
+
+Fixes: fd0b6c1ff85a ("remoteproc/mediatek: Add support for mt8192 SCP")
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20201210054109.587795-1-tzungbi@google.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_common.h | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_common.h b/drivers/remoteproc/mtk_common.h
+index 47b4561443a94..f2bcc9d9fda65 100644
+--- a/drivers/remoteproc/mtk_common.h
++++ b/drivers/remoteproc/mtk_common.h
+@@ -32,22 +32,22 @@
+ #define MT8183_SCP_CACHESIZE_8KB	BIT(8)
+ #define MT8183_SCP_CACHE_CON_WAYEN	BIT(10)
+ 
+-#define MT8192_L2TCM_SRAM_PD_0		0x210C0
+-#define MT8192_L2TCM_SRAM_PD_1		0x210C4
+-#define MT8192_L2TCM_SRAM_PD_2		0x210C8
+-#define MT8192_L1TCM_SRAM_PDN		0x2102C
+-#define MT8192_CPU0_SRAM_PD		0x21080
+-
+-#define MT8192_SCP2APMCU_IPC_SET	0x24080
+-#define MT8192_SCP2APMCU_IPC_CLR	0x24084
++#define MT8192_L2TCM_SRAM_PD_0		0x10C0
++#define MT8192_L2TCM_SRAM_PD_1		0x10C4
++#define MT8192_L2TCM_SRAM_PD_2		0x10C8
++#define MT8192_L1TCM_SRAM_PDN		0x102C
++#define MT8192_CPU0_SRAM_PD		0x1080
++
++#define MT8192_SCP2APMCU_IPC_SET	0x4080
++#define MT8192_SCP2APMCU_IPC_CLR	0x4084
+ #define MT8192_SCP_IPC_INT_BIT		BIT(0)
+-#define MT8192_SCP2SPM_IPC_CLR		0x24094
+-#define MT8192_GIPC_IN_SET		0x24098
++#define MT8192_SCP2SPM_IPC_CLR		0x4094
++#define MT8192_GIPC_IN_SET		0x4098
+ #define MT8192_HOST_IPC_INT_BIT		BIT(0)
+ 
+-#define MT8192_CORE0_SW_RSTN_CLR	0x30000
+-#define MT8192_CORE0_SW_RSTN_SET	0x30004
+-#define MT8192_CORE0_WDT_CFG		0x30034
++#define MT8192_CORE0_SW_RSTN_CLR	0x10000
++#define MT8192_CORE0_SW_RSTN_SET	0x10004
++#define MT8192_CORE0_WDT_CFG		0x10034
+ 
+ #define SCP_FW_VER_LEN			32
+ #define SCP_SHARE_BUFFER_SIZE		288
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-mediatek-unprepare-clk-if-scp_before_load.patch b/queue-5.10/remoteproc-mediatek-unprepare-clk-if-scp_before_load.patch
new file mode 100644
index 00000000000..b83d4850393
--- /dev/null
+++ b/queue-5.10/remoteproc-mediatek-unprepare-clk-if-scp_before_load.patch
@@ -0,0 +1,40 @@
+From d92347c3311698138ac65a70a9837890acc3a2d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:59:14 +0800
+Subject: remoteproc/mediatek: unprepare clk if scp_before_load fails
+
+From: Tzung-Bi Shih <tzungbi@google.com>
+
+[ Upstream commit 22c3df6f5574c8d401ea431c7ce24e7c5c5e7ef3 ]
+
+Fixes the error handling to unprepare clk if scp_before_load fails.
+
+Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Fixes: fd0b6c1ff85a ("remoteproc/mediatek: Add support for mt8192 SCP")
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20201203155914.3844426-1-tzungbi@google.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index f74f22d4d1ffc..52fa01d67c18e 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -350,9 +350,10 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
+ 
+ 	ret = scp->data->scp_before_load(scp);
+ 	if (ret < 0)
+-		return ret;
++		goto leave;
+ 
+ 	ret = scp_elf_load_segments(rproc, fw);
++leave:
+ 	clk_disable_unprepare(scp->clk);
+ 
+ 	return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-mtk_scp-surround-dt-device-ids-with-confi.patch b/queue-5.10/remoteproc-mtk_scp-surround-dt-device-ids-with-confi.patch
new file mode 100644
index 00000000000..a299826642e
--- /dev/null
+++ b/queue-5.10/remoteproc-mtk_scp-surround-dt-device-ids-with-confi.patch
@@ -0,0 +1,47 @@
+From 6a0e5ea4460eb6067dfde59064a6a0899e092937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 16:40:07 +0900
+Subject: remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF
+
+From: Alexandre Courbot <acourbot@chromium.org>
+
+[ Upstream commit e59aef4edc45133ccb10b8e962cb74dcf1e3240b ]
+
+Now that this driver can be compiled with COMPILE_TEST, we have no
+guarantee that CONFIG_OF will also be defined. When that happens, a
+warning about mtk_scp_of_match being defined but unused will be reported
+so make sure this variable is only defined if of_match_ptr() actually
+uses it.
+
+Fixes: cbd2dca74926c0e4610c40923cc786b732c9e8ef remoteproc: scp: add COMPILE_TEST dependency
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Alexandre Courbot <acourbot@chromium.org>
+Link: https://lore.kernel.org/r/20201102074007.299222-1-acourbot@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_scp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index 577cbd5d421ec..f74f22d4d1ffc 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -772,12 +772,14 @@ static const struct mtk_scp_of_data mt8192_of_data = {
+ 	.host_to_scp_int_bit = MT8192_HOST_IPC_INT_BIT,
+ };
+ 
++#if defined(CONFIG_OF)
+ static const struct of_device_id mtk_scp_of_match[] = {
+ 	{ .compatible = "mediatek,mt8183-scp", .data = &mt8183_of_data },
+ 	{ .compatible = "mediatek,mt8192-scp", .data = &mt8192_of_data },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, mtk_scp_of_match);
++#endif
+ 
+ static struct platform_driver mtk_scp_driver = {
+ 	.probe = scp_probe,
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch b/queue-5.10/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch
new file mode 100644
index 00000000000..f0dbfc6d751
--- /dev/null
+++ b/queue-5.10/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch
@@ -0,0 +1,50 @@
+From 87c992912537782ed0a2ef1a32825af964eba936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:34:33 +0800
+Subject: remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit a24723050037303e4008b37f1f8dcc99c58901aa ]
+
+If the pm_runtime_get_sync failed in q6v5_pds_enable when
+loop (i), The unroll_pd_votes will start from (i - 1), and
+it will resulted in following problems:
+
+  1) pm_runtime_get_sync will increment pm usage counter even it
+     failed. Forgetting to pm_runtime_put_noidle will result in
+     reference leak.
+
+  2) Have not reset pds[i] performance state.
+
+Then we fix it.
+
+Fixes: 4760a896be88e ("remoteproc: q6v5-mss: Vote for rpmh power domains")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102143433.143996-1-zhangqilong3@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index eb3457a6c3b73..ba6f7551242de 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -349,8 +349,11 @@ static int q6v5_pds_enable(struct q6v5 *qproc, struct device **pds,
+ 	for (i = 0; i < pd_count; i++) {
+ 		dev_pm_genpd_set_performance_state(pds[i], INT_MAX);
+ 		ret = pm_runtime_get_sync(pds[i]);
+-		if (ret < 0)
++		if (ret < 0) {
++			pm_runtime_put_noidle(pds[i]);
++			dev_pm_genpd_set_performance_state(pds[i], 0);
+ 			goto unroll_pd_votes;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch b/queue-5.10/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch
new file mode 100644
index 00000000000..faf2a645643
--- /dev/null
+++ b/queue-5.10/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch
@@ -0,0 +1,63 @@
+From 63b351eb40e764dd27bb853029c0279da184c362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 09:54:20 +0800
+Subject: remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit c3d4e5b12672bbdf63f4cc933e3169bc6bbec8da ]
+
+platform_get_resource() may fail and in this case a NULL dereference
+will occur.
+
+Fix it to use devm_platform_ioremap_resource() instead of calling
+platform_get_resource() and devm_ioremap().
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t,
+n);
++ if (!res)
++   return -EINVAL;
+... when != res == NULL
+e = devm_ioremap(e1, res->start, e2);
+
+Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607392460-20516-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_adsp.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
+index f0b7363b5b268..9eb599701f9b0 100644
+--- a/drivers/remoteproc/qcom_q6v5_adsp.c
++++ b/drivers/remoteproc/qcom_q6v5_adsp.c
+@@ -364,15 +364,12 @@ static int adsp_init_mmio(struct qcom_adsp *adsp,
+ 				struct platform_device *pdev)
+ {
+ 	struct device_node *syscon;
+-	struct resource *res;
+ 	int ret;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	adsp->qdsp6ss_base = devm_ioremap(&pdev->dev, res->start,
+-			resource_size(res));
+-	if (!adsp->qdsp6ss_base) {
++	adsp->qdsp6ss_base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(adsp->qdsp6ss_base)) {
+ 		dev_err(adsp->dev, "failed to map QDSP6SS registers\n");
+-		return -ENOMEM;
++		return PTR_ERR(adsp->qdsp6ss_base);
+ 	}
+ 
+ 	syscon = of_parse_phandle(pdev->dev.of_node, "qcom,halt-regs", 0);
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch b/queue-5.10/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch
new file mode 100644
index 00000000000..59215dbd463
--- /dev/null
+++ b/queue-5.10/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch
@@ -0,0 +1,41 @@
+From 33403c924ce95e6c1cff93e9e619a67f2a740c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:35:34 +0800
+Subject: remoteproc: qcom: fix reference leak in adsp_start
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit aa37448f597c09844942da87d042fc6793f989c2 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in adsp_start, so we should fix it.
+
+Fixes: dc160e4491222 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102143534.144484-1-zhangqilong3@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_adsp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
+index efb2c1aa80a3c..f0b7363b5b268 100644
+--- a/drivers/remoteproc/qcom_q6v5_adsp.c
++++ b/drivers/remoteproc/qcom_q6v5_adsp.c
+@@ -193,8 +193,10 @@ static int adsp_start(struct rproc *rproc)
+ 
+ 	dev_pm_genpd_set_performance_state(adsp->dev, INT_MAX);
+ 	ret = pm_runtime_get_sync(adsp->dev);
+-	if (ret)
++	if (ret) {
++		pm_runtime_put_noidle(adsp->dev);
+ 		goto disable_xo_clk;
++	}
+ 
+ 	ret = clk_bulk_prepare_enable(adsp->num_clks, adsp->clks);
+ 	if (ret) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/remoteproc-qcom-pas-fix-error-handling-in-adsp_pds_e.patch b/queue-5.10/remoteproc-qcom-pas-fix-error-handling-in-adsp_pds_e.patch
new file mode 100644
index 00000000000..8581cfc8776
--- /dev/null
+++ b/queue-5.10/remoteproc-qcom-pas-fix-error-handling-in-adsp_pds_e.patch
@@ -0,0 +1,50 @@
+From c76028be2ace6af9b72c1a17d09ae1ec2735a520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:35:54 +0800
+Subject: remoteproc: qcom: pas: fix error handling in adsp_pds_enable
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit c0a6e5ee1ecfe4c3a5799cfd30820748eff5dfab ]
+
+If the pm_runtime_get_sync failed in adsp_pds_enable when
+loop (i), The unroll_pd_votes will start from (i - 1), and
+it will resulted in following problems:
+
+  1) pm_runtime_get_sync will increment pm usage counter even it
+     failed. Forgetting to pm_runtime_put_noidle will result in
+     reference leak.
+
+  2) Have not reset pds[i] performance state.
+
+Then we fix it.
+
+Fixes: 17ee2fb4e8567 ("remoteproc: qcom: pas: Vote for active/proxy power domains")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102143554.144707-1-zhangqilong3@huawei.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 3837f23995e05..0678b417707ef 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -90,8 +90,11 @@ static int adsp_pds_enable(struct qcom_adsp *adsp, struct device **pds,
+ 	for (i = 0; i < pd_count; i++) {
+ 		dev_pm_genpd_set_performance_state(pds[i], INT_MAX);
+ 		ret = pm_runtime_get_sync(pds[i]);
+-		if (ret < 0)
++		if (ret < 0) {
++			pm_runtime_put_noidle(pds[i]);
++			dev_pm_genpd_set_performance_state(pds[i], 0);
+ 			goto unroll_pd_votes;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch b/queue-5.10/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch
new file mode 100644
index 00000000000..38ae97a18c7
--- /dev/null
+++ b/queue-5.10/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch
@@ -0,0 +1,75 @@
+From c3c7c2ba8ded7273aba0da33f0c12b4921073a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 14:25:29 -0700
+Subject: Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9cb4c67d7717135d6f4600a49ab07b470ea4ee2f ]
+
+This reverts commit 02b9aec59243c6240fc42884acc958602146ddf6.
+
+As talked about in the patch ("soc: qcom: geni: More properly switch
+to DMA mode"), swapping the order of geni_se_setup_m_cmd() and
+geni_se_xx_dma_prep() can sometimes cause corrupted transfers.  Thus
+we traded one problem for another.  Now that we've debugged the
+problem further and fixed the geni helper functions to more disable
+FIFO interrupts when we move to DMA mode we can revert it and end up
+with (hopefully) zero problems!
+
+To be explicit, the patch ("soc: qcom: geni: More properly switch
+to DMA mode") is a prerequisite for this one.
+
+Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20201013142448.v2.2.I7b22281453b8a18ab16ef2bfd4c641fb1cc6a92c@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 8b4c35f47a70f..dce75b85253c1 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -366,6 +366,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 
+ 	writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
++	geni_se_setup_m_cmd(se, I2C_READ, m_param);
+ 
+ 	if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -373,8 +374,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		dma_buf = NULL;
+ 	}
+ 
+-	geni_se_setup_m_cmd(se, I2C_READ, m_param);
+-
+ 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ 	if (!time_left)
+ 		geni_i2c_abort_xfer(gi2c);
+@@ -408,6 +407,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+ 
+ 	writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
++	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
+ 
+ 	if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
+ 		geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -415,8 +415,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ 		dma_buf = NULL;
+ 	}
+ 
+-	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
+-
+ 	if (!dma_buf) /* Get FIFO IRQ */
+ 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/revert-powerpc-pseries-hotplug-cpu-remove-double-fre.patch b/queue-5.10/revert-powerpc-pseries-hotplug-cpu-remove-double-fre.patch
new file mode 100644
index 00000000000..29dbab1455a
--- /dev/null
+++ b/queue-5.10/revert-powerpc-pseries-hotplug-cpu-remove-double-fre.patch
@@ -0,0 +1,44 @@
+From 09d12c3d55b08aa9f637ece7bc82ed812948979a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 21:07:52 -0500
+Subject: Revert "powerpc/pseries/hotplug-cpu: Remove double free in error
+ path"
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit a40fdaf1420d6e6bda0dd2df1e6806013e58dbe1 ]
+
+This reverts commit a0ff72f9f5a780341e7ff5e9ba50a0dad5fa1980.
+
+Since the commit b015f6bc9547 ("powerpc/pseries: Add cpu DLPAR
+support for drc-info property"), the 'cpu_drcs' wouldn't be double
+freed when the 'cpus' node not found.
+
+So we needn't apply this patch, otherwise, the memory will be leaked.
+
+Fixes: a0ff72f9f5a7 ("powerpc/pseries/hotplug-cpu: Remove double free in error path")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+[mpe: Caused by me applying a patch to a function that had changed in the interim]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201111020752.1686139-1-zhangxiaoxu5@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index a02012f1b04af..12cbffd3c2e32 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -746,6 +746,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+ 	parent = of_find_node_by_path("/cpus");
+ 	if (!parent) {
+ 		pr_warn("Could not find CPU root node in device tree\n");
++		kfree(cpu_drcs);
+ 		return -1;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/rsi-fix-error-return-code-in-rsi_reset_card.patch b/queue-5.10/rsi-fix-error-return-code-in-rsi_reset_card.patch
new file mode 100644
index 00000000000..0fbeac53b23
--- /dev/null
+++ b/queue-5.10/rsi-fix-error-return-code-in-rsi_reset_card.patch
@@ -0,0 +1,69 @@
+From 1f65ee8af7999212d1d7167c87b2c96877545c87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 11:07:34 +0800
+Subject: rsi: fix error return code in rsi_reset_card()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit fb21d14694bd46a538258d86498736490b3ba855 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 17ff2c794f39 ("rsi: reset device changes for 9116")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1605582454-39649-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_usb.c | 30 +++++++++++++-------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index a62d41c0ccbc0..00b5589847985 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -741,24 +741,24 @@ static int rsi_reset_card(struct rsi_hw *adapter)
+ 		if (ret < 0)
+ 			goto fail;
+ 	} else {
+-		if ((rsi_usb_master_reg_write(adapter,
+-					      NWP_WWD_INTERRUPT_TIMER,
+-					      NWP_WWD_INT_TIMER_CLKS,
+-					      RSI_9116_REG_SIZE)) < 0) {
++		ret = rsi_usb_master_reg_write(adapter,
++					       NWP_WWD_INTERRUPT_TIMER,
++					       NWP_WWD_INT_TIMER_CLKS,
++					       RSI_9116_REG_SIZE);
++		if (ret < 0)
+ 			goto fail;
+-		}
+-		if ((rsi_usb_master_reg_write(adapter,
+-					      NWP_WWD_SYSTEM_RESET_TIMER,
+-					      NWP_WWD_SYS_RESET_TIMER_CLKS,
+-					      RSI_9116_REG_SIZE)) < 0) {
++		ret = rsi_usb_master_reg_write(adapter,
++					       NWP_WWD_SYSTEM_RESET_TIMER,
++					       NWP_WWD_SYS_RESET_TIMER_CLKS,
++					       RSI_9116_REG_SIZE);
++		if (ret < 0)
+ 			goto fail;
+-		}
+-		if ((rsi_usb_master_reg_write(adapter,
+-					      NWP_WWD_MODE_AND_RSTART,
+-					      NWP_WWD_TIMER_DISABLE,
+-					      RSI_9116_REG_SIZE)) < 0) {
++		ret = rsi_usb_master_reg_write(adapter,
++					       NWP_WWD_MODE_AND_RSTART,
++					       NWP_WWD_TIMER_DISABLE,
++					       RSI_9116_REG_SIZE);
++		if (ret < 0)
+ 			goto fail;
+-		}
+ 	}
+ 
+ 	rsi_dbg(INFO_ZONE, "Reset card done\n");
+-- 
+2.27.0
+
diff --git a/queue-5.10/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch b/queue-5.10/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch
new file mode 100644
index 00000000000..1644edc6be1
--- /dev/null
+++ b/queue-5.10/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch
@@ -0,0 +1,56 @@
+From 0d90b88df8ef744cf4a4407f1ced36b20d33a192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:04:51 +0300
+Subject: rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ba1c30bf3f2536f248d262c6f257b5a787305991 ]
+
+These functions should return zero on success.  Non-zero returns are
+treated as error.  On some paths, this doesn't matter but in
+nvmem_cell_read() a non-zero return would be passed to ERR_PTR() and
+lead to an Oops.
+
+Fixes: d6c3029f32f7 ("rtc: pcf2127: add support for accessing internal static RAM")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201022070451.GA2817669@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 07a5630ec841f..4d9711d51f8f3 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -243,10 +243,8 @@ static int pcf2127_nvmem_read(void *priv, unsigned int offset,
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
+-			       val, bytes);
+-
+-	return ret ?: bytes;
++	return regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
++				val, bytes);
+ }
+ 
+ static int pcf2127_nvmem_write(void *priv, unsigned int offset,
+@@ -261,10 +259,8 @@ static int pcf2127_nvmem_write(void *priv, unsigned int offset,
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
+-				val, bytes);
+-
+-	return ret ?: bytes;
++	return regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
++				 val, bytes);
+ }
+ 
+ /* watchdog driver */
+-- 
+2.27.0
+
diff --git a/queue-5.10/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch b/queue-5.10/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch
new file mode 100644
index 00000000000..cc819e50dd2
--- /dev/null
+++ b/queue-5.10/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch
@@ -0,0 +1,48 @@
+From cebcaae1658068a262d3fc72eaa2c6f8314f8730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 14:31:50 +0800
+Subject: s390/cio: fix use-after-free in ccw_device_destroy_console
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 14d4c4fa46eeaa3922e8e1c4aa727eb0a1412804 ]
+
+Use of sch->dev reference after the put_device() call could trigger
+the use-after-free bugs.
+
+Fix this by simply adjusting the position of put_device.
+
+Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Suggested-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+[vneethv@linux.ibm.com: Slight modification in the commit-message]
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index b29fe8d50baf2..33280ca181e95 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1664,10 +1664,10 @@ void __init ccw_device_destroy_console(struct ccw_device *cdev)
+ 	struct io_subchannel_private *io_priv = to_io_private(sch);
+ 
+ 	set_io_private(sch, NULL);
+-	put_device(&sch->dev);
+-	put_device(&cdev->dev);
+ 	dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
+ 			  io_priv->dma_area, io_priv->dma_area_dma);
++	put_device(&sch->dev);
++	put_device(&cdev->dev);
+ 	kfree(io_priv);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/s390-test_unwind-fix-call_on_stack-tests.patch b/queue-5.10/s390-test_unwind-fix-call_on_stack-tests.patch
new file mode 100644
index 00000000000..efe61c40921
--- /dev/null
+++ b/queue-5.10/s390-test_unwind-fix-call_on_stack-tests.patch
@@ -0,0 +1,53 @@
+From bfe50068d73a55ffc2e890217189bd4474c833e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 18:05:56 +0100
+Subject: s390/test_unwind: fix CALL_ON_STACK tests
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit f22b9c219a798e1bf11110a3d2733d883e6da059 ]
+
+The CALL_ON_STACK tests use the no_dat stack to switch to a different
+stack for unwinding tests. If an interrupt or machine check happens
+while using that stack, and previously being on the async stack, the
+interrupt / machine check entry code (SWITCH_ASYNC) will assume that
+the previous context did not use the async stack and happily use the
+async stack again.
+
+This will lead to stack corruption of the previous context.
+
+To solve this disable both interrupts and machine checks before
+switching to the no_dat stack.
+
+Fixes: 7868249fbbc8 ("s390/test_unwind: add CALL_ON_STACK tests")
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/lib/test_unwind.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/lib/test_unwind.c b/arch/s390/lib/test_unwind.c
+index 7c988994931f0..6bad84c372dcb 100644
+--- a/arch/s390/lib/test_unwind.c
++++ b/arch/s390/lib/test_unwind.c
+@@ -205,12 +205,15 @@ static noinline int unwindme_func3(struct unwindme *u)
+ /* This function must appear in the backtrace. */
+ static noinline int unwindme_func2(struct unwindme *u)
+ {
++	unsigned long flags;
+ 	int rc;
+ 
+ 	if (u->flags & UWM_SWITCH_STACK) {
+-		preempt_disable();
++		local_irq_save(flags);
++		local_mcck_disable();
+ 		rc = CALL_ON_STACK(unwindme_func3, S390_lowcore.nodat_stack, 1, u);
+-		preempt_enable();
++		local_mcck_enable();
++		local_irq_restore(flags);
+ 		return rc;
+ 	} else {
+ 		return unwindme_func3(u);
+-- 
+2.27.0
+
diff --git a/queue-5.10/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch b/queue-5.10/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch
new file mode 100644
index 00000000000..4e7a5b7e89c
--- /dev/null
+++ b/queue-5.10/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch
@@ -0,0 +1,50 @@
+From c51d62155072af61dee501c88362700778eefc3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 09:03:09 +0000
+Subject: samples: bpf: Fix lwt_len_hist reusing previous BPF map
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]
+
+Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
+map isn't cleared on test end. This leds to reuse of that map for
+each test, which prevents the results of the test from being accurate.
+
+This commit fixes the problem by removing of pinned map from bpffs.
+Also, this commit add the executable permission to shell script
+files.
+
+Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/lwt_len_hist.sh | 2 ++
+ samples/bpf/test_lwt_bpf.sh | 0
+ 2 files changed, 2 insertions(+)
+ mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
+ mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh
+
+diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
+old mode 100644
+new mode 100755
+index 090b96eaf7f76..0eda9754f50b8
+--- a/samples/bpf/lwt_len_hist.sh
++++ b/samples/bpf/lwt_len_hist.sh
+@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
+ TRACE_ROOT=/sys/kernel/debug/tracing
+ 
+ function cleanup {
++	# To reset saved histogram, remove pinned map
++	rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
+ 	ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
+ 	ip link del $VETH0 2> /dev/null
+ 	ip link del $VETH1 2> /dev/null
+diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
+old mode 100644
+new mode 100755
+-- 
+2.27.0
+
diff --git a/queue-5.10/samples-bpf-fix-possible-hang-in-xdpsock-with-multip.patch b/queue-5.10/samples-bpf-fix-possible-hang-in-xdpsock-with-multip.patch
new file mode 100644
index 00000000000..6bfb49cef38
--- /dev/null
+++ b/queue-5.10/samples-bpf-fix-possible-hang-in-xdpsock-with-multip.patch
@@ -0,0 +1,42 @@
+From 4bd9c6c0b9893d7d4244962bdc26702a47700a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 17:34:07 +0100
+Subject: samples/bpf: Fix possible hang in xdpsock with multiple threads
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 092fde0f863b72b67c4d6dc03844f5658fc00a35 ]
+
+Fix a possible hang in xdpsock that can occur when using multiple
+threads. In this case, one or more of the threads might get stuck in
+the while-loop in tx_only after the user has signaled the main thread
+to stop execution. In this case, no more Tx packets will be sent, so a
+thread might get stuck in the aforementioned while-loop. Fix this by
+introducing a test inside the while-loop to check if the benchmark has
+been terminated. If so, return from the function.
+
+Fixes: cd9e72b6f210 ("samples/bpf: xdpsock: Add option to specify batch size")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201210163407.22066-1-magnus.karlsson@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdpsock_user.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
+index 1149e94ca32fd..33c58de58626c 100644
+--- a/samples/bpf/xdpsock_user.c
++++ b/samples/bpf/xdpsock_user.c
+@@ -1250,6 +1250,8 @@ static void tx_only(struct xsk_socket_info *xsk, u32 *frame_nb, int batch_size)
+ 	while (xsk_ring_prod__reserve(&xsk->tx, batch_size, &idx) <
+ 				      batch_size) {
+ 		complete_tx_only(xsk, batch_size);
++		if (benchmark_done)
++			return;
+ 	}
+ 
+ 	for (i = 0; i < batch_size; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/sched-deadline-fix-sched_dl_global_validate.patch b/queue-5.10/sched-deadline-fix-sched_dl_global_validate.patch
new file mode 100644
index 00000000000..7821331dc5d
--- /dev/null
+++ b/queue-5.10/sched-deadline-fix-sched_dl_global_validate.patch
@@ -0,0 +1,143 @@
+From 972748e82ff8f926aabe9e8ef8e5ab6ee7833c81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 23:49:42 +0800
+Subject: sched/deadline: Fix sched_dl_global_validate()
+
+From: Peng Liu <iwtbavbm@gmail.com>
+
+[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]
+
+When change sched_rt_{runtime, period}_us, we validate that the new
+settings should at least accommodate the currently allocated -dl
+bandwidth:
+
+  sched_rt_handler()
+    -->	sched_dl_bandwidth_validate()
+	{
+		new_bw = global_rt_runtime()/global_rt_period();
+
+		for_each_possible_cpu(cpu) {
+			dl_b = dl_bw_of(cpu);
+			if (new_bw < dl_b->total_bw)    <-------
+				ret = -EBUSY;
+		}
+	}
+
+But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
+dl_b->total_bw is the allocated bandwidth of the whole root domain.
+Instead, we should compare dl_b->total_bw against "cpus*new_bw",
+where 'cpus' is the number of CPUs of the root domain.
+
+Also, below annotation(in kernel/sched/sched.h) implied implementation
+only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
+evolving till got merged(v9), but the annotation remains unchanged,
+meaningless and misleading, update it.
+
+* With respect to SMP, the bandwidth is given on a per-CPU basis,
+* meaning that:
+*  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+*  - dl_total_bw array contains, in the i-eth element, the currently
+*    allocated bandwidth on the i-eth CPU.
+
+[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/
+
+Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
+Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Acked-by: Juri Lelli <juri.lelli@redhat.com>
+Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c |  5 +++--
+ kernel/sched/sched.h    | 42 ++++++++++++++++++-----------------------
+ 2 files changed, 21 insertions(+), 26 deletions(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 1d3c97268ec0d..8d06d1f4e2f7b 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2547,7 +2547,7 @@ int sched_dl_global_validate(void)
+ 	u64 period = global_rt_period();
+ 	u64 new_bw = to_ratio(period, runtime);
+ 	struct dl_bw *dl_b;
+-	int cpu, ret = 0;
++	int cpu, cpus, ret = 0;
+ 	unsigned long flags;
+ 
+ 	/*
+@@ -2562,9 +2562,10 @@ int sched_dl_global_validate(void)
+ 	for_each_possible_cpu(cpu) {
+ 		rcu_read_lock_sched();
+ 		dl_b = dl_bw_of(cpu);
++		cpus = dl_bw_cpus(cpu);
+ 
+ 		raw_spin_lock_irqsave(&dl_b->lock, flags);
+-		if (new_bw < dl_b->total_bw)
++		if (new_bw * cpus < dl_b->total_bw)
+ 			ret = -EBUSY;
+ 		raw_spin_unlock_irqrestore(&dl_b->lock, flags);
+ 
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index df80bfcea92eb..c122176c627ec 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -257,30 +257,6 @@ struct rt_bandwidth {
+ 
+ void __dl_clear_params(struct task_struct *p);
+ 
+-/*
+- * To keep the bandwidth of -deadline tasks and groups under control
+- * we need some place where:
+- *  - store the maximum -deadline bandwidth of the system (the group);
+- *  - cache the fraction of that bandwidth that is currently allocated.
+- *
+- * This is all done in the data structure below. It is similar to the
+- * one used for RT-throttling (rt_bandwidth), with the main difference
+- * that, since here we are only interested in admission control, we
+- * do not decrease any runtime while the group "executes", neither we
+- * need a timer to replenish it.
+- *
+- * With respect to SMP, the bandwidth is given on a per-CPU basis,
+- * meaning that:
+- *  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+- *  - dl_total_bw array contains, in the i-eth element, the currently
+- *    allocated bandwidth on the i-eth CPU.
+- * Moreover, groups consume bandwidth on each CPU, while tasks only
+- * consume bandwidth on the CPU they're running on.
+- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
+- * that will be shown the next time the proc or cgroup controls will
+- * be red. It on its turn can be changed by writing on its own
+- * control.
+- */
+ struct dl_bandwidth {
+ 	raw_spinlock_t		dl_runtime_lock;
+ 	u64			dl_runtime;
+@@ -292,6 +268,24 @@ static inline int dl_bandwidth_enabled(void)
+ 	return sysctl_sched_rt_runtime >= 0;
+ }
+ 
++/*
++ * To keep the bandwidth of -deadline tasks under control
++ * we need some place where:
++ *  - store the maximum -deadline bandwidth of each cpu;
++ *  - cache the fraction of bandwidth that is currently allocated in
++ *    each root domain;
++ *
++ * This is all done in the data structure below. It is similar to the
++ * one used for RT-throttling (rt_bandwidth), with the main difference
++ * that, since here we are only interested in admission control, we
++ * do not decrease any runtime while the group "executes", neither we
++ * need a timer to replenish it.
++ *
++ * With respect to SMP, bandwidth is given on a per root domain basis,
++ * meaning that:
++ *  - bw (< 100%) is the deadline bandwidth of each CPU;
++ *  - total_bw is the currently allocated bandwidth in each root domain;
++ */
+ struct dl_bw {
+ 	raw_spinlock_t		lock;
+ 	u64			bw;
+-- 
+2.27.0
+
diff --git a/queue-5.10/sched-reenable-interrupts-in-do_sched_yield.patch b/queue-5.10/sched-reenable-interrupts-in-do_sched_yield.patch
new file mode 100644
index 00000000000..24d5ba15284
--- /dev/null
+++ b/queue-5.10/sched-reenable-interrupts-in-do_sched_yield.patch
@@ -0,0 +1,45 @@
+From b584569a14229d48abf47f5010b0e666423eeab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 16:46:55 +0200
+Subject: sched: Reenable interrupts in do_sched_yield()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]
+
+do_sched_yield() invokes schedule() with interrupts disabled which is
+not allowed. This goes back to the pre git era to commit a6efb709806c
+("[PATCH] irqlock patch 2.5.27-H6") in the history tree.
+
+Reenable interrupts and remove the misleading comment which "explains" it.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index e7e453492cffc..77aa0e788b9b7 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6100,12 +6100,8 @@ static void do_sched_yield(void)
+ 	schedstat_inc(rq->yld_count);
+ 	current->sched_class->yield_task(rq);
+ 
+-	/*
+-	 * Since we are going to call schedule() anyway, there's
+-	 * no need to preempt or enable interrupts:
+-	 */
+ 	preempt_disable();
+-	rq_unlock(rq, &rf);
++	rq_unlock_irq(rq, &rf);
+ 	sched_preempt_enable_no_resched();
+ 
+ 	schedule();
+-- 
+2.27.0
+
diff --git a/queue-5.10/scripts-kernel-doc-fix-parsing-function-like-typedef.patch b/queue-5.10/scripts-kernel-doc-fix-parsing-function-like-typedef.patch
new file mode 100644
index 00000000000..2dc95783885
--- /dev/null
+++ b/queue-5.10/scripts-kernel-doc-fix-parsing-function-like-typedef.patch
@@ -0,0 +1,55 @@
+From aafdd58a461689588123ef919aaea0a371809feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 09:17:32 +0100
+Subject: scripts: kernel-doc: fix parsing function-like typedefs
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 7d2c6b1edf790d96e9017a0b27be2425e1af1532 ]
+
+Changeset 6b80975c6308 ("scripts: kernel-doc: fix typedef parsing")
+added support for things like:
+
+	typedef unsigned long foo();
+
+However, it caused a regression on this prototype:
+
+	typedef bool v4l2_check_dv_timings_fnc(const struct v4l2_dv_timings *t, void *handle);
+
+This is only noticed after adding a patch that checks if the
+kernel-doc identifier matches the typedef:
+
+	./scripts/kernel-doc -none $(git grep '^.. kernel-doc::' Documentation/ |cut -d ' ' -f 3|sort|uniq) 2>&1|grep expecting
+	include/media/v4l2-dv-timings.h:38: warning: expecting prototype for typedef v4l2_check_dv_timings_fnc. Prototype was for typedef nc instead
+
+The problem is that, with the new parsing logic, it is not
+checking for complete words at the type part.
+
+Fix it by adding a \b at the end of each type word at the
+regex.
+
+fixes: 6b80975c6308 ("scripts: kernel-doc: fix typedef parsing")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Link: https://lore.kernel.org/r/218ff56dcb8e73755005d3fb64586eb1841a276b.1606896997.git.mchehab+huawei@kernel.org
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kernel-doc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+index 9b6ddeb097e93..6325bec3f66f8 100755
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -1431,7 +1431,7 @@ sub dump_enum($$) {
+     }
+ }
+ 
+-my $typedef_type = qr { ((?:\s+[\w\*]+){1,8})\s* }x;
++my $typedef_type = qr { ((?:\s+[\w\*]+\b){1,8})\s* }x;
+ my $typedef_ident = qr { \*?\s*(\w\S+)\s* }x;
+ my $typedef_args = qr { \s*\((.*)\); }x;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/scripts-kernel-doc-restore-anonymous-enum-parsing.patch b/queue-5.10/scripts-kernel-doc-restore-anonymous-enum-parsing.patch
new file mode 100644
index 00000000000..bd528bb8e47
--- /dev/null
+++ b/queue-5.10/scripts-kernel-doc-restore-anonymous-enum-parsing.patch
@@ -0,0 +1,41 @@
+From 2cd6bd0d622c28f02b7dda33b7be03b790def334 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 19:06:37 +0200
+Subject: scripts: kernel-doc: Restore anonymous enum parsing
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit ae5b17e464146ddb8fee744fa2150922d6072916 ]
+
+The commit d38c8cfb0571 ("scripts: kernel-doc: add support for typedef enum")
+broke anonymous enum parsing. Restore it by relying on members rather than
+its name.
+
+Fixes: d38c8cfb0571 ("scripts: kernel-doc: add support for typedef enum")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Link: https://lore.kernel.org/r/20201102170637.36138-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kernel-doc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+index f699cf05d4098..9b6ddeb097e93 100755
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -1390,7 +1390,7 @@ sub dump_enum($$) {
+ 	$members = $2;
+     }
+ 
+-    if ($declaration_name) {
++    if ($members) {
+ 	my %_members;
+ 
+ 	$members =~ s/\s+$//;
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-aacraid-improve-compat_ioctl-handlers.patch b/queue-5.10/scsi-aacraid-improve-compat_ioctl-handlers.patch
new file mode 100644
index 00000000000..9473440445f
--- /dev/null
+++ b/queue-5.10/scsi-aacraid-improve-compat_ioctl-handlers.patch
@@ -0,0 +1,165 @@
+From 3a6160fe290b5aafaae3951ffc8fbf10c1a2245a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 17:44:19 +0100
+Subject: scsi: aacraid: Improve compat_ioctl handlers
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 077054215a7f787e389a807ece8a39247abbbc1e ]
+
+The use of compat_alloc_user_space() can be easily replaced by handling
+compat arguments in the regular handler, and this will make it work for
+big-endian kernels as well, which at the moment get an invalid indirect
+pointer argument.
+
+Calling aac_ioctl() instead of aac_compat_do_ioctl() means the compat and
+native code paths behave the same way again, which they stopped when the
+adapter health check was added only in the native function.
+
+Link: https://lore.kernel.org/r/20201030164450.1253641-1-arnd@kernel.org
+Fixes: 572ee53a9bad ("scsi: aacraid: check adapter health")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aacraid/commctrl.c | 22 ++++++++++--
+ drivers/scsi/aacraid/linit.c    | 61 ++-------------------------------
+ 2 files changed, 22 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index e3e157a749880..1b1da162f5f6b 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -25,6 +25,7 @@
+ #include <linux/completion.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/blkdev.h>
++#include <linux/compat.h>
+ #include <linux/delay.h> /* ssleep prototype */
+ #include <linux/kthread.h>
+ #include <linux/uaccess.h>
+@@ -226,6 +227,12 @@ static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
+ 	return status;
+ }
+ 
++struct compat_fib_ioctl {
++	u32	fibctx;
++	s32	wait;
++	compat_uptr_t fib;
++};
++
+ /**
+  *	next_getadapter_fib	-	get the next fib
+  *	@dev: adapter to use
+@@ -243,8 +250,19 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
+ 	struct list_head * entry;
+ 	unsigned long flags;
+ 
+-	if(copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
+-		return -EFAULT;
++	if (in_compat_syscall()) {
++		struct compat_fib_ioctl cf;
++
++		if (copy_from_user(&cf, arg, sizeof(struct compat_fib_ioctl)))
++			return -EFAULT;
++
++		f.fibctx = cf.fibctx;
++		f.wait = cf.wait;
++		f.fib = compat_ptr(cf.fib);
++	} else {
++		if (copy_from_user(&f, arg, sizeof(struct fib_ioctl)))
++			return -EFAULT;
++	}
+ 	/*
+ 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext
+ 	 *
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 8f3772480582c..0a82afaf40285 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -1182,63 +1182,6 @@ static long aac_cfg_ioctl(struct file *file,
+ 	return aac_do_ioctl(aac, cmd, (void __user *)arg);
+ }
+ 
+-#ifdef CONFIG_COMPAT
+-static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long arg)
+-{
+-	long ret;
+-	switch (cmd) {
+-	case FSACTL_MINIPORT_REV_CHECK:
+-	case FSACTL_SENDFIB:
+-	case FSACTL_OPEN_GET_ADAPTER_FIB:
+-	case FSACTL_CLOSE_GET_ADAPTER_FIB:
+-	case FSACTL_SEND_RAW_SRB:
+-	case FSACTL_GET_PCI_INFO:
+-	case FSACTL_QUERY_DISK:
+-	case FSACTL_DELETE_DISK:
+-	case FSACTL_FORCE_DELETE_DISK:
+-	case FSACTL_GET_CONTAINERS:
+-	case FSACTL_SEND_LARGE_FIB:
+-		ret = aac_do_ioctl(dev, cmd, (void __user *)arg);
+-		break;
+-
+-	case FSACTL_GET_NEXT_ADAPTER_FIB: {
+-		struct fib_ioctl __user *f;
+-
+-		f = compat_alloc_user_space(sizeof(*f));
+-		ret = 0;
+-		if (clear_user(f, sizeof(*f)))
+-			ret = -EFAULT;
+-		if (copy_in_user(f, (void __user *)arg, sizeof(struct fib_ioctl) - sizeof(u32)))
+-			ret = -EFAULT;
+-		if (!ret)
+-			ret = aac_do_ioctl(dev, cmd, f);
+-		break;
+-	}
+-
+-	default:
+-		ret = -ENOIOCTLCMD;
+-		break;
+-	}
+-	return ret;
+-}
+-
+-static int aac_compat_ioctl(struct scsi_device *sdev, unsigned int cmd,
+-			    void __user *arg)
+-{
+-	struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+-	if (!capable(CAP_SYS_RAWIO))
+-		return -EPERM;
+-	return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
+-}
+-
+-static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+-{
+-	if (!capable(CAP_SYS_RAWIO))
+-		return -EPERM;
+-	return aac_compat_do_ioctl(file->private_data, cmd, arg);
+-}
+-#endif
+-
+ static ssize_t aac_show_model(struct device *device,
+ 			      struct device_attribute *attr, char *buf)
+ {
+@@ -1523,7 +1466,7 @@ static const struct file_operations aac_cfg_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.unlocked_ioctl	= aac_cfg_ioctl,
+ #ifdef CONFIG_COMPAT
+-	.compat_ioctl   = aac_compat_cfg_ioctl,
++	.compat_ioctl   = aac_cfg_ioctl,
+ #endif
+ 	.open		= aac_cfg_open,
+ 	.llseek		= noop_llseek,
+@@ -1536,7 +1479,7 @@ static struct scsi_host_template aac_driver_template = {
+ 	.info				= aac_info,
+ 	.ioctl				= aac_ioctl,
+ #ifdef CONFIG_COMPAT
+-	.compat_ioctl			= aac_compat_ioctl,
++	.compat_ioctl			= aac_ioctl,
+ #endif
+ 	.queuecommand			= aac_queuecommand,
+ 	.bios_param			= aac_biosparm,
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-core-fix-vpd-lun-id-designator-priorities.patch b/queue-5.10/scsi-core-fix-vpd-lun-id-designator-priorities.patch
new file mode 100644
index 00000000000..1d9fab73e18
--- /dev/null
+++ b/queue-5.10/scsi-core-fix-vpd-lun-id-designator-priorities.patch
@@ -0,0 +1,261 @@
+From 4413c5edf2daee9052e61fc9dabb403e6303d76e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 18:08:45 +0100
+Subject: scsi: core: Fix VPD LUN ID designator priorities
+
+From: Martin Wilck <mwilck@suse.com>
+
+[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]
+
+The current implementation of scsi_vpd_lun_id() uses the designator length
+as an implicit measure of priority. This works most of the time, but not
+always. For example, some Hitachi storage arrays return this in VPD 0x83:
+
+VPD INQUIRY: Device Identification page
+  Designation descriptor number 1, descriptor length: 24
+    designator_type: T10 vendor identification,  code_set: ASCII
+    associated with the Addressed logical unit
+      vendor id: HITACHI
+      vendor specific: 5030C3502025
+  Designation descriptor number 2, descriptor length: 6
+    designator_type: vendor specific [0x0],  code_set: Binary
+    associated with the Target port
+      vendor specific: 08 03
+  Designation descriptor number 3, descriptor length: 20
+    designator_type: NAA,  code_set: Binary
+    associated with the Addressed logical unit
+      NAA 6, IEEE Company_id: 0x60e8
+      Vendor Specific Identifier: 0x7c35000
+      Vendor Specific Identifier Extension: 0x30c35000002025
+      [0x60060e8007c350000030c35000002025]
+
+The current code would use the first descriptor because it's longer than
+the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
+descriptors over T10 vendor ID. Designator length should only be used to
+compare designators of the same type.
+
+This patch addresses the issue by separating designator priority and
+length.
+
+Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
+Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
+ 1 file changed, 86 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 03c6d0620bfd0..2d17137f8ff3b 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2948,6 +2948,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
+ }
+ EXPORT_SYMBOL(sdev_enable_disk_events);
+ 
++static unsigned char designator_prio(const unsigned char *d)
++{
++	if (d[1] & 0x30)
++		/* not associated with LUN */
++		return 0;
++
++	if (d[3] == 0)
++		/* invalid length */
++		return 0;
++
++	/*
++	 * Order of preference for lun descriptor:
++	 * - SCSI name string
++	 * - NAA IEEE Registered Extended
++	 * - EUI-64 based 16-byte
++	 * - EUI-64 based 12-byte
++	 * - NAA IEEE Registered
++	 * - NAA IEEE Extended
++	 * - EUI-64 based 8-byte
++	 * - SCSI name string (truncated)
++	 * - T10 Vendor ID
++	 * as longer descriptors reduce the likelyhood
++	 * of identification clashes.
++	 */
++
++	switch (d[1] & 0xf) {
++	case 8:
++		/* SCSI name string, variable-length UTF-8 */
++		return 9;
++	case 3:
++		switch (d[4] >> 4) {
++		case 6:
++			/* NAA registered extended */
++			return 8;
++		case 5:
++			/* NAA registered */
++			return 5;
++		case 4:
++			/* NAA extended */
++			return 4;
++		case 3:
++			/* NAA locally assigned */
++			return 1;
++		default:
++			break;
++		}
++		break;
++	case 2:
++		switch (d[3]) {
++		case 16:
++			/* EUI64-based, 16 byte */
++			return 7;
++		case 12:
++			/* EUI64-based, 12 byte */
++			return 6;
++		case 8:
++			/* EUI64-based, 8 byte */
++			return 3;
++		default:
++			break;
++		}
++		break;
++	case 1:
++		/* T10 vendor ID */
++		return 1;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ /**
+  * scsi_vpd_lun_id - return a unique device identification
+  * @sdev: SCSI device
+@@ -2964,7 +3036,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
+  */
+ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ {
+-	u8 cur_id_type = 0xff;
++	u8 cur_id_prio = 0;
+ 	u8 cur_id_size = 0;
+ 	const unsigned char *d, *cur_id_str;
+ 	const struct scsi_vpd *vpd_pg83;
+@@ -2977,20 +3049,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ 		return -ENXIO;
+ 	}
+ 
+-	/*
+-	 * Look for the correct descriptor.
+-	 * Order of preference for lun descriptor:
+-	 * - SCSI name string
+-	 * - NAA IEEE Registered Extended
+-	 * - EUI-64 based 16-byte
+-	 * - EUI-64 based 12-byte
+-	 * - NAA IEEE Registered
+-	 * - NAA IEEE Extended
+-	 * - T10 Vendor ID
+-	 * as longer descriptors reduce the likelyhood
+-	 * of identification clashes.
+-	 */
+-
+ 	/* The id string must be at least 20 bytes + terminating NULL byte */
+ 	if (id_len < 21) {
+ 		rcu_read_unlock();
+@@ -3000,8 +3058,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ 	memset(id, 0, id_len);
+ 	d = vpd_pg83->data + 4;
+ 	while (d < vpd_pg83->data + vpd_pg83->len) {
+-		/* Skip designators not referring to the LUN */
+-		if ((d[1] & 0x30) != 0x00)
++		u8 prio = designator_prio(d);
++
++		if (prio == 0 || cur_id_prio > prio)
+ 			goto next_desig;
+ 
+ 		switch (d[1] & 0xf) {
+@@ -3009,28 +3068,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ 			/* T10 Vendor ID */
+ 			if (cur_id_size > d[3])
+ 				break;
+-			/* Prefer anything */
+-			if (cur_id_type > 0x01 && cur_id_type != 0xff)
+-				break;
++			cur_id_prio = prio;
+ 			cur_id_size = d[3];
+ 			if (cur_id_size + 4 > id_len)
+ 				cur_id_size = id_len - 4;
+ 			cur_id_str = d + 4;
+-			cur_id_type = d[1] & 0xf;
+ 			id_size = snprintf(id, id_len, "t10.%*pE",
+ 					   cur_id_size, cur_id_str);
+ 			break;
+ 		case 0x2:
+ 			/* EUI-64 */
+-			if (cur_id_size > d[3])
+-				break;
+-			/* Prefer NAA IEEE Registered Extended */
+-			if (cur_id_type == 0x3 &&
+-			    cur_id_size == d[3])
+-				break;
++			cur_id_prio = prio;
+ 			cur_id_size = d[3];
+ 			cur_id_str = d + 4;
+-			cur_id_type = d[1] & 0xf;
+ 			switch (cur_id_size) {
+ 			case 8:
+ 				id_size = snprintf(id, id_len,
+@@ -3048,17 +3098,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ 						   cur_id_str);
+ 				break;
+ 			default:
+-				cur_id_size = 0;
+ 				break;
+ 			}
+ 			break;
+ 		case 0x3:
+ 			/* NAA */
+-			if (cur_id_size > d[3])
+-				break;
++			cur_id_prio = prio;
+ 			cur_id_size = d[3];
+ 			cur_id_str = d + 4;
+-			cur_id_type = d[1] & 0xf;
+ 			switch (cur_id_size) {
+ 			case 8:
+ 				id_size = snprintf(id, id_len,
+@@ -3071,26 +3118,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ 						   cur_id_str);
+ 				break;
+ 			default:
+-				cur_id_size = 0;
+ 				break;
+ 			}
+ 			break;
+ 		case 0x8:
+ 			/* SCSI name string */
+-			if (cur_id_size + 4 > d[3])
++			if (cur_id_size > d[3])
+ 				break;
+ 			/* Prefer others for truncated descriptor */
+-			if (cur_id_size && d[3] > id_len)
+-				break;
++			if (d[3] > id_len) {
++				prio = 2;
++				if (cur_id_prio > prio)
++					break;
++			}
++			cur_id_prio = prio;
+ 			cur_id_size = id_size = d[3];
+ 			cur_id_str = d + 4;
+-			cur_id_type = d[1] & 0xf;
+ 			if (cur_id_size >= id_len)
+ 				cur_id_size = id_len - 1;
+ 			memcpy(id, cur_id_str, cur_id_size);
+-			/* Decrease priority for truncated descriptor */
+-			if (cur_id_size != id_size)
+-				cur_id_size = 6;
+ 			break;
+ 		default:
+ 			break;
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-fnic-fix-error-return-code-in-fnic_probe.patch b/queue-5.10/scsi-fnic-fix-error-return-code-in-fnic_probe.patch
new file mode 100644
index 00000000000..92ab1077455
--- /dev/null
+++ b/queue-5.10/scsi-fnic-fix-error-return-code-in-fnic_probe.patch
@@ -0,0 +1,38 @@
+From 2ba01202703733720be5345604cc6a5215e7a837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 15:47:39 +0800
+Subject: scsi: fnic: Fix error return code in fnic_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]
+
+Return a negative error code from the error handling case instead of 0 as
+done elsewhere in this function.
+
+Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
+Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
+index 5f8a7ef8f6a8e..4f7befb43d604 100644
+--- a/drivers/scsi/fnic/fnic_main.c
++++ b/drivers/scsi/fnic/fnic_main.c
+@@ -740,6 +740,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	for (i = 0; i < FNIC_IO_LOCKS; i++)
+ 		spin_lock_init(&fnic->io_req_lock[i]);
+ 
++	err = -ENOMEM;
+ 	fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
+ 	if (!fnic->io_req_pool)
+ 		goto err_out_free_resources;
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-hisi_sas-fix-up-probe-error-handling-for-v3-hw.patch b/queue-5.10/scsi-hisi_sas-fix-up-probe-error-handling-for-v3-hw.patch
new file mode 100644
index 00000000000..8b21df66700
--- /dev/null
+++ b/queue-5.10/scsi-hisi_sas-fix-up-probe-error-handling-for-v3-hw.patch
@@ -0,0 +1,108 @@
+From 0ea7664f509aa1ae8d2dc600e3cdb4ca5893ca56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 16:46:33 +0800
+Subject: scsi: hisi_sas: Fix up probe error handling for v3 hw
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 2ebde94f2ea4cffd812ece2f318c2f4922239b1d ]
+
+Fix some rollbacks in function hisi_sas_v3_probe() and
+interrupt_init_v3_hw().
+
+Link: https://lore.kernel.org/r/1606207594-196362-3-git-send-email-john.garry@huawei.com
+Fixes: 8d98416a55eb ("scsi: hisi_sas: Switch v3 hw to MQ")
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 26 +++++++++++---------------
+ 1 file changed, 11 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 960de375ce699..2cbd8a524edab 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -2409,8 +2409,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
+ 			      DRV_NAME " phy", hisi_hba);
+ 	if (rc) {
+ 		dev_err(dev, "could not request phy interrupt, rc=%d\n", rc);
+-		rc = -ENOENT;
+-		goto free_irq_vectors;
++		return -ENOENT;
+ 	}
+ 
+ 	rc = devm_request_irq(dev, pci_irq_vector(pdev, 2),
+@@ -2418,8 +2417,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
+ 			      DRV_NAME " channel", hisi_hba);
+ 	if (rc) {
+ 		dev_err(dev, "could not request chnl interrupt, rc=%d\n", rc);
+-		rc = -ENOENT;
+-		goto free_irq_vectors;
++		return -ENOENT;
+ 	}
+ 
+ 	rc = devm_request_irq(dev, pci_irq_vector(pdev, 11),
+@@ -2427,8 +2425,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
+ 			      DRV_NAME " fatal", hisi_hba);
+ 	if (rc) {
+ 		dev_err(dev, "could not request fatal interrupt, rc=%d\n", rc);
+-		rc = -ENOENT;
+-		goto free_irq_vectors;
++		return -ENOENT;
+ 	}
+ 
+ 	if (hisi_sas_intr_conv)
+@@ -2449,8 +2446,7 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
+ 		if (rc) {
+ 			dev_err(dev, "could not request cq%d interrupt, rc=%d\n",
+ 				i, rc);
+-			rc = -ENOENT;
+-			goto free_irq_vectors;
++			return -ENOENT;
+ 		}
+ 		cq->irq_mask = pci_irq_get_affinity(pdev, i + BASE_VECTORS_V3_HW);
+ 		if (!cq->irq_mask) {
+@@ -2460,10 +2456,6 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
+ 	}
+ 
+ 	return 0;
+-
+-free_irq_vectors:
+-	pci_free_irq_vectors(pdev);
+-	return rc;
+ }
+ 
+ static int hisi_sas_v3_init(struct hisi_hba *hisi_hba)
+@@ -3317,11 +3309,11 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	rc = interrupt_preinit_v3_hw(hisi_hba);
+ 	if (rc)
+-		goto err_out_ha;
++		goto err_out_debugfs;
+ 	dev_err(dev, "%d hw queues\n", shost->nr_hw_queues);
+ 	rc = scsi_add_host(shost, dev);
+ 	if (rc)
+-		goto err_out_ha;
++		goto err_out_free_irq_vectors;
+ 
+ 	rc = sas_register_ha(sha);
+ 	if (rc)
+@@ -3348,8 +3340,12 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ err_out_register_ha:
+ 	scsi_remove_host(shost);
+-err_out_ha:
++err_out_free_irq_vectors:
++	pci_free_irq_vectors(pdev);
++err_out_debugfs:
+ 	hisi_sas_debugfs_exit(hisi_hba);
++err_out_ha:
++	hisi_sas_free(hisi_hba);
+ 	scsi_host_put(shost);
+ err_out_regions:
+ 	pci_release_regions(pdev);
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-iscsi-fix-inappropriate-use-of-put_device.patch b/queue-5.10/scsi-iscsi-fix-inappropriate-use-of-put_device.patch
new file mode 100644
index 00000000000..951f2fc2787
--- /dev/null
+++ b/queue-5.10/scsi-iscsi-fix-inappropriate-use-of-put_device.patch
@@ -0,0 +1,42 @@
+From 891d4e4cccd627be86496cd95c1ad138fbf93981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:48:52 +0800
+Subject: scsi: iscsi: Fix inappropriate use of put_device()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 6dc1c7ab6f047f45b62986ffebc5324e86ed5f5a ]
+
+kfree(conn) is called inside put_device(&conn->dev) which could lead to
+use-after-free. In addition, device_unregister() should be used here rather
+than put_deviceO().
+
+Link: https://lore.kernel.org/r/20201120074852.31658-1-miaoqinglang@huawei.com
+Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport registration failure")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 2eb3e4f9375a5..2e68c0a876986 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid)
+ 	return conn;
+ 
+ release_conn_ref:
+-	put_device(&conn->dev);
++	device_unregister(&conn->dev);
++	put_device(&session->dev);
++	return NULL;
+ release_parent_ref:
+ 	put_device(&session->dev);
+ free_conn:
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-pm80xx-do-not-sleep-in-atomic-context.patch b/queue-5.10/scsi-pm80xx-do-not-sleep-in-atomic-context.patch
new file mode 100644
index 00000000000..3e9b2f85914
--- /dev/null
+++ b/queue-5.10/scsi-pm80xx-do-not-sleep-in-atomic-context.patch
@@ -0,0 +1,51 @@
+From ea287107352fdc8aa256ac90d7ba5eb992a526db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 14:29:39 +0100
+Subject: scsi: pm80xx: Do not sleep in atomic context
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit 4ba9e516573e60c471c01bb369144651f6f8d50b ]
+
+hw_event_sas_phy_up() is used in hardirq/softirq context:
+
+ pm8001_interrupt_handler_msix() || pm8001_interrupt_handler_intx() || pm8001_tasklet
+   => PM8001_CHIP_DISP->isr() = pm80xx_chip_isr()
+     => process_oq() [spin_lock_irqsave(&pm8001_ha->lock,)]
+       => process_one_iomb()
+         => mpi_hw_event()
+           => hw_event_sas_phy_up()
+             => msleep(200)
+
+Revert the msleep() back to an mdelay() to avoid sleeping in atomic
+context.
+
+Link: https://lore.kernel.org/r/20201126132952.2287996-2-bigeasy@linutronix.de
+Fixes: 4daf1ef3c681 ("scsi: pm80xx: Convert 'long' mdelay to msleep")
+Cc: Vikram Auradkar <auradkar@google.com>
+Cc: Jack Wang <jinpu.wang@cloud.ionos.com>
+Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 7593f248afb2c..155382ce84698 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -3363,7 +3363,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ 	pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
+ 	spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
+ 	if (pm8001_ha->flags == PM8001F_RUN_TIME)
+-		msleep(200);/*delay a moment to wait disk to spinup*/
++		mdelay(200); /* delay a moment to wait for disk to spin up */
+ 	pm8001_bytes_dmaed(pm8001_ha, phy_id);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch b/queue-5.10/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch
new file mode 100644
index 00000000000..5e11f679183
--- /dev/null
+++ b/queue-5.10/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch
@@ -0,0 +1,41 @@
+From dd1e52dc6bfd7f04f56d9f4f1ec22f66fa5766f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 19:55:51 +0800
+Subject: scsi: pm80xx: Fix error return in pm8001_pci_probe()
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]
+
+The driver did not return an error in the case where
+pm8001_configure_phy_settings() failed.
+
+Use rc to store the return value of pm8001_configure_phy_settings().
+
+Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
+Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
+Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 3cf3e58b69799..2025361b36e96 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -1131,7 +1131,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
+ 
+ 	pm8001_init_sas_add(pm8001_ha);
+ 	/* phy setting support for motherboard controller */
+-	if (pm8001_configure_phy_settings(pm8001_ha))
++	rc = pm8001_configure_phy_settings(pm8001_ha);
++	if (rc)
+ 		goto err_out_shost;
+ 
+ 	pm8001_post_sas_ha_init(shost, chip);
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch b/queue-5.10/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch
new file mode 100644
index 00000000000..8bf14ac4b30
--- /dev/null
+++ b/queue-5.10/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch
@@ -0,0 +1,47 @@
+From c6c1aec6823f5a51d70c49998bdea3fcdd612393 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 17:15:18 +0800
+Subject: scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]
+
+Add the missing destroy_workqueue() before return from __qedi_probe in the
+error handling case when fails to create workqueue qedi->offload_thread.
+
+Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 61fab01d2d527..f5fc7f518f8af 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2766,7 +2766,7 @@ retry_probe:
+ 			QEDI_ERR(&qedi->dbg_ctx,
+ 				 "Unable to start offload thread!\n");
+ 			rc = -ENODEV;
+-			goto free_cid_que;
++			goto free_tmf_thread;
+ 		}
+ 
+ 		INIT_DELAYED_WORK(&qedi->recovery_work, qedi_recovery_handler);
+@@ -2790,6 +2790,8 @@ retry_probe:
+ 
+ 	return 0;
+ 
++free_tmf_thread:
++	destroy_workqueue(qedi->tmf_thread);
+ free_cid_que:
+ 	qedi_release_cid_que(qedi);
+ free_uio:
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-qla2xxx-fix-fw-initialization-error-on-big-endi.patch b/queue-5.10/scsi-qla2xxx-fix-fw-initialization-error-on-big-endi.patch
new file mode 100644
index 00000000000..af86cd8ad89
--- /dev/null
+++ b/queue-5.10/scsi-qla2xxx-fix-fw-initialization-error-on-big-endi.patch
@@ -0,0 +1,104 @@
+From 976d6f397667f75c97db6fa3385db5570c8e2dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 05:23:05 -0800
+Subject: scsi: qla2xxx: Fix FW initialization error on big endian machines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arun Easi <aeasi@marvell.com>
+
+[ Upstream commit 8a78dd6ed1af06bfa7b4ade81328ff7ea11b6947 ]
+
+Some fields are not correctly byte swapped causing failure during
+initialization. As probe() returns failure, HBAs will not be claimed when
+this happens.
+
+qla2xxx [0007:01:00.0]-ffff:3: Secure Flash Update in FW: Supported
+qla2xxx [0007:01:00.0]-ffff:3: SCM in FW: Supported
+qla2xxx [0007:01:00.0]-00d2:3: Init Firmware **** FAILED ****.
+qla2xxx [0007:01:00.0]-00d6:3: Failed to initialize adapter - Adapter flags 2.
+qla2xxx 0007:01:00.1: enabling device (0140 -> 0142)
+qla2xxx [0007:01:00.1]-011c: : MSI-X vector count: 128.
+qla2xxx [0007:01:00.1]-001d: : Found an ISP2289 irq 18 iobase 0xd000080080004000.
+qla2xxx 0007:01:00.1: Using 64-bit direct DMA at offset 800000000000000
+BUG: Bad page state in process insmod  pfn:67118 page:f00000000168bd40
+count:-1 mapcount:0 mapping: (null) index:0x0
+page flags: 0x3ffff800000000() page dumped because: nonzero _count
+Modules linked in: qla2xxx(OE+) nvme_fc nvme_fabrics
+	nvme_core scsi_transport_fc scsi_tgt nls_utf8 isofs ip6t_rpfilter
+	ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set
+	nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat
+	nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle
+	ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4
+	nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle
+	iptable_security iptable_raw ebtable_filter ebtables ip6table_filter
+	ip6_tables iptable_filter nx_crypto ses enclosure scsi_transport_sas
+	pseries_rng sg ip_tables xfs libcrc32c sr_mod cdrom sd_mod crc_t10dif
+	crct10dif_generic crct10dif_common usb_storage ipr libata tg3 ptp
+	pps_core dm_mirror dm_region_hash dm_log dm_mod
+CPU: 32 PID: 8560 Comm: insmod Kdump: loaded Tainted: G
+	OE  ------------   3.10.0-957.el7.ppc64 #1
+Call Trace:
+[c0000006dd7caa70] [c00000000001cca8] .show_stack+0x88/0x330 (unreliable)
+[c0000006dd7cab30] [c000000000ac3d88] .dump_stack+0x28/0x3c
+[c0000006dd7caba0] [c00000000029e48c] .bad_page+0x15c/0x1c0
+[c0000006dd7cac40] [c00000000029f938] .get_page_from_freelist+0x11e8/0x1ea0
+[c0000006dd7caf40] [c0000000002a1d30] .__alloc_pages_nodemask+0x1c0/0xc70
+[c0000006dd7cb140] [c00000000002ba0c] .__dma_direct_alloc_coherent+0x8c/0x170
+[c0000006dd7cb1e0] [d000000010a94688] .qla2x00_mem_alloc+0x10f8/0x1370 [qla2xxx]
+[c0000006dd7cb2d0] [d000000010a9c790] .qla2x00_probe_one+0xb60/0x22e0 [qla2xxx]
+[c0000006dd7cb540] [c0000000005de764] .pci_device_probe+0x204/0x300
+[c0000006dd7cb600] [c0000000006ca61c] .driver_probe_device+0x2cc/0x6f0
+[c0000006dd7cb6b0] [c0000000006cabec] .__driver_attach+0x10c/0x110
+[c0000006dd7cb740] [c0000000006c5f04] .bus_for_each_dev+0x94/0x100
+[c0000006dd7cb7e0] [c0000000006c94f4] .driver_attach+0x34/0x50
+[c0000006dd7cb860] [c0000000006c8f58] .bus_add_driver+0x298/0x3b0
+[c0000006dd7cb900] [c0000000006cb6e0] .driver_register+0xb0/0x1a0
+[c0000006dd7cb980] [c0000000005dc474] .__pci_register_driver+0xc4/0xf0
+[c0000006dd7cba10] [d000000010b94e20] .qla2x00_module_init+0x2a8/0x328 [qla2xxx]
+[c0000006dd7cbaa0] [c00000000000c130] .do_one_initcall+0x130/0x2e0
+[c0000006dd7cbb50] [c0000000001b2e8c] .load_module+0x1afc/0x2340
+[c0000006dd7cbd40] [c0000000001b3920] .SyS_finit_module+0xd0/0x130
+[c0000006dd7cbe30] [c00000000000a284] 	system_call+0x38/0xfc
+
+Link: https://lore.kernel.org/r/20201202132312.19966-9-njavali@marvell.com
+Fixes: 9f2475fe7406 ("scsi: qla2xxx: SAN congestion management implementation")
+Fixes: cf3c54fb49a4 ("scsi: qla2xxx: Add SLER and PI control support”)
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 07afd0d8a8f3e..bef871a890281 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -1129,7 +1129,7 @@ qla2x00_get_fw_version(scsi_qla_host_t *vha)
+ 		if (ha->flags.scm_supported_a &&
+ 		    (ha->fw_attributes_ext[0] & FW_ATTR_EXT0_SCM_SUPPORTED)) {
+ 			ha->flags.scm_supported_f = 1;
+-			ha->sf_init_cb->flags |= BIT_13;
++			ha->sf_init_cb->flags |= cpu_to_le16(BIT_13);
+ 		}
+ 		ql_log(ql_log_info, vha, 0x11a3, "SCM in FW: %s\n",
+ 		       (ha->flags.scm_supported_f) ? "Supported" :
+@@ -1137,9 +1137,9 @@ qla2x00_get_fw_version(scsi_qla_host_t *vha)
+ 
+ 		if (vha->flags.nvme2_enabled) {
+ 			/* set BIT_15 of special feature control block for SLER */
+-			ha->sf_init_cb->flags |= BIT_15;
++			ha->sf_init_cb->flags |= cpu_to_le16(BIT_15);
+ 			/* set BIT_14 of special feature control block for PI CTRL*/
+-			ha->sf_init_cb->flags |= BIT_14;
++			ha->sf_init_cb->flags |= cpu_to_le16(BIT_14);
+ 		}
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-qla2xxx-fix-n2n-and-nvme-connect-retry-failure.patch b/queue-5.10/scsi-qla2xxx-fix-n2n-and-nvme-connect-retry-failure.patch
new file mode 100644
index 00000000000..25d141a39a1
--- /dev/null
+++ b/queue-5.10/scsi-qla2xxx-fix-n2n-and-nvme-connect-retry-failure.patch
@@ -0,0 +1,138 @@
+From b73beb29ecbc0591aac2b22bf6c25d055b342cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 05:23:06 -0800
+Subject: scsi: qla2xxx: Fix N2N and NVMe connect retry failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 07a5f69248e3486e387c40af64793466371c7d91 ]
+
+FC-NVMe target discovery failed when initiator wwpn < target wwpn in an N2N
+(Direct Attach) config, where the driver was stuck on FCP PRLI mode and
+failed to retry with NVMe PRLI.
+
+Link: https://lore.kernel.org/r/20201202132312.19966-10-njavali@marvell.com
+Fixes: 84ed362ac40c ("scsi: qla2xxx: Dual FCP-NVMe target port support”)
+Fixes: 983f127603fa ("scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure”)
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 71 ++++++++++++++++++++++++---------
+ drivers/scsi/qla2xxx/qla_mbx.c  |  3 --
+ 2 files changed, 52 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 898c70b8ebbf6..52e8b555bd1dc 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1268,9 +1268,10 @@ qla24xx_async_prli(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 		lio->u.logio.flags |= SRB_LOGIN_NVME_PRLI;
+ 
+ 	ql_dbg(ql_dbg_disc, vha, 0x211b,
+-	    "Async-prli - %8phC hdl=%x, loopid=%x portid=%06x retries=%d %s.\n",
++	    "Async-prli - %8phC hdl=%x, loopid=%x portid=%06x retries=%d fc4type %x priority %x %s.\n",
+ 	    fcport->port_name, sp->handle, fcport->loop_id, fcport->d_id.b24,
+-	    fcport->login_retry, NVME_TARGET(vha->hw, fcport) ? "nvme" : "fc");
++	    fcport->login_retry, fcport->fc4_type, vha->hw->fc4_type_priority,
++	    NVME_TARGET(vha->hw, fcport) ? "nvme" : "fcp");
+ 
+ 	rval = qla2x00_start_sp(sp);
+ 	if (rval != QLA_SUCCESS) {
+@@ -1932,26 +1933,58 @@ qla24xx_handle_prli_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ 			break;
+ 		}
+ 
+-		/*
+-		 * Retry PRLI with other FC-4 type if failure occurred on dual
+-		 * FCP/NVMe port
+-		 */
+-		if (NVME_FCP_TARGET(ea->fcport)) {
+-			ql_dbg(ql_dbg_disc, vha, 0x2118,
+-				"%s %d %8phC post %s prli\n",
+-				__func__, __LINE__, ea->fcport->port_name,
+-				(ea->fcport->fc4_type & FS_FC4TYPE_NVME) ?
+-				"NVMe" : "FCP");
+-			if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME)
++		ql_dbg(ql_dbg_disc, vha, 0x2118,
++		       "%s %d %8phC priority %s, fc4type %x\n",
++		       __func__, __LINE__, ea->fcport->port_name,
++		       vha->hw->fc4_type_priority == FC4_PRIORITY_FCP ?
++		       "FCP" : "NVMe", ea->fcport->fc4_type);
++
++		if (N2N_TOPO(vha->hw)) {
++			if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME) {
+ 				ea->fcport->fc4_type &= ~FS_FC4TYPE_NVME;
+-			else
++				ea->fcport->fc4_type |= FS_FC4TYPE_FCP;
++			} else {
+ 				ea->fcport->fc4_type &= ~FS_FC4TYPE_FCP;
+-		}
++				ea->fcport->fc4_type |= FS_FC4TYPE_NVME;
++			}
+ 
+-		ea->fcport->flags &= ~FCF_ASYNC_SENT;
+-		ea->fcport->keep_nport_handle = 0;
+-		ea->fcport->logout_on_delete = 1;
+-		qlt_schedule_sess_for_deletion(ea->fcport);
++			if (ea->fcport->n2n_link_reset_cnt < 3) {
++				ea->fcport->n2n_link_reset_cnt++;
++				vha->relogin_jif = jiffies + 2 * HZ;
++				/*
++				 * PRLI failed. Reset link to kick start
++				 * state machine
++				 */
++				set_bit(N2N_LINK_RESET, &vha->dpc_flags);
++			} else {
++				ql_log(ql_log_warn, vha, 0x2119,
++				       "%s %d %8phC Unable to reconnect\n",
++				       __func__, __LINE__,
++				       ea->fcport->port_name);
++			}
++		} else {
++			/*
++			 * switch connect. login failed. Take connection down
++			 * and allow relogin to retrigger
++			 */
++			if (NVME_FCP_TARGET(ea->fcport)) {
++				ql_dbg(ql_dbg_disc, vha, 0x2118,
++				       "%s %d %8phC post %s prli\n",
++				       __func__, __LINE__,
++				       ea->fcport->port_name,
++				       (ea->fcport->fc4_type & FS_FC4TYPE_NVME)
++				       ? "NVMe" : "FCP");
++				if (vha->hw->fc4_type_priority == FC4_PRIORITY_NVME)
++					ea->fcport->fc4_type &= ~FS_FC4TYPE_NVME;
++				else
++					ea->fcport->fc4_type &= ~FS_FC4TYPE_FCP;
++			}
++
++			ea->fcport->flags &= ~FCF_ASYNC_SENT;
++			ea->fcport->keep_nport_handle = 0;
++			ea->fcport->logout_on_delete = 1;
++			qlt_schedule_sess_for_deletion(ea->fcport);
++		}
+ 		break;
+ 	}
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index bef871a890281..d6325fb2ef73b 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3998,9 +3998,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 				fcport->scan_state = QLA_FCPORT_FOUND;
+ 				fcport->n2n_flag = 1;
+ 				fcport->keep_nport_handle = 1;
+-				fcport->fc4_type = FS_FC4TYPE_FCP;
+-				if (vha->flags.nvme_enabled)
+-					fcport->fc4_type |= FS_FC4TYPE_NVME;
+ 
+ 				if (wwn_to_u64(vha->port_name) >
+ 				    wwn_to_u64(fcport->port_name)) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-ufs-avoid-to-call-req_clks_off-to-clks_off.patch b/queue-5.10/scsi-ufs-avoid-to-call-req_clks_off-to-clks_off.patch
new file mode 100644
index 00000000000..1abe9c6f0a8
--- /dev/null
+++ b/queue-5.10/scsi-ufs-avoid-to-call-req_clks_off-to-clks_off.patch
@@ -0,0 +1,38 @@
+From 7e003938927ecf6abb8ab76004a74e3fc8b1d245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 08:58:33 -0800
+Subject: scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit fd62de114f8c9df098dcd43b5d83c5714176dd12 ]
+
+Once UFS is gated with CLKS_OFF, it should not call REQ_CLKS_OFF
+again. This can lead to hibern8_enter failure.
+
+Link: https://lore.kernel.org/r/20201117165839.1643377-2-jaegeuk@kernel.org
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 0c148fcd24deb..1ad7d6c130f5b 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1752,7 +1752,8 @@ static void __ufshcd_release(struct ufs_hba *hba)
+ 	if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended ||
+ 	    hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL ||
+ 	    ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks ||
+-	    hba->active_uic_cmd || hba->uic_async_done)
++	    hba->active_uic_cmd || hba->uic_async_done ||
++	    hba->clk_gating.state == CLKS_OFF)
+ 		return;
+ 
+ 	hba->clk_gating.state = REQ_CLKS_OFF;
+-- 
+2.27.0
+
diff --git a/queue-5.10/scsi-ufs-fix-clkgating-on-off.patch b/queue-5.10/scsi-ufs-fix-clkgating-on-off.patch
new file mode 100644
index 00000000000..ce19b4aa073
--- /dev/null
+++ b/queue-5.10/scsi-ufs-fix-clkgating-on-off.patch
@@ -0,0 +1,53 @@
+From 8b86174f6f6f37ed5c3126a7b8140e1003fe5d87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 08:58:38 -0800
+Subject: scsi: ufs: Fix clkgating on/off
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 8eb456be75af7e5a7ac0cd223eaa198cf7ee2ac1 ]
+
+The following call stack prevents clk_gating at every I/O completion.  We
+can remove the condition, ufshcd_any_tag_in_use(), since clkgating_work
+will check it again.
+
+ufshcd_complete_requests(struct ufs_hba *hba)
+  ufshcd_transfer_req_compl()
+    __ufshcd_transfer_req_compl()
+      __ufshcd_release(hba)
+        if (ufshcd_any_tag_in_use() == 1)
+           return;
+  ufshcd_tmc_handler(hba);
+    blk_mq_tagset_busy_iter();
+
+Note that this still requires work to deal with a potential race condition
+when user sets clkgating.delay_ms to very small value. That can cause
+preventing clkgating by the check of ufshcd_any_tag_in_use() in gate_work.
+
+Link: https://lore.kernel.org/r/20201117165839.1643377-7-jaegeuk@kernel.org
+Fixes: 7252a3603015 ("scsi: ufs: Avoid busy-waiting by eliminating tag conflicts")
+Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 1ad7d6c130f5b..911aba3e7675c 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1751,7 +1751,7 @@ static void __ufshcd_release(struct ufs_hba *hba)
+ 
+ 	if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended ||
+ 	    hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL ||
+-	    ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks ||
++	    hba->outstanding_tasks ||
+ 	    hba->active_uic_cmd || hba->uic_async_done ||
+ 	    hba->clk_gating.state == CLKS_OFF)
+ 		return;
+-- 
+2.27.0
+
diff --git a/queue-5.10/selftest-bpf-add-missed-ip6ip6-test-back.patch b/queue-5.10/selftest-bpf-add-missed-ip6ip6-test-back.patch
new file mode 100644
index 00000000000..6fc26ba91fc
--- /dev/null
+++ b/queue-5.10/selftest-bpf-add-missed-ip6ip6-test-back.patch
@@ -0,0 +1,242 @@
+From 835a8dc94dda699ea743c88ffabeb9aecb0ceaa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 09:50:12 +0800
+Subject: selftest/bpf: Add missed ip6ip6 test back
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 58cfa49c2ba7f815adccc27a775e7cf8a8f7f539 ]
+
+In comment 173ca26e9b51 ("samples/bpf: add comprehensive ipip, ipip6,
+ip6ip6 test") we added ip6ip6 test for bpf tunnel testing. But in commit
+933a741e3b82 ("selftests/bpf: bpf tunnel test.") when we moved it to
+the current folder, we didn't add it.
+
+This patch add the ip6ip6 test back to bpf tunnel test. Update the ipip6's
+topology for both IPv4 and IPv6 testing. Since iperf test is removed as
+currect framework simplified it in purpose, I also removed unused tcp
+checkings in test_tunnel_kern.c.
+
+Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20201110015013.1570716-2-liuhangbin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tunnel_kern.c    | 42 +++---------------
+ tools/testing/selftests/bpf/test_tunnel.sh    | 43 +++++++++++++++++--
+ 2 files changed, 46 insertions(+), 39 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+index f48dbfe24ddc8..a621b58ab079d 100644
+--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+@@ -15,7 +15,6 @@
+ #include <linux/ip.h>
+ #include <linux/ipv6.h>
+ #include <linux/types.h>
+-#include <linux/tcp.h>
+ #include <linux/socket.h>
+ #include <linux/pkt_cls.h>
+ #include <linux/erspan.h>
+@@ -528,12 +527,11 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
+ 	struct bpf_tunnel_key key = {};
+ 	void *data = (void *)(long)skb->data;
+ 	struct iphdr *iph = data;
+-	struct tcphdr *tcp = data + sizeof(*iph);
+ 	void *data_end = (void *)(long)skb->data_end;
+ 	int ret;
+ 
+ 	/* single length check */
+-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
++	if (data + sizeof(*iph) > data_end) {
+ 		ERROR(1);
+ 		return TC_ACT_SHOT;
+ 	}
+@@ -541,16 +539,6 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
+ 	key.tunnel_ttl = 64;
+ 	if (iph->protocol == IPPROTO_ICMP) {
+ 		key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
+-	} else {
+-		if (iph->protocol != IPPROTO_TCP || iph->ihl != 5)
+-			return TC_ACT_SHOT;
+-
+-		if (tcp->dest == bpf_htons(5200))
+-			key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
+-		else if (tcp->dest == bpf_htons(5201))
+-			key.remote_ipv4 = 0xac100165; /* 172.16.1.101 */
+-		else
+-			return TC_ACT_SHOT;
+ 	}
+ 
+ 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);
+@@ -585,19 +573,20 @@ int _ipip6_set_tunnel(struct __sk_buff *skb)
+ 	struct bpf_tunnel_key key = {};
+ 	void *data = (void *)(long)skb->data;
+ 	struct iphdr *iph = data;
+-	struct tcphdr *tcp = data + sizeof(*iph);
+ 	void *data_end = (void *)(long)skb->data_end;
+ 	int ret;
+ 
+ 	/* single length check */
+-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
++	if (data + sizeof(*iph) > data_end) {
+ 		ERROR(1);
+ 		return TC_ACT_SHOT;
+ 	}
+ 
+ 	__builtin_memset(&key, 0x0, sizeof(key));
+-	key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
+ 	key.tunnel_ttl = 64;
++	if (iph->protocol == IPPROTO_ICMP) {
++		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
++	}
+ 
+ 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
+ 				     BPF_F_TUNINFO_IPV6);
+@@ -634,35 +623,18 @@ int _ip6ip6_set_tunnel(struct __sk_buff *skb)
+ 	struct bpf_tunnel_key key = {};
+ 	void *data = (void *)(long)skb->data;
+ 	struct ipv6hdr *iph = data;
+-	struct tcphdr *tcp = data + sizeof(*iph);
+ 	void *data_end = (void *)(long)skb->data_end;
+ 	int ret;
+ 
+ 	/* single length check */
+-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
++	if (data + sizeof(*iph) > data_end) {
+ 		ERROR(1);
+ 		return TC_ACT_SHOT;
+ 	}
+ 
+-	key.remote_ipv6[0] = bpf_htonl(0x2401db00);
+ 	key.tunnel_ttl = 64;
+-
+ 	if (iph->nexthdr == 58 /* NEXTHDR_ICMP */) {
+-		key.remote_ipv6[3] = bpf_htonl(1);
+-	} else {
+-		if (iph->nexthdr != 6 /* NEXTHDR_TCP */) {
+-			ERROR(iph->nexthdr);
+-			return TC_ACT_SHOT;
+-		}
+-
+-		if (tcp->dest == bpf_htons(5200)) {
+-			key.remote_ipv6[3] = bpf_htonl(1);
+-		} else if (tcp->dest == bpf_htons(5201)) {
+-			key.remote_ipv6[3] = bpf_htonl(2);
+-		} else {
+-			ERROR(tcp->dest);
+-			return TC_ACT_SHOT;
+-		}
++		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
+ 	}
+ 
+ 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
+diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
+index bd12ec97a44df..1ccbe804e8e1c 100755
+--- a/tools/testing/selftests/bpf/test_tunnel.sh
++++ b/tools/testing/selftests/bpf/test_tunnel.sh
+@@ -24,12 +24,12 @@
+ # Root namespace with metadata-mode tunnel + BPF
+ # Device names and addresses:
+ # 	veth1 IP: 172.16.1.200, IPv6: 00::22 (underlay)
+-# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200 (overlay)
++# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200, IPv6: 1::22 (overlay)
+ #
+ # Namespace at_ns0 with native tunnel
+ # Device names and addresses:
+ # 	veth0 IPv4: 172.16.1.100, IPv6: 00::11 (underlay)
+-# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100 (overlay)
++# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100, IPv6: 1::11 (overlay)
+ #
+ #
+ # End-to-end ping packet flow
+@@ -250,7 +250,7 @@ add_ipip_tunnel()
+ 	ip addr add dev $DEV 10.1.1.200/24
+ }
+ 
+-add_ipip6tnl_tunnel()
++add_ip6tnl_tunnel()
+ {
+ 	ip netns exec at_ns0 ip addr add ::11/96 dev veth0
+ 	ip netns exec at_ns0 ip link set dev veth0 up
+@@ -262,11 +262,13 @@ add_ipip6tnl_tunnel()
+ 		ip link add dev $DEV_NS type $TYPE \
+ 		local ::11 remote ::22
+ 	ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
++	ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96
+ 	ip netns exec at_ns0 ip link set dev $DEV_NS up
+ 
+ 	# root namespace
+ 	ip link add dev $DEV type $TYPE external
+ 	ip addr add dev $DEV 10.1.1.200/24
++	ip addr add dev $DEV 1::22/96
+ 	ip link set dev $DEV up
+ }
+ 
+@@ -534,7 +536,7 @@ test_ipip6()
+ 
+ 	check $TYPE
+ 	config_device
+-	add_ipip6tnl_tunnel
++	add_ip6tnl_tunnel
+ 	ip link set dev veth1 mtu 1500
+ 	attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel
+ 	# underlay
+@@ -553,6 +555,34 @@ test_ipip6()
+         echo -e ${GREEN}"PASS: $TYPE"${NC}
+ }
+ 
++test_ip6ip6()
++{
++	TYPE=ip6tnl
++	DEV_NS=ip6ip6tnl00
++	DEV=ip6ip6tnl11
++	ret=0
++
++	check $TYPE
++	config_device
++	add_ip6tnl_tunnel
++	ip link set dev veth1 mtu 1500
++	attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel
++	# underlay
++	ping6 $PING_ARG ::11
++	# ip6 over ip6
++	ping6 $PING_ARG 1::11
++	check_err $?
++	ip netns exec at_ns0 ping6 $PING_ARG 1::22
++	check_err $?
++	cleanup
++
++	if [ $ret -ne 0 ]; then
++                echo -e ${RED}"FAIL: ip6$TYPE"${NC}
++                return 1
++        fi
++        echo -e ${GREEN}"PASS: ip6$TYPE"${NC}
++}
++
+ setup_xfrm_tunnel()
+ {
+ 	auth=0x$(printf '1%.0s' {1..40})
+@@ -646,6 +676,7 @@ cleanup()
+ 	ip link del veth1 2> /dev/null
+ 	ip link del ipip11 2> /dev/null
+ 	ip link del ipip6tnl11 2> /dev/null
++	ip link del ip6ip6tnl11 2> /dev/null
+ 	ip link del gretap11 2> /dev/null
+ 	ip link del ip6gre11 2> /dev/null
+ 	ip link del ip6gretap11 2> /dev/null
+@@ -742,6 +773,10 @@ bpf_tunnel_test()
+ 	test_ipip6
+ 	errors=$(( $errors + $? ))
+ 
++	echo "Testing IP6IP6 tunnel..."
++	test_ip6ip6
++	errors=$(( $errors + $? ))
++
+ 	echo "Testing IPSec tunnel..."
+ 	test_xfrm_tunnel
+ 	errors=$(( $errors + $? ))
+-- 
+2.27.0
+
diff --git a/queue-5.10/selftests-bpf-fix-broken-riscv-build.patch b/queue-5.10/selftests-bpf-fix-broken-riscv-build.patch
new file mode 100644
index 00000000000..df76510333f
--- /dev/null
+++ b/queue-5.10/selftests-bpf-fix-broken-riscv-build.patch
@@ -0,0 +1,48 @@
+From dc94bbb24a6da9793324ff122d80ee91c5accacc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 08:16:38 +0100
+Subject: selftests/bpf: Fix broken riscv build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@gmail.com>
+
+[ Upstream commit 6016df8fe874e1cf36f6357d71438b384198ce06 ]
+
+The selftests/bpf Makefile includes system include directories from
+the host, when building BPF programs. On RISC-V glibc requires that
+__riscv_xlen is defined. This is not the case for "clang -target bpf",
+which messes up __WORDSIZE (errno.h -> ... -> wordsize.h) and breaks
+the build.
+
+By explicitly defining __risc_xlen correctly for riscv, we can
+workaround this.
+
+Fixes: 167381f3eac0 ("selftests/bpf: Makefile fix "missing" headers on build with -idirafter")
+Signed-off-by: Björn Töpel <bjorn.topel@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Luke Nelson <luke.r.nels@gmail.com>
+Link: https://lore.kernel.org/bpf/20201118071640.83773-2-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 542768f5195b7..136df8c102812 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -220,7 +220,8 @@ $(RESOLVE_BTFIDS): $(BPFOBJ) | $(BUILD_DIR)/resolve_btfids	\
+ # build would have failed anyways.
+ define get_sys_includes
+ $(shell $(1) -v -E - </dev/null 2>&1 \
+-	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
++	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') \
++$(shell $(1) -dM -E - </dev/null | grep '#define __riscv_xlen ' | sed 's/#define /-D/' | sed 's/ /=/')
+ endef
+ 
+ # Determine target endianness.
+-- 
+2.27.0
+
diff --git a/queue-5.10/selftests-bpf-fix-invalid-use-of-strncat-in-test_soc.patch b/queue-5.10/selftests-bpf-fix-invalid-use-of-strncat-in-test_soc.patch
new file mode 100644
index 00000000000..fa7a4437705
--- /dev/null
+++ b/queue-5.10/selftests-bpf-fix-invalid-use-of-strncat-in-test_soc.patch
@@ -0,0 +1,109 @@
+From 2d318c9c05d29bd6eb52445e17719daf9614e49d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 15:54:40 -0800
+Subject: selftests/bpf: Fix invalid use of strncat in test_sockmap
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit eceae70bdeaeb6b8ceb662983cf663ff352fbc96 ]
+
+strncat()'s third argument is how many bytes will be added *in addition* to
+already existing bytes in destination. Plus extra zero byte will be added
+after that. So existing use in test_sockmap has many opportunities to overflow
+the string and cause memory corruptions. And in this case, GCC complains for
+a good reason.
+
+Fixes: 16962b2404ac ("bpf: sockmap, add selftests")
+Fixes: 73563aa3d977 ("selftests/bpf: test_sockmap, print additional test options")
+Fixes: 1ade9abadfca ("bpf: test_sockmap, add options for msg_pop_data() helper")
+Fixes: 463bac5f1ca7 ("bpf, selftests: Add test for ktls with skb bpf ingress policy")
+Fixes: e9dd904708c4 ("bpf: add tls support for testing in test_sockmap")
+Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20201203235440.2302137-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 36 ++++++++++++++--------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 0fa1e421c3d7a..427ca00a32177 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -1273,6 +1273,16 @@ static char *test_to_str(int test)
+ 	return "unknown";
+ }
+ 
++static void append_str(char *dst, const char *src, size_t dst_cap)
++{
++	size_t avail = dst_cap - strlen(dst);
++
++	if (avail <= 1) /* just zero byte could be written */
++		return;
++
++	strncat(dst, src, avail - 1); /* strncat() adds + 1 for zero byte */
++}
++
+ #define OPTSTRING 60
+ static void test_options(char *options)
+ {
+@@ -1281,42 +1291,42 @@ static void test_options(char *options)
+ 	memset(options, 0, OPTSTRING);
+ 
+ 	if (txmsg_pass)
+-		strncat(options, "pass,", OPTSTRING);
++		append_str(options, "pass,", OPTSTRING);
+ 	if (txmsg_redir)
+-		strncat(options, "redir,", OPTSTRING);
++		append_str(options, "redir,", OPTSTRING);
+ 	if (txmsg_drop)
+-		strncat(options, "drop,", OPTSTRING);
++		append_str(options, "drop,", OPTSTRING);
+ 	if (txmsg_apply) {
+ 		snprintf(tstr, OPTSTRING, "apply %d,", txmsg_apply);
+-		strncat(options, tstr, OPTSTRING);
++		append_str(options, tstr, OPTSTRING);
+ 	}
+ 	if (txmsg_cork) {
+ 		snprintf(tstr, OPTSTRING, "cork %d,", txmsg_cork);
+-		strncat(options, tstr, OPTSTRING);
++		append_str(options, tstr, OPTSTRING);
+ 	}
+ 	if (txmsg_start) {
+ 		snprintf(tstr, OPTSTRING, "start %d,", txmsg_start);
+-		strncat(options, tstr, OPTSTRING);
++		append_str(options, tstr, OPTSTRING);
+ 	}
+ 	if (txmsg_end) {
+ 		snprintf(tstr, OPTSTRING, "end %d,", txmsg_end);
+-		strncat(options, tstr, OPTSTRING);
++		append_str(options, tstr, OPTSTRING);
+ 	}
+ 	if (txmsg_start_pop) {
+ 		snprintf(tstr, OPTSTRING, "pop (%d,%d),",
+ 			 txmsg_start_pop, txmsg_start_pop + txmsg_pop);
+-		strncat(options, tstr, OPTSTRING);
++		append_str(options, tstr, OPTSTRING);
+ 	}
+ 	if (txmsg_ingress)
+-		strncat(options, "ingress,", OPTSTRING);
++		append_str(options, "ingress,", OPTSTRING);
+ 	if (txmsg_redir_skb)
+-		strncat(options, "redir_skb,", OPTSTRING);
++		append_str(options, "redir_skb,", OPTSTRING);
+ 	if (txmsg_ktls_skb)
+-		strncat(options, "ktls_skb,", OPTSTRING);
++		append_str(options, "ktls_skb,", OPTSTRING);
+ 	if (ktls)
+-		strncat(options, "ktls,", OPTSTRING);
++		append_str(options, "ktls,", OPTSTRING);
+ 	if (peek_flag)
+-		strncat(options, "peek,", OPTSTRING);
++		append_str(options, "peek,", OPTSTRING);
+ }
+ 
+ static int __test_exec(int cgrp, int test, struct sockmap_options *opt)
+-- 
+2.27.0
+
diff --git a/queue-5.10/selftests-run_kselftest.sh-fix-dry-run-typo.patch b/queue-5.10/selftests-run_kselftest.sh-fix-dry-run-typo.patch
new file mode 100644
index 00000000000..1fb269d895f
--- /dev/null
+++ b/queue-5.10/selftests-run_kselftest.sh-fix-dry-run-typo.patch
@@ -0,0 +1,35 @@
+From d951e7f37517cf8707688a621668e92a7ba2aaed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 16:31:14 +0800
+Subject: selftests/run_kselftest.sh: fix dry-run typo
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 93f20eff0cca972d74cb554a2e8b47730228be16 ]
+
+Should be -d instead of -n for dry-run.
+
+Fixes: 5da1918446a1 ("selftests/run_kselftest.sh: Make each test individually selectable")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/run_kselftest.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/run_kselftest.sh b/tools/testing/selftests/run_kselftest.sh
+index 609a4ef9300e3..97165a83df632 100755
+--- a/tools/testing/selftests/run_kselftest.sh
++++ b/tools/testing/selftests/run_kselftest.sh
+@@ -48,7 +48,7 @@ while true; do
+ 		-l | --list)
+ 			echo "$available"
+ 			exit 0 ;;
+-		-n | --dry-run)
++		-d | --dry-run)
+ 			dryrun="echo"
+ 			shift ;;
+ 		-h | --help)
+-- 
+2.27.0
+
diff --git a/queue-5.10/selftests-seccomp-update-kernel-config.patch b/queue-5.10/selftests-seccomp-update-kernel-config.patch
new file mode 100644
index 00000000000..b2b66e5fa77
--- /dev/null
+++ b/queue-5.10/selftests-seccomp-update-kernel-config.patch
@@ -0,0 +1,39 @@
+From d6617360ff79d00279942370dbdf95bf0ed7c9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 17:26:43 +0100
+Subject: selftests/seccomp: Update kernel config
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@linux.microsoft.com>
+
+[ Upstream commit 2c07343abd8932200a45ff7b10950e71081e9e77 ]
+
+seccomp_bpf.c uses unshare(CLONE_NEWPID), which requires CONFIG_PID_NS
+to be set.
+
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Shuah Khan <shuah@kernel.org>
+Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
+Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
+Acked-by: Tycho Andersen <tycho@tycho.pizza>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20201202162643.249276-1-mic@digikod.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/seccomp/config | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/seccomp/config b/tools/testing/selftests/seccomp/config
+index 64c19d8eba795..ad431a5178fbe 100644
+--- a/tools/testing/selftests/seccomp/config
++++ b/tools/testing/selftests/seccomp/config
+@@ -1,3 +1,4 @@
++CONFIG_PID_NS=y
+ CONFIG_SECCOMP=y
+ CONFIG_SECCOMP_FILTER=y
+ CONFIG_USER_NS=y
+-- 
+2.27.0
+
diff --git a/queue-5.10/selinux-fix-error-initialization-in-inode_doinit_wit.patch b/queue-5.10/selinux-fix-error-initialization-in-inode_doinit_wit.patch
new file mode 100644
index 00000000000..4b4b4e97950
--- /dev/null
+++ b/queue-5.10/selinux-fix-error-initialization-in-inode_doinit_wit.patch
@@ -0,0 +1,62 @@
+From 117298317e4bb83fe648351a06fd0aefd11da3dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 09:36:30 +0800
+Subject: selinux: fix error initialization in inode_doinit_with_dentry()
+
+From: Tianyue Ren <rentianyue@kylinos.cn>
+
+[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]
+
+Mark the inode security label as invalid if we cannot find
+a dentry so that we will retry later rather than marking it
+initialized with the unlabeled SID.
+
+Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
+Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
+[PM: minor comment tweaks]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 6b1826fc3658e..158fc47d8620d 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1451,7 +1451,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ 			 * inode_doinit with a dentry, before these inodes could
+ 			 * be used again by userspace.
+ 			 */
+-			goto out;
++			isec->initialized = LABEL_INVALID;
++			/*
++			 * There is nothing useful to jump to the "out"
++			 * label, except a needless spin lock/unlock
++			 * cycle.
++			 */
++			return 0;
+ 		}
+ 
+ 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
+@@ -1507,8 +1513,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ 			 * inode_doinit() with a dentry, before these inodes
+ 			 * could be used again by userspace.
+ 			 */
+-			if (!dentry)
+-				goto out;
++			if (!dentry) {
++				isec->initialized = LABEL_INVALID;
++				/*
++				 * There is nothing useful to jump to the "out"
++				 * label, except a needless spin lock/unlock
++				 * cycle.
++				 */
++				return 0;
++			}
+ 			rc = selinux_genfs_get_sid(dentry, sclass,
+ 						   sbsec->flags, &sid);
+ 			if (rc) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch b/queue-5.10/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch
new file mode 100644
index 00000000000..16f5e731c6c
--- /dev/null
+++ b/queue-5.10/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch
@@ -0,0 +1,101 @@
+From cd7362d8726309b6d3e8bb52ec420dd894cddd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 11:49:38 -0500
+Subject: selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]
+
+A previous fix, commit 83370b31a915 ("selinux: fix error initialization
+in inode_doinit_with_dentry()"), changed how failures were handled
+before a SELinux policy was loaded.  Unfortunately that patch was
+potentially problematic for two reasons: it set the isec->initialized
+state without holding a lock, and it didn't set the inode's SELinux
+label to the "default" for the particular filesystem.  The later can
+be a problem if/when a later attempt to revalidate the inode fails
+and SELinux reverts to the existing inode label.
+
+This patch should restore the default inode labeling that existed
+before the original fix, without affecting the LABEL_INVALID marking
+such that revalidation will still be attempted in the future.
+
+Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
+Reported-by: Sven Schnelle <svens@linux.ibm.com>
+Tested-by: Sven Schnelle <svens@linux.ibm.com>
+Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 31 +++++++++++++------------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 158fc47d8620d..c46312710e73e 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1451,13 +1451,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ 			 * inode_doinit with a dentry, before these inodes could
+ 			 * be used again by userspace.
+ 			 */
+-			isec->initialized = LABEL_INVALID;
+-			/*
+-			 * There is nothing useful to jump to the "out"
+-			 * label, except a needless spin lock/unlock
+-			 * cycle.
+-			 */
+-			return 0;
++			goto out_invalid;
+ 		}
+ 
+ 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
+@@ -1513,15 +1507,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ 			 * inode_doinit() with a dentry, before these inodes
+ 			 * could be used again by userspace.
+ 			 */
+-			if (!dentry) {
+-				isec->initialized = LABEL_INVALID;
+-				/*
+-				 * There is nothing useful to jump to the "out"
+-				 * label, except a needless spin lock/unlock
+-				 * cycle.
+-				 */
+-				return 0;
+-			}
++			if (!dentry)
++				goto out_invalid;
+ 			rc = selinux_genfs_get_sid(dentry, sclass,
+ 						   sbsec->flags, &sid);
+ 			if (rc) {
+@@ -1546,11 +1533,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ out:
+ 	spin_lock(&isec->lock);
+ 	if (isec->initialized == LABEL_PENDING) {
+-		if (!sid || rc) {
++		if (rc) {
+ 			isec->initialized = LABEL_INVALID;
+ 			goto out_unlock;
+ 		}
+-
+ 		isec->initialized = LABEL_INITIALIZED;
+ 		isec->sid = sid;
+ 	}
+@@ -1558,6 +1544,15 @@ out:
+ out_unlock:
+ 	spin_unlock(&isec->lock);
+ 	return rc;
++
++out_invalid:
++	spin_lock(&isec->lock);
++	if (isec->initialized == LABEL_PENDING) {
++		isec->initialized = LABEL_INVALID;
++		isec->sid = sid;
++	}
++	spin_unlock(&isec->lock);
++	return 0;
+ }
+ 
+ /* Convert a Linux signal to an access vector. */
+-- 
+2.27.0
+
diff --git a/queue-5.10/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch b/queue-5.10/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch
new file mode 100644
index 00000000000..9880445d76c
--- /dev/null
+++ b/queue-5.10/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch
@@ -0,0 +1,68 @@
+From 9f6cece3eeeb88c4646e6726a747b9da8bf2e98a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:58 +0100
+Subject: seq_buf: Avoid type mismatch for seq_buf_init
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]
+
+Building with W=2 prints a number of warnings for one function that
+has a pointer type mismatch:
+
+linux/seq_buf.h: In function 'seq_buf_init':
+linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]
+
+Change the type in the function prototype according to the type in
+the structure.
+
+Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org
+
+Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/seq_buf.h   | 2 +-
+ include/linux/trace_seq.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
+index fb0205d87d3c1..9d6c28cc4d8f2 100644
+--- a/include/linux/seq_buf.h
++++ b/include/linux/seq_buf.h
+@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
+ }
+ 
+ static inline void
+-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
++seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
+ {
+ 	s->buffer = buf;
+ 	s->size = size;
+diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
+index 6c30508fca198..5a2c650d9e1c1 100644
+--- a/include/linux/trace_seq.h
++++ b/include/linux/trace_seq.h
+@@ -12,7 +12,7 @@
+  */
+ 
+ struct trace_seq {
+-	unsigned char		buffer[PAGE_SIZE];
++	char			buffer[PAGE_SIZE];
+ 	struct seq_buf		seq;
+ 	int			full;
+ };
+@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
+  * that is about to be written to and then return the result
+  * of that write.
+  */
+-static inline unsigned char *
++static inline char *
+ trace_seq_buffer_ptr(struct trace_seq *s)
+ {
+ 	return s->buffer + seq_buf_used(&s->seq);
+-- 
+2.27.0
+
diff --git a/queue-5.10/serial-8250-mtk-fix-reference-leak-in-mtk8250_probe.patch b/queue-5.10/serial-8250-mtk-fix-reference-leak-in-mtk8250_probe.patch
new file mode 100644
index 00000000000..d82b386a61c
--- /dev/null
+++ b/queue-5.10/serial-8250-mtk-fix-reference-leak-in-mtk8250_probe.patch
@@ -0,0 +1,55 @@
+From ca9371799e7e877168ae72a815361c961c7341e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 22:11:26 +0800
+Subject: serial: 8250-mtk: Fix reference leak in mtk8250_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 6e4e636e0e3e0b5deffc5e233adcb2cd4e68f2d0 ]
+
+The pm_runtime_enable will increase power disable depth.
+Thus a pairing decrement is needed on the error handling
+path to keep it balanced according to context.
+
+Fixes: e32a83c70cf98 ("serial: 8250-mtk: modify mtk uart power and clock management")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201119141126.168850-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_mtk.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index fa876e2c13e5d..f7d3023f860f0 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -572,15 +572,22 @@ static int mtk8250_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	err = mtk8250_runtime_resume(&pdev->dev);
+ 	if (err)
+-		return err;
++		goto err_pm_disable;
+ 
+ 	data->line = serial8250_register_8250_port(&uart);
+-	if (data->line < 0)
+-		return data->line;
++	if (data->line < 0) {
++		err = data->line;
++		goto err_pm_disable;
++	}
+ 
+ 	data->rx_wakeup_irq = platform_get_irq_optional(pdev, 1);
+ 
+ 	return 0;
++
++err_pm_disable:
++	pm_runtime_disable(&pdev->dev);
++
++	return err;
+ }
+ 
+ static int mtk8250_remove(struct platform_device *pdev)
+-- 
+2.27.0
+
diff --git a/queue-5.10/series b/queue-5.10/series
index 81cb373e920..4cce9ca480b 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1 +1,509 @@
 hwmon-k10temp-remove-support-for-displaying-voltage-and-current-on-zen-cpus.patch
+drm-gma500-fix-double-free-of-gma_connector.patch
+iio-adc-at91_adc-add-kconfig-dep-on-the-of-symbol-an.patch
+drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch
+drm-mcde-fix-handling-of-platform_get_irq-error.patch
+drm-tve200-fix-handling-of-platform_get_irq-error.patch
+arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch
+arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch
+soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch
+soc-mediatek-check-if-power-domains-can-be-powered-o.patch
+arm64-dts-mediatek-mt8183-fix-gce-incorrect-mbox-cel.patch
+arm64-dts-ipq6018-update-the-reserved-memory-node.patch
+arm64-dts-qcom-sc7180-fix-one-forgotten-interconnect.patch
+soc-qcom-geni-more-properly-switch-to-dma-mode.patch
+revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch
+rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch
+rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch
+rdma-bnxt_re-fix-entry-size-during-srq-create.patch
+selinux-fix-error-initialization-in-inode_doinit_wit.patch
+arm-dts-aspeed-g6-fix-the-gpio-memory-size.patch
+arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch
+rdma-core-fix-error-return-in-_ib_modify_qp.patch
+rdma-rxe-compute-psn-windows-correctly.patch
+x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch
+arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch
+rdma-rtrs-clt-remove-destroy_con_cq_qp-in-case-route.patch
+rdma-rtrs-clt-missing-error-from-rtrs_rdma_conn_esta.patch
+rdma-rtrs-srv-don-t-guard-the-whole-__alloc_srv-with.patch
+x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch
+asoc-qcom-fix-unsigned-int-bitwidth-compared-to-less.patch
+sched-deadline-fix-sched_dl_global_validate.patch
+sched-reenable-interrupts-in-do_sched_yield.patch
+drm-amdgpu-fix-incorrect-enum-type.patch
+crypto-talitos-endianess-in-current_desc_hdr.patch
+crypto-talitos-fix-return-type-of-current_desc_hdr.patch
+crypto-inside-secure-fix-sizeof-mismatch.patch
+asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch
+drm-msm-add-missing-stub-definition.patch
+arm-dts-aspeed-tiogapass-remove-vuart.patch
+drm-amdgpu-fix-build_coefficients-argument.patch
+powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch
+spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch
+f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch
+rdma-mlx5-fix-corruption-of-reg_pages-in-mlx5_ib_rer.patch
+perf-test-use-generic-event-for-expand_libpfm_events.patch
+drm-msm-dp-displayport-phy-compliance-tests-fixup.patch
+drm-msm-dsi_pll_7nm-restore-vco-rate-during-restore_.patch
+drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch
+drm-msm-dpu-fix-clock-scaling-on-non-sc7180-board.patch
+spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch
+scsi-aacraid-improve-compat_ioctl-handlers.patch
+pinctrl-core-add-missing-ifdef-config_gpiolib.patch
+asoc-pcm-drain-support-reactivation.patch
+drm-bridge-tpd12s015-fix-irq-registering-in-tpd12s01.patch
+libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch
+crypto-arm64-poly1305-neon-reorder-pac-authenticatio.patch
+crypto-arm-aes-neonbs-fix-usage-of-cbc-aes-fallback.patch
+crypto-caam-fix-printing-on-xts-fallback-allocation-.patch
+selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch
+nl80211-cfg80211-fix-potential-infinite-loop.patch
+spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch
+bpf-fix-tests-for-local_storage.patch
+x86-mce-correct-the-detection-of-invalid-notifier-pr.patch
+drm-edid-fix-uninitialized-variable-in-drm_cvt_modes.patch
+ath11k-initialize-complete-alpha2-for-regulatory-cha.patch
+ath11k-fix-number-of-rules-in-filtered-etsi-regdomai.patch
+ath11k-fix-wmi-init-configuration.patch
+brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch
+arm64-dts-exynos-include-common-syscon-restart-power.patch
+arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch
+drm-panel-simple-add-flags-to-boe_nv133fhm_n61.patch
+bluetooth-fix-null-pointer-dereference-in-hci_event_.patch
+bluetooth-fix-ll-privacy-ble-device-fails-to-connect.patch
+bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch
+spi-stm32-qspi-fix-reference-leak-in-stm32-qspi-oper.patch
+spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch
+spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch
+spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch
+spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch
+spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch
+spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch
+spi-imx-fix-reference-leak-in-two-imx-operations.patch
+asoc-qcom-common-fix-refcounting-in-qcom_snd_parse_o.patch
+ath11k-handle-errors-if-peer-creation-fails.patch
+mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch
+drm-msm-a6xx-clear-shadow-on-suspend.patch
+drm-msm-a5xx-clear-shadow-on-suspend.patch
+firmware-tegra-fix-strncpy-strncat-confusion.patch
+drm-msm-dp-return-correct-connection-status-after-su.patch
+drm-msm-dp-skip-checking-link_status_updated-bit.patch
+drm-msm-dp-do-not-notify-audio-subsystem-if-sink-doe.patch
+selftests-run_kselftest.sh-fix-dry-run-typo.patch
+selftest-bpf-add-missed-ip6ip6-test-back.patch
+asoc-wm8994-fix-pm-disable-depth-imbalance-on-error.patch
+asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch
+spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch
+virtiofs-fix-leak-in-setup.patch
+net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch
+net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch
+asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch
+rdma-mthca-work-around-wenum-conversion-warning.patch
+asoc-sof-intel-fix-kconfig-dependency-for-snd_intel_.patch
+arm64-dts-ti-k3-am65-j721e-fix-unit-address-format-e.patch
+mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch
+drm-amdgpu-fix-compute-queue-priority-if-num_kcq-is-.patch
+soc-ti-omap-prm-do-not-check-rstst-bit-on-deassert-i.patch
+crypto-kconfig-crypto_manager_extra_tests-requires-t.patch
+crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch
+firmware-arm_scmi-fix-missing-destroy_workqueue.patch
+drm-udl-fix-missing-error-code-in-udl_handle_damage.patch
+staging-greybus-codecs-fix-reference-counter-leak-in.patch
+staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch
+scripts-kernel-doc-restore-anonymous-enum-parsing.patch
+drm-amdkfd-put-acpi-table-after-using-it.patch
+ionic-use-mc-sync-for-multicast-filters.patch
+ionic-flatten-calls-to-ionic_lif_rx_mode.patch
+ionic-change-set_rx_mode-from_ndo-to-can_sleep.patch
+media-tm6000-fix-sizeof-mismatches.patch
+media-platform-add-missing-put_device-call-in-mtk_jp.patch
+media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch
+media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-4640
+media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-7942
+media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch
+media-v4l2-fwnode-v4l2_fwnode_endpoint_parse-caller-.patch
+media-ov5640-fix-support-of-bt656-bus-mode.patch
+media-staging-rkisp1-cap-fix-runtime-pm-imbalance-on.patch
+media-cedrus-fix-reference-leak-in-cedrus_start_stre.patch
+media-platform-add-missing-put_device-call-in-mtk_jp.patch-21183
+media-venus-core-change-clk-enable-and-disable-order.patch
+media-venus-core-vote-for-video-mem-path.patch
+media-venus-core-vote-with-average-bandwidth-and-pea.patch
+rdma-cma-add-missing-error-handling-of-listen_id.patch
+asoc-meson-fix-compile_test-error.patch
+spi-dw-fix-build-error-by-selecting-multiplexer.patch
+scsi-core-fix-vpd-lun-id-designator-priorities.patch
+media-venus-put-dummy-vote-on-video-mem-path-after-l.patch
+media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch
+video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch
+mmc-sdhci-tegra-fix-wrong-unit-with-busy_timeout.patch
+drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch
+drm-meson-free-rdma-resources-after-tearing-down-drm.patch
+drm-meson-unbind-all-connectors-on-module-removal.patch
+drm-meson-dw-hdmi-register-a-callback-to-disable-the.patch
+drm-meson-dw-hdmi-ensure-that-clocks-are-enabled-bef.patch
+asoc-intel-snd_soc_intel_keembay-should-depend-on-ar.patch
+iommu-vt-d-include-conditionally-on-config_intel_iom.patch
+input-ads7846-fix-race-that-causes-missing-releases.patch
+input-ads7846-fix-integer-overflow-on-rt-calculation.patch
+input-ads7846-fix-unaligned-access-on-7845.patch
+bus-mhi-core-remove-double-locking-from-mhi_driver_r.patch
+bus-mhi-core-fix-null-pointer-access-when-parsing-mh.patch
+usb-max3421-fix-return-error-code-in-max3421_probe.patch
+spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch
+selftests-bpf-fix-broken-riscv-build.patch
+powerpc-avoid-broken-gcc-__attribute__-optimize.patch
+powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch
+arm-dts-tacoma-fix-node-vs-reg-mismatch-for-flash-me.patch
+revert-powerpc-pseries-hotplug-cpu-remove-double-fre.patch
+powerpc-powernv-sriov-fix-unsigned-int-win-compared-.patch
+mfd-htc-i2cpld-add-the-missed-i2c_put_adapter-in-htc.patch
+mfd-mfd_sl28cpld-should-depend-on-arch_layerscape.patch
+mfd-stmfx-fix-dev_err_probe-call-in-stmfx_chip_init.patch
+mfd-cpcap-fix-interrupt-regression-with-regmap-clear.patch
+edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch
+scsi-ufs-avoid-to-call-req_clks_off-to-clks_off.patch
+scsi-ufs-fix-clkgating-on-off.patch
+rcu-allow-rcu_irq_enter_check_tick-from-nmi.patch
+rcu-ftrace-fix-ftrace-recursion.patch
+rcu-tree-defer-kvfree_rcu-allocation-to-a-clean-cont.patch
+crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch
+crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch
+crypto-sun8i-ce-fix-two-error-path-s-memory-leak.patch
+spi-fix-resource-leak-for-drivers-without-.remove-ca.patch
+drm-meson-dw-hdmi-disable-clocks-on-driver-teardown.patch
+drm-meson-dw-hdmi-enable-the-iahb-clock-early-enough.patch
+pci-disable-msi-for-pericom-pcie-usb-adapter.patch
+pci-brcmstb-initialize-tmp-before-use.patch
+soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch
+soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch
+drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch
+soc-qcom-initialize-local-variable.patch
+arm64-dts-qcom-sm8250-correct-compatible-for-sm8250-.patch
+arm64-dts-qcom-msm8916-samsung-a2015-disable-muic-i2.patch
+input-omap4-keypad-fix-runtime-pm-error-handling.patch
+clk-meson-kconfig-fix-dependency-for-g12a.patch
+staging-mfd-hi6421-spmi-pmic-fix-error-return-code-i.patch
+ath11k-fix-the-rx_filter-flag-setting-for-peer-rssi-.patch
+rdma-cxgb4-validate-the-number-of-cqes.patch
+soundwire-fix-debug_locks_warn_on-for-uninitialized-.patch
+pinctrl-sunxi-fix-irq-bank-map-for-the-allwinner-a10.patch
+memstick-fix-a-double-free-bug-in-memstick_check.patch
+arm-dts-at91-sam9x60-add-pincontrol-for-usb-host.patch
+arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch
+arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch
+mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch
+brcmfmac-fix-error-return-code-in-brcmf_cfg80211_con.patch
+orinoco-move-context-allocation-after-processing-the.patch
+qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch
+rsi-fix-error-return-code-in-rsi_reset_card.patch
+cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch
+dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch
+arm64-dts-qcom-sdm845-limit-ipa-iommu-streams.patch
+leds-netxbig-add-missing-put_device-call-in-netxbig_.patch
+leds-lp50xx-fix-an-error-handling-path-in-lp50xx_pro.patch
+leds-turris-omnia-check-for-led_color_id_rgb-instead.patch
+arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch
+rdma-cma-fix-deadlock-on-lock-in-rdma_cma_listen_on_.patch
+soundwire-qcom-fix-build-failure-when-slimbus-is-mod.patch
+drm-imx-dcss-fix-rotations-for-vivante-tiled-formats.patch
+media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch
+platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch
+platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch
+arm64-dts-qcom-sc7180-limit-ipa-iommu-streams.patch
+rdma-hns-only-record-vlan-info-for-hip08.patch
+rdma-hns-fix-missing-fields-in-address-vector.patch
+rdma-hns-avoid-setting-loopback-indicator-when-smac-.patch
+serial-8250-mtk-fix-reference-leak-in-mtk8250_probe.patch
+samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch
+media-imx214-fix-stop-streaming.patch
+mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch
+media-max2175-fix-max2175_set_csm_mode-error-code.patch
+slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch
+rdma-core-track-device-memory-mrs.patch
+drm-mediatek-use-correct-aliases-name-for-ovl.patch
+hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch
+arm-dts-remove-non-existent-i2c1-from-98dx3236.patch
+arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch
+power-supply-bq25890-use-the-correct-range-for-iilim.patch
+arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch
+power-supply-max17042_battery-fix-current_-avg-now-h.patch
+power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch
+power-supply-bq24190_charger-fix-reference-leak.patch
+genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch
+arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch
+arm64-dts-ls1028a-fix-flexspi-clock-input.patch
+arm64-dts-freescale-sl28-combine-spi-mtd-partitions.patch
+phy-tegra-xusb-fix-usb_phy-device-driver-field.patch
+arm64-dts-qcom-c630-polish-i2c-hid-devices.patch
+arm64-dts-qcom-c630-fix-pinctrl-pins-properties.patch
+pci-bounds-check-command-line-resource-alignment-req.patch
+pci-fix-overflow-in-command-line-resource-alignment-.patch
+pci-iproc-fix-out-of-bound-array-accesses.patch
+pci-iproc-invalidate-correct-paxb-inbound-windows.patch
+arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch
+arm64-dts-meson-sm1-fix-typo-in-opp-table.patch
+soc-amlogic-canvas-add-missing-put_device-call-in-me.patch
+scsi-hisi_sas-fix-up-probe-error-handling-for-v3-hw.patch
+scsi-pm80xx-do-not-sleep-in-atomic-context.patch
+spi-spi-fsl-dspi-use-max_native_cs-instead-of-num_ch.patch
+arm-dts-at91-at91sam9rl-fix-adc-triggers.patch
+rdma-hns-fix-0-length-sge-calculation-error.patch
+rdma-hns-bugfix-for-calculation-of-extended-sge.patch
+mailbox-arm_mhu_db-fix-mhu_db_shutdown-by-replacing-.patch
+soundwire-master-use-pm_runtime_set_active-on-add.patch
+platform-x86-dell-smbios-base-fix-error-return-code-.patch
+asoc-intel-boards-tgl_max98373-update-tdm-slot_width.patch
+media-max9271-fix-gpio-enable-disable.patch
+media-rdacm20-enable-gpio1-explicitly.patch
+media-i2c-imx219-selection-compliance-fixes.patch
+ath11k-don-t-cast-ath11k_skb_cb-to-ieee80211_tx_info.patch
+ath11k-reset-ath11k_skb_cb-before-setting-new-flags.patch
+ath11k-fix-an-error-handling-path.patch
+ath10k-fix-the-parsing-error-in-service-available-ev.patch
+ath10k-fix-an-error-handling-path.patch
+ath10k-release-some-resources-in-an-error-handling-p.patch
+sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch
+nfsv4.2-condition-readdir-s-mask-for-security-label-.patch
+sunrpc-xprt_load_transport-needs-to-support-the-neti.patch
+nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch
+net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch
+lockd-don-t-use-interval-based-rebinding-over-tcp.patch
+nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch
+selftests-seccomp-update-kernel-config.patch
+vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch
+hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch
+f2fs-fix-double-free-of-unicode-map.patch
+media-tvp5150-fix-wrong-return-value-of-tvp5150_pars.patch
+media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch
+powerpc-perf-fix-crash-with-is_sier_available-when-p.patch
+powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch
+powerpc-xmon-fix-build-failure-for-8xx.patch
+powerpc-perf-fix-to-update-radix_scope_qual-in-power.patch
+powerpc-perf-update-the-pmu-group-constraints-for-l2.patch
+powerpc-perf-fix-the-pmu-group-constraints-for-thres.patch
+clocksource-drivers-orion-add-missing-clk_disable_un.patch
+clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch
+clocksource-drivers-ingenic-fix-section-mismatch.patch
+clocksource-drivers-riscv-make-riscv_timer-depends-o.patch
+arm64-mte-fix-prctl-pr_get_tagged_addr_ctrl-if-tcf0-.patch
+iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch
+libbpf-sanitise-map-names-before-pinning.patch
+arm-dts-at91-sam9x60ek-remove-bypass-property.patch
+arm-dts-at91-sama5d2-map-securam-as-device.patch
+scripts-kernel-doc-fix-parsing-function-like-typedef.patch
+bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch
+selftests-bpf-fix-invalid-use-of-strncat-in-test_soc.patch
+pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch
+soc-rockchip-io-domain-fix-error-return-code-in-rock.patch
+arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch
+memstick-r592-fix-error-return-in-r592_probe.patch
+mips-don-t-round-up-kernel-sections-size-for-membloc.patch
+mt76-mt7663s-fix-a-possible-ple-quota-underflow.patch
+mt76-mt7915-set-fops_sta_stats.owner-to-this_module.patch
+mt76-set-fops_tx_stats.owner-to-this_module.patch
+mt76-dma-fix-possible-deadlock-running-mt76_dma_clea.patch
+net-mlx5-properly-convey-driver-version-to-firmware.patch
+mt76-fix-memory-leak-if-device-probing-fails.patch
+mt76-fix-tkip-configuration-for-mt7615-7663-devices.patch
+asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch
+asoc-q6afe-clocks-add-missing-parent-clock-rate.patch
+dm-ioctl-fix-error-return-code-in-target_message.patch
+asoc-cros_ec_codec-fix-uninitialized-memory-read.patch
+asoc-atmel-mchp-spdifrx-needs-common_clk.patch
+asoc-qcom-fix-qdsp6-dependencies-attempt-3.patch
+phy-mediatek-allow-compile-testing-the-hdmi-phy.patch
+phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch
+memory-ti-emif-sram-only-build-for-armv7.patch
+memory-jz4780_nemc-fix-potential-null-dereference-in.patch
+drm-msm-a5xx-make-preemption-reset-case-reentrant.patch
+drm-msm-add-iommu_support-dependency.patch
+clocksource-drivers-arm_arch_timer-use-stable-count-.patch
+clocksource-drivers-arm_arch_timer-correct-fault-pro.patch
+cpufreq-ap806-add-missing-module_device_table.patch
+cpufreq-highbank-add-missing-module_device_table.patch
+cpufreq-mediatek-add-missing-module_device_table.patch
+cpufreq-qcom-add-missing-module_device_table.patch
+cpufreq-st-add-missing-module_device_table.patch
+cpufreq-sun50i-add-missing-module_device_table.patch
+cpufreq-loongson1-add-missing-module_alias.patch
+cpufreq-scpi-add-missing-module_alias.patch
+cpufreq-vexpress-spc-add-missing-module_alias.patch
+cpufreq-imx-fix-nvmem_imx_ocotp-dependency.patch
+macintosh-adb-iop-always-wait-for-reply-message-from.patch
+macintosh-adb-iop-send-correct-poll-command.patch
+staging-bcm2835-fix-vchiq_mmal-dependencies.patch
+staging-greybus-audio-fix-possible-leak-free-widgets.patch
+spi-dw-fix-error-return-code-in-dw_spi_bt1_probe.patch
+bluetooth-btusb-add-the-missed-release_firmware-in-b.patch
+bluetooth-btmtksdio-add-the-missed-release_firmware-.patch
+bluetooth-sco-fix-crash-when-using-bt_sndmtu-bt_rcvm.patch
+block-rnbd-clt-dynamically-alloc-buffer-for-pathname.patch
+block-rnbd-fix-a-null-pointer-dereference-on-dev-blk.patch
+bluetooth-btusb-fix-detection-of-some-fake-csr-contr.patch
+platform-x86-intel-vbtn-fix-sw_tablet_mode-always-re.patch
+adm8211-fix-error-return-code-in-adm8211_probe.patch
+mtd-spi-nor-sst-fix-bpn-bits-for-the-sst25vf064c.patch
+mtd-spi-nor-ignore-errors-in-spi_nor_unlock_all.patch
+mtd-spi-nor-atmel-remove-global-protection-flag.patch
+mtd-spi-nor-atmel-fix-unlock_all-for-at25fs010-040.patch
+arm64-dts-meson-g12b-odroid-n2-fix-phy-deassert-timi.patch
+arm64-dts-meson-fix-phy-deassert-timing-requirements.patch
+arm-dts-meson-fix-phy-deassert-timing-requirements.patch
+arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch
+arm64-dts-meson-g12b-w400-fix-phy-deassert-timing-re.patch
+clk-fsl-sai-fix-memory-leak.patch
+scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch
+scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch
+scsi-iscsi-fix-inappropriate-use-of-put_device.patch
+seq_buf-avoid-type-mismatch-for-seq_buf_init.patch
+scsi-fnic-fix-error-return-code-in-fnic_probe.patch
+platform-x86-mlx-platform-fix-item-counter-assignmen.patch
+platform-x86-mlx-platform-fix-item-counter-assignmen.patch-3823
+arm-9030-1-entry-omit-fp-emulation-for-und-exception.patch
+powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch
+powerpc-pseries-hibernation-remove-redundant-cachein.patch
+powerpc-powermac-fix-low_sleep_handler-with-config_v.patch
+drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch
+asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch
+coresight-remove-broken-__exit-annotations.patch
+asoc-max98390-fix-error-codes-in-max98390_dsm_init.patch
+powerpc-mm-sanity_check_fault-should-work-for-all-no.patch
+usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch
+usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch
+speakup-fix-uninitialized-flush_lock.patch
+nfsd-fix-message-level-for-normal-termination.patch
+nfsd-fix-5-seconds-delay-when-doing-inter-server-cop.patch
+nfs_common-need-lock-during-iterate-through-the-list.patch
+x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch
+scsi-qla2xxx-fix-fw-initialization-error-on-big-endi.patch
+scsi-qla2xxx-fix-n2n-and-nvme-connect-retry-failure.patch
+platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch
+misc-pci_endpoint_test-fix-return-value-of-error-bra.patch
+bus-fsl-mc-add-back-accidentally-dropped-error-check.patch
+bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch
+fsi-aspeed-add-mutex-to-protect-hw-access.patch
+s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch
+iwlwifi-dbg-tlv-fix-old-length-in-is_trig_data_conta.patch
+iwlwifi-mvm-hook-up-missing-rx-handlers.patch
+erofs-avoid-using-generic_block_bmap.patch
+clk-renesas-r8a779a0-fix-r-and-osc-clocks.patch
+can-m_can-m_can_config_endisable-remove-double-clear.patch
+powerpc-sstep-emulate-prefixed-instructions-only-whe.patch
+powerpc-sstep-cover-new-vsx-instructions-under-confi.patch
+slimbus-qcom-fix-potential-null-dereference-in-qcom_.patch
+alsa-hda-hdmi-fix-silent-stream-for-first-playback-t.patch
+rdma-core-do-not-indicate-device-ready-when-device-e.patch
+rdma-uverbs-fix-incorrect-variable-type.patch
+remoteproc-mediatek-change-mt8192-cfg-register-base.patch
+remoteproc-mtk_scp-surround-dt-device-ids-with-confi.patch
+remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch
+remoteproc-qcom-fix-reference-leak-in-adsp_start.patch
+remoteproc-qcom-pas-fix-error-handling-in-adsp_pds_e.patch
+remoteproc-k3-dsp-fix-return-value-check-in-k3_dsp_r.patch
+remoteproc-qcom-fix-potential-null-dereference-in-ad.patch
+remoteproc-mediatek-unprepare-clk-if-scp_before_load.patch
+clk-qcom-gcc-sc7180-use-floor-ops-for-sdcc-clks.patch
+clk-tegra-fix-duplicated-se-clock-entry.patch
+mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch
+mtd-rawnand-meson-fix-a-resource-leak-in-init.patch
+mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch
+samples-bpf-fix-possible-hang-in-xdpsock-with-multip.patch
+fs-handle-i_dontcache-in-iput_final-instead-of-gener.patch
+extcon-max77693-fix-modalias-string.patch
+crypto-atmel-i2c-select-config_bitreverse.patch
+mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch
+mac80211-fix-a-mistake-check-for-rx_stats-update.patch
+asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch
+irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch
+irqchip-ti-sci-inta-fix-printing-of-inta-id-on-probe.patch
+irqchip-ti-sci-intr-fix-freeing-of-irqs.patch
+dmaengine-ti-k3-udma-correct-normal-channel-offset-w.patch
+rdma-hns-limit-the-length-of-data-copied-between-ker.patch
+rdma-hns-normalization-the-judgment-of-some-features.patch
+rdma-hns-do-shift-on-traffic-class-when-using-rocev2.patch
+gpiolib-irq-hooks-fix-recursion-in-gpiochip_irq_unma.patch
+ath11k-fix-incorrect-tlvs-in-scan-start-command.patch
+irqchip-qcom-pdc-fix-phantom-irq-when-changing-betwe.patch
+watchdog-armada_37xx-add-missing-dependency-on-has_i.patch
+watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch
+watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch
+watchdog-sprd-check-busy-bit-before-new-loading-rath.patch
+watchdog-fix-potential-dereferencing-of-null-pointer.patch
+ubifs-fix-error-return-code-in-ubifs_init_authentica.patch
+um-monitor-error-events-in-irq-controller.patch
+um-tty-fix-handling-of-close-in-tty-lines.patch
+um-chan_xterm-fix-fd-leak.patch
+sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch
+rdma-mlx5-fix-mr-cache-memory-leak.patch
+rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch
+nfc-s3fwrn5-release-the-nfc-firmware.patch
+drm-mxsfb-silence-eprobe_defer-while-waiting-for-bri.patch
+powerpc-perf-fix-threshold-event-counter-multiplier-.patch
+powerpc-ps3-use-dma_mapping_error.patch
+perf-test-fix-metric-parsing-test.patch
+drm-amdgpu-fix-regression-in-vbios-reservation-handl.patch
+mm-gup-reorganize-internal_get_user_pages_fast.patch
+mm-gup-prevent-gup_fast-from-racing-with-cow-during-.patch
+mm-gup-combine-put_compound_head-and-unpin_user_page.patch
+mm-memcg-slab-fix-return-of-child-memcg-objcg-for-ro.patch
+mm-memcg-slab-fix-use-after-free-in-obj_cgroup_charg.patch
+mm-rmap-always-do-ttu_ignore_access.patch
+sparc-fix-handling-of-page-table-constructor-failure.patch
+mm-vmalloc-fix-unlock-order-in-s_stop.patch
+mm-vmalloc.c-fix-kasan-shadow-poisoning-size.patch
+mm-memory_failure-always-pin-the-page-in-madvise_inj.patch
+hugetlb-fix-an-error-code-in-hugetlb_reserve_pages.patch
+mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch
+proc-fix-lookup-in-proc-net-subdirectories-after-set.patch
+checkpatch-fix-unescaped-left-brace.patch
+s390-test_unwind-fix-call_on_stack-tests.patch
+lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch
+ice-xsk-clear-the-status-bits-for-the-next_to_use-de.patch
+i40e-xsk-clear-the-status-bits-for-the-next_to_use-d.patch
+net-dsa-qca-ar9331-fix-sleeping-function-called-from.patch
+dpaa2-eth-fix-the-size-of-the-mapped-sgt-buffer.patch
+net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch
+net-mscc-ocelot-fix-a-resource-leak-in-the-error-han.patch
+net-allwinner-fix-some-resources-leak-in-the-error-h.patch
+block-rnbd-clt-get-rid-of-warning-regarding-size-arg.patch
+block-rnbd-clt-fix-possible-memleak.patch
+nfs-pnfs-fix-a-typo-in-ff_layout_resend_pnfs_read.patch
+net-korina-fix-return-value.patch
+devlink-use-_bitul-macro-instead-of-bit-in-the-uapi-.patch
+libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch
+powerpc-32s-fix-cleanup_cpu_mmu_context-compile-bug.patch
+watchdog-qcom-avoid-context-switch-in-restart-handle.patch
+watchdog-coh901327-add-common_clk-dependency.patch
+clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch
+pwm-zx-add-missing-cleanup-in-error-path.patch
+pwm-lp3943-dynamically-allocate-pwm-chip-base.patch
+pwm-imx27-fix-overflow-for-bigger-periods.patch
+pwm-sun4i-remove-erroneous-else-branch.patch
+io_uring-cancel-only-requests-of-current-task.patch
+tools-build-add-missing-libcap-to-test-all.bin-targe.patch
+perf-record-fix-memory-leak-when-using-user-regs-to-.patch
+qlcnic-fix-error-code-in-probe.patch
+nfp-move-indirect-block-cleanup-to-flower-app-stop-c.patch
+vdpa-mlx5-use-write-memory-barrier-after-updating-cq.patch
+virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch
+virtio_net-fix-error-code-in-probe.patch
+virtio_ring-fix-two-use-after-free-bugs.patch
+vhost-scsi-fix-error-return-code-in-vhost_scsi_set_e.patch
+epoll-check-for-events-when-removing-a-timed-out-thr.patch
+clk-bcm-dvp-add-module_device_table.patch
+clk-at91-sama7g5-fix-compilation-error.patch
+clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch
+clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch
+clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch
+clk-vc5-use-idt-voltage-microvolt-instead-of-idt-vol.patch
+kconfig-fix-return-value-of-do_error_if.patch
+powerpc-boot-fix-build-of-dts-fsl.patch
+powerpc-smp-add-__init-to-init_big_cores.patch
+arm-9044-1-vfp-use-undef-hook-for-vfp-support-detect.patch
+arm-9036-1-uncompress-fix-dbgadtb-size-parameter-nam.patch
+perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch
+io_uring-fix-racy-iopoll-flush-overflow.patch
+io_uring-cancel-reqs-shouldn-t-kill-overflow-list.patch
+smack-handle-io_uring-kernel-thread-privileges.patch
+proc-mountinfo-make-splice-available-again.patch
diff --git a/queue-5.10/slimbus-qcom-fix-potential-null-dereference-in-qcom_.patch b/queue-5.10/slimbus-qcom-fix-potential-null-dereference-in-qcom_.patch
new file mode 100644
index 00000000000..64119ffd3e9
--- /dev/null
+++ b/queue-5.10/slimbus-qcom-fix-potential-null-dereference-in-qcom_.patch
@@ -0,0 +1,62 @@
+From 8c1b680ac1a411c43a81e71bb08b23ff6e174068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 09:54:32 +0800
+Subject: slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 428bb001143cf5bfb65aa4ae90d4ebc95f82d007 ]
+
+platform_get_resource_byname() may fail and in this case a NULL
+dereference will occur.
+
+Fix it to use devm_platform_ioremap_resource_byname() instead of calling
+platform_get_resource_byname() and devm_ioremap().
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t,
+n);
++ if (!res)
++   return -EINVAL;
+... when != res == NULL
+e = devm_ioremap(e1, res->start, e2);
+
+Fixes: ad7fcbc308b0 ("slimbus: qcom: Add Qualcomm Slimbus controller driver")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607392473-20610-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ctrl.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
+index 4aad2566f52d2..f04b961b96cd4 100644
+--- a/drivers/slimbus/qcom-ctrl.c
++++ b/drivers/slimbus/qcom-ctrl.c
+@@ -472,15 +472,10 @@ static void qcom_slim_rxwq(struct work_struct *work)
+ static void qcom_slim_prg_slew(struct platform_device *pdev,
+ 				struct qcom_slim_ctrl *ctrl)
+ {
+-	struct resource	*slew_mem;
+-
+ 	if (!ctrl->slew_reg) {
+ 		/* SLEW RATE register for this SLIMbus */
+-		slew_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+-				"slew");
+-		ctrl->slew_reg = devm_ioremap(&pdev->dev, slew_mem->start,
+-				resource_size(slew_mem));
+-		if (!ctrl->slew_reg)
++		ctrl->slew_reg = devm_platform_ioremap_resource_byname(pdev, "slew");
++		if (IS_ERR(ctrl->slew_reg))
+ 			return;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch b/queue-5.10/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch
new file mode 100644
index 00000000000..f9e50c08150
--- /dev/null
+++ b/queue-5.10/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch
@@ -0,0 +1,51 @@
+From f34f4984ea30ed163263d615b259a423b95b78e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:24:50 +0000
+Subject: slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]
+
+Attempting to send a power request during PM operations, when the QMI
+handle isn't initialized results in a NULL pointer dereference. So check
+if the QMI handle has been initialized before attempting to post the
+power requests.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 218aefc3531cd..50cfd67c2871e 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1205,6 +1205,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
+ 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ 	int ret = 0;
+ 
++	if (!ctrl->qmi.handle)
++		return 0;
++
+ 	if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
+ 		ret = qcom_slim_ngd_power_up(ctrl);
+ 	if (ret) {
+@@ -1503,6 +1506,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
+ 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ 	int ret = 0;
+ 
++	if (!ctrl->qmi.handle)
++		return 0;
++
+ 	ret = qcom_slim_qmi_power_request(ctrl, false);
+ 	if (ret && ret != -EBUSY)
+ 		dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
+-- 
+2.27.0
+
diff --git a/queue-5.10/smack-handle-io_uring-kernel-thread-privileges.patch b/queue-5.10/smack-handle-io_uring-kernel-thread-privileges.patch
new file mode 100644
index 00000000000..22e9de50489
--- /dev/null
+++ b/queue-5.10/smack-handle-io_uring-kernel-thread-privileges.patch
@@ -0,0 +1,43 @@
+From 7269f600fbd86b4587436994c64f1c288c944cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Dec 2020 15:34:24 -0800
+Subject: Smack: Handle io_uring kernel thread privileges
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit 942cb357ae7d9249088e3687ee6a00ed2745a0c7 ]
+
+Smack assumes that kernel threads are privileged for smackfs
+operations. This was necessary because the credential of the
+kernel thread was not related to a user operation. With io_uring
+the credential does reflect a user's rights and can be used.
+
+Suggested-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack_access.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index efe2406a39609..7eabb448acab4 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -688,9 +688,10 @@ bool smack_privileged_cred(int cap, const struct cred *cred)
+ bool smack_privileged(int cap)
+ {
+ 	/*
+-	 * All kernel tasks are privileged
++	 * Kernel threads may not have credentials we can use.
++	 * The io_uring kernel threads do have reliable credentials.
+ 	 */
+-	if (unlikely(current->flags & PF_KTHREAD))
++	if ((current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD)
+ 		return true;
+ 
+ 	return smack_privileged_cred(cap, current_cred());
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch b/queue-5.10/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch
new file mode 100644
index 00000000000..1ad11d55035
--- /dev/null
+++ b/queue-5.10/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch
@@ -0,0 +1,43 @@
+From 885ce654177a65d8354e263f18ba993021a16267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 09:13:22 +0800
+Subject: soc: amlogic: canvas: add missing put_device() call in
+ meson_canvas_get()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 28f851e6afa858f182802e23ac60c3ed7d1c04a1 ]
+
+if of_find_device_by_node() succeed, meson_canvas_get() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: 382f8be04551 ("soc: amlogic: canvas: Fix meson_canvas_get when probe failed")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20201117011322.522477-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/amlogic/meson-canvas.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c
+index c655f5f92b124..d0329ad170d13 100644
+--- a/drivers/soc/amlogic/meson-canvas.c
++++ b/drivers/soc/amlogic/meson-canvas.c
+@@ -72,8 +72,10 @@ struct meson_canvas *meson_canvas_get(struct device *dev)
+ 	 * current state, this driver probe cannot return -EPROBE_DEFER
+ 	 */
+ 	canvas = dev_get_drvdata(&canvas_pdev->dev);
+-	if (!canvas)
++	if (!canvas) {
++		put_device(&canvas_pdev->dev);
+ 		return ERR_PTR(-EINVAL);
++	}
+ 
+ 	return canvas;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-mediatek-check-if-power-domains-can-be-powered-o.patch b/queue-5.10/soc-mediatek-check-if-power-domains-can-be-powered-o.patch
new file mode 100644
index 00000000000..2fffde8b1f1
--- /dev/null
+++ b/queue-5.10/soc-mediatek-check-if-power-domains-can-be-powered-o.patch
@@ -0,0 +1,55 @@
+From 04db9a749c8822ee2502eea2841bb07a0feced4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 11:31:35 +0800
+Subject: soc: mediatek: Check if power domains can be powered on at boot time
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]
+
+In the error case, where a power domain cannot be powered on
+successfully at boot time (in mtk_register_power_domains),
+pm_genpd_init would still be called with is_off=false, and the
+system would later try to disable the power domain again, triggering
+warnings as disabled clocks are disabled again (and other potential
+issues).
+
+Also print a warning splat in that case, as this should never
+happen.
+
+Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
+index f669d3754627d..ca75b14931ec9 100644
+--- a/drivers/soc/mediatek/mtk-scpsys.c
++++ b/drivers/soc/mediatek/mtk-scpsys.c
+@@ -524,6 +524,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ 	for (i = 0; i < num; i++) {
+ 		struct scp_domain *scpd = &scp->domains[i];
+ 		struct generic_pm_domain *genpd = &scpd->genpd;
++		bool on;
+ 
+ 		/*
+ 		 * Initially turn on all domains to make the domains usable
+@@ -531,9 +532,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ 		 * software.  The unused domains will be switched off during
+ 		 * late_init time.
+ 		 */
+-		genpd->power_on(genpd);
++		on = !WARN_ON(genpd->power_on(genpd) < 0);
+ 
+-		pm_genpd_init(genpd, NULL, false);
++		pm_genpd_init(genpd, NULL, !on);
+ 	}
+ 
+ 	/*
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-qcom-geni-more-properly-switch-to-dma-mode.patch b/queue-5.10/soc-qcom-geni-more-properly-switch-to-dma-mode.patch
new file mode 100644
index 00000000000..7cbbeac3cef
--- /dev/null
+++ b/queue-5.10/soc-qcom-geni-more-properly-switch-to-dma-mode.patch
@@ -0,0 +1,107 @@
+From 583a35b78fd2750a25450361ce1b60d770dfc653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 14:25:28 -0700
+Subject: soc: qcom: geni: More properly switch to DMA mode
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ]
+
+On geni-i2c transfers using DMA, it was seen that if you program the
+command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
+cause interrupts to fire.  If we get unlucky, these interrupts can
+just keep firing (and not be handled) blocking further progress and
+hanging the system.
+
+In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
+we avoided that by making sure we didn't program the command until
+after geni_se_rx_dma_prep() was called.  While that avoided the
+problems, it also turns out to be invalid.  At least in the TX case we
+started seeing sporadic corrupted transfers.  This is easily seen by
+adding an msleep() between the DMA prep and the writing of the
+command, which makes the problem worse.  That means we need to revert
+that commit and find another way to fix the bogus IRQs.
+
+Specifically, after reverting commit 02b9aec59243 ("i2c:
+i2c-qcom-geni: Fix DMA transfer race"), I put some traces in.  I found
+that the when the interrupts were firing like crazy:
+- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
+- "dma" was set.
+
+Further debugging showed that I could make the problem happen more
+reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
+ran up until geni_se_rx_dma_prep() programmed the length.
+
+A rather simple fix is to change geni_se_select_dma_mode() so it's a
+true inverse of geni_se_select_fifo_mode() and disables all the FIFO
+related interrupts.  Now the problematic interrupts can't fire and we
+can program things in the correct order without worrying.
+
+As part of this, let's also change the writel_relaxed() in the prepare
+function to a writel() so that our DMA is guaranteed to be prepared
+now that we can't rely on geni_se_setup_m_cmd()'s writel().
+
+NOTE: the only current user of GENI_SE_DMA in mainline is i2c.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index d0e4f520cff8c..751a49f6534f4 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -289,10 +289,23 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
+ 
+ static void geni_se_select_dma_mode(struct geni_se *se)
+ {
++	u32 proto = geni_se_read_proto(se);
+ 	u32 val;
+ 
+ 	geni_se_irq_clear(se);
+ 
++	val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
++	if (proto != GENI_SE_UART) {
++		val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
++		val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
++	}
++	writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
++
++	val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
++	if (proto != GENI_SE_UART)
++		val &= ~S_CMD_DONE_EN;
++	writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
++
+ 	val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
+ 	val |= GENI_DMA_MODE_EN;
+ 	writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
+@@ -651,7 +664,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ 	writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
+ 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
+ 	writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
+-	writel_relaxed(len, se->base + SE_DMA_TX_LEN);
++	writel(len, se->base + SE_DMA_TX_LEN);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(geni_se_tx_dma_prep);
+@@ -688,7 +701,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
+ 	/* RX does not have EOT buffer type bit. So just reset RX_ATTR */
+ 	writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
+-	writel_relaxed(len, se->base + SE_DMA_RX_LEN);
++	writel(len, se->base + SE_DMA_RX_LEN);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(geni_se_rx_dma_prep);
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-qcom-initialize-local-variable.patch b/queue-5.10/soc-qcom-initialize-local-variable.patch
new file mode 100644
index 00000000000..aa18909060e
--- /dev/null
+++ b/queue-5.10/soc-qcom-initialize-local-variable.patch
@@ -0,0 +1,48 @@
+From bef150f706b4cfe510c624d3cd1c202dec712220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 11:46:37 -0700
+Subject: soc: qcom: initialize local variable
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit a161ffe4b877721d8917e18e70461d255a090f19 ]
+
+clang static analysis reports this problem
+
+pdr_interface.c:596:6: warning: Branch condition evaluates
+  to a garbage value
+        if (!req.service_path[0])
+            ^~~~~~~~~~~~~~~~~~~~
+
+This check that req.service_path was set in an earlier loop.
+However req is a stack variable and its initial value
+is undefined.
+
+So initialize req to 0.
+
+Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers")
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Signed-off-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20200819184637.15648-1-trix@redhat.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/pdr_interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c
+index 088dc99f77f3f..f63135c09667f 100644
+--- a/drivers/soc/qcom/pdr_interface.c
++++ b/drivers/soc/qcom/pdr_interface.c
+@@ -569,7 +569,7 @@ EXPORT_SYMBOL(pdr_add_lookup);
+ int pdr_restart_pd(struct pdr_handle *pdr, struct pdr_service *pds)
+ {
+ 	struct servreg_restart_pd_resp resp;
+-	struct servreg_restart_pd_req req;
++	struct servreg_restart_pd_req req = { 0 };
+ 	struct sockaddr_qrtr addr;
+ 	struct pdr_service *tmp;
+ 	struct qmi_txn txn;
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch b/queue-5.10/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch
new file mode 100644
index 00000000000..18a32dd9995
--- /dev/null
+++ b/queue-5.10/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch
@@ -0,0 +1,36 @@
+From f021f6b81d6acc59209624bb638c42391ca7d98f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Sep 2020 14:31:42 +0300
+Subject: soc: renesas: rmobile-sysc: Fix some leaks in
+ rmobile_init_pm_domains()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]
+
+This code needs to call iounmap() on one error path.
+
+Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/rmobile-sysc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/renesas/rmobile-sysc.c b/drivers/soc/renesas/rmobile-sysc.c
+index 54b616ad4a62a..beb1c7211c3d6 100644
+--- a/drivers/soc/renesas/rmobile-sysc.c
++++ b/drivers/soc/renesas/rmobile-sysc.c
+@@ -327,6 +327,7 @@ static int __init rmobile_init_pm_domains(void)
+ 
+ 		pmd = of_get_child_by_name(np, "pm-domains");
+ 		if (!pmd) {
++			iounmap(base);
+ 			pr_warn("%pOF lacks pm-domains node\n", np);
+ 			continue;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-rockchip-io-domain-fix-error-return-code-in-rock.patch b/queue-5.10/soc-rockchip-io-domain-fix-error-return-code-in-rock.patch
new file mode 100644
index 00000000000..1199bd29d7a
--- /dev/null
+++ b/queue-5.10/soc-rockchip-io-domain-fix-error-return-code-in-rock.patch
@@ -0,0 +1,38 @@
+From ab4a4a5337d8e75344eca8a085c79a2aafd03e08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:33:25 +0800
+Subject: soc: rockchip: io-domain: Fix error return code in
+ rockchip_iodomain_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit c2867b2e710fc85bb39c6f6e5948450c48e8a33e ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: e943c43b32ce ("PM: AVS: rockchip-io: Move the driver to the rockchip specific drivers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607070805-33038-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/rockchip/io-domain.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/rockchip/io-domain.c b/drivers/soc/rockchip/io-domain.c
+index eece97f97ef8f..b29e829e815e5 100644
+--- a/drivers/soc/rockchip/io-domain.c
++++ b/drivers/soc/rockchip/io-domain.c
+@@ -547,6 +547,7 @@ static int rockchip_iodomain_probe(struct platform_device *pdev)
+ 		if (uV < 0) {
+ 			dev_err(iod->dev, "Can't determine voltage: %s\n",
+ 				supply_name);
++			ret = uV;
+ 			goto unreg_notify;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch b/queue-5.10/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch
new file mode 100644
index 00000000000..ed49db58a9e
--- /dev/null
+++ b/queue-5.10/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch
@@ -0,0 +1,73 @@
+From 323bf6aee4c8ce5f0d969b4b5b0acd2b8396aa6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:37 -0800
+Subject: soc: ti: Fix reference imbalance in knav_dma_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]
+
+The patch fix two reference leak.
+
+  1) pm_runtime_get_sync will increment pm usage counter even it
+     failed. Forgetting to call put operation will result in
+     reference leak.
+
+  2) The pm_runtime_enable will increase power disable depth. Thus
+     a pairing decrement is needed on the error handling path to
+     keep it balanced.
+
+We fix it by: 1) adding call pm_runtime_put_noidle or
+pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
+in error handling, to keep usage counter and disable depth balanced.
+
+Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_dma.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
+index 8c863ecb1c605..56597f6ea666a 100644
+--- a/drivers/soc/ti/knav_dma.c
++++ b/drivers/soc/ti/knav_dma.c
+@@ -749,8 +749,9 @@ static int knav_dma_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(kdev->dev);
+ 	ret = pm_runtime_get_sync(kdev->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(kdev->dev);
+ 		dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
+-		return ret;
++		goto err_pm_disable;
+ 	}
+ 
+ 	/* Initialise all packet dmas */
+@@ -764,7 +765,8 @@ static int knav_dma_probe(struct platform_device *pdev)
+ 
+ 	if (list_empty(&kdev->list)) {
+ 		dev_err(dev, "no valid dma instance\n");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto err_put_sync;
+ 	}
+ 
+ 	debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
+@@ -772,6 +774,13 @@ static int knav_dma_probe(struct platform_device *pdev)
+ 
+ 	device_ready = true;
+ 	return ret;
++
++err_put_sync:
++	pm_runtime_put_sync(kdev->dev);
++err_pm_disable:
++	pm_runtime_disable(kdev->dev);
++
++	return ret;
+ }
+ 
+ static int knav_dma_remove(struct platform_device *pdev)
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch b/queue-5.10/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch
new file mode 100644
index 00000000000..38023ec8648
--- /dev/null
+++ b/queue-5.10/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch
@@ -0,0 +1,36 @@
+From 570a89c0e7053af8df5f9f6b377dcdad7a38133c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:00 -0800
+Subject: soc: ti: knav_qmss: fix reference leak in knav_queue_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in knav_queue_probe, so we should fix it.
+
+Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_qmss_queue.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index a460f201bf8e7..54afa8f7f4087 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -1784,6 +1784,7 @@ static int knav_queue_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(&pdev->dev);
+ 		dev_err(dev, "Failed to enable QMSS\n");
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/soc-ti-omap-prm-do-not-check-rstst-bit-on-deassert-i.patch b/queue-5.10/soc-ti-omap-prm-do-not-check-rstst-bit-on-deassert-i.patch
new file mode 100644
index 00000000000..7c7f4128a73
--- /dev/null
+++ b/queue-5.10/soc-ti-omap-prm-do-not-check-rstst-bit-on-deassert-i.patch
@@ -0,0 +1,39 @@
+From 2c2cf73dfad6357736ee58bdce7be0b122b992c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 12:57:13 +0200
+Subject: soc: ti: omap-prm: Do not check rstst bit on deassert if already
+ deasserted
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit c1995e5afaf6abf3922b5395ad1f4096951e3276 ]
+
+If a rstctrl reset bit is already deasserted, we can just bail out early
+not wait for rstst to clear. Otherwise we can have deassert fail for
+already deasserted resets.
+
+Fixes: c5117a78dd88 ("soc: ti: omap-prm: poll for reset complete during de-assert")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/omap_prm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
+index 980b04c38fd94..4d41dc3cdce1f 100644
+--- a/drivers/soc/ti/omap_prm.c
++++ b/drivers/soc/ti/omap_prm.c
+@@ -484,6 +484,10 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,
+ 	struct ti_prm_platform_data *pdata = dev_get_platdata(reset->dev);
+ 	int ret = 0;
+ 
++	/* Nothing to do if the reset is already deasserted */
++	if (!omap_reset_status(rcdev, id))
++		return 0;
++
+ 	has_rstst = reset->prm->data->rstst ||
+ 		(reset->prm->data->flags & OMAP_PRM_HAS_RSTST);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/soundwire-fix-debug_locks_warn_on-for-uninitialized-.patch b/queue-5.10/soundwire-fix-debug_locks_warn_on-for-uninitialized-.patch
new file mode 100644
index 00000000000..27cf00c2456
--- /dev/null
+++ b/queue-5.10/soundwire-fix-debug_locks_warn_on-for-uninitialized-.patch
@@ -0,0 +1,83 @@
+From 4e82632c81a11dd384a891606310a57907e36e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 11:29:41 +0000
+Subject: soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit e6db818a3f51781ba12ac4d52b8773f74d57b06b ]
+
+running kernel with CONFIG_DEBUG_LOCKS_ALLOC enabled will below warning:
+
+BUG: key ffff502e09807098 has not been registered!
+DEBUG_LOCKS_WARN_ON(1)
+WARNING: CPU: 5 PID: 129 at kernel/locking/lockdep.c:4623
+	lockdep_init_map_waits+0xe8/0x250
+Modules linked in:
+CPU: 5 PID: 129 Comm: kworker/5:1 Tainted: G
+       W         5.10.0-rc1-00277-ged49f224ca3f-dirty #1210
+Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+Workqueue: events deferred_probe_work_func
+pstate: 80c00005 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
+pc : lockdep_init_map_waits+0xe8/0x250
+lr : lockdep_init_map_waits+0xe8/0x250
+ [ Trimmed ]
+
+Call trace:
+ lockdep_init_map_waits+0xe8/0x250
+ __kernfs_create_file+0x78/0x180
+ sysfs_add_file_mode_ns+0x94/0x1c8
+ internal_create_group+0x110/0x3e0
+ sysfs_create_group+0x18/0x28
+ devm_device_add_group+0x4c/0xb0
+ add_all_attributes+0x438/0x490
+ sdw_slave_sysfs_dpn_init+0x128/0x138
+ sdw_slave_sysfs_init+0x80/0xa0
+ sdw_drv_probe+0x94/0x170
+ really_probe+0x118/0x3e0
+ driver_probe_device+0x5c/0xc0
+
+ [ Trimmed ]
+
+CPU: 5 PID: 129 Comm: kworker/5:1 Tainted: G
+     W         5.10.0-rc1-00277-ged49f224ca3f-dirty #1210
+Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+Workqueue: events deferred_probe_work_func
+Call trace:
+ dump_backtrace+0x0/0x1c0
+ show_stack+0x18/0x68
+ dump_stack+0xd8/0x134
+ __warn+0xa0/0x158
+ report_bug+0xc8/0x178
+ bug_handler+0x20/0x78
+ brk_handler+0x70/0xc8
+
+[ Trimmed ]
+
+Fix this by initializing dynamically allocated sysfs attribute to keep lockdep happy!
+
+Fixes: bcac59029955 ("soundwire: add Slave sysfs support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20201104112941.1134-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/sysfs_slave_dpn.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/sysfs_slave_dpn.c b/drivers/soundwire/sysfs_slave_dpn.c
+index 05a721ea9830a..c4b6543c09fd6 100644
+--- a/drivers/soundwire/sysfs_slave_dpn.c
++++ b/drivers/soundwire/sysfs_slave_dpn.c
+@@ -37,6 +37,7 @@ static int field##_attribute_alloc(struct device *dev,			\
+ 		return -ENOMEM;						\
+ 	dpn_attr->N = N;						\
+ 	dpn_attr->dir = dir;						\
++	sysfs_attr_init(&dpn_attr->dev_attr.attr);			\
+ 	dpn_attr->format_string = format_string;			\
+ 	dpn_attr->dev_attr.attr.name = __stringify(field);		\
+ 	dpn_attr->dev_attr.attr.mode = 0444;				\
+-- 
+2.27.0
+
diff --git a/queue-5.10/soundwire-master-use-pm_runtime_set_active-on-add.patch b/queue-5.10/soundwire-master-use-pm_runtime_set_active-on-add.patch
new file mode 100644
index 00000000000..6454071be6a
--- /dev/null
+++ b/queue-5.10/soundwire-master-use-pm_runtime_set_active-on-add.patch
@@ -0,0 +1,75 @@
+From 64d6f59258c9b67f5ffdeda7d1c4415bd348ec32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 21:07:42 +0800
+Subject: soundwire: master: use pm_runtime_set_active() on add
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit e04e60fce47e61743a8726d76b0149c1f4ad8957 ]
+
+The 'master' device acts as a glue layer used during bus
+initialization only, and it needs to be 'transparent' for pm_runtime
+management. Its behavior should be that it becomes active when one of
+its children becomes active, and suspends when all of its children are
+suspended.
+
+In our tests on Intel platforms, we routinely see these sort of
+warnings on the initial boot:
+
+[ 21.447345] rt715 sdw:3:25d:715:0: runtime PM trying to activate
+child device sdw:3:25d:715:0 but parent (sdw-master-3) is not active
+
+This is root-caused to a missing setup to make the device 'active' on
+probe. Since we don't want the device to remain active forever after
+the probe, the autosuspend configuration is also enabled at the end of
+the probe - the device will actually autosuspend only in the case
+where there are no devices physically attached. In practice, the
+master device will suspend when all its children are no longer active.
+
+Fixes: bd84256e86ecf ('soundwire: master: enable pm runtime')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20201124130742.10986-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/master.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/soundwire/master.c b/drivers/soundwire/master.c
+index 3488bb824e845..9b05c9e25ebe4 100644
+--- a/drivers/soundwire/master.c
++++ b/drivers/soundwire/master.c
+@@ -8,6 +8,15 @@
+ #include <linux/soundwire/sdw_type.h>
+ #include "bus.h"
+ 
++/*
++ * The 3s value for autosuspend will only be used if there are no
++ * devices physically attached on a bus segment. In practice enabling
++ * the bus operation will result in children devices become active and
++ * the master device will only suspend when all its children are no
++ * longer active.
++ */
++#define SDW_MASTER_SUSPEND_DELAY_MS 3000
++
+ /*
+  * The sysfs for properties reflects the MIPI description as given
+  * in the MIPI DisCo spec
+@@ -154,7 +163,12 @@ int sdw_master_device_add(struct sdw_bus *bus, struct device *parent,
+ 	bus->dev = &md->dev;
+ 	bus->md = md;
+ 
++	pm_runtime_set_autosuspend_delay(&bus->md->dev, SDW_MASTER_SUSPEND_DELAY_MS);
++	pm_runtime_use_autosuspend(&bus->md->dev);
++	pm_runtime_mark_last_busy(&bus->md->dev);
++	pm_runtime_set_active(&bus->md->dev);
+ 	pm_runtime_enable(&bus->md->dev);
++	pm_runtime_idle(&bus->md->dev);
+ device_register_err:
+ 	return ret;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/soundwire-qcom-fix-build-failure-when-slimbus-is-mod.patch b/queue-5.10/soundwire-qcom-fix-build-failure-when-slimbus-is-mod.patch
new file mode 100644
index 00000000000..710e81aadc8
--- /dev/null
+++ b/queue-5.10/soundwire-qcom-fix-build-failure-when-slimbus-is-mod.patch
@@ -0,0 +1,48 @@
+From a6fb1bac369ffc4340611644cc89849f2723cafd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 11:21:55 +0530
+Subject: soundwire: qcom: Fix build failure when slimbus is module
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit 47edc0104c61d609b0898a302267b7269d87a6af ]
+
+Commit 5bd773242f75 ("soundwire: qcom: avoid dependency on
+CONFIG_SLIMBUS") removed hard dependency on Slimbus for qcom driver but
+it results in build failure when: CONFIG_SOUNDWIRE_QCOM=y
+CONFIG_SLIMBUS=m
+
+drivers/soundwire/qcom.o: In function `qcom_swrm_probe':
+qcom.c:(.text+0xf44): undefined reference to `slimbus_bus'
+
+Fix this by using IS_REACHABLE() in driver which is recommended to be
+used with imply.
+
+Fixes: 5bd773242f75 ("soundwire: qcom: avoid dependency on CONFIG_SLIMBUS")
+Reported-by: kernel test robot <lkp@intel.com>
+Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Link: https://lore.kernel.org/r/20201125055155.GD8403@vkoul-mobl
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
+index fbca4ebf63e92..6d22df01f3547 100644
+--- a/drivers/soundwire/qcom.c
++++ b/drivers/soundwire/qcom.c
+@@ -799,7 +799,7 @@ static int qcom_swrm_probe(struct platform_device *pdev)
+ 	data = of_device_get_match_data(dev);
+ 	ctrl->rows_index = sdw_find_row_index(data->default_rows);
+ 	ctrl->cols_index = sdw_find_col_index(data->default_cols);
+-#if IS_ENABLED(CONFIG_SLIMBUS)
++#if IS_REACHABLE(CONFIG_SLIMBUS)
+ 	if (dev->parent->bus == &slimbus_bus) {
+ #else
+ 	if (false) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/sparc-fix-handling-of-page-table-constructor-failure.patch b/queue-5.10/sparc-fix-handling-of-page-table-constructor-failure.patch
new file mode 100644
index 00000000000..e09e1f9131a
--- /dev/null
+++ b/queue-5.10/sparc-fix-handling-of-page-table-constructor-failure.patch
@@ -0,0 +1,43 @@
+From 4f944e5395f7e4655fc17cd5d9e96aaead14241a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 19:07:59 -0800
+Subject: sparc: fix handling of page table constructor failure
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 06517c9a336f4c20f2064611bf4b1e7881a95fe1 ]
+
+The page has just been allocated, so its refcount is 1.  free_unref_page()
+is for use on pages which have a zero refcount.  Use __free_page() like
+the other implementations of pte_alloc_one().
+
+Link: https://lkml.kernel.org/r/20201125034655.27687-1-willy@infradead.org
+Fixes: 1ae9ae5f7df7 ("sparc: handle pgtable_page_ctor() fail")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Miller <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/mm/init_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 96edf64d4fb30..182bb7bdaa0a1 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -2894,7 +2894,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm)
+ 	if (!page)
+ 		return NULL;
+ 	if (!pgtable_pte_page_ctor(page)) {
+-		free_unref_page(page);
++		__free_page(page);
+ 		return NULL;
+ 	}
+ 	return (pte_t *) page_address(page);
+-- 
+2.27.0
+
diff --git a/queue-5.10/speakup-fix-uninitialized-flush_lock.patch b/queue-5.10/speakup-fix-uninitialized-flush_lock.patch
new file mode 100644
index 00000000000..c7f387340ec
--- /dev/null
+++ b/queue-5.10/speakup-fix-uninitialized-flush_lock.patch
@@ -0,0 +1,39 @@
+From ae94431c919407ce7879d8508b63e82eef145442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 09:22:29 +0800
+Subject: speakup: fix uninitialized flush_lock
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]
+
+The flush_lock is uninitialized, use DEFINE_SPINLOCK
+to define and initialize flush_lock.
+
+Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accessibility/speakup/speakup_dectlk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accessibility/speakup/speakup_dectlk.c b/drivers/accessibility/speakup/speakup_dectlk.c
+index 780214b5ca16e..ab6d61e80b1cb 100644
+--- a/drivers/accessibility/speakup/speakup_dectlk.c
++++ b/drivers/accessibility/speakup/speakup_dectlk.c
+@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);
+ static int in_escape;
+ static int is_flushing;
+ 
+-static spinlock_t flush_lock;
++static DEFINE_SPINLOCK(flush_lock);
+ static DECLARE_WAIT_QUEUE_HEAD(flush);
+ 
+ static struct var_t vars[] = {
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch b/queue-5.10/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch
new file mode 100644
index 00000000000..85c42a0dd81
--- /dev/null
+++ b/queue-5.10/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch
@@ -0,0 +1,42 @@
+From 8562cc4f184d13226c9f61d60549ede05edd86d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 15:49:11 +0800
+Subject: spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in
+ bcm63xx_hsspi_resume
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]
+
+Fix the missing clk_disable_unprepare() before return
+from bcm63xx_hsspi_resume in the error handling case when
+fails to prepare and enable bs->pll_clk.
+
+Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx-hsspi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index 9909b18f3c5a5..1f08d7553f079 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -494,8 +494,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
+ 
+ 	if (bs->pll_clk) {
+ 		ret = clk_prepare_enable(bs->pll_clk);
+-		if (ret)
++		if (ret) {
++			clk_disable_unprepare(bs->clk);
+ 			return ret;
++		}
+ 	}
+ 
+ 	spi_master_resume(master);
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-dw-fix-build-error-by-selecting-multiplexer.patch b/queue-5.10/spi-dw-fix-build-error-by-selecting-multiplexer.patch
new file mode 100644
index 00000000000..52ba591c0fe
--- /dev/null
+++ b/queue-5.10/spi-dw-fix-build-error-by-selecting-multiplexer.patch
@@ -0,0 +1,44 @@
+From 6e93925f85991f2f4280c989562f5b9b3d419b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 20:07:21 -0800
+Subject: spi: dw: fix build error by selecting MULTIPLEXER
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 1241f0787578136ab58f49adc52f2dcd2bbc4bf2 ]
+
+Fix build error for spi-dw-bt1.o by selecting MULTIPLEXER.
+
+hppa-linux-ld: drivers/spi/spi-dw-bt1.o: in function `dw_spi_bt1_sys_init':
+(.text+0x1ac): undefined reference to `devm_mux_control_get'
+
+Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Serge Semin <Sergey.Semin@baikalelectronics.ru>
+Cc: Ramil Zaripov <Ramil.Zaripov@baikalelectronics.ru>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: linux-spi@vger.kernel.org
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/20201116040721.8001-1-rdunlap@infradead.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 5cff60de8e834..3fd16b7f61507 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -255,6 +255,7 @@ config SPI_DW_MMIO
+ config SPI_DW_BT1
+ 	tristate "Baikal-T1 SPI driver for DW SPI core"
+ 	depends on MIPS_BAIKAL_T1 || COMPILE_TEST
++	select MULTIPLEXER
+ 	help
+ 	  Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI
+ 	  controllers. Two of them are pretty much normal: with IRQ, DMA,
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-dw-fix-error-return-code-in-dw_spi_bt1_probe.patch b/queue-5.10/spi-dw-fix-error-return-code-in-dw_spi_bt1_probe.patch
new file mode 100644
index 00000000000..bc7220e3fbe
--- /dev/null
+++ b/queue-5.10/spi-dw-fix-error-return-code-in-dw_spi_bt1_probe.patch
@@ -0,0 +1,42 @@
+From 75ab3c798e94b39871e00c815f4745dcf73c7105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:42:37 +0800
+Subject: spi: dw: Fix error return code in dw_spi_bt1_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit e748edd9841306908b4e02dddd0afd1aa1f8b973 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/1607071357-33378-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw-bt1.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-dw-bt1.c b/drivers/spi/spi-dw-bt1.c
+index f382dfad78421..c279b7891e3ac 100644
+--- a/drivers/spi/spi-dw-bt1.c
++++ b/drivers/spi/spi-dw-bt1.c
+@@ -280,8 +280,10 @@ static int dw_spi_bt1_probe(struct platform_device *pdev)
+ 	dws->bus_num = pdev->id;
+ 	dws->reg_io_width = 4;
+ 	dws->max_freq = clk_get_rate(dwsbt1->clk);
+-	if (!dws->max_freq)
++	if (!dws->max_freq) {
++		ret = -EINVAL;
+ 		goto err_disable_clk;
++	}
+ 
+ 	init_func = device_get_match_data(&pdev->dev);
+ 	ret = init_func(pdev, dwsbt1);
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch b/queue-5.10/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch
new file mode 100644
index 00000000000..e7df5faf8d2
--- /dev/null
+++ b/queue-5.10/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch
@@ -0,0 +1,80 @@
+From 951c8eecc1ecc69e4c76024ab805dc4168110f44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 17:16:02 +0100
+Subject: spi: fix resource leak for drivers without .remove callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]
+
+Consider an spi driver with a .probe but without a .remove callback (e.g.
+rtc-ds1347). The function spi_drv_probe() is called to bind a device and
+so dev_pm_domain_attach() is called. As there is no remove callback
+spi_drv_remove() isn't called at unbind time however and so calling
+dev_pm_domain_detach() is missed and the pm domain keeps active.
+
+To fix this always use both spi_drv_probe() and spi_drv_remove() and
+make them handle the respective callback not being set. This has the
+side effect that for a (hypothetical) driver that has neither .probe nor
+remove the clk and pm domain setup is done.
+
+Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index fc9a59788d2ea..2eaa7dbb70108 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -405,9 +405,11 @@ static int spi_drv_probe(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = sdrv->probe(spi);
+-	if (ret)
+-		dev_pm_domain_detach(dev, true);
++	if (sdrv->probe) {
++		ret = sdrv->probe(spi);
++		if (ret)
++			dev_pm_domain_detach(dev, true);
++	}
+ 
+ 	return ret;
+ }
+@@ -415,9 +417,10 @@ static int spi_drv_probe(struct device *dev)
+ static int spi_drv_remove(struct device *dev)
+ {
+ 	const struct spi_driver		*sdrv = to_spi_driver(dev->driver);
+-	int ret;
++	int ret = 0;
+ 
+-	ret = sdrv->remove(to_spi_device(dev));
++	if (sdrv->remove)
++		ret = sdrv->remove(to_spi_device(dev));
+ 	dev_pm_domain_detach(dev, true);
+ 
+ 	return ret;
+@@ -442,10 +445,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
+ {
+ 	sdrv->driver.owner = owner;
+ 	sdrv->driver.bus = &spi_bus_type;
+-	if (sdrv->probe)
+-		sdrv->driver.probe = spi_drv_probe;
+-	if (sdrv->remove)
+-		sdrv->driver.remove = spi_drv_remove;
++	sdrv->driver.probe = spi_drv_probe;
++	sdrv->driver.remove = spi_drv_remove;
+ 	if (sdrv->shutdown)
+ 		sdrv->driver.shutdown = spi_drv_shutdown;
+ 	return driver_register(&sdrv->driver);
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch b/queue-5.10/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch
new file mode 100644
index 00000000000..9436ac847cb
--- /dev/null
+++ b/queue-5.10/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch
@@ -0,0 +1,41 @@
+From 942735419c200c60afc636b51c3cd1d46ff4d659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:56:51 +0800
+Subject: spi: img-spfi: fix reference leak in img_spfi_resume
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in img_spfi_resume, so we should fix it.
+
+Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-img-spfi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index b068537375d60..5f05d519fbbd0 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -731,8 +731,10 @@ static int img_spfi_resume(struct device *dev)
+ 	int ret;
+ 
+ 	ret = pm_runtime_get_sync(dev);
+-	if (ret)
++	if (ret) {
++		pm_runtime_put_noidle(dev);
+ 		return ret;
++	}
+ 	spfi_reset(spfi);
+ 	pm_runtime_put(dev);
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-imx-fix-reference-leak-in-two-imx-operations.patch b/queue-5.10/spi-imx-fix-reference-leak-in-two-imx-operations.patch
new file mode 100644
index 00000000000..fb5fc5995f6
--- /dev/null
+++ b/queue-5.10/spi-imx-fix-reference-leak-in-two-imx-operations.patch
@@ -0,0 +1,46 @@
+From 4398dce735aa7f8df6b8062db20b1bc1cb390c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:58:35 +0800
+Subject: spi: imx: fix reference leak in two imx operations
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 1dcbdd944824369d4569959f8130336fe6fe5f39 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in callers(spi_imx_prepare_message and
+spi_imx_remove), so we should fix it.
+
+Fixes: 525c9e5a32bd7 ("spi: imx: enable runtime pm support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102145835.4765-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 0b597905ee72c..8df5e973404f0 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1538,6 +1538,7 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+ 
+ 	ret = pm_runtime_get_sync(spi_imx->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(spi_imx->dev);
+ 		dev_err(spi_imx->dev, "failed to enable clock\n");
+ 		return ret;
+ 	}
+@@ -1748,6 +1749,7 @@ static int spi_imx_remove(struct platform_device *pdev)
+ 
+ 	ret = pm_runtime_get_sync(spi_imx->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(spi_imx->dev);
+ 		dev_err(spi_imx->dev, "failed to enable clock\n");
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch b/queue-5.10/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch
new file mode 100644
index 00000000000..18df4fec33d
--- /dev/null
+++ b/queue-5.10/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch
@@ -0,0 +1,45 @@
+From 04a4bc9a0077485a4a1ef031e834342386ace82e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 15:49:12 +0800
+Subject: spi: mt7621: fix missing clk_disable_unprepare() on error in
+ mt7621_spi_probe
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 702b15cb97123cedcec56a39d9a21c5288eb9ae1 ]
+
+Fix the missing clk_disable_unprepare() before return
+from mt7621_spi_probe in the error handling case.
+
+Fixes: cbd66c626e16 ("spi: mt7621: Move SPI driver out of staging")
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201103074912.195576-1-miaoqinglang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt7621.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c
+index 2c3b7a2a1ec77..2cdae7994e2aa 100644
+--- a/drivers/spi/spi-mt7621.c
++++ b/drivers/spi/spi-mt7621.c
+@@ -353,6 +353,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ 	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
+ 	if (!master) {
+ 		dev_info(&pdev->dev, "master allocation failed\n");
++		clk_disable_unprepare(clk);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -377,6 +378,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ 	ret = device_reset(&pdev->dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "SPI reset failed!\n");
++		clk_disable_unprepare(clk);
+ 		return ret;
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch b/queue-5.10/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch
new file mode 100644
index 00000000000..78271bee2d2
--- /dev/null
+++ b/queue-5.10/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch
@@ -0,0 +1,37 @@
+From 329dd5749fe8ee8d901f6a6a9cd0ff6ae58efcb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 09:24:21 +0800
+Subject: spi: mxs: fix reference leak in mxs_spi_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in mxs_spi_probe, so we should fix it.
+
+Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mxs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
+index 918918a9e0491..435309b09227e 100644
+--- a/drivers/spi/spi-mxs.c
++++ b/drivers/spi/spi-mxs.c
+@@ -607,6 +607,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
+ 
+ 	ret = pm_runtime_get_sync(ssp->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(ssp->dev);
+ 		dev_err(ssp->dev, "runtime_get_sync failed\n");
+ 		goto out_pm_runtime_disable;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-spi-fsl-dspi-use-max_native_cs-instead-of-num_ch.patch b/queue-5.10/spi-spi-fsl-dspi-use-max_native_cs-instead-of-num_ch.patch
new file mode 100644
index 00000000000..05a8f6b0863
--- /dev/null
+++ b/queue-5.10/spi-spi-fsl-dspi-use-max_native_cs-instead-of-num_ch.patch
@@ -0,0 +1,57 @@
+From 6f956540feddb5fd9ee633591a873ba954f6f33e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 11:59:16 +0300
+Subject: spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set
+ SPI_MCR
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit 2c2b3ad2c4c801bab1eec7264ea6991b1e4e8f2c ]
+
+If cs-gpios property is used in devicetree then ctlr->num_chipselect value
+may be changed by spi_get_gpio_descs().
+So use ctlr->max_native_cs instead of ctlr->num_chipselect to set SPI_MCR
+
+Fixes: 4fcc7c2292de (spi: spi-fsl-dspi: Don't access reserved fields in SPI_MCR)
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Link: https://lore.kernel.org/r/20201201085916.63543-1-fido_max@inbox.ru
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 1a08c1d584abe..0287366874882 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1165,7 +1165,7 @@ static int dspi_init(struct fsl_dspi *dspi)
+ 	unsigned int mcr;
+ 
+ 	/* Set idle states for all chip select signals to high */
+-	mcr = SPI_MCR_PCSIS(GENMASK(dspi->ctlr->num_chipselect - 1, 0));
++	mcr = SPI_MCR_PCSIS(GENMASK(dspi->ctlr->max_native_cs - 1, 0));
+ 
+ 	if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+ 		mcr |= SPI_MCR_XSPI;
+@@ -1250,7 +1250,7 @@ static int dspi_probe(struct platform_device *pdev)
+ 
+ 	pdata = dev_get_platdata(&pdev->dev);
+ 	if (pdata) {
+-		ctlr->num_chipselect = pdata->cs_num;
++		ctlr->num_chipselect = ctlr->max_native_cs = pdata->cs_num;
+ 		ctlr->bus_num = pdata->bus_num;
+ 
+ 		/* Only Coldfire uses platform data */
+@@ -1263,7 +1263,7 @@ static int dspi_probe(struct platform_device *pdev)
+ 			dev_err(&pdev->dev, "can't get spi-num-chipselects\n");
+ 			goto out_ctlr_put;
+ 		}
+-		ctlr->num_chipselect = cs_num;
++		ctlr->num_chipselect = ctlr->max_native_cs = cs_num;
+ 
+ 		of_property_read_u32(np, "bus-num", &bus_num);
+ 		ctlr->bus_num = bus_num;
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch b/queue-5.10/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch
new file mode 100644
index 00000000000..3585be028e7
--- /dev/null
+++ b/queue-5.10/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch
@@ -0,0 +1,37 @@
+From eae2e620f9f4b299fd34582c233251bb8f074e74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:09:10 +0800
+Subject: spi: spi-mem: fix reference leak in spi_mem_access_start
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit c02bb16b0e826bf0e19aa42c3ae60ea339f32cf5 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in spi_mem_access_start, so we should fix it.
+
+Fixes: f86c24f479530 ("spi: spi-mem: Split spi_mem_exec_op() code")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103140910.3482-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index ef53290b7d24d..4682f49dc7330 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -243,6 +243,7 @@ static int spi_mem_access_start(struct spi_mem *mem)
+ 
+ 		ret = pm_runtime_get_sync(ctlr->dev.parent);
+ 		if (ret < 0) {
++			pm_runtime_put_noidle(ctlr->dev.parent);
+ 			dev_err(&ctlr->dev, "Failed to power device: %d\n",
+ 				ret);
+ 			return ret;
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch b/queue-5.10/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch
new file mode 100644
index 00000000000..38dc63655dd
--- /dev/null
+++ b/queue-5.10/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch
@@ -0,0 +1,37 @@
+From 23c0a0e504708df1a75ae155883045fdfc8aecab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:09:47 +0800
+Subject: spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in ti_qspi_setup, so we should fix it.
+
+Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-ti-qspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 3c41649698a5b..9417385c09217 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -174,6 +174,7 @@ static int ti_qspi_setup(struct spi_device *spi)
+ 
+ 	ret = pm_runtime_get_sync(qspi->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(qspi->dev);
+ 		dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch b/queue-5.10/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch
new file mode 100644
index 00000000000..d6e13307f63
--- /dev/null
+++ b/queue-5.10/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch
@@ -0,0 +1,38 @@
+From aacb190ead919d9d73dd3f6b14de861b18ca0f28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 09:50:35 +0800
+Subject: spi: sprd: fix reference leak in sprd_spi_remove
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit e4062765bc2a41e025e29dd56bad798505036427 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in sprd_spi_remove, so we should fix it.
+
+Fixes: e7d973a31c24b ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Link: https://lore.kernel.org/r/20201106015035.139574-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sprd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c
+index 635738f54c731..b41a75749b498 100644
+--- a/drivers/spi/spi-sprd.c
++++ b/drivers/spi/spi-sprd.c
+@@ -1010,6 +1010,7 @@ static int sprd_spi_remove(struct platform_device *pdev)
+ 
+ 	ret = pm_runtime_get_sync(ss->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(ss->dev);
+ 		dev_err(ss->dev, "failed to resume SPI controller\n");
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch b/queue-5.10/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch
new file mode 100644
index 00000000000..8dde62276a1
--- /dev/null
+++ b/queue-5.10/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch
@@ -0,0 +1,38 @@
+From f82b8fb1f150724dd3e03f2a03585bd840da6104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 09:52:17 +0800
+Subject: spi: stm32: fix reference leak in stm32_spi_resume
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 900ccdcb79bb61471df1566a70b2b39687a628d5 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in stm32_spi_resume, so we should fix it.
+
+Fixes: db96bf976a4fc ("spi: stm32: fixes suspend/resume management")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/20201106015217.140476-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 2cc850eb8922d..471dedf3d3392 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -2062,6 +2062,7 @@ static int stm32_spi_resume(struct device *dev)
+ 
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
+ 		dev_err(dev, "Unable to power device:%d\n", ret);
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-stm32-qspi-fix-reference-leak-in-stm32-qspi-oper.patch b/queue-5.10/spi-stm32-qspi-fix-reference-leak-in-stm32-qspi-oper.patch
new file mode 100644
index 00000000000..435c26a410d
--- /dev/null
+++ b/queue-5.10/spi-stm32-qspi-fix-reference-leak-in-stm32-qspi-oper.patch
@@ -0,0 +1,55 @@
+From eab54ae6319c9f65801f0a8717dbee4a95ba57d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 09:53:57 +0800
+Subject: spi: stm32-qspi: fix reference leak in stm32 qspi operations
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 88e1419b5ee30cc50e0c4d5265bdee1ba04af539 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in two callers(stm32_qspi_exec_op and
+stm32_qspi_setup), so we should fix it.
+
+Fixes: 9d282c17b023a ("spi: stm32-qspi: Add pm_runtime support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@st.com>
+Link: https://lore.kernel.org/r/20201106015357.141235-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-qspi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
+index a900962b4336e..947e6b9dc9f4d 100644
+--- a/drivers/spi/spi-stm32-qspi.c
++++ b/drivers/spi/spi-stm32-qspi.c
+@@ -434,8 +434,10 @@ static int stm32_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ 	int ret;
+ 
+ 	ret = pm_runtime_get_sync(qspi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(qspi->dev);
+ 		return ret;
++	}
+ 
+ 	mutex_lock(&qspi->lock);
+ 	ret = stm32_qspi_send(mem, op);
+@@ -462,8 +464,10 @@ static int stm32_qspi_setup(struct spi_device *spi)
+ 		return -EINVAL;
+ 
+ 	ret = pm_runtime_get_sync(qspi->dev);
+-	if (ret < 0)
++	if (ret < 0) {
++		pm_runtime_put_noidle(qspi->dev);
+ 		return ret;
++	}
+ 
+ 	presc = DIV_ROUND_UP(qspi->clk_rate, spi->max_speed_hz) - 1;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch b/queue-5.10/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch
new file mode 100644
index 00000000000..60ae9fd1b94
--- /dev/null
+++ b/queue-5.10/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch
@@ -0,0 +1,46 @@
+From db5e11c6e74b2965005b22f7bbd95f3e818289ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:06 +0800
+Subject: spi: tegra114: fix reference leak in tegra spi ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in two callers(tegra_spi_setup and
+tegra_spi_resume), so we should fix it.
+
+Fixes: f333a331adfac ("spi/tegra114: add spi driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index ca6886aaa5197..a2e5907276e7f 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -966,6 +966,7 @@ static int tegra_spi_setup(struct spi_device *spi)
+ 
+ 	ret = pm_runtime_get_sync(tspi->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(tspi->dev);
+ 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ 		if (cdata)
+ 			tegra_spi_cleanup(spi);
+@@ -1474,6 +1475,7 @@ static int tegra_spi_resume(struct device *dev)
+ 
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
+ 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch b/queue-5.10/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch
new file mode 100644
index 00000000000..875444949db
--- /dev/null
+++ b/queue-5.10/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch
@@ -0,0 +1,37 @@
+From a85f905d95a5a31dfbdfc5a9d1d9acf1879b788a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:23 +0800
+Subject: spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in tegra_sflash_resume, so we should fix it.
+
+Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-sflash.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index b59015c7c8a80..cfb7de7379376 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -552,6 +552,7 @@ static int tegra_sflash_resume(struct device *dev)
+ 
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
+ 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch b/queue-5.10/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch
new file mode 100644
index 00000000000..37debb0e46d
--- /dev/null
+++ b/queue-5.10/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch
@@ -0,0 +1,46 @@
+From dfac45bfa96bf4ba11c139c2d5ad84769fa6923f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:45 +0800
+Subject: spi: tegra20-slink: fix reference leak in slink ops of tegra20
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in two callers(tegra_slink_setup and
+tegra_slink_resume), so we should fix it.
+
+Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index a0810765d4e52..f7c832fd40036 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -751,6 +751,7 @@ static int tegra_slink_setup(struct spi_device *spi)
+ 
+ 	ret = pm_runtime_get_sync(tspi->dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(tspi->dev);
+ 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ 		return ret;
+ 	}
+@@ -1188,6 +1189,7 @@ static int tegra_slink_resume(struct device *dev)
+ 
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
++		pm_runtime_put_noidle(dev);
+ 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ 		return ret;
+ 	}
+-- 
+2.27.0
+
diff --git a/queue-5.10/staging-bcm2835-fix-vchiq_mmal-dependencies.patch b/queue-5.10/staging-bcm2835-fix-vchiq_mmal-dependencies.patch
new file mode 100644
index 00000000000..bf14d7f6ffd
--- /dev/null
+++ b/queue-5.10/staging-bcm2835-fix-vchiq_mmal-dependencies.patch
@@ -0,0 +1,58 @@
+From 82a7554f2fd9e20f614f7f9b57a704a5b4de34c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:38:30 +0100
+Subject: staging: bcm2835: fix vchiq_mmal dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 6c91799f59ed491a2b5bf5ef7c6d60306cda4e09 ]
+
+When the MMAL code is built-in but the vchiq core config is
+set to =m, the mmal code never gets built, which in turn can
+lead to link errors:
+
+ERROR: modpost: "vchiq_mmal_port_set_format" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_port_disable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_port_parameter_set" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_component_finalise" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_port_connect_tunnel" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_component_enable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_finalise" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_component_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_component_disable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "mmal_vchi_buffer_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_port_enable" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_version" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_submit_buffer" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_init" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "mmal_vchi_buffer_cleanup" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+ERROR: modpost: "vchiq_mmal_port_parameter_get" [drivers/staging/vc04_services/bcm2835-camera/bcm2835-v4l2.ko] undefined!
+
+Change the Kconfig to depend on BCM2835_VCHIQ like the other drivers,
+and remove the now redundant dependencies.
+
+Fixes: b18ee53ad297 ("staging: bcm2835: Break MMAL support out from camera")
+Acked-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20201203223836.1362313-1-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/vchiq-mmal/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/vc04_services/vchiq-mmal/Kconfig b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+index 500c0d12e4ff2..c99525a0bb452 100644
+--- a/drivers/staging/vc04_services/vchiq-mmal/Kconfig
++++ b/drivers/staging/vc04_services/vchiq-mmal/Kconfig
+@@ -1,6 +1,6 @@
+ config BCM2835_VCHIQ_MMAL
+ 	tristate "BCM2835 MMAL VCHIQ service"
+-	depends on (ARCH_BCM2835 || COMPILE_TEST)
++	depends on BCM2835_VCHIQ
+ 	help
+ 	  Enables the MMAL API over VCHIQ interface as used for the
+ 	  majority of the multimedia services on VideoCore.
+-- 
+2.27.0
+
diff --git a/queue-5.10/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch b/queue-5.10/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch
new file mode 100644
index 00000000000..588c1f62393
--- /dev/null
+++ b/queue-5.10/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch
@@ -0,0 +1,65 @@
+From d6a1920634ddfbbc80805adc5b990465397ca6ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 14:49:24 +0800
+Subject: staging: gasket: interrupt: fix the missed eventfd_ctx_put() in
+ gasket_interrupt.c
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ]
+
+gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an
+error path. We check interrupt is valid before calling
+eventfd_ctx_fdget() to fix it.
+
+There is the same issue in gasket_interrupt_clear_eventfd(), Add the
+missed function call to fix it.
+
+Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
+index 2d6195f7300e9..864342acfd86e 100644
+--- a/drivers/staging/gasket/gasket_interrupt.c
++++ b/drivers/staging/gasket/gasket_interrupt.c
+@@ -487,14 +487,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
+ int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
+ 				 int interrupt, int event_fd)
+ {
+-	struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
+-
+-	if (IS_ERR(ctx))
+-		return PTR_ERR(ctx);
++	struct eventfd_ctx *ctx;
+ 
+ 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ 		return -EINVAL;
+ 
++	ctx = eventfd_ctx_fdget(event_fd);
++
++	if (IS_ERR(ctx))
++		return PTR_ERR(ctx);
++
+ 	interrupt_data->eventfd_ctxs[interrupt] = ctx;
+ 	return 0;
+ }
+@@ -505,6 +507,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
+ 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ 		return -EINVAL;
+ 
+-	interrupt_data->eventfd_ctxs[interrupt] = NULL;
++	if (interrupt_data->eventfd_ctxs[interrupt]) {
++		eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
++		interrupt_data->eventfd_ctxs[interrupt] = NULL;
++	}
+ 	return 0;
+ }
+-- 
+2.27.0
+
diff --git a/queue-5.10/staging-greybus-audio-fix-possible-leak-free-widgets.patch b/queue-5.10/staging-greybus-audio-fix-possible-leak-free-widgets.patch
new file mode 100644
index 00000000000..0571b24d7f6
--- /dev/null
+++ b/queue-5.10/staging-greybus-audio-fix-possible-leak-free-widgets.patch
@@ -0,0 +1,44 @@
+From 7cc0779e7ecbe9d012d753b1a7516f99c0ce17ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 18:38:27 +0800
+Subject: staging: greybus: audio: Fix possible leak free widgets in
+ gbaudio_dapm_free_controls
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit e77b259f67ab99f1e22ce895b9b1c637fd5f2d4c ]
+
+In gbaudio_dapm_free_controls(), if one of the widgets is not found, an error
+will be returned directly, which will cause the rest to be unable to be freed,
+resulting in leak.
+
+This patch fixes the bug. If if one of them is not found, just skip and free the others.
+
+Fixes: 510e340efe0c ("staging: greybus: audio: Add helper APIs for dynamic audio module")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20201205103827.31244-1-wanghai38@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/audio_helper.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c
+index 237531ba60f30..3011b8abce389 100644
+--- a/drivers/staging/greybus/audio_helper.c
++++ b/drivers/staging/greybus/audio_helper.c
+@@ -135,7 +135,8 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm,
+ 		if (!w) {
+ 			dev_err(dapm->dev, "%s: widget not found\n",
+ 				widget->name);
+-			return -EINVAL;
++			widget++;
++			continue;
+ 		}
+ 		widget++;
+ #ifdef CONFIG_DEBUG_FS
+-- 
+2.27.0
+
diff --git a/queue-5.10/staging-greybus-codecs-fix-reference-counter-leak-in.patch b/queue-5.10/staging-greybus-codecs-fix-reference-counter-leak-in.patch
new file mode 100644
index 00000000000..5ba8d12516b
--- /dev/null
+++ b/queue-5.10/staging-greybus-codecs-fix-reference-counter-leak-in.patch
@@ -0,0 +1,47 @@
+From cedfe391b9562119c55e33e8418472a846012fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 21:13:46 +0800
+Subject: staging: greybus: codecs: Fix reference counter leak in error
+ handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]
+
+gb_pm_runtime_get_sync has increased the usage counter of the device here.
+Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
+leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
+fixed it by adding it.
+
+Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/audio_codec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
+index 494aa823e9984..42ce6c88ea753 100644
+--- a/drivers/staging/greybus/audio_codec.c
++++ b/drivers/staging/greybus/audio_codec.c
+@@ -490,6 +490,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
+ 	if (ret) {
+ 		dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
+ 				    ret);
++		gb_pm_runtime_put_noidle(bundle);
+ 		mutex_unlock(&codec->lock);
+ 		return ret;
+ 	}
+@@ -566,6 +567,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
+ 		break;
+ 	}
+ 	if (ret) {
++		gb_pm_runtime_put_noidle(bundle);
+ 		mutex_unlock(&codec->lock);
+ 		dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
+ 				    ret);
+-- 
+2.27.0
+
diff --git a/queue-5.10/staging-mfd-hi6421-spmi-pmic-fix-error-return-code-i.patch b/queue-5.10/staging-mfd-hi6421-spmi-pmic-fix-error-return-code-i.patch
new file mode 100644
index 00000000000..4b0f2683b8f
--- /dev/null
+++ b/queue-5.10/staging-mfd-hi6421-spmi-pmic-fix-error-return-code-i.patch
@@ -0,0 +1,42 @@
+From 24d0ba5893d3768ba17ae65c43ea7f8b6989bd44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 18:37:24 +0800
+Subject: staging: mfd: hi6421-spmi-pmic: fix error return code in
+ hi6421_spmi_pmic_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit ba3e4a2a0b3c639d3835f2f1dce27d79576ae453 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 4524ac56cdca ("staging: mfd: add a PMIC driver for HiSilicon 6421 SPMI version")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20201118103724.57451-1-wanghai38@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/hikey9xx/hi6421-spmi-pmic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/hikey9xx/hi6421-spmi-pmic.c b/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
+index 64b30d263c8d0..4f34a52829700 100644
+--- a/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
++++ b/drivers/staging/hikey9xx/hi6421-spmi-pmic.c
+@@ -262,8 +262,10 @@ static int hi6421_spmi_pmic_probe(struct spmi_device *pdev)
+ 	hi6421_spmi_pmic_irq_prc(pmic);
+ 
+ 	pmic->irqs = devm_kzalloc(dev, HISI_IRQ_NUM * sizeof(int), GFP_KERNEL);
+-	if (!pmic->irqs)
++	if (!pmic->irqs) {
++		ret = -ENOMEM;
+ 		goto irq_malloc;
++	}
+ 
+ 	pmic->domain = irq_domain_add_simple(np, HISI_IRQ_NUM, 0,
+ 					     &hi6421_spmi_domain_ops, pmic);
+-- 
+2.27.0
+
diff --git a/queue-5.10/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch b/queue-5.10/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch
new file mode 100644
index 00000000000..8466937f46a
--- /dev/null
+++ b/queue-5.10/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch
@@ -0,0 +1,55 @@
+From e18c4c42778b79856ae691450c7447b40b2e2dc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 11:28:35 +0200
+Subject: sunrpc: fix xs_read_xdr_buf for partial pages receive
+
+From: Dan Aloni <dan@kernelim.com>
+
+[ Upstream commit ac9645c87380e39a8fa87a1b51721efcdea89dbf ]
+
+When receiving pages data, return value 'ret' when positive includes
+`buf->page_base`, so we should subtract that before it is used for
+changing `offset` and comparing against `want`.
+
+This was discovered on the very rare cases where the server returned a
+chunk of bytes that when added to the already received amount of bytes
+for the pages happened to match the current `recv.len`, for example
+on this case:
+
+     buf->page_base : 258356
+     actually received from socket: 1740
+     ret : 260096
+     want : 260096
+
+In this case neither of the two 'if ... goto out' trigger, and we
+continue to tail parsing.
+
+Worth to mention that the ensuing EMSGSIZE from the continued execution of
+`xs_read_xdr_buf` may be observed by an application due to 4 superfluous
+bytes being added to the pages data.
+
+Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching to using iterators")
+Signed-off-by: Dan Aloni <dan@kernelim.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index c93ff70da3f98..c56a66cdf4ac8 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -433,7 +433,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
+ 		if (ret <= 0)
+ 			goto sock_err;
+ 		xs_flush_bvec(buf->bvec, ret, seek + buf->page_base);
+-		offset += ret - buf->page_base;
++		ret -= buf->page_base;
++		offset += ret;
+ 		if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
+ 			goto out;
+ 		if (ret != want)
+-- 
+2.27.0
+
diff --git a/queue-5.10/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch b/queue-5.10/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch
new file mode 100644
index 00000000000..4f787d6d38f
--- /dev/null
+++ b/queue-5.10/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch
@@ -0,0 +1,118 @@
+From ce66e0dc6ec83418ceb99d31ac0bff405afffcdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 17:40:33 -0400
+Subject: SUNRPC: rpc_wake_up() should wake up tasks in the correct order
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit e4c72201b6ec3173dfe13fa2e2335a3ad78d4921 ]
+
+Currently, we wake up the tasks by priority queue ordering, which means
+that we ignore the batching that is supposed to help with QoS issues.
+
+Fixes: c049f8ea9a0d ("SUNRPC: Remove the bh-safe lock requirement on the rpc_wait_queue->lock")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/sched.c | 65 +++++++++++++++++++++++++---------------------
+ 1 file changed, 35 insertions(+), 30 deletions(-)
+
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index f06d7c315017c..cf702a5f7fe5d 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -675,6 +675,23 @@ struct rpc_task *rpc_wake_up_next(struct rpc_wait_queue *queue)
+ }
+ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
+ 
++/**
++ * rpc_wake_up_locked - wake up all rpc_tasks
++ * @queue: rpc_wait_queue on which the tasks are sleeping
++ *
++ */
++static void rpc_wake_up_locked(struct rpc_wait_queue *queue)
++{
++	struct rpc_task *task;
++
++	for (;;) {
++		task = __rpc_find_next_queued(queue);
++		if (task == NULL)
++			break;
++		rpc_wake_up_task_queue_locked(queue, task);
++	}
++}
++
+ /**
+  * rpc_wake_up - wake up all rpc_tasks
+  * @queue: rpc_wait_queue on which the tasks are sleeping
+@@ -683,25 +700,28 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
+  */
+ void rpc_wake_up(struct rpc_wait_queue *queue)
+ {
+-	struct list_head *head;
+-
+ 	spin_lock(&queue->lock);
+-	head = &queue->tasks[queue->maxpriority];
++	rpc_wake_up_locked(queue);
++	spin_unlock(&queue->lock);
++}
++EXPORT_SYMBOL_GPL(rpc_wake_up);
++
++/**
++ * rpc_wake_up_status_locked - wake up all rpc_tasks and set their status value.
++ * @queue: rpc_wait_queue on which the tasks are sleeping
++ * @status: status value to set
++ */
++static void rpc_wake_up_status_locked(struct rpc_wait_queue *queue, int status)
++{
++	struct rpc_task *task;
++
+ 	for (;;) {
+-		while (!list_empty(head)) {
+-			struct rpc_task *task;
+-			task = list_first_entry(head,
+-					struct rpc_task,
+-					u.tk_wait.list);
+-			rpc_wake_up_task_queue_locked(queue, task);
+-		}
+-		if (head == &queue->tasks[0])
++		task = __rpc_find_next_queued(queue);
++		if (task == NULL)
+ 			break;
+-		head--;
++		rpc_wake_up_task_queue_set_status_locked(queue, task, status);
+ 	}
+-	spin_unlock(&queue->lock);
+ }
+-EXPORT_SYMBOL_GPL(rpc_wake_up);
+ 
+ /**
+  * rpc_wake_up_status - wake up all rpc_tasks and set their status value.
+@@ -712,23 +732,8 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
+  */
+ void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
+ {
+-	struct list_head *head;
+-
+ 	spin_lock(&queue->lock);
+-	head = &queue->tasks[queue->maxpriority];
+-	for (;;) {
+-		while (!list_empty(head)) {
+-			struct rpc_task *task;
+-			task = list_first_entry(head,
+-					struct rpc_task,
+-					u.tk_wait.list);
+-			task->tk_status = status;
+-			rpc_wake_up_task_queue_locked(queue, task);
+-		}
+-		if (head == &queue->tasks[0])
+-			break;
+-		head--;
+-	}
++	rpc_wake_up_status_locked(queue, status);
+ 	spin_unlock(&queue->lock);
+ }
+ EXPORT_SYMBOL_GPL(rpc_wake_up_status);
+-- 
+2.27.0
+
diff --git a/queue-5.10/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch b/queue-5.10/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch
new file mode 100644
index 00000000000..5c8f698305e
--- /dev/null
+++ b/queue-5.10/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch
@@ -0,0 +1,185 @@
+From 3f76385353c7d6dbc128d4315621cc831d9f9b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:33:38 -0500
+Subject: SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]
+
+According to RFC5666, the correct netid for an IPv6 addressed RDMA
+transport is "rdma6", which we've supported as a mount option since
+Linux-4.7. The problem is when we try to load the module "xprtrdma6",
+that will fail, since there is no modulealias of that name.
+
+Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/xprt.h     |  1 +
+ net/sunrpc/xprt.c               | 65 +++++++++++++++++++++++++--------
+ net/sunrpc/xprtrdma/module.c    |  1 +
+ net/sunrpc/xprtrdma/transport.c |  1 +
+ net/sunrpc/xprtsock.c           |  4 ++
+ 5 files changed, 56 insertions(+), 16 deletions(-)
+
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index a603d48d2b2cd..3ac5037d1c3da 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -330,6 +330,7 @@ struct xprt_class {
+ 	struct rpc_xprt *	(*setup)(struct xprt_create *);
+ 	struct module		*owner;
+ 	char			name[32];
++	const char *		netid[];
+ };
+ 
+ /*
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index f6c17e75f20ed..57f09ea3ef2af 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -151,31 +151,64 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(xprt_unregister_transport);
+ 
++static void
++xprt_class_release(const struct xprt_class *t)
++{
++	module_put(t->owner);
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid_locked(const char *netid)
++{
++	const struct xprt_class *t;
++	unsigned int i;
++
++	list_for_each_entry(t, &xprt_list, list) {
++		for (i = 0; t->netid[i][0] != '\0'; i++) {
++			if (strcmp(t->netid[i], netid) != 0)
++				continue;
++			if (!try_module_get(t->owner))
++				continue;
++			return t;
++		}
++	}
++	return NULL;
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid(const char *netid)
++{
++	const struct xprt_class *t;
++
++	spin_lock(&xprt_list_lock);
++	t = xprt_class_find_by_netid_locked(netid);
++	if (!t) {
++		spin_unlock(&xprt_list_lock);
++		request_module("rpc%s", netid);
++		spin_lock(&xprt_list_lock);
++		t = xprt_class_find_by_netid_locked(netid);
++	}
++	spin_unlock(&xprt_list_lock);
++	return t;
++}
++
+ /**
+  * xprt_load_transport - load a transport implementation
+- * @transport_name: transport to load
++ * @netid: transport to load
+  *
+  * Returns:
+  * 0:		transport successfully loaded
+  * -ENOENT:	transport module not available
+  */
+-int xprt_load_transport(const char *transport_name)
++int xprt_load_transport(const char *netid)
+ {
+-	struct xprt_class *t;
+-	int result;
++	const struct xprt_class *t;
+ 
+-	result = 0;
+-	spin_lock(&xprt_list_lock);
+-	list_for_each_entry(t, &xprt_list, list) {
+-		if (strcmp(t->name, transport_name) == 0) {
+-			spin_unlock(&xprt_list_lock);
+-			goto out;
+-		}
+-	}
+-	spin_unlock(&xprt_list_lock);
+-	result = request_module("xprt%s", transport_name);
+-out:
+-	return result;
++	t = xprt_class_find_by_netid(netid);
++	if (!t)
++		return -ENOENT;
++	xprt_class_release(t);
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(xprt_load_transport);
+ 
+diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
+index 620327c01302c..45c5b41ac8dc9 100644
+--- a/net/sunrpc/xprtrdma/module.c
++++ b/net/sunrpc/xprtrdma/module.c
+@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_ALIAS("svcrdma");
+ MODULE_ALIAS("xprtrdma");
++MODULE_ALIAS("rpcrdma6");
+ 
+ static void __exit rpc_rdma_cleanup(void)
+ {
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 8915e42240d38..035060c05fd5a 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -768,6 +768,7 @@ static struct xprt_class xprt_rdma = {
+ 	.owner			= THIS_MODULE,
+ 	.ident			= XPRT_TRANSPORT_RDMA,
+ 	.setup			= xprt_setup_rdma,
++	.netid			= { "rdma", "rdma6", "" },
+ };
+ 
+ void xprt_rdma_cleanup(void)
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 7090bbee0ec59..c93ff70da3f98 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -3059,6 +3059,7 @@ static struct xprt_class	xs_local_transport = {
+ 	.owner		= THIS_MODULE,
+ 	.ident		= XPRT_TRANSPORT_LOCAL,
+ 	.setup		= xs_setup_local,
++	.netid		= { "" },
+ };
+ 
+ static struct xprt_class	xs_udp_transport = {
+@@ -3067,6 +3068,7 @@ static struct xprt_class	xs_udp_transport = {
+ 	.owner		= THIS_MODULE,
+ 	.ident		= XPRT_TRANSPORT_UDP,
+ 	.setup		= xs_setup_udp,
++	.netid		= { "udp", "udp6", "" },
+ };
+ 
+ static struct xprt_class	xs_tcp_transport = {
+@@ -3075,6 +3077,7 @@ static struct xprt_class	xs_tcp_transport = {
+ 	.owner		= THIS_MODULE,
+ 	.ident		= XPRT_TRANSPORT_TCP,
+ 	.setup		= xs_setup_tcp,
++	.netid		= { "tcp", "tcp6", "" },
+ };
+ 
+ static struct xprt_class	xs_bc_tcp_transport = {
+@@ -3083,6 +3086,7 @@ static struct xprt_class	xs_bc_tcp_transport = {
+ 	.owner		= THIS_MODULE,
+ 	.ident		= XPRT_TRANSPORT_BC_TCP,
+ 	.setup		= xs_setup_bc_tcp,
++	.netid		= { "" },
+ };
+ 
+ /**
+-- 
+2.27.0
+
diff --git a/queue-5.10/tools-build-add-missing-libcap-to-test-all.bin-targe.patch b/queue-5.10/tools-build-add-missing-libcap-to-test-all.bin-targe.patch
new file mode 100644
index 00000000000..a68650c44e3
--- /dev/null
+++ b/queue-5.10/tools-build-add-missing-libcap-to-test-all.bin-targe.patch
@@ -0,0 +1,81 @@
+From 1e156a0905728b9c2130da2daf61efbcfdf2b086 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 00:08:36 +0100
+Subject: tools build: Add missing libcap to test-all.bin target
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 09d59c2f3465fb01e65a0c96698697b026ea8e79 ]
+
+We're missing -lcap in test-all.bin target, so in case it's the only
+library missing (if more are missing test-all.bin fails anyway), we will
+falsely claim that we detected it and fail build, like:
+
+  $ make
+  ...
+  Auto-detecting system features:
+  ...                         dwarf: [ on  ]
+  ...            dwarf_getlocations: [ on  ]
+  ...                         glibc: [ on  ]
+  ...                        libbfd: [ on  ]
+  ...                libbfd-buildid: [ on  ]
+  ...                        libcap: [ on  ]
+  ...                        libelf: [ on  ]
+  ...                       libnuma: [ on  ]
+  ...        numa_num_possible_cpus: [ on  ]
+  ...                       libperl: [ on  ]
+  ...                     libpython: [ on  ]
+  ...                     libcrypto: [ on  ]
+  ...                     libunwind: [ on  ]
+  ...            libdw-dwarf-unwind: [ on  ]
+  ...                          zlib: [ on  ]
+  ...                          lzma: [ on  ]
+  ...                     get_cpuid: [ on  ]
+  ...                           bpf: [ on  ]
+  ...                        libaio: [ on  ]
+  ...                       libzstd: [ on  ]
+  ...        disassembler-four-args: [ on  ]
+
+  ...
+
+    CC       builtin-ftrace.o
+
+  In file included from builtin-ftrace.c:29:
+  util/cap.h:11:10: fatal error: sys/capability.h: No such file or directory
+     11 | #include <sys/capability.h>
+        |          ^~~~~~~~~~~~~~~~~~
+  compilation terminated.
+
+Fixes: 74d5f3d06f707eb5 ("tools build: Add capability-related feature detection")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Igor Lubashev <ilubashe@akamai.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20201203230836.3751981-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index cdde783f3018b..89ba522e377dc 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -90,7 +90,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$(
+ ###############################
+ 
+ $(OUTPUT)test-all.bin:
+-	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd
++	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd -lcap
+ 
+ $(OUTPUT)test-hello.bin:
+ 	$(BUILD)
+-- 
+2.27.0
+
diff --git a/queue-5.10/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch b/queue-5.10/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch
new file mode 100644
index 00000000000..f93bdd8e72e
--- /dev/null
+++ b/queue-5.10/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch
@@ -0,0 +1,41 @@
+From 4aa9f39c6c0bf49e7a6596f4b886e1d7b511daed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 14:33:20 +0800
+Subject: ubifs: Fix error return code in ubifs_init_authentication()
+
+From: Wang ShaoBo <bobo.shaobowang@huawei.com>
+
+[ Upstream commit 3cded66330591cfd2554a3fd5edca8859ea365a2 ]
+
+Fix to return PTR_ERR() error code from the error handling case where
+ubifs_hash_get_desc() failed instead of 0 in ubifs_init_authentication(),
+as done elsewhere in this function.
+
+Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support")
+Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/auth.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
+index b93b3cd10bfd3..8c50de693e1d4 100644
+--- a/fs/ubifs/auth.c
++++ b/fs/ubifs/auth.c
+@@ -338,8 +338,10 @@ int ubifs_init_authentication(struct ubifs_info *c)
+ 	c->authenticated = true;
+ 
+ 	c->log_hash = ubifs_hash_get_desc(c);
+-	if (IS_ERR(c->log_hash))
++	if (IS_ERR(c->log_hash)) {
++		err = PTR_ERR(c->log_hash);
+ 		goto out_free_hmac;
++	}
+ 
+ 	err = 0;
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/um-chan_xterm-fix-fd-leak.patch b/queue-5.10/um-chan_xterm-fix-fd-leak.patch
new file mode 100644
index 00000000000..2f9f77e001f
--- /dev/null
+++ b/queue-5.10/um-chan_xterm-fix-fd-leak.patch
@@ -0,0 +1,66 @@
+From f3343d119fe459257c8ba15202144c201ccc0870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:40 +0000
+Subject: um: chan_xterm: Fix fd leak
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]
+
+xterm serial channel was leaking a fd used in setting up the
+port helper
+
+This bug is prehistoric - it predates switching to git. The "fixes"
+header here is really just to mark all the versions we would like this to
+apply to which is "Anything from the Cretaceous period onwards".
+
+No dinosaurs were harmed in fixing this bug.
+
+Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/xterm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
+index fc7f1e7467032..87ca4a47cd66e 100644
+--- a/arch/um/drivers/xterm.c
++++ b/arch/um/drivers/xterm.c
+@@ -18,6 +18,7 @@
+ struct xterm_chan {
+ 	int pid;
+ 	int helper_pid;
++	int chan_fd;
+ 	char *title;
+ 	int device;
+ 	int raw;
+@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
+ 		return NULL;
+ 	*data = ((struct xterm_chan) { .pid 		= -1,
+ 				       .helper_pid 	= -1,
++				       .chan_fd		= -1,
+ 				       .device 		= device,
+ 				       .title 		= opts->xterm_title,
+ 				       .raw  		= opts->raw } );
+@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
+ 		goto out_kill;
+ 	}
+ 
++	data->chan_fd = fd;
+ 	new = xterm_fd(fd, &data->helper_pid);
+ 	if (new < 0) {
+ 		err = new;
+@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
+ 		os_kill_process(data->helper_pid, 0);
+ 	data->helper_pid = -1;
+ 
++	if (data->chan_fd != -1)
++		os_close_file(data->chan_fd);
+ 	os_close_file(fd);
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/um-monitor-error-events-in-irq-controller.patch b/queue-5.10/um-monitor-error-events-in-irq-controller.patch
new file mode 100644
index 00000000000..925d89b57c4
--- /dev/null
+++ b/queue-5.10/um-monitor-error-events-in-irq-controller.patch
@@ -0,0 +1,36 @@
+From cf12ac04adc4f547dfbb5c9e618386ac69bf6981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:38 +0000
+Subject: um: Monitor error events in IRQ controller
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ]
+
+Ensure that file closes, connection closes, etc are propagated
+as interrupts in the interrupt controller.
+
+Fixes: ff6a17989c08 ("Epoll based IRQ controller")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
+index d508310ee5e1e..f1732c308c615 100644
+--- a/arch/um/os-Linux/irq.c
++++ b/arch/um/os-Linux/irq.c
+@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)
+ int os_event_mask(int irq_type)
+ {
+ 	if (irq_type == IRQ_READ)
+-		return EPOLLIN | EPOLLPRI;
++		return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP;
+ 	if (irq_type == IRQ_WRITE)
+ 		return EPOLLOUT;
+ 	return 0;
+-- 
+2.27.0
+
diff --git a/queue-5.10/um-tty-fix-handling-of-close-in-tty-lines.patch b/queue-5.10/um-tty-fix-handling-of-close-in-tty-lines.patch
new file mode 100644
index 00000000000..46c3ee9cc92
--- /dev/null
+++ b/queue-5.10/um-tty-fix-handling-of-close-in-tty-lines.patch
@@ -0,0 +1,49 @@
+From a4d803ded29296c681d053821b9b10fc903d2814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:39 +0000
+Subject: um: tty: Fix handling of close in tty lines
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ]
+
+Fix a logical error in tty reading. We get 0 and errno == EAGAIN
+on the first attempt to read from a closed file descriptor.
+
+Compared to that a true EAGAIN is EAGAIN and -1.
+
+If we check errno for EAGAIN first, before checking the return
+value we miss the fact that the descriptor is closed.
+
+This bug is as old as the driver. It was not showing up with
+the original POLL based IRQ controller, because it was
+producing multiple events. Switching to EPOLL unmasked it.
+
+Fixes: ff6a17989c08 ("Epoll based IRQ controller")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/chan_user.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 4d80526a4236e..d8845d4aac6a7 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused)
+ 	n = read(fd, c_out, sizeof(*c_out));
+ 	if (n > 0)
+ 		return n;
+-	else if (errno == EAGAIN)
+-		return 0;
+ 	else if (n == 0)
+ 		return -EIO;
++	else if (errno == EAGAIN)
++		return 0;
+ 	return -errno;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch b/queue-5.10/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch
new file mode 100644
index 00000000000..785abfed879
--- /dev/null
+++ b/queue-5.10/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch
@@ -0,0 +1,39 @@
+From ebbfc88da05c5417382f4aff0b1a392d752f204f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 22:57:19 +0800
+Subject: usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]
+
+The pm_runtime_enable will decrement the power disable depth. Imbalance
+depth will resulted in enabling runtime PM of device fails later.  Thus
+a pairing decrement must be needed on the error handling path to keep it
+balanced.
+
+Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 8771a2ed69268..7f4a03e8647af 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -220,6 +220,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 
+ err_pm_runtime:
+ 	pm_runtime_put_sync(dev);
++	pm_runtime_disable(dev);
+ 
+ err_phy:
+ 	for (i = 0; i < omap->nports; i++) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/usb-max3421-fix-return-error-code-in-max3421_probe.patch b/queue-5.10/usb-max3421-fix-return-error-code-in-max3421_probe.patch
new file mode 100644
index 00000000000..d5904679cb0
--- /dev/null
+++ b/queue-5.10/usb-max3421-fix-return-error-code-in-max3421_probe.patch
@@ -0,0 +1,47 @@
+From 0f7f723c61cf4a902a8235f7c0c24948015bc146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:15:00 +0800
+Subject: usb/max3421: fix return error code in max3421_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ]
+
+retval may be reassigned to 0 after max3421_of_vbus_en_pin(),
+if allocate memory failed after this, max3421_probe() cann't
+return ENOMEM, fix this by moving assign retval afther max3421_probe().
+
+Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 0894f6caccb2c..ebb8180b52ab1 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1847,7 +1847,7 @@ max3421_probe(struct spi_device *spi)
+ 	struct max3421_hcd *max3421_hcd;
+ 	struct usb_hcd *hcd = NULL;
+ 	struct max3421_hcd_platform_data *pdata = NULL;
+-	int retval = -ENOMEM;
++	int retval;
+ 
+ 	if (spi_setup(spi) < 0) {
+ 		dev_err(&spi->dev, "Unable to setup SPI bus");
+@@ -1889,6 +1889,7 @@ max3421_probe(struct spi_device *spi)
+ 		goto error;
+ 	}
+ 
++	retval = -ENOMEM;
+ 	hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
+ 			     dev_name(&spi->dev));
+ 	if (!hcd) {
+-- 
+2.27.0
+
diff --git a/queue-5.10/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch b/queue-5.10/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch
new file mode 100644
index 00000000000..79fb4e58bc0
--- /dev/null
+++ b/queue-5.10/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch
@@ -0,0 +1,42 @@
+From e3424b621c0f5c225f681903f4b5b9b2dcc081ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 22:58:09 +0800
+Subject: usb: oxu210hp-hcd: Fix memory leak in oxu_create
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]
+
+usb_create_hcd will alloc memory for hcd, and we should
+call usb_put_hcd to free it when adding fails to prevent
+memory leak.
+
+Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/oxu210hp-hcd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
+index 27dbbe1b28b12..e832909a924fa 100644
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -4151,8 +4151,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
+ 	oxu->is_otg = otg;
+ 
+ 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+-	if (ret < 0)
++	if (ret < 0) {
++		usb_put_hcd(hcd);
+ 		return ERR_PTR(ret);
++	}
+ 
+ 	device_wakeup_enable(hcd->self.controller);
+ 	return hcd;
+-- 
+2.27.0
+
diff --git a/queue-5.10/vdpa-mlx5-use-write-memory-barrier-after-updating-cq.patch b/queue-5.10/vdpa-mlx5-use-write-memory-barrier-after-updating-cq.patch
new file mode 100644
index 00000000000..ccfd2d14a43
--- /dev/null
+++ b/queue-5.10/vdpa-mlx5-use-write-memory-barrier-after-updating-cq.patch
@@ -0,0 +1,44 @@
+From 575c5d6c8e3d6502d0b58811dafec80aa91d53fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 16:00:04 +0200
+Subject: vdpa/mlx5: Use write memory barrier after updating CQ index
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 83ef73b27eb2363f44faf9c3ee28a3fe752cfd15 ]
+
+Make sure to put dma write memory barrier after updating CQ consumer
+index so the hardware knows that there are available CQE slots in the
+queue.
+
+Failure to do this can cause the update of the RX doorbell record to get
+updated before the CQ consumer index resulting in CQ overrun.
+
+Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20201209140004.15892-1-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 1fa6fcac82992..81b932f72e103 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -464,6 +464,11 @@ static int mlx5_vdpa_poll_one(struct mlx5_vdpa_cq *vcq)
+ static void mlx5_vdpa_handle_completions(struct mlx5_vdpa_virtqueue *mvq, int num)
+ {
+ 	mlx5_cq_set_ci(&mvq->cq.mcq);
++
++	/* make sure CQ cosumer update is visible to the hardware before updating
++	 * RX doorbell record.
++	 */
++	dma_wmb();
+ 	rx_post(&mvq->vqqp, num);
+ 	if (mvq->event_cb.callback)
+ 		mvq->event_cb.callback(mvq->event_cb.private);
+-- 
+2.27.0
+
diff --git a/queue-5.10/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch b/queue-5.10/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch
new file mode 100644
index 00000000000..691ca641a9a
--- /dev/null
+++ b/queue-5.10/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch
@@ -0,0 +1,46 @@
+From 6a6998333041342cf0d3471804bea583eae2316f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 12:34:58 -0400
+Subject: vfio-pci: Use io_remap_pfn_range() for PCI IO memory
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]
+
+commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
+pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
+BAR space into userspace to work correctly on AMD SME systems that default
+to all memory encrypted.
+
+Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
+should be calling io_remap_pfn_range() otherwise it will not work on SME
+systems.
+
+Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Acked-by: Peter Xu <peterx@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index e6190173482c7..89e451615729a 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1635,8 +1635,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
+ 
+ 	mutex_unlock(&vdev->vma_lock);
+ 
+-	if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+-			    vma->vm_end - vma->vm_start, vma->vm_page_prot))
++	if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
++			       vma->vm_end - vma->vm_start, vma->vm_page_prot))
+ 		ret = VM_FAULT_SIGBUS;
+ 
+ up_out:
+-- 
+2.27.0
+
diff --git a/queue-5.10/vhost-scsi-fix-error-return-code-in-vhost_scsi_set_e.patch b/queue-5.10/vhost-scsi-fix-error-return-code-in-vhost_scsi_set_e.patch
new file mode 100644
index 00000000000..04db7cad1fb
--- /dev/null
+++ b/queue-5.10/vhost-scsi-fix-error-return-code-in-vhost_scsi_set_e.patch
@@ -0,0 +1,39 @@
+From 217800bd32907a1772915f2792f71b3b88d29db3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:43:30 +0800
+Subject: vhost scsi: fix error return code in vhost_scsi_set_endpoint()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 2e1139d613c7fb0956e82f72a8281c0a475ad4f8 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607071411-33484-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/scsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 6ff8a50966915..4ce9f00ae10e8 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1643,7 +1643,8 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 			if (!vhost_vq_is_setup(vq))
+ 				continue;
+ 
+-			if (vhost_scsi_setup_vq_cmds(vq, vq->num))
++			ret = vhost_scsi_setup_vq_cmds(vq, vq->num);
++			if (ret)
+ 				goto destroy_vq_cmds;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch b/queue-5.10/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch
new file mode 100644
index 00000000000..5eb87ea282d
--- /dev/null
+++ b/queue-5.10/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch
@@ -0,0 +1,40 @@
+From 50206b86ff351c00baa0f0c18df86f59586bd3ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:13:50 +0800
+Subject: video: fbdev: atmel_lcdfb: fix return error code in
+ atmel_lcdfb_of_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ]
+
+If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init()
+can't return -ENOMEM, fix this by putting the error code in loop.
+
+Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/atmel_lcdfb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index 8c1d47e52b1a6..355b6120dc4f0 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -987,8 +987,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ 	}
+ 
+ 	INIT_LIST_HEAD(&pdata->pwr_gpios);
+-	ret = -ENOMEM;
+ 	for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
++		ret = -ENOMEM;
+ 		gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
+ 					     i, GPIOD_ASIS);
+ 		if (IS_ERR(gpiod))
+-- 
+2.27.0
+
diff --git a/queue-5.10/virtio_net-fix-error-code-in-probe.patch b/queue-5.10/virtio_net-fix-error-code-in-probe.patch
new file mode 100644
index 00000000000..74613c9339f
--- /dev/null
+++ b/queue-5.10/virtio_net-fix-error-code-in-probe.patch
@@ -0,0 +1,39 @@
+From 8a4a7024a8f4e56b529f426e0d71305de737449b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 17:23:16 +0300
+Subject: virtio_net: Fix error code in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 411ea23a76526e6efed0b601abb603d3c981b333 ]
+
+Set a negative error code intead of returning success if the MTU has
+been changed to something invalid.
+
+Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
+Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
+Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X8pGVJSeeCdII1Ys@mwanda
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 21b71148c5324..34bb95dd92392 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3072,6 +3072,7 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 			dev_err(&vdev->dev,
+ 				"device MTU appears to have changed it is now %d < %d",
+ 				mtu, dev->min_mtu);
++			err = -EINVAL;
+ 			goto free;
+ 		}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch b/queue-5.10/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch
new file mode 100644
index 00000000000..4a86cab5180
--- /dev/null
+++ b/queue-5.10/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch
@@ -0,0 +1,44 @@
+From 291fd1702d525641b1f2f2e37d7e123b5cfc9772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 17:23:00 +0300
+Subject: virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ae93d8ea0fa701e84ab9df0db9fb60ec6c80d7b8 ]
+
+There is a copy and paste bug in the error handling of this code and
+it uses "ring_dma_addr" three times instead of "device_event_dma_addr"
+and "driver_event_dma_addr".
+
+Fixes: 1ce9e6055fa0 (" virtio_ring: introduce packed ring support")
+Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
+Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X8pGRJlEzyn+04u2@mwanda
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index becc776979602..924b6b85376bd 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1676,9 +1676,9 @@ err_desc_extra:
+ err_desc_state:
+ 	kfree(vq);
+ err_vq:
+-	vring_free_queue(vdev, event_size_in_bytes, device, ring_dma_addr);
++	vring_free_queue(vdev, event_size_in_bytes, device, device_event_dma_addr);
+ err_device:
+-	vring_free_queue(vdev, event_size_in_bytes, driver, ring_dma_addr);
++	vring_free_queue(vdev, event_size_in_bytes, driver, driver_event_dma_addr);
+ err_driver:
+ 	vring_free_queue(vdev, ring_size_in_bytes, ring, ring_dma_addr);
+ err_ring:
+-- 
+2.27.0
+
diff --git a/queue-5.10/virtio_ring-fix-two-use-after-free-bugs.patch b/queue-5.10/virtio_ring-fix-two-use-after-free-bugs.patch
new file mode 100644
index 00000000000..4231961d76c
--- /dev/null
+++ b/queue-5.10/virtio_ring-fix-two-use-after-free-bugs.patch
@@ -0,0 +1,64 @@
+From b4d304bf7188cfa4d9d1ffa783fc20cbff49628f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 17:23:36 +0300
+Subject: virtio_ring: Fix two use after free bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e152d8af4220a05c9797591609151d404866beaa ]
+
+The "vq" struct is added to the "vdev->vqs" list prematurely.  If we
+encounter an error later in the function then the "vq" is freed, but
+since it is still on the list that could lead to a use after free bug.
+
+Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately")
+Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
+Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 924b6b85376bd..71e16b53e9c18 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1608,7 +1608,6 @@ static struct virtqueue *vring_create_virtqueue_packed(
+ 	vq->num_added = 0;
+ 	vq->packed_ring = true;
+ 	vq->use_dma_api = vring_use_dma_api(vdev);
+-	list_add_tail(&vq->vq.list, &vdev->vqs);
+ #ifdef DEBUG
+ 	vq->in_use = false;
+ 	vq->last_add_time_valid = false;
+@@ -1669,6 +1668,7 @@ static struct virtqueue *vring_create_virtqueue_packed(
+ 			cpu_to_le16(vq->packed.event_flags_shadow);
+ 	}
+ 
++	list_add_tail(&vq->vq.list, &vdev->vqs);
+ 	return &vq->vq;
+ 
+ err_desc_extra:
+@@ -2085,7 +2085,6 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
+ 	vq->last_used_idx = 0;
+ 	vq->num_added = 0;
+ 	vq->use_dma_api = vring_use_dma_api(vdev);
+-	list_add_tail(&vq->vq.list, &vdev->vqs);
+ #ifdef DEBUG
+ 	vq->in_use = false;
+ 	vq->last_add_time_valid = false;
+@@ -2127,6 +2126,7 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
+ 	memset(vq->split.desc_state, 0, vring.num *
+ 			sizeof(struct vring_desc_state_split));
+ 
++	list_add_tail(&vq->vq.list, &vdev->vqs);
+ 	return &vq->vq;
+ }
+ EXPORT_SYMBOL_GPL(__vring_new_virtqueue);
+-- 
+2.27.0
+
diff --git a/queue-5.10/virtiofs-fix-leak-in-setup.patch b/queue-5.10/virtiofs-fix-leak-in-setup.patch
new file mode 100644
index 00000000000..271dd813dfc
--- /dev/null
+++ b/queue-5.10/virtiofs-fix-leak-in-setup.patch
@@ -0,0 +1,38 @@
+From 8b6939856a2a3c71eb2e80082a252a3490ab7fa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 17:22:31 +0100
+Subject: virtiofs fix leak in setup
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 66ab33bf6d4341574f88b511e856a73f6f2a921e ]
+
+This can be triggered for example by adding the "-omand" mount option,
+which will be rejected and virtio_fs_fill_super() will return an error.
+
+In such a case the allocations for fuse_conn and fuse_mount will leak due
+to s_root not yet being set and so ->put_super() not being called.
+
+Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/virtio_fs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
+index 21a9e534417c0..d2c0e58c6416f 100644
+--- a/fs/fuse/virtio_fs.c
++++ b/fs/fuse/virtio_fs.c
+@@ -1464,6 +1464,8 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
+ 	if (!sb->s_root) {
+ 		err = virtio_fs_fill_super(sb, fsc);
+ 		if (err) {
++			fuse_mount_put(fm);
++			sb->s_fs_info = NULL;
+ 			deactivate_locked_super(sb);
+ 			return err;
+ 		}
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch b/queue-5.10/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch
new file mode 100644
index 00000000000..d295289e464
--- /dev/null
+++ b/queue-5.10/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch
@@ -0,0 +1,48 @@
+From d04fcef8b1e77d479320e2e358996c49f64c1d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 08:25:49 -0800
+Subject: watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 7f6f1dfb2dcbe5d2bfa213f2df5d74c147cd5954 ]
+
+The following kbuild warning is seen on a system without HAS_IOMEM.
+
+WARNING: unmet direct dependencies detected for MFD_SYSCON
+  Depends on [n]: HAS_IOMEM [=n]
+  Selected by [y]:
+  - ARMADA_37XX_WATCHDOG [=y] && WATCHDOG [=y] && (ARCH_MVEBU || COMPILE_TEST
+
+This results in a subsequent compile error.
+
+drivers/watchdog/armada_37xx_wdt.o: in function `armada_37xx_wdt_probe':
+armada_37xx_wdt.c:(.text+0xdc): undefined reference to `devm_ioremap'
+
+Add the missing dependency.
+
+Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Fixes: 54e3d9b518c8 ("watchdog: Add support for Armada 37xx CPU watchdog")
+Link: https://lore.kernel.org/r/20201108162550.27660-1-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index fd7968635e6df..b3e8bdaa2a112 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -386,6 +386,7 @@ config ARM_SBSA_WATCHDOG
+ config ARMADA_37XX_WATCHDOG
+ 	tristate "Armada 37xx watchdog"
+ 	depends on ARCH_MVEBU || COMPILE_TEST
++	depends on HAS_IOMEM
+ 	select MFD_SYSCON
+ 	select WATCHDOG_CORE
+ 	help
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-coh901327-add-common_clk-dependency.patch b/queue-5.10/watchdog-coh901327-add-common_clk-dependency.patch
new file mode 100644
index 00000000000..3a9ff6b0761
--- /dev/null
+++ b/queue-5.10/watchdog-coh901327-add-common_clk-dependency.patch
@@ -0,0 +1,45 @@
+From 4dfad4b54c886b8a313d6462f49e7b1d40072929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:33:42 +0100
+Subject: watchdog: coh901327: add COMMON_CLK dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]
+
+clang produces a build failure in configurations without COMMON_CLK
+when a timeout calculation goes wrong:
+
+arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
+coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'
+
+Add a Kconfig dependency to only do build testing when COMMON_CLK
+is enabled.
+
+Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index f8e9be65036ae..db935d6b10c27 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -632,7 +632,7 @@ config SUNXI_WATCHDOG
+ 
+ config COH901327_WATCHDOG
+ 	bool "ST-Ericsson COH 901 327 watchdog"
+-	depends on ARCH_U300 || (ARM && COMPILE_TEST)
++	depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
+ 	default y if MACH_U300
+ 	select WATCHDOG_CORE
+ 	help
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-fix-potential-dereferencing-of-null-pointer.patch b/queue-5.10/watchdog-fix-potential-dereferencing-of-null-pointer.patch
new file mode 100644
index 00000000000..88d231e4114
--- /dev/null
+++ b/queue-5.10/watchdog-fix-potential-dereferencing-of-null-pointer.patch
@@ -0,0 +1,71 @@
+From 0f06166987a724f0e3919516ad9479b3c731166c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 13:05:12 +0000
+Subject: watchdog: Fix potential dereferencing of null pointer
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ]
+
+A reboot notifier, which stops the WDT by calling the stop hook without
+any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.
+
+Howerer we allow the WDT driver to omit the stop hook since commit
+"d0684c8a93549" ("watchdog: Make stop function optional") and provide
+a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
+in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
+control reboot policy"). Together that commits make user potential to
+insert a watchdog driver that don't provide a stop hook but with the
+stop_on_reboot parameter set, then dereferencing of null pointer occurs
+on system reboot.
+
+Check the stop hook before registering the reboot notifier to fix the
+issue.
+
+Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
+index 4238447578128..0e9a99559609c 100644
+--- a/drivers/watchdog/watchdog_core.c
++++ b/drivers/watchdog/watchdog_core.c
+@@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
+ 	}
+ 
+ 	if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
+-		wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+-
+-		ret = register_reboot_notifier(&wdd->reboot_nb);
+-		if (ret) {
+-			pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+-			       wdd->id, ret);
+-			watchdog_dev_unregister(wdd);
+-			ida_simple_remove(&watchdog_ida, id);
+-			return ret;
++		if (!wdd->ops->stop)
++			pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
++		else {
++			wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
++
++			ret = register_reboot_notifier(&wdd->reboot_nb);
++			if (ret) {
++				pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
++					wdd->id, ret);
++				watchdog_dev_unregister(wdd);
++				ida_simple_remove(&watchdog_ida, id);
++				return ret;
++			}
+ 		}
+ 	}
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-qcom-avoid-context-switch-in-restart-handle.patch b/queue-5.10/watchdog-qcom-avoid-context-switch-in-restart-handle.patch
new file mode 100644
index 00000000000..5b0bc045c7b
--- /dev/null
+++ b/queue-5.10/watchdog-qcom-avoid-context-switch-in-restart-handle.patch
@@ -0,0 +1,69 @@
+From 00af2cde33db1f9c608c9cf105d4f73d8949a814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 11:30:05 +0530
+Subject: watchdog: qcom: Avoid context switch in restart handler
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]
+
+The use of msleep() in the restart handler will cause scheduler to
+induce a context switch which is not desirable. This generates below
+warning on SDX55 when WDT is the only available restart source:
+
+[   39.800188] reboot: Restarting system
+[   39.804115] ------------[ cut here ]------------
+[   39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764
+[   39.812538] Modules linked in:
+[   39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47
+[   39.824854] Hardware name: Generic DT based system
+[   39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14)
+[   39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0)
+[   39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0)
+[   39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8)
+[   39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764)
+[   39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640)
+[   39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c)
+[   39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4)
+[   39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38)
+[   39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc)
+[   39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28)
+[   39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84)
+[   39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c)
+[   39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0)
+[   39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54)
+[   39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0)
+[   39.958855] bfa0:                   0001221c bed2fe24 fee1dead 28121969 01234567 00000000
+[   39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000
+[   39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580
+[   39.980124] ---[ end trace 3f578288bad866e4 ]---
+
+Hence, replace msleep() with mdelay() to fix this issue.
+
+Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/qcom-wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
+index ab7465d186fda..cdf754233e53d 100644
+--- a/drivers/watchdog/qcom-wdt.c
++++ b/drivers/watchdog/qcom-wdt.c
+@@ -148,7 +148,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
+ 	 */
+ 	wmb();
+ 
+-	msleep(150);
++	mdelay(150);
+ 	return 0;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch b/queue-5.10/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch
new file mode 100644
index 00000000000..aeb0f5ea0ae
--- /dev/null
+++ b/queue-5.10/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch
@@ -0,0 +1,41 @@
+From dcabdfd41cfe05ca3ace43588c4c40bd0075c3b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 08:25:50 -0800
+Subject: watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]
+
+If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled,
+the build fails with the following error.
+
+drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
+sirfsoc_wdt.c:(.text+0x112):
+	undefined reference to `devm_platform_ioremap_resource'
+
+Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
+Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index b3e8bdaa2a112..f8e9be65036ae 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -790,6 +790,7 @@ config MOXART_WDT
+ 
+ config SIRFSOC_WATCHDOG
+ 	tristate "SiRFSOC watchdog"
++	depends on HAS_IOMEM
+ 	depends on ARCH_SIRF || COMPILE_TEST
+ 	select WATCHDOG_CORE
+ 	default y
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch b/queue-5.10/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch
new file mode 100644
index 00000000000..bf0baead236
--- /dev/null
+++ b/queue-5.10/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch
@@ -0,0 +1,74 @@
+From c48b69c0f6f16313e1969f249c6ae55105fffaa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 11:00:54 +0800
+Subject: watchdog: sprd: check busy bit before new loading rather than after
+ that
+
+From: Lingling Xu <ling_ling.xu@unisoc.com>
+
+[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ]
+
+As the specification described, users must check busy bit before start
+a new loading operation to make sure that the previous loading is done
+and the device is ready to accept a new one.
+
+[ chunyan: Massaged changelog ]
+
+Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
+Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201029023933.24548-3-zhang.lyra@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index f3c90b4afead1..b9b1daa9e2a4c 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -108,18 +108,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+ 	u32 tmr_step = timeout * SPRD_WDT_CNT_STEP;
+ 	u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP;
+ 
+-	sprd_wdt_unlock(wdt->base);
+-	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+-		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
+-	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
+-		       wdt->base + SPRD_WDT_LOAD_LOW);
+-	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+-			SPRD_WDT_LOW_VALUE_MASK,
+-		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
+-	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
+-		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
+-	sprd_wdt_lock(wdt->base);
+-
+ 	/*
+ 	 * Waiting the load value operation done,
+ 	 * it needs two or three RTC clock cycles.
+@@ -134,6 +122,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+ 
+ 	if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT)
+ 		return -EBUSY;
++
++	sprd_wdt_unlock(wdt->base);
++	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
++	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
++		       wdt->base + SPRD_WDT_LOAD_LOW);
++	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++			SPRD_WDT_LOW_VALUE_MASK,
++		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
++	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
++		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
++	sprd_wdt_lock(wdt->base);
++
+ 	return 0;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch b/queue-5.10/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch
new file mode 100644
index 00000000000..fa19d792ffa
--- /dev/null
+++ b/queue-5.10/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch
@@ -0,0 +1,54 @@
+From d1db03f9def37e99e66430385bc2a6a49183d6e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 10:39:31 +0800
+Subject: watchdog: sprd: remove watchdog disable from resume fail path
+
+From: Lingling Xu <ling_ling.xu@unisoc.com>
+
+[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ]
+
+sprd_wdt_start() would return fail if the loading operation is not completed
+in a certain time, disabling watchdog for that case would probably cause
+the kernel crash when kick watchdog later, that's too bad, so remove the
+watchdog disable operation for the fail case to make sure other parts in
+the kernel can run normally.
+
+[ chunyan: Massaged changelog ]
+
+Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
+Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201029023933.24548-2-zhang.lyra@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sprd_wdt.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index 65cb55f3916fc..f3c90b4afead1 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -345,15 +345,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (watchdog_active(&wdt->wdd)) {
++	if (watchdog_active(&wdt->wdd))
+ 		ret = sprd_wdt_start(&wdt->wdd);
+-		if (ret) {
+-			sprd_wdt_disable(wdt);
+-			return ret;
+-		}
+-	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static const struct dev_pm_ops sprd_wdt_pm_ops = {
+-- 
+2.27.0
+
diff --git a/queue-5.10/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch b/queue-5.10/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch
new file mode 100644
index 00000000000..85faf0b230a
--- /dev/null
+++ b/queue-5.10/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch
@@ -0,0 +1,105 @@
+From 83919b3b7c73990129e3981f8f09def74cadf752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 22:35:01 +0100
+Subject: x86/apic: Fix x2apic enablement without interrupt remapping
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ]
+
+Currently, Linux as a hypervisor guest will enable x2apic only if there are
+no CPUs present at boot time with an APIC ID above 255.
+
+Hotplugging a CPU later with a higher APIC ID would result in a CPU which
+cannot be targeted by external interrupts.
+
+Add a filter in x2apic_apic_id_valid() which can be used to prevent such
+CPUs from coming online, and allow x2apic to be enabled even if they are
+present at boot time.
+
+Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM")
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/apic.h        |  1 +
+ arch/x86/kernel/apic/apic.c        | 14 ++++++++------
+ arch/x86/kernel/apic/x2apic_phys.c |  9 +++++++++
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 4e3099d9ae625..57af25cb44f63 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -259,6 +259,7 @@ static inline u64 native_x2apic_icr_read(void)
+ 
+ extern int x2apic_mode;
+ extern int x2apic_phys;
++extern void __init x2apic_set_max_apicid(u32 apicid);
+ extern void __init check_x2apic(void);
+ extern void x2apic_setup(void);
+ static inline int x2apic_enabled(void)
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index b3eef1d5c9037..113f6ca7b8284 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1841,20 +1841,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
+ 		return;
+ 
+ 	if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
+-		/* IR is required if there is APIC ID > 255 even when running
+-		 * under KVM
++		/*
++		 * Using X2APIC without IR is not architecturally supported
++		 * on bare metal but may be supported in guests.
+ 		 */
+-		if (max_physical_apicid > 255 ||
+-		    !x86_init.hyper.x2apic_available()) {
++		if (!x86_init.hyper.x2apic_available()) {
+ 			pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
+ 			x2apic_disable();
+ 			return;
+ 		}
+ 
+ 		/*
+-		 * without IR all CPUs can be addressed by IOAPIC/MSI
+-		 * only in physical mode
++		 * Without IR, all CPUs can be addressed by IOAPIC/MSI only
++		 * in physical mode, and CPUs with an APIC ID that cannnot
++		 * be addressed must not be brought online.
+ 		 */
++		x2apic_set_max_apicid(255);
+ 		x2apic_phys = 1;
+ 	}
+ 	x2apic_enable();
+diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
+index bc9693841353c..e14eae6d6ea71 100644
+--- a/arch/x86/kernel/apic/x2apic_phys.c
++++ b/arch/x86/kernel/apic/x2apic_phys.c
+@@ -8,6 +8,12 @@
+ int x2apic_phys;
+ 
+ static struct apic apic_x2apic_phys;
++static u32 x2apic_max_apicid __ro_after_init;
++
++void __init x2apic_set_max_apicid(u32 apicid)
++{
++	x2apic_max_apicid = apicid;
++}
+ 
+ static int __init set_x2apic_phys_mode(char *arg)
+ {
+@@ -98,6 +104,9 @@ static int x2apic_phys_probe(void)
+ /* Common x2apic functions, also used by x2apic_cluster */
+ int x2apic_apic_id_valid(u32 apicid)
+ {
++	if (x2apic_max_apicid && apicid > x2apic_max_apicid)
++		return 0;
++
+ 	return 1;
+ }
+ 
+-- 
+2.27.0
+
diff --git a/queue-5.10/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch b/queue-5.10/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch
new file mode 100644
index 00000000000..a5b4ce9b2ac
--- /dev/null
+++ b/queue-5.10/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch
@@ -0,0 +1,46 @@
+From 5ee02dc9aff7fc916b5a4bf005796e867f209df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 23:31:10 +0900
+Subject: x86/kprobes: Restore BTF if the single-stepping is cancelled
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]
+
+Fix to restore BTF if single-stepping causes a page fault and
+it is cancelled.
+
+Usually the BTF flag was restored when the single stepping is done
+(in resume_execution()). However, if a page fault happens on the
+single stepping instruction, the fault handler is invoked and
+the single stepping is cancelled. Thus, the BTF flag is not
+restored.
+
+Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 547c7abb39f51..39f7d8c3c064b 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -937,6 +937,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+ 		 * So clear it by resetting the current kprobe:
+ 		 */
+ 		regs->flags &= ~X86_EFLAGS_TF;
++		/*
++		 * Since the single step (trap) has been cancelled,
++		 * we need to restore BTF here.
++		 */
++		restore_btf();
+ 
+ 		/*
+ 		 * If the TF flag was set before the kprobe hit,
+-- 
+2.27.0
+
diff --git a/queue-5.10/x86-mce-correct-the-detection-of-invalid-notifier-pr.patch b/queue-5.10/x86-mce-correct-the-detection-of-invalid-notifier-pr.patch
new file mode 100644
index 00000000000..53b461b2f3a
--- /dev/null
+++ b/queue-5.10/x86-mce-correct-the-detection-of-invalid-notifier-pr.patch
@@ -0,0 +1,60 @@
+From 0d7566543421d04425cf3a981386bc5665195243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 22:12:16 +0800
+Subject: x86/mce: Correct the detection of invalid notifier priorities
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 15af36596ae305aefc8c502c2d3e8c58221709eb ]
+
+Commit
+
+  c9c6d216ed28 ("x86/mce: Rename "first" function as "early"")
+
+changed the enumeration of MCE notifier priorities. Correct the check
+for notifier priorities to cover the new range.
+
+ [ bp: Rewrite commit message, remove superfluous brackets in
+   conditional. ]
+
+Fixes: c9c6d216ed28 ("x86/mce: Rename "first" function as "early"")
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20201106141216.2062-2-thunder.leizhen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/mce.h     | 3 ++-
+ arch/x86/kernel/cpu/mce/core.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index a0f147893a041..fc25c88c7ff29 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -177,7 +177,8 @@ enum mce_notifier_prios {
+ 	MCE_PRIO_EXTLOG,
+ 	MCE_PRIO_UC,
+ 	MCE_PRIO_EARLY,
+-	MCE_PRIO_CEC
++	MCE_PRIO_CEC,
++	MCE_PRIO_HIGHEST = MCE_PRIO_CEC
+ };
+ 
+ struct notifier_block;
+diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
+index 32b7099e35111..311688202ea51 100644
+--- a/arch/x86/kernel/cpu/mce/core.c
++++ b/arch/x86/kernel/cpu/mce/core.c
+@@ -162,7 +162,8 @@ EXPORT_SYMBOL_GPL(mce_log);
+ 
+ void mce_register_decode_chain(struct notifier_block *nb)
+ {
+-	if (WARN_ON(nb->priority > MCE_PRIO_MCELOG && nb->priority < MCE_PRIO_EDAC))
++	if (WARN_ON(nb->priority < MCE_PRIO_LOWEST ||
++		    nb->priority > MCE_PRIO_HIGHEST))
+ 		return;
+ 
+ 	blocking_notifier_chain_register(&x86_mce_decoder_chain, nb);
+-- 
+2.27.0
+
diff --git a/queue-5.10/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch b/queue-5.10/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch
new file mode 100644
index 00000000000..1e428725ef8
--- /dev/null
+++ b/queue-5.10/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch
@@ -0,0 +1,73 @@
+From 2728d26baeb3794b42e0f22972f751b7deefe015 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 19:06:48 -0400
+Subject: x86/mm/ident_map: Check for errors from ident_pud_init()
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]
+
+Commit
+
+  ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
+
+added ident_p4d_init() to support 5-level paging, but this function
+doesn't check and return errors from ident_pud_init().
+
+For example, the decompressor stub uses this code to create an identity
+mapping. If it runs out of pages while trying to allocate a PMD
+pagetable, the error will be currently ignored.
+
+Fix this to propagate errors.
+
+ [ bp: Space out statements for better readability. ]
+
+Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Joerg Roedel <jroedel@suse.de>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/ident_map.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
+index fe7a12599d8eb..968d7005f4a72 100644
+--- a/arch/x86/mm/ident_map.c
++++ b/arch/x86/mm/ident_map.c
+@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+ 			  unsigned long addr, unsigned long end)
+ {
+ 	unsigned long next;
++	int result;
+ 
+ 	for (; addr < end; addr = next) {
+ 		p4d_t *p4d = p4d_page + p4d_index(addr);
+@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+ 
+ 		if (p4d_present(*p4d)) {
+ 			pud = pud_offset(p4d, 0);
+-			ident_pud_init(info, pud, addr, next);
++			result = ident_pud_init(info, pud, addr, next);
++			if (result)
++				return result;
++
+ 			continue;
+ 		}
+ 		pud = (pud_t *)info->alloc_pgt_page(info->context);
+ 		if (!pud)
+ 			return -ENOMEM;
+-		ident_pud_init(info, pud, addr, next);
++
++		result = ident_pud_init(info, pud, addr, next);
++		if (result)
++			return result;
++
+ 		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
+ 	}
+ 
+-- 
+2.27.0
+
-- 
2.47.3